Open-data analysts notice kubectl logs timestamps that disagree with wall-clock incident times. What underlying factor most directly affects interpretation of those stamps?

Log timestamps from kubectl logs are recorded based on the node clock and how the container runtime stores time for that stream. When open-data analysts see timestamps that disagree with wall-clock incident times, the underlying factor most directly affecting interpretation is skew or timezone handling on the node hosting the container—not Service selectors or quota arithmetic rewriting clocks. Fix NTP before trusting the timeline story. Service selector labels do not rewrite log timestamps on every scrape; selectors determine which pods a Service matches. Ingress path rules do not convert all logs to a UTC offset of +14 hours; Ingress routes HTTP paths and does not mutate container log clocks. ResourceQuota hard limits do not shift timestamps backward by one hour per CPU unit; quotas throttle resource admission, not log timebases. Exam caveat: Compare API server times, node times, and client laptop times during incidents. Central logging should normalize to UTC with synchronized clocks across the municipal fleet. Operational check: Check NTP on the worker, correct skew, reproduce a log line, and confirm timestamps align with the incident clock used by open-data responders. In municipal production practice, record the finding in the incident ticket with command output snippets, confirm the fix under change control, and re-validate the user-facing civic service before closing the change window.