gcloud-lab/apps/base/osint-dashboard/templates/monitoring/alertmanager.yaml

{{- if .Values.monitoring.enabled }}
apiVersion: v1
kind: ConfigMap
metadata:
  name: alertmanager-config
  namespace: {{ .Values.namespace }}
  labels:
    {{- include "osint-dashboard.labels" . | nindent 4 }}
    app.kubernetes.io/component: monitoring
data:
  alertmanager.yml: |
    global:
      resolve_timeout: 5m

    route:
      group_by: ['alertname', 'namespace']
      group_wait: 30s
      group_interval: 5m
      repeat_interval: 4h
      receiver: 'default'
      routes:
        - match:
            severity: critical
          receiver: 'pager'
          repeat_interval: 1h
        - match:
            severity: warning
          receiver: 'slack'

    receivers:
      - name: 'default'
        email_configs:
          - to: CHANGE_ME_USE_SOPS
            from: monitoring@{{ .Values.monitoring.defaultEmailDomain }}
            smarthost: CHANGE_ME_USE_SOPS
            auth_username: CHANGE_ME_USE_SOPS
            auth_password: CHANGE_ME_USE_SOPS

      - name: 'pager'
        webhook_configs:
          - url: CHANGE_ME_USE_SOPS
            send_resolved: true

      - name: 'slack'
        slack_configs:
          - api_url: CHANGE_ME_USE_SOPS
            channel: '#osint-alerts'
            send_resolved: true
            title: '{{ .GroupLabels.alertname }}'
            text: >-
              {{ range .Alerts }}
              *Alert:* {{ .Labels.alertname }}
              *Severity:* {{ .Labels.severity }}
              *Summary:* {{ .Annotations.summary }}
              {{ end }}

    inhibit_rules:
      - source_match:
          severity: 'critical'
        target_match:
          severity: 'warning'
        equal: ['alertname', 'namespace']
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: alertmanager
  namespace: {{ .Values.namespace }}
  labels:
    {{- include "osint-dashboard.labels" . | nindent 4 }}
    app.kubernetes.io/component: monitoring
spec:
  replicas: 1
  selector:
    matchLabels:
      {{- include "osint-dashboard.selectorLabels" . | nindent 6 }}
      app.kubernetes.io/component: monitoring
  template:
    metadata:
      labels:
        {{- include "osint-dashboard.selectorLabels" . | nindent 8 }}
        app.kubernetes.io/component: monitoring
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 65534
        fsGroup: 65534
      containers:
        - name: alertmanager
          image: "{{ .Values.monitoring.alertmanager.image.repository }}:{{ .Values.monitoring.alertmanager.image.tag }}"
          ports:
            - containerPort: {{ .Values.monitoring.alertmanager.port }}
              name: web
          args:
            - "--config.file=/etc/alertmanager/alertmanager.yml"
            - "--storage.path=/alertmanager"
          resources:
            {{- toYaml .Values.monitoring.alertmanager.resources | nindent 12 }}
          volumeMounts:
            - name: config
              mountPath: /etc/alertmanager
            - name: data
              mountPath: /alertmanager
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
      volumes:
        - name: config
          configMap:
            name: alertmanager-config
  strategy:
    type: Recreate
---
apiVersion: v1
kind: Service
metadata:
  name: alertmanager
  namespace: {{ .Values.namespace }}
  labels:
    {{- include "osint-dashboard.labels" . | nindent 4 }}
    app.kubernetes.io/component: monitoring
spec:
  type: ClusterIP
  ports:
    - port: {{ .Values.monitoring.alertmanager.port }}
      targetPort: web
      protocol: TCP
      name: web
  selector:
    app.kubernetes.io/name: osint-dashboard
    app.kubernetes.io/component: monitoring
{{- end }}