Sirius Devops
5e477492e6
- Helm chart scaffold (Chart.yaml, values.yaml, _helpers.tpl) - Namespace + RBAC manifests - PostgreSQL (CNPG, 3 replicas, PostGIS + TimescaleDB) - NATS JetStream (3 replicas, persistent, custom subjects) - Redis Sentinel (1 primary + 2 replicas, HA) - MinIO distributed (4 replicas, bucket init job) - Gateway API HTTPRoute + cert-manager TLS certificates - Monitoring stack (Prometheus, Grafana, Alertmanager, exporters) - NetworkPolicies (default deny + per-component policies) - GitHub Actions CI/CD pipeline (lint, template, security scan) - Flux CD staging overlay
134 lines
3.7 KiB
YAML
134 lines
3.7 KiB
YAML
{{- if .Values.monitoring.enabled }}
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: alertmanager-config
|
|
namespace: {{ .Values.namespace }}
|
|
labels:
|
|
{{- include "osint-dashboard.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: monitoring
|
|
data:
|
|
alertmanager.yml: |
|
|
global:
|
|
resolve_timeout: 5m
|
|
|
|
route:
|
|
group_by: ['alertname', 'namespace']
|
|
group_wait: 30s
|
|
group_interval: 5m
|
|
repeat_interval: 4h
|
|
receiver: 'default'
|
|
routes:
|
|
- match:
|
|
severity: critical
|
|
receiver: 'pager'
|
|
repeat_interval: 1h
|
|
- match:
|
|
severity: warning
|
|
receiver: 'slack'
|
|
|
|
receivers:
|
|
- name: 'default'
|
|
email_configs:
|
|
- to: CHANGE_ME_USE_SOPS
|
|
from: monitoring@{{ .Values.monitoring.defaultEmailDomain }}
|
|
smarthost: CHANGE_ME_USE_SOPS
|
|
auth_username: CHANGE_ME_USE_SOPS
|
|
auth_password: CHANGE_ME_USE_SOPS
|
|
|
|
- name: 'pager'
|
|
webhook_configs:
|
|
- url: CHANGE_ME_USE_SOPS
|
|
send_resolved: true
|
|
|
|
- name: 'slack'
|
|
slack_configs:
|
|
- api_url: CHANGE_ME_USE_SOPS
|
|
channel: '#osint-alerts'
|
|
send_resolved: true
|
|
title: '{{ .GroupLabels.alertname }}'
|
|
text: >-
|
|
{{ range .Alerts }}
|
|
*Alert:* {{ .Labels.alertname }}
|
|
*Severity:* {{ .Labels.severity }}
|
|
*Summary:* {{ .Annotations.summary }}
|
|
{{ end }}
|
|
|
|
inhibit_rules:
|
|
- source_match:
|
|
severity: 'critical'
|
|
target_match:
|
|
severity: 'warning'
|
|
equal: ['alertname', 'namespace']
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: alertmanager
|
|
namespace: {{ .Values.namespace }}
|
|
labels:
|
|
{{- include "osint-dashboard.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: monitoring
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
{{- include "osint-dashboard.selectorLabels" . | nindent 6 }}
|
|
app.kubernetes.io/component: monitoring
|
|
template:
|
|
metadata:
|
|
labels:
|
|
{{- include "osint-dashboard.selectorLabels" . | nindent 8 }}
|
|
app.kubernetes.io/component: monitoring
|
|
spec:
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65534
|
|
fsGroup: 65534
|
|
containers:
|
|
- name: alertmanager
|
|
image: "{{ .Values.monitoring.alertmanager.image.repository }}:{{ .Values.monitoring.alertmanager.image.tag }}"
|
|
ports:
|
|
- containerPort: {{ .Values.monitoring.alertmanager.port }}
|
|
name: web
|
|
args:
|
|
- "--config.file=/etc/alertmanager/alertmanager.yml"
|
|
- "--storage.path=/alertmanager"
|
|
resources:
|
|
{{- toYaml .Values.monitoring.alertmanager.resources | nindent 12 }}
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /etc/alertmanager
|
|
- name: data
|
|
mountPath: /alertmanager
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: alertmanager-config
|
|
strategy:
|
|
type: Recreate
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: alertmanager
|
|
namespace: {{ .Values.namespace }}
|
|
labels:
|
|
{{- include "osint-dashboard.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: monitoring
|
|
spec:
|
|
type: ClusterIP
|
|
ports:
|
|
- port: {{ .Values.monitoring.alertmanager.port }}
|
|
targetPort: web
|
|
protocol: TCP
|
|
name: web
|
|
selector:
|
|
app.kubernetes.io/name: osint-dashboard
|
|
app.kubernetes.io/component: monitoring
|
|
{{- end }}
|