# Alert-Regeln (gitops#32). Bewusst wenige, dafuer die real erlebten Fehlerklassen:
# - TargetDown: "Exporter/Dienst tot und keiner merkt es" (coturn-Klasse)
# - KubePodRestartLoop: Crashloops im k3s-Cluster (36k-coturn-Restarts-Klasse)
# - HostOom/HostLowMemory/HostLowDisk/HostHighSwap: Ressourcendruck der Hosts
groups:
  - name: axion-basics
    rules:
      - alert: TargetDown
        expr: up == 0
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "Target {{ $labels.job }}/{{ $labels.instance }} ist seit 5m nicht erreichbar"

      - alert: KubePodRestartLoop
        expr: increase(kube_pod_container_status_restarts_total[1h]) > 3
        for: 10m
        labels:
          severity: warning
        annotations:
          summary: "Pod {{ $labels.namespace }}/{{ $labels.pod }} restartet wiederholt ({{ $value | printf \"%.0f\" }}x in 1h)"

      - alert: HostOomKill
        expr: increase(node_vmstat_oom_kill[15m]) > 0
        labels:
          severity: warning
        annotations:
          summary: "OOM-Kill auf {{ $labels.instance }}"

      - alert: HostLowMemory
        expr: node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes < 0.08
        for: 15m
        labels:
          severity: warning
        annotations:
          summary: "{{ $labels.instance }}: <8% RAM verfuegbar seit 15m"

      - alert: HostHighSwap
        expr: (node_memory_SwapTotal_bytes - node_memory_SwapFree_bytes) / node_memory_SwapTotal_bytes > 0.5
        for: 30m
        labels:
          severity: warning
        annotations:
          summary: "{{ $labels.instance }}: >50% Swap in Nutzung seit 30m"

      - alert: HostLowDisk
        expr: node_filesystem_avail_bytes{mountpoint="/",fstype!~"tmpfs|overlay"} / node_filesystem_size_bytes{mountpoint="/",fstype!~"tmpfs|overlay"} < 0.10
        for: 15m
        labels:
          severity: critical
        annotations:
          summary: "{{ $labels.instance }}: <10% Platz auf / frei"

  # CVE-Pipeline (gitops#47): Funde aus den Trivy-Scans. Pflichtfelder je Alarm:
  # CVE-ID, Mitigation (Fix-Version + NVD-Link), Ort (host), Typ (target_type);
  # der Zeitstrahl kommt aus trivy_vuln_first_seen_timestamp + resolved-Edit.
  # Alle Regeln routen per room-Label in den Security-Raum.
  - name: axion-cve
    rules:
      - alert: TrivyCriticalVuln
        expr: trivy_vuln_info{severity="CRITICAL"} == 1
        labels:
          severity: critical
          room: security
        annotations:
          summary: "{{ $labels.cve }} (CRITICAL) in {{ $labels.target }} [{{ $labels.target_type }}@{{ $labels.host }}] — Paket {{ $labels.pkg }} {{ $labels.installed }}{{ if $labels.fixed_version }}, Fix: {{ $labels.fixed_version }}{{ else }}, noch kein Fix{{ end }} — https://nvd.nist.gov/vuln/detail/{{ $labels.cve }}"
      - alert: TrivyHighVuln
        expr: trivy_vuln_info{severity="HIGH"} == 1
        for: 24h
        labels:
          severity: warning
          room: security
        annotations:
          summary: "{{ $labels.cve }} (HIGH) in {{ $labels.target }} [{{ $labels.target_type }}@{{ $labels.host }}] — Paket {{ $labels.pkg }} {{ $labels.installed }}{{ if $labels.fixed_version }}, Fix: {{ $labels.fixed_version }}{{ else }}, noch kein Fix{{ end }} — https://nvd.nist.gov/vuln/detail/{{ $labels.cve }}"
      - alert: TrivyScanStale
        expr: time() - trivy_last_scan_timestamp > 172800
        labels:
          severity: warning
          room: security
        annotations:
          summary: "CVE-Scan fuer {{ $labels.target }} ist aelter als 2 Tage — Scanner pruefen (ein still gestorbener Scanner macht blind)"