Thore CimbalandClaude Fable 5
b6007c50fd
- cve-scan: Trivy-Loop ueber die 29 real deployten Images (Cluster-Inventur 2026-08-01 + Prod-Web-Image); 24h-Intervall, Fehler einzelner Images blockieren nicht - cve-exporter: Stdlib-Exporter mit first_seen-State (Zeitstrahl), Schema trivy_vuln_info/_count/_first_seen/_last_scan gemaess Pflichtfeldern - 3 Alertregeln (CRITICAL sofort, HIGH mit 24h-Daempfung, Scan-Frische) - promtool SUCCESS 9 rules; alle mit room=security - matrix-alerts: Label-basiertes Raum-Routing (MATRIX_ROOM_<NAME>), Edits landen im richtigen Raum via State - Grafana-Dashboard cve-overview: Severity-Stats, CVE-Tabelle mit NVD-Link/Fix-Version/first-seen, Zeitstrahl, Verlauf UNGETESTET bis zum Deploy auf CFGMON (compose up -d). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PKhFj1S3UdD6xL2fbWPeYj
83 lines
3.6 KiB
YAML
83 lines
3.6 KiB
YAML
# Alert-Regeln (gitops#32). Bewusst wenige, dafuer die real erlebten Fehlerklassen:
|
|
# - TargetDown: "Exporter/Dienst tot und keiner merkt es" (coturn-Klasse)
|
|
# - KubePodRestartLoop: Crashloops im k3s-Cluster (36k-coturn-Restarts-Klasse)
|
|
# - HostOom/HostLowMemory/HostLowDisk/HostHighSwap: Ressourcendruck der Hosts
|
|
groups:
|
|
- name: axion-basics
|
|
rules:
|
|
- alert: TargetDown
|
|
expr: up == 0
|
|
for: 5m
|
|
labels:
|
|
severity: critical
|
|
annotations:
|
|
summary: "Target {{ $labels.job }}/{{ $labels.instance }} ist seit 5m nicht erreichbar"
|
|
|
|
- alert: KubePodRestartLoop
|
|
expr: increase(kube_pod_container_status_restarts_total[1h]) > 3
|
|
for: 10m
|
|
labels:
|
|
severity: warning
|
|
annotations:
|
|
summary: "Pod {{ $labels.namespace }}/{{ $labels.pod }} restartet wiederholt ({{ $value | printf \"%.0f\" }}x in 1h)"
|
|
|
|
- alert: HostOomKill
|
|
expr: increase(node_vmstat_oom_kill[15m]) > 0
|
|
labels:
|
|
severity: warning
|
|
annotations:
|
|
summary: "OOM-Kill auf {{ $labels.instance }}"
|
|
|
|
- alert: HostLowMemory
|
|
expr: node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes < 0.08
|
|
for: 15m
|
|
labels:
|
|
severity: warning
|
|
annotations:
|
|
summary: "{{ $labels.instance }}: <8% RAM verfuegbar seit 15m"
|
|
|
|
- alert: HostHighSwap
|
|
expr: (node_memory_SwapTotal_bytes - node_memory_SwapFree_bytes) / node_memory_SwapTotal_bytes > 0.5
|
|
for: 30m
|
|
labels:
|
|
severity: warning
|
|
annotations:
|
|
summary: "{{ $labels.instance }}: >50% Swap in Nutzung seit 30m"
|
|
|
|
- alert: HostLowDisk
|
|
expr: node_filesystem_avail_bytes{mountpoint="/",fstype!~"tmpfs|overlay"} / node_filesystem_size_bytes{mountpoint="/",fstype!~"tmpfs|overlay"} < 0.10
|
|
for: 15m
|
|
labels:
|
|
severity: critical
|
|
annotations:
|
|
summary: "{{ $labels.instance }}: <10% Platz auf / frei"
|
|
|
|
# CVE-Pipeline (gitops#47): Funde aus den Trivy-Scans. Pflichtfelder je Alarm:
|
|
# CVE-ID, Mitigation (Fix-Version + NVD-Link), Ort (host), Typ (target_type);
|
|
# der Zeitstrahl kommt aus trivy_vuln_first_seen_timestamp + resolved-Edit.
|
|
# Alle Regeln routen per room-Label in den Security-Raum.
|
|
- name: axion-cve
|
|
rules:
|
|
- alert: TrivyCriticalVuln
|
|
expr: trivy_vuln_info{severity="CRITICAL"} == 1
|
|
labels:
|
|
severity: critical
|
|
room: security
|
|
annotations:
|
|
summary: "{{ $labels.cve }} (CRITICAL) in {{ $labels.target }} [{{ $labels.target_type }}@{{ $labels.host }}] — Paket {{ $labels.pkg }} {{ $labels.installed }}{{ if $labels.fixed_version }}, Fix: {{ $labels.fixed_version }}{{ else }}, noch kein Fix{{ end }} — https://nvd.nist.gov/vuln/detail/{{ $labels.cve }}"
|
|
- alert: TrivyHighVuln
|
|
expr: trivy_vuln_info{severity="HIGH"} == 1
|
|
for: 24h
|
|
labels:
|
|
severity: warning
|
|
room: security
|
|
annotations:
|
|
summary: "{{ $labels.cve }} (HIGH) in {{ $labels.target }} [{{ $labels.target_type }}@{{ $labels.host }}] — Paket {{ $labels.pkg }} {{ $labels.installed }}{{ if $labels.fixed_version }}, Fix: {{ $labels.fixed_version }}{{ else }}, noch kein Fix{{ end }} — https://nvd.nist.gov/vuln/detail/{{ $labels.cve }}"
|
|
- alert: TrivyScanStale
|
|
expr: time() - trivy_last_scan_timestamp > 172800
|
|
labels:
|
|
severity: warning
|
|
room: security
|
|
annotations:
|
|
summary: "CVE-Scan fuer {{ $labels.target }} ist aelter als 2 Tage — Scanner pruefen (ein still gestorbener Scanner macht blind)"
|