# Storage alert rules — volume usage warnings before auto-expand kicks in
# Apply: kubectl apply -f prometheus-rules-storage.yaml
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: foxhunt-storage-alerts
  namespace: foxhunt
  labels:
    app.kubernetes.io/part-of: foxhunt
    role: alert-rules
spec:
  groups:
    - name: storage_volume_usage
      interval: 60s
      rules:
        # PVC usage > 75% — warning (auto-expand triggers at 85%)
        - alert: PVCUsageHigh
          expr: |
            100 * kubelet_volume_stats_used_bytes{namespace="foxhunt"}
              / kubelet_volume_stats_capacity_bytes{namespace="foxhunt"} > 75
          for: 5m
          labels:
            severity: warning
            component: storage
          annotations:
            summary: "PVC {{ $labels.persistentvolumeclaim }} at {{ $value | printf \"%.0f\" }}% usage"
            description: "Volume {{ $labels.persistentvolumeclaim }} is {{ $value | printf \"%.0f\" }}% full. Auto-expand triggers at 85%."

        # PVC usage > 90% — critical (auto-expand should have already acted)
        - alert: PVCUsageCritical
          expr: |
            100 * kubelet_volume_stats_used_bytes{namespace="foxhunt"}
              / kubelet_volume_stats_capacity_bytes{namespace="foxhunt"} > 90
          for: 2m
          labels:
            severity: critical
            component: storage
          annotations:
            summary: "PVC {{ $labels.persistentvolumeclaim }} CRITICAL at {{ $value | printf \"%.0f\" }}%"
            description: "Volume {{ $labels.persistentvolumeclaim }} is {{ $value | printf \"%.0f\" }}% full despite auto-expand. Investigate immediately."
            action: "Check pvc-autoscaler CronJob logs. Manual expand: kubectl patch pvc {{ $labels.persistentvolumeclaim }} -n foxhunt --type merge -p '{\"spec\":{\"resources\":{\"requests\":{\"storage\":\"XXGi\"}}}}'"

        # PVC approaching max auto-expand limit (>80Gi of 100Gi max)
        - alert: PVCApproachingMaxSize
          expr: |
            kubelet_volume_stats_capacity_bytes{namespace="foxhunt"} > 80 * 1024 * 1024 * 1024
            and
            100 * kubelet_volume_stats_used_bytes{namespace="foxhunt"}
              / kubelet_volume_stats_capacity_bytes{namespace="foxhunt"} > 70
          for: 10m
          labels:
            severity: warning
            component: storage
          annotations:
            summary: "PVC {{ $labels.persistentvolumeclaim }} is large and growing"
            description: "Volume is >80Gi and >70% full. Auto-expand max is 100Gi. Consider manual intervention or data cleanup."