8ce29df5cd
- Prometheus→operator: egress port 8443→10250 (actual container port) - Alertmanager ingress: add port 8080 from Prometheus for config-reloader sidecar - Argo controller metrics service: remove part-of:foxhunt label (already scraped via additionalScrapeConfigs with HTTPS; foxhunt-services ServiceMonitor was creating duplicate HTTP target → 400) Result: 25/25 targets UP, 0 DOWN. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
65 lines
1.6 KiB
YAML
65 lines
1.6 KiB
YAML
# AlertManager network policy
|
|
# Ingress: Prometheus (alert delivery), Grafana (alert UI queries)
|
|
# Egress: Mattermost webhooks (cluster-internal), DNS
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: alertmanager
|
|
namespace: foxhunt
|
|
labels:
|
|
app.kubernetes.io/part-of: foxhunt
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: alertmanager
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
ingress:
|
|
# Prometheus pushes alerts and scrapes metrics (9093 API, 8080 config-reloader)
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: prometheus
|
|
ports:
|
|
- protocol: TCP
|
|
port: 9093
|
|
- protocol: TCP
|
|
port: 8080
|
|
# Grafana queries AlertManager API for alert state/silences
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: grafana
|
|
ports:
|
|
- protocol: TCP
|
|
port: 9093
|
|
egress:
|
|
# DNS resolution
|
|
- to:
|
|
- namespaceSelector: {}
|
|
ports:
|
|
- protocol: UDP
|
|
port: 53
|
|
- protocol: TCP
|
|
port: 53
|
|
# Mattermost incoming webhook (cluster-internal)
|
|
- to:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: mattermost
|
|
ports:
|
|
- protocol: TCP
|
|
port: 8065
|
|
# External HTTPS (PagerDuty, email, future integrations)
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 0.0.0.0/0
|
|
except:
|
|
- 10.0.0.0/8
|
|
- 172.16.0.0/12
|
|
- 192.168.0.0/16
|
|
ports:
|
|
- protocol: TCP
|
|
port: 443
|