vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

export bao client-cert not_before/not_after gauges and alert past 80% of lifetime

Browse source
This commit is contained in:
atlas 2026-10-25 17:41:47 +01:00 • committed by mara
commit 078696aaee
23 changed files with 604 additions and 53 deletions
Download patch file Download diff file Expand all files Collapse all files

36
nix/module-eval/grafana.nix
View file

@ -570,6 +570,42 @@ let
in
lib.all (uid: check uid expected.${uid}) (builtins.attrNames expected);
}
{
# The cert-lifetime alert fires at a lifetime fraction over 0.8 and
# selects the two gauge names `swarm-secret-client` spells in Rust; a
# rename on either side provisions cleanly and the rule then reads
# nothing. The sibling disk rule is the presence control: it goes through
# the same lookup, so a misspelled attribute path fails both arms.
# 🔬 Invert-proof: change `threshold = 0.8` on `hh-bao-client-cert-lifetime`
# in swarm-grafana.nix, or a name in `swarm-secret-client/src/cert.rs`.
name = "the bao client-cert lifetime alert fires over 0.8 on the gauges the services export";
ok =
let
groups =
grafanaHere.containers.swarm-grafana.config.services.grafana.provision.alerting.rules.settings.groups;
rules = lib.concatMap (g: g.rules) groups;
source = builtins.readFile ../../swarm-secret-client/src/cert.rs;
threshold =
uid:
let
rule = lib.findFirst (r: r.uid == uid) null rules;
condition = lib.findFirst (q: q.refId == "C") null rule.data;
in
lib.head (lib.head condition.model.conditions).evaluator.params;
query =
(lib.head (lib.findFirst (r: r.uid == "hh-bao-client-cert-lifetime") null rules).data).model;
in
threshold "hh-host-disk-high" == 0.85
&& threshold "hh-bao-client-cert-lifetime" == 0.8
&&
lib.all
(metric: lib.hasInfix ''{__name__="${metric}"'' query.expr && lib.hasInfix ''"${metric}"'' source)
[
"bao.client_cert.not_before"
"bao.client_cert.not_after"
]
&& query.instant;
}
{
# 🩸 The regression this guards: moving bao's metrics scrape into its
# own in-container collector made that collector stamp every exported