# alert-rules.yml
groups:
- name: example-alerts
  rules:
  # 服务可用性告警
  - alert: ServiceDown
    expr: up == 0
    for: 2m
    labels:
      severity: critical
    annotations:
      summary: "服务 {{ $labels.job }} 不可用"
      description: "服务 {{ $labels.job }} 实例 {{ $labels.instance }} 已经不可用超过2分钟"
      runbook_url: "https://internal.wiki/runbooks/service-down"

  # 高CPU使用率告警
  - alert: HighCPUUsage
    expr: rate(node_cpu_seconds_total{mode!="idle"}[2m]) > 0.8
    for: 5m
    labels:
      severity: warning
    annotations:
      summary: "主机 {{ $labels.instance }} CPU使用率过高"
      description: "主机 {{ $labels.instance }} 的CPU使用率持续5分钟超过80%"
      value: "{{ $value }}"

  # 高内存使用率告警
  - alert: HighMemoryUsage
    expr: (node_memory_MemTotal_bytes - node_memory_MemAvailable_bytes) / node_memory_MemTotal_bytes > 0.85
    for: 10m
    labels:
      severity: warning
    annotations:
      summary: "主机 {{ $labels.instance }} 内存使用率过高"
      description: "主机 {{ $labels.instance }} 的内存使用率持续10分钟超过85%"
      value: "{{ $value }}"

  # 高磁盘使用率告警
  - alert: HighDiskUsage
    expr: (node_filesystem_size_bytes - node_filesystem_free_bytes) / node_filesystem_size_bytes > 0.9
    for: 15m
    labels:
      severity: critical
    annotations:
      summary: "主机 {{ $labels.instance }} 磁盘使用率过高"
      description: "主机 {{ $labels.instance }} 挂载点 {{ $labels.mountpoint }} 的磁盘使用率持续15分钟超过90%"
      value: "{{ $value }}"

  # HTTP错误率告警
  - alert: HighHttpErrorRate
    expr: rate(http_requests_total{code=~"5.."}[5m]) / rate(http_requests_total[5m]) > 0.05
    for: 2m
    labels:
      severity: critical
    annotations:
      summary: "服务 {{ $labels.job }} HTTP错误率过高"
      description: "服务 {{ $labels.job }} 的5xx错误率持续2分钟超过5%"
      value: "{{ $value }}"

# Prometheus自动发现配置
apiVersion: v1
kind: ConfigMap
metadata:
  name: prometheus-config
  namespace: istio-system
data:
  prometheus.yml: |
    global:
      scrape_interval: 15s
      evaluation_interval: 15s
    
    rule_files:
      - "istio_rules.yml"
    
    scrape_configs:
    # Istio网格指标
    - job_name: 'istio-mesh'
      kubernetes_sd_configs:
      - role: endpoints
        namespaces:
          names:
          - istio-system
      relabel_configs:
      - source_labels: [__meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
        action: keep
        regex: istiod;http-monitoring
    
    # Envoy代理指标
    - job_name: 'envoy-stats'
      kubernetes_sd_configs:
      - role: pod
      relabel_configs:
      - source_labels: [__meta_kubernetes_pod_container_name]
        action: keep
        regex: 'istio-proxy'
      - source_labels: [__meta_kubernetes_pod_name]
        action: replace
        target_label: pod_name
      - source_labels: [__meta_kubernetes_namespace]
        action: replace
        target_label: namespace
    
    # 应用指标
    - job_name: 'kubernetes-pods'
      kubernetes_sd_configs:
      - role: pod
      relabel_configs:
      - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
        action: keep
        regex: true
      - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
        action: replace
        target_label: __metrics_path__
        regex: (.+)
      - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
        action: replace
        regex: ([^:]+)(?::\d+)?;(\d+)
        replacement: $1:$2
        target_label: __address__
      - action: labelmap
        regex: __meta_kubernetes_pod_label_(.+)
      - source_labels: [__meta_kubernetes_namespace]
        action: replace
        target_label: kubernetes_namespace
      - source_labels: [__meta_kubernetes_pod_name]
        action: replace
        target_label: kubernetes_pod_name