Ignore alerts from k8s namespaces

[Stanislav Panov]

Hello!

I have kubernetes cluster and an external Alertmanager (see the screenshot in the attachment).

there are several namespaces in the cluster.

I only need to process alerts from one - " Namespace-2"

alerts from other namespaces are useless and can be ignored

Please advise the method (if any), how it can be implemented

Notes:

1) I tried to implement using inhibit_rules,

inhibit_rules:
  - target_match_re:
      namespace: "^((?!namespace-2).)*$"

but encountered this error

 FAILED: error parsing regexp: invalid or unsupported Perl syntax: `(?!`

2) I tried implementing it at the routing level, but there is no configuration of matchers for defaultReceiver. I need the default receiver to receive alerts only from namespace-2

Thanks

[Brian Candler]

error parsing regexp: invalid or unsupported Perl syntax: `(?!`

Go's regular expressions - RE2 - are true regular expressions that don't support lookbehind/lookahead assertions.

For the available syntax, see https://github.com/google/re2/wiki/Syntax

2) I tried implementing it at the routing level, but there is no configuration of matchers for defaultReceiver. I need the default receiver to receive alerts only from namespace-2

Routing rules nest to an arbitrary depth, so you can add an extra level of routing at the top level, and nest your existing rules under it. 

[Stanislav Panov]

Routing rules nest to an arbitrary depth, so you can add an extra level of routing at the top level, and nest your existing rules under it. 

Thank you, Brian!

I'll try using it. 

вторник, 14 июля 2020 г., 14:15:27 UTC+3 пользователь Brian Candler написал:

[Stanislav Panov]

route:
  receiver: "trash-receiver"
  routes:
    - match:
        namespace: "namespace-2"
      receiver: "namespace-2-receiver"

I expect that all alerts that have label namespace: "namespace-2" will end up in the namespace2-receiver, and all the others will end up in the trash-receiver (will be ignored)

the only thing I worry about is that the default root receiver is trash receiver, i.e. my default configuration ignores alerts. If there is an error in matcher at the lower level, an important alert may be lost (I wrote about this in Note 2))

[Brian Candler]

You can move the trash receiver down a level if you like:

route:
  receiver: "my-default-receiver"

  routes:
    - match:
        namespace: "namespace-2"
      receiver: "namespace-2-receiver"

    - receiver: "trash-receiver"

But clearly, as written this does the same.

[Stanislav Panov]

in fact, yes, both options do the same thing

Thank you, Brian!