Infra alers in tenants monitoring #2775

Activity

1. Chernosov Denis (dvc)

   added

   kind/bugCategorizes issue or PR as related to a bugCategorizes issue or PR as related to a bug

   on Jun 1, 2026
2. dosubot commented on Jun 1, 2026

   

   dosubotbot

   on Jun 1, 2026 – with DosuBot

   More actions

   This is a valid issue. The monitoring-agents package currently deploys all alert rules globally without distinguishing between infrastructure and tenant contexts [1]. The alerts for Kubelet, KubeAPI, KubeControllerManager, and KubeScheduler are defined in the alerts/ directory and included unconditionally via a Helm glob pattern.

   This is the same class of problem that was addressed for dashboards in issue #2194 [2] — infrastructure dashboards were scoped to tenant-root/cozy-monitoring namespaces via conditional rendering in PR #2197 [3]. However, the same scoping was never applied to the alert rules.

   A similar fix could be applied to alerts.yaml by wrapping infrastructure-specific alert files in a namespace conditional, following the established dashboard pattern [4]:

   {{- if or (eq .Release.Namespace "tenant-root") (eq .Release.Namespace "cozy-monitoring") }}
   # Include infrastructure-only alerts (kubelet, kube-apiserver, kube-controller-manager, kube-scheduler)
   {{- end }}

   This would require splitting the alert files in the alerts/ directory into infrastructure-specific (kubelet, kube-apiserver, kube-controller-manager, kube-scheduler) and workload-generic (apps, storage, node resources) groups, then conditionally including only the infrastructure alerts when deploying to tenant-root or cozy-monitoring.

   To reply, just mention @dosu.

   ---

   Share context across your team and agents. Try Dosu.

   
3. myasnikovdaniil

   self-assigned this

   on Jun 1, 2026
4. dvc commented on Jun 1, 2026

   

   Chernosov Denis (dvc)

   on Jun 1, 2026

   ContributorAuthor

   More actions

   see also vmalert setting

   https://docs.victoriametrics.com/operator/resources/vmalert/#rules

   Following rules are applied:

   If ruleNamespaceSelector and ruleSelector both undefined, then by default select nothing. With option set - spec.selectAllByDefault: true, select all vmrules.
   If ruleNamespaceSelector defined, ruleSelector undefined, then all vmrules are matching at namespaces for given ruleNamespaceSelector.
   If ruleNamespaceSelector undefined, ruleSelector defined, then all vmrules at VMAlert’s namespaces are matching for given ruleSelector.
   If ruleNamespaceSelector and ruleSelector both defined, then only vmrules at namespaces matched ruleNamespaceSelector for given ruleSelector are matching.

   related to discussion about grafana dashboards. IMHO ))
5. Aleksei Sviridkin (lexfrei)

   added

   area/monitoringIssues or PRs related to the monitoring stack (vlogs, vmstack, grafana, workloadmonitor)Issues or PRs related to the monitoring stack (vlogs, vmstack, grafana, workloadmonitor)

   triage/acceptedIndicates an issue is ready to be actively worked onIndicates an issue is ready to be actively worked on

   priority/important-longtermImportant over the long term, but may not be staffed and/or may need multiple releases to completeImportant over the long term, but may not be staffed and/or may need multiple releases to complete

   on Jul 1, 2026
6. Aleksei Sviridkin (lexfrei)

   added a commit that references this issue on Oct 7, 2026

   fix(monitoring): scope tenant VMAlert to its own rule namespaces

   ...

   41df418