vmalert helm release

No introduction found. Create it?

Key	Types
server.datasource.url (5) `http://victoria-logs-server.observability.svc.cluster.local:9428`	string
server.resources.limits.memory (5) `128Mi`	string
server.resources.requests.cpu (5) `10m`	string
server.resources.requests.memory (4) `64Mi`	string
server.config.alerts.groups[].interval (4) `5m`	string
server.config.alerts.groups[].name (4) `victorialogs.rules`	string
server.config.alerts.groups[].rules[].alert (4) `LoggingPipelineDead PanicLogPatternDetected AuthentikLoginFailureSpike`	string
server.config.alerts.groups[].rules[].annotations.summary (4) `Log pipeline dead — almost no logs ingested in 15m Repeated panic/segfault logs in {{ $labels.k_namespace_name }} Authentik login-failure spike — possible brute force`	string
server.config.alerts.groups[].rules[].annotations.description (2) VictoriaLogs received {{ $labels.ingested }} lines in 15m (normal ~180k). Log collection is broken and evidence is being lost. Check fluent-bit DaemonSet health and the victoria-logs ingestion endpoint. Logs: https://grafana.${SECRET_DOMAIN}/explore?schemaVersion=1&panes=%7B%22vl%22%3A%7B%22datasource%22%3A%22victoria-logs%22%2C%22queries%22%3A%5B%7B%22refId%22%3A%22A%22%2C%22expr%22%3A%22%2A%22%2C%22datasource%22%3A%7B%22type%22%3A%22victoriametrics-logs-datasource%22%2C%22uid%22%3A%22victoria-logs%22%7D%7D%5D%2C%22range%22%3A%7B%22from%22%3A%22now-30m%22%2C%22to%22%3A%22now%22%7D%7D%7D {{ $labels.hits }} panic/segfault log lines in 10m in namespace {{ $labels.k_namespace_name }} — something is crash-looping at the process level (may not surface as pod restarts if a supervisor swallows it). Inspect the namespace's pod logs in VictoriaLogs. Logs: https://grafana.${SECRET_DOMAIN}/explore?schemaVersion=1&panes=%7B%22vl%22%3A%7B%22datasource%22%3A%22victoria-logs%22%2C%22queries%22%3A%5B%7B%22refId%22%3A%22A%22%2C%22expr%22%3A%22%28%5C%22panic%3A%5C%22%20OR%20%5C%22segfault%5C%22%20OR%20%5C%22SIGSEGV%5C%22%29%22%2C%22datasource%22%3A%7B%22type%22%3A%22victoriametrics-logs-datasource%22%2C%22uid%22%3A%22victoria-logs%22%7D%7D%5D%2C%22range%22%3A%7B%22from%22%3A%22now-30m%22%2C%22to%22%3A%22now%22%7D%7D%7D {{ $labels.failures }} failed logins in 15m (baseline ~5/week). Check Authentik events for the source IP/username, and Cloudflare for the client; consider blocking at the edge. Logs: https://grafana.${SECRET_DOMAIN}/explore?schemaVersion=1&panes=%7B%22vl%22%3A%7B%22datasource%22%3A%22victoria-logs%22%2C%22queries%22%3A%5B%7B%22refId%22%3A%22A%22%2C%22expr%22%3A%22k_namespace_name%3Asecurity%20%5C%22login_failed%5C%22%22%2C%22datasource%22%3A%7B%22type%22%3A%22victoriametrics-logs-datasource%22%2C%22uid%22%3A%22victoria-logs%22%7D%7D%5D%2C%22range%22%3A%7B%22from%22%3A%22now-1h%22%2C%22to%22%3A%22now%22%7D%7D%7D	string
server.config.alerts.groups[].rules[].expr (4) `_time:15m * \| stats count() as ingested \| filter ingested:<100 _time:10m ("panic:" OR "segfault" OR "SIGSEGV") \| stats by (k_namespace_name) count() as hits \| filter hits:>3 _time:15m k_namespace_name:security "login_failed" \| stats count() as failures \| filter failures:>20`	string
server.config.alerts.groups[].rules[].labels.severity (4) `warning warning warning`	string
server.config.alerts.groups[].rules[].labels.category (1) `security security security security`	string
server.config.alerts.groups[].rules[].labels.tier (1) `security`	string
server.config.alerts.groups[].rules[].for (2) `3m`	string
server.config.alerts.groups[].type (4) `vlogs`	string
server.notifier.url (4) `http://alertmanager-operated.observability.svc.cluster.local:9093`	string
server.notifier.alertmanager.url (1) `http://alertmanager-operated.observability.svc.cluster.local:9093`	string
server.extraArgs."rule.defaultRuleType" (3) `vlogs`	string
server.extraArgs."datasource.queryStep" (1) `5m`	string
server.extraArgs.evaluationInterval (1) `1m`	string
server.extraArgs."external.url" (1) `https://victoria-logs.melotic.dev`	string
server.extraArgs.loggerFormat (1) `json`	string
server.securityContext.allowPrivilegeEscalation (2) `false`	boolean
server.securityContext.capabilities.drop[] (2) `- ALL`	string
server.securityContext.readOnlyRootFilesystem (2) `true`	boolean
server.securityContext.enabled (1) `true`	boolean
server.securityContext.runAsNonRoot (1) `true`	boolean
server.securityContext.runAsUser (1) `1000`	number
server.configMap (1) `vm-alert-rules`	string
server.extraVolumeMounts[].mountPath (1) `/tmp`	string
server.extraVolumeMounts[].name (1) `tmp`	string
server.extraVolumes[].name (1) `tmp`	string
server.fullnameOverride (1) `vmalert`	string
server.image.registry (1) `docker.io`	string
server.podAnnotations."reloader.stakater.com/auto" (1) `true`	string
server.podSecurityContext.fsGroup (1) `1000`	number
server.podSecurityContext.runAsGroup (1) `1000`	number
server.podSecurityContext.runAsNonRoot (1) `true`	boolean
server.podSecurityContext.runAsUser (1) `1000`	number
server.podSecurityContext.seccompProfile.type (1) `RuntimeDefault`	string
serviceMonitor.enabled (4) `true`	boolean
serviceMonitor.app.endpoints[].interval (1) `60s`	string
serviceMonitor.app.endpoints[].path (1) `/metrics`	string
serviceMonitor.app.endpoints[].port (1) `http`	string
serviceMonitor.app.endpoints[].scheme (1) `http`	string
serviceMonitor.app.serviceName (1) `vmalert`	string
fullnameOverride (3) `vmalert`	string
alertmanager.enabled (1) `false`	boolean
controllers.vmalert.annotations."reloader.stakater.com/auto" (1) `true`	string
controllers.vmalert.containers.app.args[] (1) `- --datasource.url=http://victoria-logs-server.observability.svc.cluster.local:9428 - --notifier.url=http://kube-prometheus-stack-alertmanager.observability.svc.cluster.local:9093 - --rule=/config/rules.yaml - --rule.defaultRuleType=vlogs - --httpListenAddr=:8880`	string
controllers.vmalert.containers.app.image.repository (1) `victoriametrics/vmalert`	string
controllers.vmalert.containers.app.image.tag (1) `v1.150.0`	string
controllers.vmalert.containers.app.probes.liveness.custom (1) `true`	boolean
controllers.vmalert.containers.app.probes.liveness.enabled (1) `true`	boolean
controllers.vmalert.containers.app.probes.liveness.spec.httpGet.path (1) `/health`	string
controllers.vmalert.containers.app.probes.liveness.spec.httpGet.port (1) `8880`	number
controllers.vmalert.containers.app.probes.liveness.spec.initialDelaySeconds (1) `10`	number
controllers.vmalert.containers.app.probes.liveness.spec.periodSeconds (1) `20`	number
controllers.vmalert.containers.app.probes.readiness.custom (1) `true`	boolean
controllers.vmalert.containers.app.probes.readiness.enabled (1) `true`	boolean
controllers.vmalert.containers.app.probes.readiness.spec.httpGet.path (1) `/health`	string
controllers.vmalert.containers.app.probes.readiness.spec.httpGet.port (1) `8880`	number
controllers.vmalert.containers.app.probes.readiness.spec.initialDelaySeconds (1) `5`	number
controllers.vmalert.containers.app.probes.readiness.spec.periodSeconds (1) `10`	number
controllers.vmalert.containers.app.resources.limits.memory (1) `256Mi`	string
controllers.vmalert.containers.app.resources.requests.cpu (1) `10m`	string
controllers.vmalert.containers.app.resources.requests.memory (1) `64Mi`	string
controllers.vmalert.containers.app.securityContext.allowPrivilegeEscalation (1) `false`	boolean
controllers.vmalert.containers.app.securityContext.capabilities.drop[] (1) `- ALL`	string
controllers.vmalert.containers.app.securityContext.readOnlyRootFilesystem (1) `true`	boolean
controllers.vmalert.pod.securityContext.runAsGroup (1) `65534`	number
controllers.vmalert.pod.securityContext.runAsNonRoot (1) `true`	boolean
controllers.vmalert.pod.securityContext.runAsUser (1) `65534`	number
controllers.vmalert.pod.securityContext.seccompProfile.type (1) `RuntimeDefault`	string
controllers.vmalert.replicas (1) `1`	number
controllers.vmalert.type (1) `deployment`	string
persistence.config.globalMounts[].path (1) `/config/rules.yaml`	string
persistence.config.globalMounts[].readOnly (1) `true`	boolean
persistence.config.globalMounts[].subPath (1) `rules.yaml`	string
persistence.config.name (1) `vmalert-rules`	string
persistence.config.type (1) `configMap`	string
service.app.controller (1) `vmalert`	string
service.app.ports.http.port (1) `8880`	number
service.app.ports.http.protocol (1) `TCP`	string
serviceAccount.create (1) `true`	boolean

Key

Types

http://victoria-logs-server.observability.svc.cluster.local:9428

string

server.resources.limits.memory (5)

128Mi

string

server.resources.requests.cpu (5)

10m

string

server.resources.requests.memory (4)

64Mi

string

server.config.alerts.groups[].interval (4)

5m

string

server.config.alerts.groups[].name (4)

victorialogs.rules

string

server.config.alerts.groups[].rules[].alert (4)

LoggingPipelineDead
PanicLogPatternDetected
AuthentikLoginFailureSpike

string

server.config.alerts.groups[].rules[].annotations.summary (4)

Log pipeline dead — almost no logs ingested in 15m
Repeated panic/segfault logs in {{ $labels.k_namespace_name }}
Authentik login-failure spike — possible brute force

string

server.config.alerts.groups[].rules[].annotations.description (2)

VictoriaLogs received {{ $labels.ingested }} lines in 15m (normal ~180k). Log collection is broken and evidence is being lost. Check fluent-bit DaemonSet health and the victoria-logs ingestion endpoint. Logs: https://grafana.${SECRET_DOMAIN}/explore?schemaVersion=1&panes=%7B%22vl%22%3A%7B%22datasource%22%3A%22victoria-logs%22%2C%22queries%22%3A%5B%7B%22refId%22%3A%22A%22%2C%22expr%22%3A%22%2A%22%2C%22datasource%22%3A%7B%22type%22%3A%22victoriametrics-logs-datasource%22%2C%22uid%22%3A%22victoria-logs%22%7D%7D%5D%2C%22range%22%3A%7B%22from%22%3A%22now-30m%22%2C%22to%22%3A%22now%22%7D%7D%7D
{{ $labels.hits }} panic/segfault log lines in 10m in namespace {{ $labels.k_namespace_name }} — something is crash-looping at the process level (may not surface as pod restarts if a supervisor swallows it). Inspect the namespace's pod logs in VictoriaLogs. Logs: https://grafana.${SECRET_DOMAIN}/explore?schemaVersion=1&panes=%7B%22vl%22%3A%7B%22datasource%22%3A%22victoria-logs%22%2C%22queries%22%3A%5B%7B%22refId%22%3A%22A%22%2C%22expr%22%3A%22%28%5C%22panic%3A%5C%22%20OR%20%5C%22segfault%5C%22%20OR%20%5C%22SIGSEGV%5C%22%29%22%2C%22datasource%22%3A%7B%22type%22%3A%22victoriametrics-logs-datasource%22%2C%22uid%22%3A%22victoria-logs%22%7D%7D%5D%2C%22range%22%3A%7B%22from%22%3A%22now-30m%22%2C%22to%22%3A%22now%22%7D%7D%7D
{{ $labels.failures }} failed logins in 15m (baseline ~5/week). Check Authentik events for the source IP/username, and Cloudflare for the client; consider blocking at the edge. Logs: https://grafana.${SECRET_DOMAIN}/explore?schemaVersion=1&panes=%7B%22vl%22%3A%7B%22datasource%22%3A%22victoria-logs%22%2C%22queries%22%3A%5B%7B%22refId%22%3A%22A%22%2C%22expr%22%3A%22k_namespace_name%3Asecurity%20%5C%22login_failed%5C%22%22%2C%22datasource%22%3A%7B%22type%22%3A%22victoriametrics-logs-datasource%22%2C%22uid%22%3A%22victoria-logs%22%7D%7D%5D%2C%22range%22%3A%7B%22from%22%3A%22now-1h%22%2C%22to%22%3A%22now%22%7D%7D%7D

string

server.config.alerts.groups[].rules[].expr (4)

_time:15m * | stats count() as ingested | filter ingested:<100
_time:10m ("panic:" OR "segfault" OR "SIGSEGV") | stats by (k_namespace_name) count() as hits | filter hits:>3
_time:15m k_namespace_name:security "login_failed" | stats count() as failures | filter failures:>20

string

server.config.alerts.groups[].rules[].labels.severity (4)

warning
warning
warning

string

server.config.alerts.groups[].rules[].labels.category (1)

security
security
security
security

string

server.config.alerts.groups[].rules[].labels.tier (1)

security

string

server.config.alerts.groups[].rules[].for (2)

3m

string

server.config.alerts.groups[].type (4)

vlogs

string

server.notifier.url (4)

http://alertmanager-operated.observability.svc.cluster.local:9093

string

server.notifier.alertmanager.url (1)

http://alertmanager-operated.observability.svc.cluster.local:9093

string

server.extraArgs."rule.defaultRuleType" (3)

vlogs

string

server.extraArgs."datasource.queryStep" (1)

5m

string

server.extraArgs.evaluationInterval (1)

1m

string

server.extraArgs."external.url" (1)

https://victoria-logs.melotic.dev

string

server.extraArgs.loggerFormat (1)

json

string

server.securityContext.allowPrivilegeEscalation (2)

false

boolean

server.securityContext.capabilities.drop[] (2)

- ALL

string

server.securityContext.readOnlyRootFilesystem (2)

true

boolean

server.securityContext.enabled (1)

true

boolean

server.securityContext.runAsNonRoot (1)

true

boolean

server.securityContext.runAsUser (1)

number

server.configMap (1)

vm-alert-rules

string

server.extraVolumeMounts[].mountPath (1)

/tmp

string

server.extraVolumeMounts[].name (1)

tmp

string

server.extraVolumes[].name (1)

tmp

string

server.fullnameOverride (1)

vmalert

string

server.image.registry (1)

docker.io

string

server.podAnnotations."reloader.stakater.com/auto" (1)

true

string

server.podSecurityContext.fsGroup (1)

number

server.podSecurityContext.runAsGroup (1)

number

server.podSecurityContext.runAsNonRoot (1)

true

boolean

server.podSecurityContext.runAsUser (1)

number

server.podSecurityContext.seccompProfile.type (1)

RuntimeDefault

string

serviceMonitor.enabled (4)

true

boolean

serviceMonitor.app.endpoints[].interval (1)

60s

string

serviceMonitor.app.endpoints[].path (1)

/metrics

string

serviceMonitor.app.endpoints[].port (1)

http

string

serviceMonitor.app.endpoints[].scheme (1)

http

string

serviceMonitor.app.serviceName (1)

vmalert

string

fullnameOverride (3)

vmalert

string

alertmanager.enabled (1)

false

boolean

controllers.vmalert.annotations."reloader.stakater.com/auto" (1)

true

string

controllers.vmalert.containers.app.args[] (1)

- --datasource.url=http://victoria-logs-server.observability.svc.cluster.local:9428
- --notifier.url=http://kube-prometheus-stack-alertmanager.observability.svc.cluster.local:9093
- --rule=/config/rules.yaml
- --rule.defaultRuleType=vlogs
- --httpListenAddr=:8880

string

controllers.vmalert.containers.app.image.repository (1)