From e3bc00916dc1d4dec142014cb80caba716b735c9 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Sun, 26 Jul 2026 09:15:15 +0200 Subject: [PATCH] review: full per-member/family edge coverage; DNS is the member truth MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The review flagged the v6 target as 'proxy-2 per unifi_nat_hairpin.tf'. The tf label keys are the swapped ones: DNS (dig) and the live hosts (the v6-only member with the nameserver-less dhcpcd lease answers as proxy-1.renner.uno = 2a03:…:28:f6e…; the dual-stack member answers as proxy-2.renner.uno = 45.157.177.26 + 2a03:…:4b:c1e…) both agree with the probe's original attribution, as does the netbird-proxy role's 'proxy-1 is v6-only' doc. Keep DNS attribution, document the tf mislabel (tracked for a separate relabel — renaming those tf map keys churns NAT rule resources, so it doesn't belong in this PR), and: - add proxy-2's v6 address as a third target (previously its v6 path was unprobed; verified live from a pod, returns 200) - pin job="blackbox-http" on NetbirdControllerUnreachable for consistency with the other rules Co-Authored-By: Claude Fable 5 --- .../apps/monitoring-rules/probes-blackbox.yaml | 12 +++++++++++- .../prometheusrule-netbird-availability.yaml | 4 ++-- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/kubernetes/apps/monitoring-rules/probes-blackbox.yaml b/kubernetes/apps/monitoring-rules/probes-blackbox.yaml index 02816f40..9f2bd209 100644 --- a/kubernetes/apps/monitoring-rules/probes-blackbox.yaml +++ b/kubernetes/apps/monitoring-rules/probes-blackbox.yaml @@ -83,8 +83,18 @@ spec: targets: staticConfig: static: - # proxy-2 v4 + # Member attribution follows DNS, which is the operational truth + # (verified 2026-07-26: dig + live ssh — the v6-only host with + # the dhcpcd/no-IPv4 lease is proxy-1.renner.uno = 2a03:…:28:f6e…; + # proxy-2.renner.uno is the dual-stack member). NOTE: the label + # keys in opentofu/unifi_nat_hairpin.tf have the two v6 + # addresses attributed to the OPPOSITE members — tracked for a + # separate relabel; the addresses themselves are hairpinned + # identically, so nothing was functionally wrong there. + # proxy-2 v4 (dual-stack member) - https://45.157.177.26 + # proxy-2 v6 + - https://[2a03:4000:4b:c1e:4474:43ff:fedf:8f85] # proxy-1 v6 (v6-only member) - https://[2a03:4000:28:f6e:a4c7:59ff:fe1e:9a29] --- diff --git a/kubernetes/apps/monitoring-rules/prometheusrule-netbird-availability.yaml b/kubernetes/apps/monitoring-rules/prometheusrule-netbird-availability.yaml index 548e4c80..0a9b47d0 100644 --- a/kubernetes/apps/monitoring-rules/prometheusrule-netbird-availability.yaml +++ b/kubernetes/apps/monitoring-rules/prometheusrule-netbird-availability.yaml @@ -17,7 +17,7 @@ spec: # survive) — but peer logins, route changes, the dashboard and # emergency access depend on it, and the 2026-07-24 DC outage # ran ~20 h with no signal. - expr: probe_success{instance="https://netbird.renner.uno"} == 0 + expr: probe_success{job="blackbox-http", instance="https://netbird.renner.uno"} == 0 for: 10m labels: severity: critical @@ -36,7 +36,7 @@ spec: severity: critical annotations: summary: "Public edge unreachable from the WAN (all members)" - description: "Both IP-pinned WAN-path probes of the reverse-proxy edge (proxy-2 v4, proxy-1 v6) have failed for 5 minutes — external clients cannot reach home.renner.uno and the other published apps. Check the netcup proxies (netbird-proxy containers), the mesh path to the cluster, and cluster Traefik." + description: "All IP-pinned WAN-path probes of the reverse-proxy edge (proxy-2 v4+v6, proxy-1 v6) have failed for 5 minutes — external clients cannot reach home.renner.uno and the other published apps. Check the netcup proxies (netbird-proxy containers), the mesh path to the cluster, and cluster Traefik." - alert: NetbirdPublicEdgeMemberDown # A single edge member failing WAN reachability: DNS round-robin