From 6649e5b560aae6c8de146b39926a001fd2aca38c Mon Sep 17 00:00:00 2001 From: atlas-bot Date: Sat, 3 Oct 2026 16:29:05 +0000 Subject: [PATCH] feat(monitoring): blackbox-http probe for shelly-manager /health (REN-533) In-cluster app-health target via the ClusterIP Service, so a dead app behind the live shelly-manager-gate outpost no longer reads green. Covered by the existing BlackboxProbeFailing rule; no CNP change needed (home-assistant default-deny already admits the monitoring namespace). Co-Authored-By: Claude Opus 5.5 --- .../monitoring-rules/probes-blackbox.yaml | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/kubernetes/apps/monitoring-rules/probes-blackbox.yaml b/kubernetes/apps/monitoring-rules/probes-blackbox.yaml index d8257cfa..067adad3 100644 --- a/kubernetes/apps/monitoring-rules/probes-blackbox.yaml +++ b/kubernetes/apps/monitoring-rules/probes-blackbox.yaml @@ -261,6 +261,32 @@ spec: # at 2b71dda1, and the tested one-line deletion for this target alone # is the second command listed there (20 -> 19 targets). - http://paperless.paperless.svc.cluster.local:80/accounts/login/ + # anchor: shelly-manager-app-health + # APP-HEALTH probe for shelly-manager (REN-531/REN-533). Same rule as + # the blocks above (monitoring-vantage-point-rule): shelly.renner.uno + # sits behind the shelly-manager-gate outpost, so only the in-cluster + # Service can tell a dead app from a live gate. + # + # /health is unauthenticated and answers a plain 200 — not a 3xx — + # per the app's own test (shelly-manager repo, + # AuthenticationTests.Health_IsUnauthenticated); it is also the pod's + # kubelet liveness/readiness path + # (../home-assistant/shelly-manager-deployment.yaml). AllowedHosts is + # "*", so the cluster-local Host header is accepted. Service :80 -> + # container :8080 (../home-assistant/shelly-manager-service.yaml). + # + # NO CiliumNetworkPolicy change: the home-assistant default-deny + # admits the whole monitoring namespace on every port + # (../../infrastructure/network-policies/home-assistant-ns.yaml, + # "Prometheus scrape" rule). If that rule is ever narrowed to + # Prometheus alone, add a blackbox-exporter grant on :8080 in a + # DEDICATED policy selecting shelly-manager — not on the {} selector, + # where :8080 is shared by three apps. The EGRESS paragraph above + # applies too: a future monitoring egress block must list + # home-assistant. + # + # REVERT: delete the target line below. + - http://shelly-manager.home-assistant.svc.cluster.local:80/health # WAN-path probes of the public edge BY PROXY IP. The name-based # home.renner.uno probe above resolves in-cluster (CoreDNS/k8s_gateway) # and never leaves the LAN — the vantage-point blind spot that let the -- 2.54.0