From c06c6f78572106586b9b55069dae654a35f4f6bf Mon Sep 17 00:00:00 2001
From: panxiao81 <pan-xiao@live.cn>
Date: Fri, 25 Sep 2026 17:10:30 +0000
Subject: [PATCH] =?UTF-8?q?=E5=90=AF=E7=94=A8=20Alertmanager=20Telegram=20?=
 =?UTF-8?q?=E9=A2=91=E9=81=93=E5=91=8A=E8=AD=A6=20(#147)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: panxiao81 <pan-xiao@live.cn>
---
 .../metrics/alertmanager-external-secret.yaml | 18 +++++++++++
 .../observability/metrics/kustomization.yaml  |  1 +
 .../observability/metrics/vmalertmanager.yaml | 32 ++++++++++++-------
 3 files changed, 40 insertions(+), 11 deletions(-)
 create mode 100644 platform/observability/metrics/alertmanager-external-secret.yaml

diff --git a/platform/observability/metrics/alertmanager-external-secret.yaml b/platform/observability/metrics/alertmanager-external-secret.yaml
new file mode 100644
index 0000000..09cf735
--- /dev/null
+++ b/platform/observability/metrics/alertmanager-external-secret.yaml
@@ -0,0 +1,18 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: alertmanager-telegram
+  namespace: monitoring
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: alertmanager-telegram
+    creationPolicy: Owner
+  data:
+    - secretKey: telegram_bot_token
+      remoteRef:
+        key: k8s/alertmanager
+        property: telegram_bot_token
diff --git a/platform/observability/metrics/kustomization.yaml b/platform/observability/metrics/kustomization.yaml
index 3c8f70f..1008738 100644
--- a/platform/observability/metrics/kustomization.yaml
+++ b/platform/observability/metrics/kustomization.yaml
@@ -6,6 +6,7 @@ resources:
   - vmagent.yaml
   - vmalert.yaml
   - vmalertmanager.yaml
+  - alertmanager-external-secret.yaml
   - reload-rbac.yaml
   - rules/vm-health.yaml
   - rules/vmagent.yaml
diff --git a/platform/observability/metrics/vmalertmanager.yaml b/platform/observability/metrics/vmalertmanager.yaml
index 38500fa..9c7d041 100644
--- a/platform/observability/metrics/vmalertmanager.yaml
+++ b/platform/observability/metrics/vmalertmanager.yaml
@@ -1,6 +1,4 @@
-# Alert router/notifier. Migrated from the retired Compose stack (see Git history),
-# which currently blackholes everything. Wire real receivers here (email via the
-# in-cluster smtp-relay, or a webhook) when you want notifications.
+# Telegram token 由 ExternalSecret 从 OpenBao 投射，配置中仅引用文件。
 apiVersion: operator.victoriametrics.com/v1beta1
 kind: VMAlertmanager
 metadata:
@@ -8,19 +6,31 @@ metadata:
   namespace: monitoring
 spec:
   replicaCount: 1
+  secrets:
+    - alertmanager-telegram
   configRawYaml: |
     route:
       receiver: blackhole
+      group_by: [alertname, cluster, job, severity]
+      group_wait: 1m
+      group_interval: 5m
+      repeat_interval: 4h
+      routes:
+        - receiver: telegram
+          matchers:
+            - severity="critical"
+          group_wait: 10s
+          repeat_interval: 1h
+        - receiver: telegram
+          matchers:
+            - severity="warning"
     receivers:
       - name: blackhole
-    # Example email receiver via the in-cluster Postfix relay (smtp-relay/):
-    # receivers:
-    #   - name: email
-    #     email_configs:
-    #       - to: 'panxiao81@outlook.com'
-    #         from: 'Alertmanager <noreply@ddupan.top>'
-    #         smarthost: 'smtp-relay.smtp-relay.svc.cluster.local:25'
-    #         require_tls: false
+      - name: telegram
+        telegram_configs:
+          - bot_token_file: /etc/vm/secrets/alertmanager-telegram/telegram_bot_token
+            chat_id: -1003956377923
+            send_resolved: true
   resources:
     requests:
       cpu: 25m