platform/observability/metrics/alertmanager-external-secret.yaml

@@ -0,0 +1,18 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: alertmanager-telegram
+  namespace: monitoring
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: alertmanager-telegram
+    creationPolicy: Owner
+  data:
+    - secretKey: telegram_bot_token
+      remoteRef:
+        key: k8s/alertmanager
+        property: telegram_bot_token

platform/observability/metrics/kustomization.yaml

@@ -6,6 +6,7 @@ resources:
   - vmagent.yaml
   - vmalert.yaml
   - vmalertmanager.yaml
+  - alertmanager-external-secret.yaml
   - reload-rbac.yaml
   - rules/vm-health.yaml
   - rules/vmagent.yaml

platform/observability/metrics/vmalertmanager.yaml

@@ -1,6 +1,4 @@
-# Alert router/notifier. Migrated from the retired Compose stack (see Git history),
-# which currently blackholes everything. Wire real receivers here (email via the
-# in-cluster smtp-relay, or a webhook) when you want notifications.
+# Telegram token 由 ExternalSecret 从 OpenBao 投射，配置中仅引用文件。
 apiVersion: operator.victoriametrics.com/v1beta1
 kind: VMAlertmanager
 metadata:
@@ -8,19 +6,31 @@ metadata:
   namespace: monitoring
 spec:
   replicaCount: 1
+  secrets:
+    - alertmanager-telegram
   configRawYaml: |
     route:
       receiver: blackhole
+      group_by: [alertname, cluster, job, severity]
+      group_wait: 1m
+      group_interval: 5m
+      repeat_interval: 4h
+      routes:
+        - receiver: telegram
+          matchers:
+            - severity="critical"
+          group_wait: 10s
+          repeat_interval: 1h
+        - receiver: telegram
+          matchers:
+            - severity="warning"
     receivers:
       - name: blackhole
-    # Example email receiver via the in-cluster Postfix relay (smtp-relay/):
-    # receivers:
-    #   - name: email
-    #     email_configs:
-    #       - to: '[email protected]'
-    #         from: 'Alertmanager <[email protected]>'
-    #         smarthost: 'smtp-relay.smtp-relay.svc.cluster.local:25'
-    #         require_tls: false
+      - name: telegram
+        telegram_configs:
+          - bot_token_file: /etc/vm/secrets/alertmanager-telegram/telegram_bot_token
+            chat_id: -1003956377923
+            send_resolved: true
   resources:
     requests:
       cpu: 25m