From 349dbd4d3c44ac3c4f8fcc1687022b40bc906bb9 Mon Sep 17 00:00:00 2001
From: Franco <franco@giantswarm.io>
Date: Fri, 22 Nov 2024 10:45:25 -0300
Subject: [PATCH] Add alert to monitor Trivy pod restarts

---
 CHANGELOG.md                                  |  1 +
 .../shield/alerting-rules/trivy.rules.yml     | 27 +++++++++++++++++++
 2 files changed, 28 insertions(+)
 create mode 100644 helm/prometheus-rules/templates/platform/shield/alerting-rules/trivy.rules.yml

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 004e0a82..77be2a93 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Add `cloud-provider-controller.rules` to monitor the cloud-provider-controller components across providers.
 - Add alerts to monitor the `HelmReleases` for `cilium` and `coredns`.
 - Add alert to monitor the `HelmRelease` for the `vertical-pod-autoscaler-crd` app.
+- Add alert to monitor `Trivy` pod restarts.
 
 ### Fixed
 
diff --git a/helm/prometheus-rules/templates/platform/shield/alerting-rules/trivy.rules.yml b/helm/prometheus-rules/templates/platform/shield/alerting-rules/trivy.rules.yml
new file mode 100644
index 00000000..9e8df83b
--- /dev/null
+++ b/helm/prometheus-rules/templates/platform/shield/alerting-rules/trivy.rules.yml
@@ -0,0 +1,27 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  creationTimestamp: null
+  labels:
+    {{- include "labels.common" . | nindent 4 }}
+  name: kyverno.rules
+  namespace: {{ .Values.namespace  }}
+spec:
+  groups:
+  - name: trivy
+    rules:
+    - alert: TrivyComponentRestartingTooOften
+      annotations:
+        description: 'Trivy pod {{ $labels.namespace }}/{{ $labels.pod }} is restarting too often'
+        opsrecipe: trivy-pod-failing
+      expr: increase(kube_pod_container_status_restarts_total{cluster_type="workload_cluster", pod=~"trivy-.*"}[1h]) > 5
+      for: 15m
+      labels:
+        area: platform
+        cancel_if_cluster_status_creating: "true"
+        cancel_if_cluster_status_deleting: "true"
+        cancel_if_cluster_status_updating: "true"
+        cancel_if_outside_working_hours: {{ include "workingHoursOnly" . }}
+        severity: notify
+        team: shield
+        topic: trivy