Split rules in different files on the chart

[paul-mesnilgrente]

We are using ElastAlert to alert on a lot of different things currently. The problem is that the rules secret or the values.yaml is getting real big with our different rules and queries.

Is there anyway to split the secret or the values.yaml in different files? Like a 1 rule = 1 file.

[jertel]

A relatively quick solution is to script the generation of a short-lived myvalues.yaml override file by looping across a directory of rule files and appending them into the generated myvalues.yaml. Then run the chart deployment as you normally would, specifying the generated myvalues.yaml as the -f override. Instead of storing the myvalues.yaml in your team's revision control system you would instead store the individual rule yaml files, and the script that performs the myvalues.yaml generation.

There are some other options but they would require some more advanced changes to the ElastAlert2 Helm chart.

[vpedosyuk]

Another option would be to use a ConfigMap/Secret watcher as a sidecar. The sidecar would "watch" for ConfigMaps and add/modify/remove them into a rules folder as separate files. And it seems Elastalert can auto-reload its config on a folder change.

For example, Grafana does similar to dashboards/datasources:
https://github.com/grafana/helm-charts/tree/main/charts/grafana#sidecar-for-dashboards
https://github.com/kiwigrid/k8s-sidecar

I guess it's also possible with minimal Helm chart changes: if there was extraContainers parameter in the Helm chart, we could have in values.yaml smth like:

extraContainers:
  - name: sidecar
    image: kiwigrid/k8s-sidecar:latest
    volumeMounts:
      - name: rules-sidecar
        mountPath: /rules
    env:
      - name: LABEL
        value: elastalert-watch
      - name: FOLDER
        value: /rules
extraVolumes:
  - name: rules-sidecar
    emptyDir: {}
extraVolumeMounts:
  - name: rules-sidecar
    mountPath: /opt/elastalert/rules/sidecar

probably, scan_subdirectories: true Elastalert setting and some additional RBAC would also be needed.