@intentius/chant-lexicon-prometheus 0.96.0 → 0.98.0

package/src/import/slo.ts

@@ -0,0 +1,175 @@
+/**
+ * Recognise a rule group that `Slo()` built, so the importer can write the
+ * `Slo` declaration instead of its forty-odd lines of rules.
+ *
+ * The group's name, recorded series, objective and burn-rate alerts give
+ * back candidate props; the candidate is accepted only when `Slo()` builds
+ * it to the same group, rule for rule. Anything else (a hand-edited
+ * threshold, an extra rule, a different description) fails that check and
+ * the group is imported as a plain `RuleGroup`.
+ */
+
+import { Slo, DEFAULT_BURN_RATES, SLO_WINDOW_PLACEHOLDER, type SloAlertTier, type SloProps, type BurnRateWindow } from "../composites/slo";
+import { ruleGroupConfig } from "../rules";
+import { durationMs } from "../duration";
+import { isAlertingRuleConfig, isRecordingRuleConfig, type AlertingRuleConfig, type LabelSet, type RuleGroupConfig } from "../model";
+
+const RATIO_PREFIX = "slo:sli_error:ratio_rate";
+const OBJECTIVE = "slo:objective:ratio";
+const BUDGET = "slo:error_budget:remaining";
+const DEFAULT_ALERT_NAME = "ErrorBudgetBurn";
+const PAIR_LABELS = new Set(["slo", "severity", "long_window", "short_window"]);
+const DESCRIPTION_TAIL = "The error ratio over both the last ";
+
+/** Objects with their keys sorted, so two configs compare equal whatever order their keys were written in. */
+function canonical(v: unknown): unknown {
+  if (Array.isArray(v)) return v.map(canonical);
+  if (typeof v === "object" && v !== null) {
+    return Object.fromEntries(
+      Object.keys(v)
+        .sort()
+        .map((k) => [k, canonical((v as Record<string, unknown>)[k])]),
+    );
+  }
+  return v;
+}
+
+function same(a: unknown, b: unknown): boolean {
+  return JSON.stringify(canonical(a)) === JSON.stringify(canonical(b));
+}
+
+/** The SLI expressions a recorded error ratio was built from, with the window put back as `{{window}}`. */
+function sliFrom(expr: string, window: string): SloProps["sli"] | undefined {
+  const unwindow = (s: string) => s.split(`[${window}]`).join(`[${SLO_WINDOW_PLACEHOLDER}]`);
+  const goodHead = "1 - (\n  (";
+  const goodTail = ")\n)";
+  if (expr.startsWith(goodHead) && expr.endsWith(goodTail)) {
+    const inner = expr.slice(goodHead.length, -goodTail.length);
+    const at = inner.indexOf(")\n  /\n  (");
+    if (at === -1) return undefined;
+    return { good: unwindow(inner.slice(0, at)), total: unwindow(inner.slice(at + ")\n  /\n  (".length)) };
+  }
+  if (expr.startsWith("(") && expr.endsWith(")")) {
+    const inner = expr.slice(1, -1);
+    const at = inner.indexOf(")\n/\n(");
+    if (at === -1) return undefined;
+    return { errors: unwindow(inner.slice(0, at)), total: unwindow(inner.slice(at + ")\n/\n(".length)) };
+  }
+  return undefined;
+}
+
+function extras(set: LabelSet | undefined, skip: (k: string) => boolean): LabelSet | undefined {
+  const out: LabelSet = {};
+  for (const [k, v] of Object.entries(set ?? {})) if (!skip(k)) out[k] = v;
+  return Object.keys(out).length > 0 ? out : undefined;
+}
+
+function isDefaultPairs(tier: "page" | "ticket", pairs: BurnRateWindow[], factors: number[], windowMs: (w: string) => number, sloWindow: string): boolean {
+  const defaults = DEFAULT_BURN_RATES[tier];
+  if (defaults.length !== pairs.length) return false;
+  return defaults.every((d, i) => {
+    const p = pairs[i];
+    const factor = Number(((d.budgetConsumed! * windowMs(sloWindow)) / windowMs(d.long)).toPrecision(6));
+    return p.long === d.long && p.short === d.short && factor === factors[i];
+  });
+}
+
+/** The `Slo` props that build exactly `group`, or `undefined` when no `Slo()` call does. */
+export function recognizeSlo(group: RuleGroupConfig): SloProps | undefined {
+  if (!group.name.startsWith("slo-") || group.query_offset !== undefined || group.limit !== undefined) return undefined;
+  const name = group.name.slice("slo-".length);
+  const records = group.rules.filter(isRecordingRuleConfig);
+  const alerts = group.rules.filter(isAlertingRuleConfig) as AlertingRuleConfig[];
+  if (records.length + alerts.length !== group.rules.length) return undefined;
+
+  const objectiveAt = records.findIndex((r) => r.record === OBJECTIVE);
+  if (objectiveAt < 1 || records[objectiveAt + 1]?.record !== BUDGET) return undefined;
+  const objective = Number(/^vector\((.+)\)$/.exec(records[objectiveAt].expr)?.[1]);
+  if (!Number.isFinite(objective)) return undefined;
+  const windowRecord = records[objectiveAt - 1].record;
+  if (!windowRecord.startsWith(RATIO_PREFIX)) return undefined;
+  const window = windowRecord.slice(RATIO_PREFIX.length);
+
+  // Candidate SLIs: from each alert window's ratio, or from the whole-window
+  // ratio when there are no alerts.
+  const ratioRecords = records.slice(0, objectiveAt - 1);
+  const sources = ratioRecords.length > 0 ? ratioRecords : [records[objectiveAt - 1]];
+  const slis = sources
+    .map((r) => (r.record.startsWith(RATIO_PREFIX) ? sliFrom(r.expr, r.record.slice(RATIO_PREFIX.length)) : undefined))
+    .filter((s): s is SloProps["sli"] => s !== undefined);
+  if (slis.length === 0) return undefined;
+
+  // Alert tiers: `page` and `ticket` by severity, or custom severities in the order they appear.
+  const alertName = alerts[0]?.alert ?? DEFAULT_ALERT_NAME;
+  const bySeverity = new Map<string, AlertingRuleConfig[]>();
+  for (const a of alerts) {
+    const severity = a.labels?.severity;
+    if (severity === undefined || a.alert !== alertName) return undefined;
+    bySeverity.set(severity, [...(bySeverity.get(severity) ?? []), a]);
+  }
+  if (bySeverity.size > 2) return undefined;
+  const severities = [...bySeverity.keys()];
+  const tierOf = new Map<string, "page" | "ticket">();
+  for (const s of severities) if (s === "page" || s === "ticket") tierOf.set(s, s);
+  for (const s of severities) {
+    if (tierOf.has(s)) continue;
+    const free = (["page", "ticket"] as const).find((t) => ![...tierOf.values()].includes(t));
+    if (!free) return undefined;
+    tierOf.set(s, free);
+  }
+
+  let description: string | undefined;
+  const alerting: NonNullable<SloProps["alerting"]> = {};
+  for (const tier of ["page", "ticket"] as const) {
+    const severity = [...tierOf].find(([, t]) => t === tier)?.[0];
+    if (severity === undefined) {
+      alerting[tier] = false;
+      continue;
+    }
+    const tierAlerts = bySeverity.get(severity)!;
+    const first = tierAlerts[0];
+    const pairs: BurnRateWindow[] = [];
+    const factors: number[] = [];
+    for (const a of tierAlerts) {
+      const long = a.labels?.long_window;
+      const short = a.labels?.short_window;
+      const factor = Number(/> \(([^ ]+) \* /.exec(a.expr)?.[1]);
+      if (long === undefined || short === undefined || !Number.isFinite(factor)) return undefined;
+      pairs.push({ long, short, factor });
+      factors.push(factor);
+    }
+    const t: SloAlertTier = {};
+    t.burnRates = isDefaultPairs(tier, pairs, factors, (w) => durationMs(w) ?? 0, window) ? "default" : pairs;
+    if (severity !== tier) t.severity = severity;
+    if (first.for !== undefined) t.for = first.for;
+    const labels = extras(first.labels, (k) => PAIR_LABELS.has(k));
+    if (labels) t.labels = labels;
+    const annotations = extras(first.annotations, (k) => k === "summary" || k === "description");
+    if (annotations) t.annotations = annotations;
+    const desc = first.annotations?.description ?? "";
+    const at = desc.indexOf(DESCRIPTION_TAIL);
+    if (at > 0 && description === undefined) description = desc.slice(0, at).trimEnd();
+    const onlyDefault = t.burnRates === "default" && Object.keys(t).length === 1;
+    if (!onlyDefault) alerting[tier] = t;
+  }
+  if (alertName !== DEFAULT_ALERT_NAME) alerting.alertName = alertName;
+
+  for (const sli of slis) {
+    const props: SloProps = {
+      name,
+      objective,
+      window,
+      ...(description ? { description } : {}),
+      sli,
+      ...(Object.keys(alerting).length > 0 ? { alerting } : {}),
+      ...(group.labels ? { labels: group.labels } : {}),
+      ...(group.interval !== undefined ? { interval: group.interval } : {}),
+    };
+    try {
+      if (same(ruleGroupConfig(Slo(props).rules), ruleGroupConfig(group))) return props;
+    } catch {
+      // Not buildable from these props; try the next candidate.
+    }
+  }
+  return undefined;
+}

package/src/import/testdata/alertmanager-full.yml

@@ -0,0 +1,89 @@
+# Deprecated spellings (match, match_re, source_match, the top-level
+# mute_time_intervals), integrations this lexicon does not type (opsgenie,
+# msteams), global fields outside the typed set, *_file credentials, Go
+# templates, a YAML anchor with a merge key, and one literal credential.
+global:
+  resolve_timeout: 5m
+  smtp_smarthost: smtp.example.com:587
+  smtp_from: alertmanager@example.com
+  smtp_auth_username: alertmanager
+  smtp_auth_password_file: /etc/alertmanager/secrets/smtp-password
+  slack_api_url_file: /etc/alertmanager/secrets/slack-url
+  opsgenie_api_key_file: /etc/alertmanager/secrets/opsgenie-key
+  http_config:
+    follow_redirects: true
+templates:
+  - /etc/alertmanager/templates/*.tmpl
+route:
+  receiver: default
+  group_by: [alertname, cluster]
+  group_wait: 30s
+  labels:
+    summary: '{{ .GroupLabels.alertname }} in {{ .GroupLabels.cluster }}'
+  routes:
+    - match:
+        severity: page
+      match_re:
+        service: ^(api|web)$
+      receiver: oncall
+      continue: true
+    - matchers: ['team="db"']
+      receiver: db-chat
+      mute_time_intervals: [weekends]
+      active_time_intervals: [business-hours]
+    - match:
+        alertname: Watchdog
+      receiver: heartbeat
+      repeat_interval: 1m
+inhibit_rules:
+  - name: page-mutes-ticket
+    source_match:
+      severity: page
+    target_matchers: ['severity="ticket"']
+    equal: [alertname, cluster]
+receivers:
+  - name: default
+    webhook_configs:
+      - url_file: /etc/alertmanager/secrets/default-webhook-url
+        max_alerts: 10
+  - name: oncall
+    pagerduty_configs:
+      - routing_key_file: /etc/alertmanager/secrets/pagerduty-key
+        description: '{{ template "pagerduty.default.description" . }}'
+        details:
+          firing: '{{ .Alerts.Firing | len }}'
+    opsgenie_configs:
+      - api_key_file: /etc/alertmanager/secrets/opsgenie-key
+        priority: P1
+  - name: db-chat
+    slack_configs:
+      - &slack
+        channel: '#db-alerts'
+        title: '{{ .CommonLabels.alertname }}'
+        text: >-
+          {{ range .Alerts }}{{ .Annotations.summary }}
+          {{ end }}
+        send_resolved: true
+      - <<: *slack
+        channel: '#db-oncall'
+    msteams_configs:
+      - webhook_url_file: /etc/alertmanager/secrets/teams-url
+  - name: heartbeat
+    email_configs:
+      - to: heartbeat@example.com
+        auth_username: heartbeat
+        auth_password: hunter2
+        headers:
+          Subject: '[heartbeat] {{ .CommonLabels.alertname }}'
+time_intervals:
+  - name: business-hours
+    time_intervals:
+      - weekdays: ['monday:friday']
+        times:
+          - start_time: '09:00'
+            end_time: '17:00'
+        location: Europe/Berlin
+mute_time_intervals:
+  - name: weekends
+    time_intervals:
+      - weekdays: [saturday, sunday]

package/src/import/testdata/fixtures.ts

@@ -0,0 +1,114 @@
+/**
+ * Fixtures shared by the import round-trip tests (roundtrip.test.ts,
+ * cli.test.ts) and the type-check of the generated source
+ * (generated-types.e2e.test.ts).
+ */
+import { readdirSync, readFileSync, statSync } from "fs";
+import { join, resolve } from "path";
+import { build } from "@intentius/chant/build";
+import type { Serializer, SerializerResult } from "@intentius/chant/serializer";
+import { k8sSerializer } from "@intentius/chant-lexicon-k8s";
+import { prometheusSerializer, ALERTMANAGER_FILE } from "../../serializer";
+import { ruleFileYaml } from "../../build";
+import { Slo } from "../../composites/slo";
+
+export const pkgDir = resolve(import.meta.dirname, "../../..");
+export const repoRoot = resolve(pkgDir, "../..");
+export const read = (...p: string[]) => readFileSync(join(import.meta.dirname, ...p), "utf-8");
+
+/** One file a build wrote: the rule file or `alertmanager.yml`. */
+export interface BuiltFile {
+  name: string;
+  yaml: string;
+}
+
+/** The rule file and `alertmanager.yml` of one build output, whichever it has. */
+export function builtFiles(out: string | SerializerResult | undefined): { rules?: string; alertmanager?: string } {
+  if (out === undefined || out === "") return {};
+  if (typeof out === "string") return out.startsWith("groups:") ? { rules: out } : { alertmanager: out };
+  const primaryIsRules = out.primary.startsWith("groups:");
+  return {
+    ...(primaryIsRules ? { rules: out.primary } : { alertmanager: out.primary }),
+    ...(out.files?.[ALERTMANAGER_FILE] !== undefined ? { alertmanager: out.files[ALERTMANAGER_FILE] } : {}),
+  };
+}
+
+/** Every file each prometheus example builds, named `<example>/rules.yml` or `<example>/alertmanager.yml`. */
+export async function exampleOutputs(): Promise<BuiltFile[]> {
+  const examplesDir = join(pkgDir, "examples");
+  const out: BuiltFile[] = [];
+  for (const name of readdirSync(examplesDir).sort()) {
+    const srcDir = join(examplesDir, name, "src");
+    try {
+      if (!statSync(srcDir).isDirectory()) continue;
+    } catch {
+      continue;
+    }
+    // k3d-stack declares its Kubernetes workloads beside the rules.
+    const serializers: Serializer[] = name === "k3d-stack" ? [k8sSerializer, prometheusSerializer] : [prometheusSerializer];
+    const result = await build(srcDir, serializers);
+    if (result.errors.length > 0) throw new Error(`${name}: ${result.errors.map(String).join("; ")}`);
+    const files = builtFiles(result.outputs.get("prometheus"));
+    if (files.rules !== undefined) out.push({ name: `${name}/rules.yml`, yaml: files.rules });
+    if (files.alertmanager !== undefined) out.push({ name: `${name}/alertmanager.yml`, yaml: files.alertmanager });
+  }
+  return out;
+}
+
+const calls = "traces_span_metrics_calls_total";
+
+/** Rule files `Slo()` builds, over the props that change its shape. */
+export function sloOutputs(): BuiltFile[] {
+  const good = {
+    good: `sum(rate(${calls}{span_name="checkout",status_code!="STATUS_CODE_ERROR"}[{{window}}]))`,
+    total: `sum(rate(${calls}{span_name="checkout"}[{{window}}]))`,
+  };
+  const errors = {
+    errors: `sum(rate(http_requests_total{code=~"5.."}[{{window}}]))`,
+    total: "sum(rate(http_requests_total[{{window}}]))",
+  };
+  const slos = [
+    Slo({ name: "defaults", objective: 0.999, window: "30d", sli: errors }),
+    Slo({
+      name: "order-ack",
+      objective: 0.995,
+      window: "28d",
+      description: "Orders are acknowledged without an error span.",
+      sli: good,
+      alerting: {
+        page: { burnRates: "default", annotations: { runbook_url: "https://runbooks.example.com/order-ack" } },
+        ticket: { burnRates: "default", for: "15m", labels: { team: "orders" } },
+      },
+      labels: { team: "orders" },
+      interval: "1m",
+    }),
+    Slo({
+      name: "custom",
+      objective: 0.99,
+      window: "7d",
+      sli: errors,
+      alerting: {
+        alertName: "LatencyBudgetBurn",
+        page: {
+          severity: "critical",
+          burnRates: [
+            { long: "1h", short: "5m", factor: 10 },
+            { long: "6h", short: "30m", budgetConsumed: 0.1 },
+          ],
+        },
+        ticket: false,
+      },
+    }),
+    Slo({ name: "no-alerts", objective: 0.95, window: "1w", sli: good, alerting: { page: false, ticket: false } }),
+  ];
+  return slos.map((s) => ({ name: `Slo ${s.rules.props.name}`, yaml: ruleFileYaml([s.rules]) }));
+}
+
+/** The vendored upstream samples, each with the source it came from in its header. */
+export const UPSTREAM = [
+  "prometheus-recording-rules.yml",
+  "prometheus-alerting-rules.yml",
+  "prometheus-alerting-templates.yml",
+  "alertmanager-simple.yml",
+  "alertmanager-route-labels.yml",
+];

package/src/import/testdata/rules-full.yml

@@ -0,0 +1,42 @@
+# Every rule file field, multi-line expressions (block scalars), a PromQL
+# raw string in backticks, Go templates in annotations and a label value
+# written as a number.
+groups:
+  - name: node
+    interval: 1m
+    query_offset: 30s
+    limit: 100
+    labels:
+      team: platform
+      tier: 1
+    rules:
+      - record: instance:node_cpu_utilisation:rate5m
+        expr: |
+          1 - avg without (cpu, mode) (
+            rate(node_cpu_seconds_total{mode="idle"}[5m])
+          )
+      - record: instance:node_host:label
+        expr: label_replace(up{job="node"}, "host", "$1", "instance", `(.*):.*`)
+        labels:
+          source: node-exporter
+      - alert: NodeHighCpu
+        expr: instance:node_cpu_utilisation:rate5m > 0.9
+        for: 15m
+        keep_firing_for: 5m
+        labels:
+          severity: ticket
+        annotations:
+          summary: "{{ $labels.instance }} CPU above 90%"
+          description: >-
+            CPU on {{ $labels.instance }} has been above 90% for 15 minutes
+            (currently {{ $value | humanizePercentage }}).
+  - name: blackbox
+    rules:
+      - alert: ProbeFailing
+        expr: probe_success == 0
+        for: 2m
+        labels:
+          severity: page
+        annotations:
+          summary: "{{ $labels.instance }} is not answering"
+          runbook_url: https://runbooks.example.com/probe

package/src/import/testdata/upstream/alertmanager-route-labels.yml

@@ -0,0 +1,65 @@
+# Vendored from github.com/prometheus/alertmanager v0.34.1, doc/examples/route_labels.yml
+# (https://github.com/prometheus/alertmanager/blob/v0.34.1/doc/examples/route_labels.yml). Apache-2.0.
+# Unchanged below this header.
+# Example showing route `labels`.
+#
+# Route labels are attached to a route, inherited by child routes, and may be
+# overridden per route. They are rendered per alert group and exposed to
+# notification templates via the `routeLabels` function (and in the
+# `routeLabels` field of the /api/v2/alerts/groups API response).
+#
+# The pattern shown here: a `description` is composed once at the root from a
+# `reason` sub-label. Each subtree overrides only `reason`, computing it from
+# the labels that branch matched on. The shared description picks up the new
+# reason automatically, so the per-branch routes never restate the surrounding
+# wording.
+
+templates:
+  - '/etc/alertmanager/template/*.tmpl'
+
+route:
+  group_by: ['alertname']
+  receiver: default
+  # `description` is defined once and built from `reason`. Child routes only
+  # override `reason`; they inherit this description unchanged.
+  labels:
+    reason: '{{ .GroupLabels.alertname }}'
+    description: '{{ .GroupLabels.alertname }} firing ({{ routeLabels "reason" }})'
+  routes:
+    # Database alerts are grouped by the affected database, so the reason can be
+    # computed from that branch's grouping label.
+    - matchers:
+        - service="database"
+      receiver: dba
+      group_by: ['alertname', 'database']
+      labels:
+        reason: 'database {{ .GroupLabels.database }}'
+
+    # Network link alerts match on both endpoints; the reason names the link.
+    - matchers:
+        - link_a_device=~".+"
+        - link_z_device=~".+"
+      receiver: network
+      group_by: ['alertname', 'link_a_device', 'link_z_device']
+      labels:
+        reason: '{{ .GroupLabels.link_a_device }} <-> {{ .GroupLabels.link_z_device }}'
+
+receivers:
+  # The webhook payload includes the rendered route labels under "routeLabels".
+  - name: default
+    webhook_configs:
+      - url: 'http://127.0.0.1:5001/'
+  - name: dba
+    webhook_configs:
+      - url: 'http://127.0.0.1:5001/'
+  - name: network
+    webhook_configs:
+      - url: 'http://127.0.0.1:5001/'
+
+# A notification template just renders the shared description:
+#
+#   {{ define "route_labels.text" }}{{ routeLabels "description" }}{{ end }}
+#
+# For a generic alert this renders e.g. "HighLatency firing (HighLatency)";
+# for the database branch "DiskFull firing (database orders)"; for the link
+# branch "LinkDown firing (switch-a <-> switch-b)" -- only `reason` changed.

package/src/import/testdata/upstream/alertmanager-simple.yml

@@ -0,0 +1,130 @@
+# Vendored from github.com/prometheus/alertmanager v0.34.1, doc/examples/simple.yml
+# (https://github.com/prometheus/alertmanager/blob/v0.34.1/doc/examples/simple.yml). Apache-2.0.
+# Unchanged below this header.
+global:
+  # The smarthost and SMTP sender used for mail notifications.
+  smtp_smarthost: 'localhost:25'
+  smtp_from: 'alertmanager@example.org'
+  smtp_auth_username: 'alertmanager'
+  smtp_auth_password: 'password'
+
+# The directory from which notification templates are read.
+templates:
+  - '/etc/alertmanager/template/*.tmpl'
+
+# The root route on which each incoming alert enters.
+route:
+  # The labels by which incoming alerts are grouped together. For example,
+  # multiple alerts coming in for cluster=A and alertname=LatencyHigh would
+  # be batched into a single group.
+  #
+  # To aggregate by all possible labels use '...' as the sole label name.
+  # This effectively disables aggregation entirely, passing through all
+  # alerts as-is. This is unlikely to be what you want, unless you have
+  # a very low alert volume or your upstream notification system performs
+  # its own grouping. Example: group_by: [...]
+  group_by: ['alertname', 'cluster', 'service']
+
+  # When a new group of alerts is created by an incoming alert, wait at
+  # least 'group_wait' to send the initial notification.
+  # This way ensures that you get multiple alerts for the same group that start
+  # firing shortly after another are batched together on the first
+  # notification.
+  group_wait: 30s
+
+  # When the first notification was sent, wait 'group_interval' to send a batch
+  # of new alerts that started firing for that group.
+  group_interval: 5m
+
+  # If an alert has successfully been sent, wait 'repeat_interval' to
+  # resend them.
+  repeat_interval: 3h
+
+  # A default receiver
+  receiver: team-X-mails
+
+  # All the above attributes are inherited by all child routes and can
+  # overwritten on each.
+
+  # The child route trees.
+  routes:
+    # This routes performs a regular expression match on alert labels to
+    # catch alerts that are related to a list of services.
+    - matchers:
+        - service=~"foo1|foo2|baz"
+      receiver: team-X-mails
+      # The service has a sub-route for critical alerts, any alerts
+      # that do not match, i.e. severity != critical, fall-back to the
+      # parent node and are sent to 'team-X-mails'
+      routes:
+        - matchers:
+            - severity="critical"
+          receiver: team-X-pager
+    - matchers:
+        - service="files"
+      receiver: team-Y-mails
+
+      routes:
+        - matchers:
+            - severity="critical"
+          receiver: team-Y-pager
+
+    # This route handles all alerts coming from a database service. If there's
+    # no team to handle it, it defaults to the DB team.
+    - matchers:
+        - service="database"
+      receiver: team-DB-pager
+      # Also group alerts by affected database.
+      group_by: [alertname, cluster, database]
+      routes:
+        - matchers:
+            - owner="team-X"
+          receiver: team-X-pager
+          continue: true
+        - matchers:
+            - owner="team-Y"
+          receiver: team-Y-pager
+
+
+# Inhibition rules allow to mute a set of alerts given that another alert is
+# firing.
+# We use this to mute any warning-level notifications if the same alert is
+# already critical.
+inhibit_rules:
+  - source_matchers: [severity="critical"]
+    target_matchers: [severity="warning"]
+    # Apply inhibition if the alertname is the same.
+    # CAUTION:
+    #   If all label names listed in `equal` are missing
+    #   from both the source and target alerts,
+    #   the inhibition rule will apply!
+    equal: [alertname, cluster, service]
+
+
+receivers:
+  - name: 'team-X-mails'
+    email_configs:
+      - to: 'team-X+alerts@example.org'
+
+  - name: 'team-X-pager'
+    email_configs:
+      - to: 'team-X+alerts-critical@example.org'
+    pagerduty_configs:
+      - service_key: <team-X-key>
+
+  - name: 'team-Y-mails'
+    email_configs:
+      - to: 'team-Y+alerts@example.org'
+
+  - name: 'team-Y-pager'
+    pagerduty_configs:
+      - service_key: <team-Y-key>
+
+  - name: 'team-DB-pager'
+    pagerduty_configs:
+      - service_key: <team-DB-key>
+
+tracing:
+  endpoint: localhost:4317
+  insecure: true
+  sampling_fraction: 1.0

package/src/import/testdata/upstream/prometheus-alerting-rules.yml

@@ -0,0 +1,15 @@
+# From github.com/prometheus/prometheus v3.15.0, docs/configuration/alerting_rules.md,
+# "Defining alerting rules" (https://github.com/prometheus/prometheus/blob/v3.15.0/docs/configuration/alerting_rules.md). Apache-2.0.
+groups:
+- name: example
+  labels:
+    team: myteam
+  rules:
+  - alert: HighRequestLatency
+    expr: job:request_latency_seconds:mean5m{job="myjob"} > 0.5
+    for: 10m
+    keep_firing_for: 5m
+    labels:
+      severity: page
+    annotations:
+      summary: High request latency

package/src/import/testdata/upstream/prometheus-alerting-templates.yml

@@ -0,0 +1,23 @@
+# From github.com/prometheus/prometheus v3.15.0, docs/configuration/alerting_rules.md,
+# "Templating" example (https://github.com/prometheus/prometheus/blob/v3.15.0/docs/configuration/alerting_rules.md). Apache-2.0.
+groups:
+- name: example
+  rules:
+
+  # Alert for any instance that is unreachable for >5 minutes.
+  - alert: InstanceDown
+    expr: up == 0
+    for: 5m
+    labels:
+      severity: page
+    annotations:
+      summary: "Instance {{ $labels.instance }} down"
+      description: "{{ $labels.instance }} of job {{ $labels.job }} has been down for more than 5 minutes."
+
+  # Alert for any instance that has a median request latency >1s.
+  - alert: APIHighRequestLatency
+    expr: api_http_request_latencies_second{quantile="0.5"} > 1
+    for: 10m
+    annotations:
+      summary: "High request latency on {{ $labels.instance }}"
+      description: "{{ $labels.instance }} has a median request latency above 1s (current value: {{ $value }}s)"

package/src/import/testdata/upstream/prometheus-recording-rules.yml

@@ -0,0 +1,7 @@
+# From github.com/prometheus/prometheus v3.15.0, docs/configuration/recording_rules.md,
+# "A simple example rules file" (https://github.com/prometheus/prometheus/blob/v3.15.0/docs/configuration/recording_rules.md). Apache-2.0.
+groups:
+  - name: example
+    rules:
+    - record: code:prometheus_http_requests_total:sum
+      expr: sum by (code) (prometheus_http_requests_total)