Sometimes you want to apply business logic to Alertmanager, enforcing authors, logic around silence times etc. According to upstream, this logic doesn't belong in Alertmanager itself - fair enough, but that leaves us wondering where to put it.
AlertManager bouncer is a reverse proxy which has the ability to intercept POSTs to the Alertmanager API, and accept, or reject them based on a set of policies.
usage: alertmanager_bouncer --backend.addr=BACKEND.ADDR --listen.addr=LISTEN.ADDR --config.bouncersfile=CONFIG.BOUNCERSFILE [<flags>]
A Business Logic Reverse Proxy for Alertmanager
Flags:
--help Show context-sensitive help (also try --help-long and --help-man).
--backend.addr=BACKEND.ADDR The URL of the backend to upstream to
--listen.addr=LISTEN.ADDR The URL for the reverse proxy to listen on
--config.bouncersfile=CONFIG.BOUNCERSFILE
The file containing the list of bouncers to create
--timeout.dial=30s The timeout of the initial connection to the backend
--timeout.tlshandshake=10s The timeout of the TLS handshake to the backend, after a connection is established
--timeout.responseheader=10s The timeout of the receive of the initial headers from the backend
--timeout.serverread=5s The timeout of the reverse proxy to read requests
--timeout.serverwrite=10s The timeout of the reverse proxy to write the response to the upstream client
--tls.certfile=TLS.CERTFILE The file path of the TLS cert file on disk, if you want to serve TLS
--tls.keyfile=TLS.KEYFILE The file path of the TLS key file on disk, if you want to serve TLS
To define the bouncers for your proxy, you need to define them in YAML in the file passed to config.bouncersfile. The format of this file is as follows:
# The bouncers for our proxy
bouncers:
# Bouncer which enforces that all silences have an author that ends with @cloudflare.com
- method: POST
uriRegex: /api/v[12]/silences # Handles both the v1 and v2 API
deciders:
- name: AllSilencesHaveAuthor
config:
domain: "@cloudflare.com"
dryrun: false # DryRun = True forces this decider to just log failures, rather than blocking
# Bouncer which mirrors both silences and alerts to another alertmanager (Maybe for testing)
- method: POST
uriRegex: /api/v[12]/(:?silences|alerts)
deciders:
- name: Mirror
config:
destination: "http://alertmanager-2:9091"Apache License 2.0, see LICENSE.