Bonnes pratiques¶

# Mimir — configuration HA
ingester:
  ring:
    replication_factor: 3
    zone_awareness_enabled: true
    kvstore:
      store: etcd

# Loki Simple Scalable — 3 replicas par tier
write:
  replicas: 3
  persistence:
    size: 50Gi

read:
  replicas: 3

backend:
  replicas: 2

# Grafana HA avec base de donnees partagee
replicas: 2

database:
  type: postgres
  host: postgresql.observability:5432
  name: grafana
  user: grafana
  password: ${GRAFANA_DB_PASSWORD}

# Partage des sessions entre replicas
session:
  provider: redis
  provider_config: addr=redis.observability:6379

# Regle d'alerte Prometheus / Alertmanager
groups:
  - name: service-slo
    rules:
      - alert: HighErrorRate
        expr: |
          sum(rate(http_requests_total{status=~"5.."}[5m])) by (service)
          /
          sum(rate(http_requests_total[5m])) by (service)
          > 0.01
        for: 5m
        labels:
          severity: critical
          team: platform
        annotations:
          summary: "Taux d'erreur > 1% pour {{ $labels.service }}"
          description: "Le service {{ $labels.service }} a un taux d'erreur de {{ $value | humanizePercentage }} sur les 5 dernieres minutes."
          runbook_url: "https://wiki.internal/runbooks/high-error-rate"
          dashboard_url: "https://grafana.internal/d/service-overview?var-service={{ $labels.service }}"

# alertmanager.yml
route:
  group_by: ['alertname', 'service']
  group_wait: 30s
  group_interval: 5m
  repeat_interval: 4h
  receiver: default

  routes:
    # Alertes critiques → PagerDuty + Slack
    - match:
        severity: critical
      receiver: pagerduty-critical
      continue: true

    - match:
        severity: critical
      receiver: slack-critical

    # Alertes warning → Slack uniquement
    - match:
        severity: warning
      receiver: slack-warning

    # Alertes securite → equipe securite
    - match:
        team: security
      receiver: slack-security

receivers:
  - name: default
    slack_configs:
      - channel: '#alerts-default'

  - name: pagerduty-critical
    pagerduty_configs:
      - routing_key: ${PAGERDUTY_KEY}

  - name: slack-critical
    slack_configs:
      - channel: '#alerts-critical'
        send_resolved: true

  - name: slack-warning
    slack_configs:
      - channel: '#alerts-warning'
        send_resolved: true

  - name: slack-security
    slack_configs:
      - channel: '#security-alerts'
        send_resolved: true

# Prometheus — filtrer les metriques inutiles a la source
scrape_configs:
  - job_name: "keycloak"
    metric_relabel_configs:
      # Garder uniquement les metriques utiles
      - source_labels: [__name__]
        regex: "keycloak_(logins|login_errors|registrations|request_duration|active_sessions).*"
        action: keep
      # Supprimer les labels a haute cardinalite
      - regex: "instance"
        action: labeldrop