M44: harden release integrity and assurance

deploy/observability/alertmanager.yml

@@ -0,0 +1,21 @@
+route:
+  receiver: fleetops-owner
+  group_by: [alertname, severity]
+  group_wait: 30s
+  group_interval: 5m
+  repeat_interval: 4h
+
+receivers:
+  - name: fleetops-owner
+    webhook_configs:
+      - url: __WEBHOOK_URL__
+        send_resolved: true
+        http_config:
+          http_headers:
+            X-Fleet-Ops-Trigger-Token:
+              secrets: [__WEBHOOK_TOKEN__]
+
+inhibit_rules:
+  - source_matchers: ['alertname="MobilityOpsApiDown"']
+    target_matchers: ['severity="warning"']
+    equal: [alertname]

deploy/observability/alerts.yml

@@ -1,6 +1,12 @@
 groups:
   - name: mobilityops
     rules:
+      - alert: FleetOpsWatchdog
+        expr: vector(1)
+        labels: {severity: none}
+        annotations:
+          summary: Fleet Ops alert delivery watchdog
+          description: This alert must always be visible at the configured receiver.
       - alert: MobilityOpsApiDown
         expr: up{job="mobilityops-api"} == 0
         for: 2m

deploy/observability/prometheus.yml

@@ -5,6 +5,11 @@ global:
 rule_files:
   - /etc/prometheus/alerts.yml
 
+alerting:
+  alertmanagers:
+    - static_configs:
+        - targets: ["alertmanager:9093"]
+
 scrape_configs:
   - job_name: mobilityops-api
     metrics_path: /metrics