Kubernetes Prometheus Alert Rules

groups:
- name: KubestateExporter
  rules:
    - alert: KubernetesStatefulSetDown
      expr: kube_statefulset_replicas > 0 and kube_statefulset_replicas != kube_statefulset_status_replicas_ready and changes(kube_statefulset_status_replicas_updated[10m]) == 0
      for: 3m
      labels:
        severity: critical
      annotations:
        summary: Kubernetes StatefulSet down (instance {{ $labels.instance }})
        description: "StatefulSet {{ $labels.namespace }}/{{ $labels.statefulset }} went down\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesContainerOomKiller
      expr: (kube_pod_container_status_restarts_total - kube_pod_container_status_restarts_total offset 10m >= 1) and ignoring (reason) min_over_time(kube_pod_container_status_last_terminated_reason{reason="OOMKilled"}[10m]) == 1
      for: 0m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes Container oom killer (instance {{ $labels.instance }})
        description: "Container {{ $labels.container }} in pod {{ $labels.namespace }}/{{ $labels.pod }} has been OOMKilled {{ $value }} times in the last 10 minutes.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
      # Threshold should be customized for each cronjob name.
    - alert: KubernetesCronJobTooLong
      expr: kube_job_status_start_time > 0 and absent(kube_job_status_completion_time) and (time() - kube_job_status_start_time) > 3600
      for: 0m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes CronJob too long (instance {{ $labels.instance }})
        description: "CronJob {{ $labels.namespace }}/{{ $labels.cronjob }} is taking more than 1h to complete.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesNodeMemoryPressure
      expr: kube_node_status_condition{condition="MemoryPressure",status="true"} == 1
      for: 2m
      labels:
        severity: critical
      annotations:
        summary: Kubernetes Node memory pressure (instance {{ $labels.instance }})
        description: "Node {{ $labels.node }} has MemoryPressure condition\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesNodeDiskPressure
      expr: kube_node_status_condition{condition="DiskPressure",status="true"} == 1
      for: 2m
      labels:
        severity: critical
      annotations:
        summary: Kubernetes Node disk pressure (instance {{ $labels.instance }})
        description: "Node {{ $labels.node }} has DiskPressure condition\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesVolumeOutOfDiskSpace
      expr: kubelet_volume_stats_available_bytes / kubelet_volume_stats_capacity_bytes * 100 < 10 and kubelet_volume_stats_capacity_bytes > 0
      for: 2m
      labels:
        severity: critical
      annotations:
        summary: Kubernetes Volume out of disk space (instance {{ $labels.instance }})
        description: "Volume is almost full (< 10% left)\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesVolumeInodesFullInFourDays
      expr: predict_linear(kubelet_volume_stats_inodes_free[6h:5m], 4 * 24 * 3600) < 0
      for: 0m
      labels:
        severity: critical
      annotations:
        summary: Kubernetes Volume inodes full in four days (instance {{ $labels.instance }})
        description: "PersistentVolume claimed by {{ $labels.namespace }}/{{ $labels.persistentvolumeclaim }} is expected to run out of free inodes within four days at the current rate.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesVolumeOutOfInodes
      expr: kubelet_volume_stats_inodes_free / kubelet_volume_stats_inodes < 0.03 and kubelet_volume_stats_inodes > 0
      for: 2m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes Volume out of inodes (instance {{ $labels.instance }})
        description: "PersistentVolume claimed by {{ $labels.namespace }}/{{ $labels.persistentvolumeclaim }} has less than 3% of its inodes free. A volume can run out of inodes (too many small files) even while free bytes remain available.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesNodeNetworkUnavailable
      expr: kube_node_status_condition{condition="NetworkUnavailable",status="true"} == 1
      for: 2m
      labels:
        severity: critical
      annotations:
        summary: Kubernetes Node network unavailable (instance {{ $labels.instance }})
        description: "Node {{ $labels.node }} has NetworkUnavailable condition\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesNodeNotReady
      expr: kube_node_status_condition{condition="Ready",status="true"} == 0
      for: 10m
      labels:
        severity: critical
      annotations:
        summary: Kubernetes Node not ready (instance {{ $labels.instance }})
        description: "Node {{ $labels.node }} has been unready for a long time\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesCronJobFailing
      expr: (kube_cronjob_status_last_schedule_time > kube_cronjob_status_last_successful_time) AND (kube_cronjob_status_active == 0) AND (kube_cronjob_spec_suspend == 0)
      for: 0m
      labels:
        severity: critical
      annotations:
        summary: Kubernetes CronJob failing (instance {{ $labels.instance }})
        description: "CronJob {{ $labels.namespace }}/{{ $labels.cronjob }} is failing\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesPersistentVolumeError
      expr: kube_persistentvolume_status_phase{phase=~"Failed|Pending"} > 0
      for: 0m
      labels:
        severity: critical
      annotations:
        summary: Kubernetes PersistentVolume error (instance {{ $labels.instance }})
        description: "Persistent volume {{ $labels.persistentvolume }} is in bad state\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesPodNotHealthy
      expr: sum by (namespace, pod) (kube_pod_status_phase{phase=~"Pending|Unknown|Failed"}) > 0
      for: 15m
      labels:
        severity: critical
      annotations:
        summary: Kubernetes Pod not healthy (instance {{ $labels.instance }})
        description: "Pod {{ $labels.namespace }}/{{ $labels.pod }} has been in a non-running state for longer than 15 minutes.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesDeploymentGenerationMismatch
      expr: kube_deployment_status_observed_generation != kube_deployment_metadata_generation
      for: 10m
      labels:
        severity: critical
      annotations:
        summary: Kubernetes Deployment generation mismatch (instance {{ $labels.instance }})
        description: "Deployment {{ $labels.namespace }}/{{ $labels.deployment }} has failed but has not been rolled back.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesStatefulSetGenerationMismatch
      expr: kube_statefulset_status_observed_generation != kube_statefulset_metadata_generation
      for: 10m
      labels:
        severity: critical
      annotations:
        summary: Kubernetes StatefulSet generation mismatch (instance {{ $labels.instance }})
        description: "StatefulSet {{ $labels.namespace }}/{{ $labels.statefulset }} has failed but has not been rolled back.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesJobSlowCompletion
      expr: kube_job_spec_completions - kube_job_status_succeeded - kube_job_status_failed > 0
      for: 12h
      labels:
        severity: critical
      annotations:
        summary: Kubernetes Job slow completion (instance {{ $labels.instance }})
        description: "Kubernetes Job {{ $labels.namespace }}/{{ $labels.job_name }} did not complete in time.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
      # Replace job="apiserver" with the actual job name in your Prometheus configuration (kube-prometheus-stack uses "apiserver" by default). The 3% error rate threshold is a rough default; adjust based on your workload.
    - alert: KubernetesAPIServerErrors
      expr: sum(rate(apiserver_request_total{job="apiserver",code=~"(?:5..)"}[1m])) by (instance, job) / sum(rate(apiserver_request_total{job="apiserver"}[1m])) by (instance, job) * 100 > 3 and sum(rate(apiserver_request_total{job="apiserver"}[1m])) by (instance, job) > 0
      for: 2m
      labels:
        severity: critical
      annotations:
        summary: Kubernetes API server errors (instance {{ $labels.instance }})
        description: "Kubernetes API server is experiencing {{ $value | humanize }}% error rate\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
      # Includes 4xx errors alongside 5xx. Some clients use GET requests to check object
      # existence, and a 404 is expected in that case, not a real error. Narrow the regex to
      # "5.." if 4xx responses cause noise.
    - alert: KubernetesAPIClientErrors
      expr: (sum(rate(rest_client_requests_total{code=~"(4|5).."}[1m])) by (instance, job) / sum(rate(rest_client_requests_total[1m])) by (instance, job)) * 100 > 1 and sum(rate(rest_client_requests_total[1m])) by (instance, job) > 0
      for: 2m
      labels:
        severity: critical
      annotations:
        summary: Kubernetes API client errors (instance {{ $labels.instance }})
        description: "Kubernetes API client is experiencing {{ $value | humanize }}% error rate\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesKube-state-metricsList/watchErrors
      expr: (rate(kube_state_metrics_list_total{result="error"}[5m]) / rate(kube_state_metrics_list_total[5m]) > 0.01 and rate(kube_state_metrics_list_total[5m]) > 0) or (rate(kube_state_metrics_watch_total{result="error"}[5m]) / rate(kube_state_metrics_watch_total[5m]) > 0.01 and rate(kube_state_metrics_watch_total[5m]) > 0)
      for: 5m
      labels:
        severity: critical
      annotations:
        summary: Kubernetes kube-state-metrics list/watch errors (instance {{ $labels.instance }})
        description: "kube-state-metrics is failing to list or watch objects from the Kubernetes API server, which means every other kube-state-metrics-based alert may silently stop firing because its data has gone stale or missing.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
      # 20% termination-rate threshold is a rough default; depends on your client request volume relative to API server flow-control settings (--max-requests-inflight) — adjust based on your baseline.
    - alert: KubernetesAPIServerTerminatingRequests
      expr: sum(rate(apiserver_request_terminations_total[10m])) / (sum(rate(apiserver_request_total[10m])) + sum(rate(apiserver_request_terminations_total[10m]))) > 0.20
      for: 2m
      labels:
        severity: critical
      annotations:
        summary: Kubernetes API server terminating requests (instance {{ $labels.instance }})
        description: "The Kubernetes API server is terminating {{ $value | humanizePercentage }} of incoming requests, indicating it is shedding load under overload (e.g. via priority and fairness flow control) rather than just returning error responses.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
      # Kubernetes Node with disabled schedules are fine.
      # This alarm can be useful to get warned if there are nodes which are longer unscheduled.
    - alert: KubernetesNodeSchedulingDisabled
      expr: kube_node_spec_taint{key="node.kubernetes.io/unschedulable"} == 1
      for: 30m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes Node scheduling disabled (instance {{ $labels.instance }})
        description: "Node {{ $labels.node }} has been marked as unschedulable for more than 30 minutes.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesNodeOutOfPodCapacity
      expr: sum by (node) ((kube_pod_status_phase{phase="Running"} == 1) + on(uid, instance) group_left(node) (0 * kube_pod_info{pod_template_hash=""})) / sum by (node) (kube_node_status_allocatable{resource="pods"}) * 100 > 90
      for: 2m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes Node out of pod capacity (instance {{ $labels.instance }})
        description: "Node {{ $labels.node }} is out of pod capacity\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesJobFailed
      expr: kube_job_status_failed > 0
      for: 0m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes Job failed (instance {{ $labels.instance }})
        description: "Job {{ $labels.namespace }}/{{ $labels.job_name }} failed to complete\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesJobNotStarting
      expr: kube_job_status_active == 0 and kube_job_status_failed == 0 and kube_job_status_succeeded == 0 and (time() - kube_job_status_start_time) > 600
      for: 0m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes Job not starting (instance {{ $labels.instance }})
        description: "Job {{ $labels.namespace }}/{{ $labels.job_name }} did not start for 10 minutes\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesCronJobSuspended
      expr: kube_cronjob_spec_suspend != 0
      for: 0m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes CronJob suspended (instance {{ $labels.instance }})
        description: "CronJob {{ $labels.namespace }}/{{ $labels.cronjob }} is suspended\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesPersistentVolumeClaimPending
      expr: kube_persistentvolumeclaim_status_phase{phase="Pending"} == 1
      for: 2m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes PersistentVolumeClaim pending (instance {{ $labels.instance }})
        description: "PersistentVolumeClaim {{ $labels.namespace }}/{{ $labels.persistentvolumeclaim }} is pending\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesVolumeFullInFourDays
      expr: predict_linear(kubelet_volume_stats_available_bytes[6h:5m], 4 * 24 * 3600) < 0
      for: 0m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes Volume full in four days (instance {{ $labels.instance }})
        description: "Volume under {{ $labels.namespace }}/{{ $labels.persistentvolumeclaim }} is expected to fill up within four days. Currently {{ $value | humanize }}% is available.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesHPAScaleInability
      expr: (kube_horizontalpodautoscaler_spec_max_replicas - kube_horizontalpodautoscaler_status_desired_replicas) * on (horizontalpodautoscaler,namespace) (kube_horizontalpodautoscaler_status_condition{condition="ScalingLimited", status="true"} == 1) == 0
      for: 2m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes HPA scale inability (instance {{ $labels.instance }})
        description: "HPA {{ $labels.namespace }}/{{ $labels.horizontalpodautoscaler }} is unable to scale\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesHPAMetricsUnavailability
      expr: kube_horizontalpodautoscaler_status_condition{status="false", condition="ScalingActive"} == 1
      for: 0m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes HPA metrics unavailability (instance {{ $labels.instance }})
        description: "HPA {{ $labels.namespace }}/{{ $labels.horizontalpodautoscaler }} is unable to collect metrics\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesPodCrashLooping
      expr: max_over_time(kube_pod_container_status_waiting_reason{reason="CrashLoopBackOff"}[5m]) >= 1
      for: 2m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes pod crash looping (instance {{ $labels.instance }})
        description: "Pod {{ $labels.namespace }}/{{ $labels.pod }} is crash looping\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesReplicaSetReplicasMismatch
      expr: kube_replicaset_spec_replicas != kube_replicaset_status_ready_replicas
      for: 10m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes ReplicaSet replicas mismatch (instance {{ $labels.instance }})
        description: "ReplicaSet {{ $labels.namespace }}/{{ $labels.replicaset }} replicas mismatch\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesDeploymentReplicasMismatch
      expr: kube_deployment_spec_replicas != kube_deployment_status_replicas_available
      for: 10m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes Deployment replicas mismatch (instance {{ $labels.instance }})
        description: "Deployment {{ $labels.namespace }}/{{ $labels.deployment }} replicas mismatch\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesStatefulSetReplicasMismatch
      expr: kube_statefulset_status_replicas_ready != kube_statefulset_status_replicas
      for: 10m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes StatefulSet replicas mismatch (instance {{ $labels.instance }})
        description: "StatefulSet does not match the expected number of replicas.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesStatefulSetUpdateNotRolledOut
      expr: max without (revision) (kube_statefulset_status_current_revision unless kube_statefulset_status_update_revision) * (kube_statefulset_replicas != kube_statefulset_status_replicas_updated)
      for: 10m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes StatefulSet update not rolled out (instance {{ $labels.instance }})
        description: "StatefulSet {{ $labels.namespace }}/{{ $labels.statefulset }} update has not been rolled out.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
      # The trailing "changes(...updated_number_scheduled[5m]) == 0" guard excludes an active,
      # legitimate rollout in progress: without it, a healthy DaemonSet update rolling out
      # pod-by-pod would trigger this alert on every intermediate step.
    - alert: KubernetesDaemonSetRolloutStuck
      expr: ((kube_daemonset_status_number_ready / kube_daemonset_status_desired_number_scheduled * 100 < 100 and kube_daemonset_status_desired_number_scheduled > 0) or kube_daemonset_status_desired_number_scheduled - kube_daemonset_status_current_number_scheduled > 0) and changes(kube_daemonset_status_updated_number_scheduled[5m]) == 0
      for: 10m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes DaemonSet rollout stuck (instance {{ $labels.instance }})
        description: "Some Pods of DaemonSet {{ $labels.namespace }}/{{ $labels.daemonset }} are not scheduled or not ready\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesDaemonSetMisscheduled
      expr: kube_daemonset_status_number_misscheduled > 0
      for: 1m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes DaemonSet misscheduled (instance {{ $labels.instance }})
        description: "Some Pods of DaemonSet {{ $labels.namespace }}/{{ $labels.daemonset }} are running where they are not supposed to run\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
      # 1s threshold is a rough default; acceptable latency depends on your cluster size and API request volume — adjust based on your baseline.
    - alert: KubernetesAPIServerLatency
      expr: histogram_quantile(0.99, sum(rate(apiserver_request_duration_seconds_bucket{verb!~"(?:CONNECT|WATCHLIST|WATCH|PROXY)"} [10m])) WITHOUT (subresource)) > 1
      for: 2m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes API server latency (instance {{ $labels.instance }})
        description: "Kubernetes API server has a 99th percentile latency of {{ $value }} seconds for {{ $labels.verb }} {{ $labels.resource }}.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesContainerWaiting
      expr: kube_pod_container_status_waiting_reason{reason!="CrashLoopBackOff"} > 0
      for: 1h
      labels:
        severity: warning
      annotations:
        summary: Kubernetes Container waiting (instance {{ $labels.instance }})
        description: "Container {{ $labels.container }} in pod {{ $labels.namespace }}/{{ $labels.pod }} has been in waiting state for longer than 1 hour, for a reason other than CrashLoopBackOff (e.g. ImagePullBackOff, CreateContainerConfigError, InvalidImageName).\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesDeploymentRolloutStuck
      expr: kube_deployment_status_condition{condition="Progressing",status="false"} != 0
      for: 10m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes Deployment rollout stuck (instance {{ $labels.instance }})
        description: "Deployment {{ $labels.namespace }}/{{ $labels.deployment }} rollout is not progressing, as reported by its Progressing=false condition.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesPodDisruptionBudgetNotEnoughHealthyPods
      expr: kube_poddisruptionbudget_status_desired_healthy - kube_poddisruptionbudget_status_current_healthy > 0
      for: 10m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes PodDisruptionBudget not enough healthy pods (instance {{ $labels.instance }})
        description: "PodDisruptionBudget {{ $labels.namespace }}/{{ $labels.poddisruptionbudget }} does not have the desired number of healthy pods, so voluntary disruptions such as node drains or cluster upgrades may be blocked or the application may be under-provisioned during maintenance.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesVersionMismatch
      expr: count(count by (git_version) (label_replace(kubernetes_build_info, "git_version", "$1", "git_version", "(v[0-9]*\.[0-9]*\.[0-9]*).*"))) > 1
      for: 10m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes version mismatch (instance {{ $labels.instance }})
        description: "There are {{ $value }} different semantic versions of Kubernetes components running simultaneously, which may indicate a partial or stalled cluster upgrade.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesHPAScaleMaximum
      expr: (kube_horizontalpodautoscaler_status_desired_replicas >= kube_horizontalpodautoscaler_spec_max_replicas) and (kube_horizontalpodautoscaler_spec_max_replicas > 1) and (kube_horizontalpodautoscaler_spec_min_replicas != kube_horizontalpodautoscaler_spec_max_replicas)
      for: 2m
      labels:
        severity: info
      annotations:
        summary: Kubernetes HPA scale maximum (instance {{ $labels.instance }})
        description: "HPA {{ $labels.namespace }}/{{ $labels.horizontalpodautoscaler }} has hit maximum number of desired pods\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
      # The 50% time-at-minimum and 3-replica floor are rough defaults; some workloads are intentionally always at minimum — adjust based on your deployment's expected scaling behavior.
    - alert: KubernetesHPAUnderutilized
      expr: max(quantile_over_time(0.5, kube_horizontalpodautoscaler_status_desired_replicas[1d]) == kube_horizontalpodautoscaler_spec_min_replicas) by (horizontalpodautoscaler) > 3
      for: 0m
      labels:
        severity: info
      annotations:
        summary: Kubernetes HPA underutilized (instance {{ $labels.instance }})
        description: "HPA {{ $labels.namespace }}/{{ $labels.horizontalpodautoscaler }} is constantly at minimum replicas for 50% of the time. Potential cost saving here.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
    - alert: KubernetesResourceQuotaExceeded
      expr: kube_resourcequota{type="used"} / ignoring(type) (kube_resourcequota{type="hard"} > 0) > 1
      for: 10m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes ResourceQuota exceeded (instance {{ $labels.instance }})
        description: "Namespace {{ $labels.namespace }} is using more of its {{ $labels.resource }} ResourceQuota than the configured hard limit ({{ $value | humanizePercentage }} of quota), indicating a misconfiguration or inconsistency between actual usage and the enforced quota.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
      # Replace job="apiserver" with the actual job name in your Prometheus configuration (kube-prometheus-stack uses "apiserver" by default).
    - alert: KubernetesClientCertificateExpiresSoon
      expr: apiserver_client_certificate_expiration_seconds_count{job="apiserver"} > 0 and histogram_quantile(0.01, sum by (job, le) (rate(apiserver_client_certificate_expiration_seconds_bucket{job="apiserver"}[5m]))) < 24*60*60
      for: 0m
      labels:
        severity: critical
      annotations:
        summary: Kubernetes client certificate expires soon (instance {{ $labels.instance }})
        description: "A client certificate used to authenticate to the apiserver is expiring in less than 24.0 hours.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"
    
      # Replace job="apiserver" with the actual job name in your Prometheus configuration (kube-prometheus-stack uses "apiserver" by default).
    - alert: KubernetesClientCertificateExpiresNextWeek
      expr: apiserver_client_certificate_expiration_seconds_count{job="apiserver"} > 0 and histogram_quantile(0.01, sum by (job, le) (rate(apiserver_client_certificate_expiration_seconds_bucket{job="apiserver"}[5m]))) < 7*24*60*60
      for: 0m
      labels:
        severity: warning
      annotations:
        summary: Kubernetes client certificate expires next week (instance {{ $labels.instance }})
        description: "A client certificate used to authenticate to the apiserver is expiring next week.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

wget https://raw.githubusercontent.com/samber/awesome-prometheus-alerts/refs/heads/master/dist/rules/kubernetes/kubestate-exporter.yml

- alert: KubernetesStatefulSetDown
  expr: kube_statefulset_replicas > 0 and kube_statefulset_replicas != kube_statefulset_status_replicas_ready and changes(kube_statefulset_status_replicas_updated[10m]) == 0
  for: 3m
  labels:
    severity: critical
  annotations:
    summary: Kubernetes StatefulSet down (instance {{ $labels.instance }})
    description: "StatefulSet {{ $labels.namespace }}/{{ $labels.statefulset }} went down\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesContainerOomKiller
  expr: (kube_pod_container_status_restarts_total - kube_pod_container_status_restarts_total offset 10m >= 1) and ignoring (reason) min_over_time(kube_pod_container_status_last_terminated_reason{reason="OOMKilled"}[10m]) == 1
  for: 0m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes Container oom killer (instance {{ $labels.instance }})
    description: "Container {{ $labels.container }} in pod {{ $labels.namespace }}/{{ $labels.pod }} has been OOMKilled {{ $value }} times in the last 10 minutes.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

  # Threshold should be customized for each cronjob name.
- alert: KubernetesCronJobTooLong
  expr: kube_job_status_start_time > 0 and absent(kube_job_status_completion_time) and (time() - kube_job_status_start_time) > 3600
  for: 0m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes CronJob too long (instance {{ $labels.instance }})
    description: "CronJob {{ $labels.namespace }}/{{ $labels.cronjob }} is taking more than 1h to complete.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesNodeMemoryPressure
  expr: kube_node_status_condition{condition="MemoryPressure",status="true"} == 1
  for: 2m
  labels:
    severity: critical
  annotations:
    summary: Kubernetes Node memory pressure (instance {{ $labels.instance }})
    description: "Node {{ $labels.node }} has MemoryPressure condition\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesNodeDiskPressure
  expr: kube_node_status_condition{condition="DiskPressure",status="true"} == 1
  for: 2m
  labels:
    severity: critical
  annotations:
    summary: Kubernetes Node disk pressure (instance {{ $labels.instance }})
    description: "Node {{ $labels.node }} has DiskPressure condition\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesVolumeOutOfDiskSpace
  expr: kubelet_volume_stats_available_bytes / kubelet_volume_stats_capacity_bytes * 100 < 10 and kubelet_volume_stats_capacity_bytes > 0
  for: 2m
  labels:
    severity: critical
  annotations:
    summary: Kubernetes Volume out of disk space (instance {{ $labels.instance }})
    description: "Volume is almost full (< 10% left)\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesVolumeInodesFullInFourDays
  expr: predict_linear(kubelet_volume_stats_inodes_free[6h:5m], 4 * 24 * 3600) < 0
  for: 0m
  labels:
    severity: critical
  annotations:
    summary: Kubernetes Volume inodes full in four days (instance {{ $labels.instance }})
    description: "PersistentVolume claimed by {{ $labels.namespace }}/{{ $labels.persistentvolumeclaim }} is expected to run out of free inodes within four days at the current rate.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesVolumeOutOfInodes
  expr: kubelet_volume_stats_inodes_free / kubelet_volume_stats_inodes < 0.03 and kubelet_volume_stats_inodes > 0
  for: 2m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes Volume out of inodes (instance {{ $labels.instance }})
    description: "PersistentVolume claimed by {{ $labels.namespace }}/{{ $labels.persistentvolumeclaim }} has less than 3% of its inodes free. A volume can run out of inodes (too many small files) even while free bytes remain available.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesNodeNetworkUnavailable
  expr: kube_node_status_condition{condition="NetworkUnavailable",status="true"} == 1
  for: 2m
  labels:
    severity: critical
  annotations:
    summary: Kubernetes Node network unavailable (instance {{ $labels.instance }})
    description: "Node {{ $labels.node }} has NetworkUnavailable condition\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesNodeNotReady
  expr: kube_node_status_condition{condition="Ready",status="true"} == 0
  for: 10m
  labels:
    severity: critical
  annotations:
    summary: Kubernetes Node not ready (instance {{ $labels.instance }})
    description: "Node {{ $labels.node }} has been unready for a long time\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesCronJobFailing
  expr: (kube_cronjob_status_last_schedule_time > kube_cronjob_status_last_successful_time) AND (kube_cronjob_status_active == 0) AND (kube_cronjob_spec_suspend == 0)
  for: 0m
  labels:
    severity: critical
  annotations:
    summary: Kubernetes CronJob failing (instance {{ $labels.instance }})
    description: "CronJob {{ $labels.namespace }}/{{ $labels.cronjob }} is failing\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesPersistentVolumeError
  expr: kube_persistentvolume_status_phase{phase=~"Failed|Pending"} > 0
  for: 0m
  labels:
    severity: critical
  annotations:
    summary: Kubernetes PersistentVolume error (instance {{ $labels.instance }})
    description: "Persistent volume {{ $labels.persistentvolume }} is in bad state\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesPodNotHealthy
  expr: sum by (namespace, pod) (kube_pod_status_phase{phase=~"Pending|Unknown|Failed"}) > 0
  for: 15m
  labels:
    severity: critical
  annotations:
    summary: Kubernetes Pod not healthy (instance {{ $labels.instance }})
    description: "Pod {{ $labels.namespace }}/{{ $labels.pod }} has been in a non-running state for longer than 15 minutes.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesDeploymentGenerationMismatch
  expr: kube_deployment_status_observed_generation != kube_deployment_metadata_generation
  for: 10m
  labels:
    severity: critical
  annotations:
    summary: Kubernetes Deployment generation mismatch (instance {{ $labels.instance }})
    description: "Deployment {{ $labels.namespace }}/{{ $labels.deployment }} has failed but has not been rolled back.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesStatefulSetGenerationMismatch
  expr: kube_statefulset_status_observed_generation != kube_statefulset_metadata_generation
  for: 10m
  labels:
    severity: critical
  annotations:
    summary: Kubernetes StatefulSet generation mismatch (instance {{ $labels.instance }})
    description: "StatefulSet {{ $labels.namespace }}/{{ $labels.statefulset }} has failed but has not been rolled back.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesJobSlowCompletion
  expr: kube_job_spec_completions - kube_job_status_succeeded - kube_job_status_failed > 0
  for: 12h
  labels:
    severity: critical
  annotations:
    summary: Kubernetes Job slow completion (instance {{ $labels.instance }})
    description: "Kubernetes Job {{ $labels.namespace }}/{{ $labels.job_name }} did not complete in time.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

  # Replace job="apiserver" with the actual job name in your Prometheus configuration (kube-prometheus-stack uses "apiserver" by default). The 3% error rate threshold is a rough default; adjust based on your workload.
- alert: KubernetesAPIServerErrors
  expr: sum(rate(apiserver_request_total{job="apiserver",code=~"(?:5..)"}[1m])) by (instance, job) / sum(rate(apiserver_request_total{job="apiserver"}[1m])) by (instance, job) * 100 > 3 and sum(rate(apiserver_request_total{job="apiserver"}[1m])) by (instance, job) > 0
  for: 2m
  labels:
    severity: critical
  annotations:
    summary: Kubernetes API server errors (instance {{ $labels.instance }})
    description: "Kubernetes API server is experiencing {{ $value | humanize }}% error rate\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

  # Includes 4xx errors alongside 5xx. Some clients use GET requests to check object
  # existence, and a 404 is expected in that case, not a real error. Narrow the regex to
  # "5.." if 4xx responses cause noise.
- alert: KubernetesAPIClientErrors
  expr: (sum(rate(rest_client_requests_total{code=~"(4|5).."}[1m])) by (instance, job) / sum(rate(rest_client_requests_total[1m])) by (instance, job)) * 100 > 1 and sum(rate(rest_client_requests_total[1m])) by (instance, job) > 0
  for: 2m
  labels:
    severity: critical
  annotations:
    summary: Kubernetes API client errors (instance {{ $labels.instance }})
    description: "Kubernetes API client is experiencing {{ $value | humanize }}% error rate\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesKube-state-metricsList/watchErrors
  expr: (rate(kube_state_metrics_list_total{result="error"}[5m]) / rate(kube_state_metrics_list_total[5m]) > 0.01 and rate(kube_state_metrics_list_total[5m]) > 0) or (rate(kube_state_metrics_watch_total{result="error"}[5m]) / rate(kube_state_metrics_watch_total[5m]) > 0.01 and rate(kube_state_metrics_watch_total[5m]) > 0)
  for: 5m
  labels:
    severity: critical
  annotations:
    summary: Kubernetes kube-state-metrics list/watch errors (instance {{ $labels.instance }})
    description: "kube-state-metrics is failing to list or watch objects from the Kubernetes API server, which means every other kube-state-metrics-based alert may silently stop firing because its data has gone stale or missing.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

  # 20% termination-rate threshold is a rough default; depends on your client request volume relative to API server flow-control settings (--max-requests-inflight) — adjust based on your baseline.
- alert: KubernetesAPIServerTerminatingRequests
  expr: sum(rate(apiserver_request_terminations_total[10m])) / (sum(rate(apiserver_request_total[10m])) + sum(rate(apiserver_request_terminations_total[10m]))) > 0.20
  for: 2m
  labels:
    severity: critical
  annotations:
    summary: Kubernetes API server terminating requests (instance {{ $labels.instance }})
    description: "The Kubernetes API server is terminating {{ $value | humanizePercentage }} of incoming requests, indicating it is shedding load under overload (e.g. via priority and fairness flow control) rather than just returning error responses.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

  # Kubernetes Node with disabled schedules are fine.
  # This alarm can be useful to get warned if there are nodes which are longer unscheduled.
- alert: KubernetesNodeSchedulingDisabled
  expr: kube_node_spec_taint{key="node.kubernetes.io/unschedulable"} == 1
  for: 30m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes Node scheduling disabled (instance {{ $labels.instance }})
    description: "Node {{ $labels.node }} has been marked as unschedulable for more than 30 minutes.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesNodeOutOfPodCapacity
  expr: sum by (node) ((kube_pod_status_phase{phase="Running"} == 1) + on(uid, instance) group_left(node) (0 * kube_pod_info{pod_template_hash=""})) / sum by (node) (kube_node_status_allocatable{resource="pods"}) * 100 > 90
  for: 2m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes Node out of pod capacity (instance {{ $labels.instance }})
    description: "Node {{ $labels.node }} is out of pod capacity\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesJobFailed
  expr: kube_job_status_failed > 0
  for: 0m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes Job failed (instance {{ $labels.instance }})
    description: "Job {{ $labels.namespace }}/{{ $labels.job_name }} failed to complete\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesJobNotStarting
  expr: kube_job_status_active == 0 and kube_job_status_failed == 0 and kube_job_status_succeeded == 0 and (time() - kube_job_status_start_time) > 600
  for: 0m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes Job not starting (instance {{ $labels.instance }})
    description: "Job {{ $labels.namespace }}/{{ $labels.job_name }} did not start for 10 minutes\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesCronJobSuspended
  expr: kube_cronjob_spec_suspend != 0
  for: 0m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes CronJob suspended (instance {{ $labels.instance }})
    description: "CronJob {{ $labels.namespace }}/{{ $labels.cronjob }} is suspended\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesPersistentVolumeClaimPending
  expr: kube_persistentvolumeclaim_status_phase{phase="Pending"} == 1
  for: 2m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes PersistentVolumeClaim pending (instance {{ $labels.instance }})
    description: "PersistentVolumeClaim {{ $labels.namespace }}/{{ $labels.persistentvolumeclaim }} is pending\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesVolumeFullInFourDays
  expr: predict_linear(kubelet_volume_stats_available_bytes[6h:5m], 4 * 24 * 3600) < 0
  for: 0m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes Volume full in four days (instance {{ $labels.instance }})
    description: "Volume under {{ $labels.namespace }}/{{ $labels.persistentvolumeclaim }} is expected to fill up within four days. Currently {{ $value | humanize }}% is available.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesHPAScaleInability
  expr: (kube_horizontalpodautoscaler_spec_max_replicas - kube_horizontalpodautoscaler_status_desired_replicas) * on (horizontalpodautoscaler,namespace) (kube_horizontalpodautoscaler_status_condition{condition="ScalingLimited", status="true"} == 1) == 0
  for: 2m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes HPA scale inability (instance {{ $labels.instance }})
    description: "HPA {{ $labels.namespace }}/{{ $labels.horizontalpodautoscaler }} is unable to scale\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesHPAMetricsUnavailability
  expr: kube_horizontalpodautoscaler_status_condition{status="false", condition="ScalingActive"} == 1
  for: 0m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes HPA metrics unavailability (instance {{ $labels.instance }})
    description: "HPA {{ $labels.namespace }}/{{ $labels.horizontalpodautoscaler }} is unable to collect metrics\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesPodCrashLooping
  expr: max_over_time(kube_pod_container_status_waiting_reason{reason="CrashLoopBackOff"}[5m]) >= 1
  for: 2m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes pod crash looping (instance {{ $labels.instance }})
    description: "Pod {{ $labels.namespace }}/{{ $labels.pod }} is crash looping\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesReplicaSetReplicasMismatch
  expr: kube_replicaset_spec_replicas != kube_replicaset_status_ready_replicas
  for: 10m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes ReplicaSet replicas mismatch (instance {{ $labels.instance }})
    description: "ReplicaSet {{ $labels.namespace }}/{{ $labels.replicaset }} replicas mismatch\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesDeploymentReplicasMismatch
  expr: kube_deployment_spec_replicas != kube_deployment_status_replicas_available
  for: 10m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes Deployment replicas mismatch (instance {{ $labels.instance }})
    description: "Deployment {{ $labels.namespace }}/{{ $labels.deployment }} replicas mismatch\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesStatefulSetReplicasMismatch
  expr: kube_statefulset_status_replicas_ready != kube_statefulset_status_replicas
  for: 10m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes StatefulSet replicas mismatch (instance {{ $labels.instance }})
    description: "StatefulSet does not match the expected number of replicas.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesStatefulSetUpdateNotRolledOut
  expr: max without (revision) (kube_statefulset_status_current_revision unless kube_statefulset_status_update_revision) * (kube_statefulset_replicas != kube_statefulset_status_replicas_updated)
  for: 10m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes StatefulSet update not rolled out (instance {{ $labels.instance }})
    description: "StatefulSet {{ $labels.namespace }}/{{ $labels.statefulset }} update has not been rolled out.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

  # The trailing "changes(...updated_number_scheduled[5m]) == 0" guard excludes an active,
  # legitimate rollout in progress: without it, a healthy DaemonSet update rolling out
  # pod-by-pod would trigger this alert on every intermediate step.
- alert: KubernetesDaemonSetRolloutStuck
  expr: ((kube_daemonset_status_number_ready / kube_daemonset_status_desired_number_scheduled * 100 < 100 and kube_daemonset_status_desired_number_scheduled > 0) or kube_daemonset_status_desired_number_scheduled - kube_daemonset_status_current_number_scheduled > 0) and changes(kube_daemonset_status_updated_number_scheduled[5m]) == 0
  for: 10m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes DaemonSet rollout stuck (instance {{ $labels.instance }})
    description: "Some Pods of DaemonSet {{ $labels.namespace }}/{{ $labels.daemonset }} are not scheduled or not ready\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesDaemonSetMisscheduled
  expr: kube_daemonset_status_number_misscheduled > 0
  for: 1m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes DaemonSet misscheduled (instance {{ $labels.instance }})
    description: "Some Pods of DaemonSet {{ $labels.namespace }}/{{ $labels.daemonset }} are running where they are not supposed to run\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

  # 1s threshold is a rough default; acceptable latency depends on your cluster size and API request volume — adjust based on your baseline.
- alert: KubernetesAPIServerLatency
  expr: histogram_quantile(0.99, sum(rate(apiserver_request_duration_seconds_bucket{verb!~"(?:CONNECT|WATCHLIST|WATCH|PROXY)"} [10m])) WITHOUT (subresource)) > 1
  for: 2m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes API server latency (instance {{ $labels.instance }})
    description: "Kubernetes API server has a 99th percentile latency of {{ $value }} seconds for {{ $labels.verb }} {{ $labels.resource }}.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesContainerWaiting
  expr: kube_pod_container_status_waiting_reason{reason!="CrashLoopBackOff"} > 0
  for: 1h
  labels:
    severity: warning
  annotations:
    summary: Kubernetes Container waiting (instance {{ $labels.instance }})
    description: "Container {{ $labels.container }} in pod {{ $labels.namespace }}/{{ $labels.pod }} has been in waiting state for longer than 1 hour, for a reason other than CrashLoopBackOff (e.g. ImagePullBackOff, CreateContainerConfigError, InvalidImageName).\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesDeploymentRolloutStuck
  expr: kube_deployment_status_condition{condition="Progressing",status="false"} != 0
  for: 10m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes Deployment rollout stuck (instance {{ $labels.instance }})
    description: "Deployment {{ $labels.namespace }}/{{ $labels.deployment }} rollout is not progressing, as reported by its Progressing=false condition.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesPodDisruptionBudgetNotEnoughHealthyPods
  expr: kube_poddisruptionbudget_status_desired_healthy - kube_poddisruptionbudget_status_current_healthy > 0
  for: 10m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes PodDisruptionBudget not enough healthy pods (instance {{ $labels.instance }})
    description: "PodDisruptionBudget {{ $labels.namespace }}/{{ $labels.poddisruptionbudget }} does not have the desired number of healthy pods, so voluntary disruptions such as node drains or cluster upgrades may be blocked or the application may be under-provisioned during maintenance.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesVersionMismatch
  expr: count(count by (git_version) (label_replace(kubernetes_build_info, "git_version", "$1", "git_version", "(v[0-9]*\.[0-9]*\.[0-9]*).*"))) > 1
  for: 10m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes version mismatch (instance {{ $labels.instance }})
    description: "There are {{ $value }} different semantic versions of Kubernetes components running simultaneously, which may indicate a partial or stalled cluster upgrade.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesHPAScaleMaximum
  expr: (kube_horizontalpodautoscaler_status_desired_replicas >= kube_horizontalpodautoscaler_spec_max_replicas) and (kube_horizontalpodautoscaler_spec_max_replicas > 1) and (kube_horizontalpodautoscaler_spec_min_replicas != kube_horizontalpodautoscaler_spec_max_replicas)
  for: 2m
  labels:
    severity: info
  annotations:
    summary: Kubernetes HPA scale maximum (instance {{ $labels.instance }})
    description: "HPA {{ $labels.namespace }}/{{ $labels.horizontalpodautoscaler }} has hit maximum number of desired pods\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

  # The 50% time-at-minimum and 3-replica floor are rough defaults; some workloads are intentionally always at minimum — adjust based on your deployment's expected scaling behavior.
- alert: KubernetesHPAUnderutilized
  expr: max(quantile_over_time(0.5, kube_horizontalpodautoscaler_status_desired_replicas[1d]) == kube_horizontalpodautoscaler_spec_min_replicas) by (horizontalpodautoscaler) > 3
  for: 0m
  labels:
    severity: info
  annotations:
    summary: Kubernetes HPA underutilized (instance {{ $labels.instance }})
    description: "HPA {{ $labels.namespace }}/{{ $labels.horizontalpodautoscaler }} is constantly at minimum replicas for 50% of the time. Potential cost saving here.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

- alert: KubernetesResourceQuotaExceeded
  expr: kube_resourcequota{type="used"} / ignoring(type) (kube_resourcequota{type="hard"} > 0) > 1
  for: 10m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes ResourceQuota exceeded (instance {{ $labels.instance }})
    description: "Namespace {{ $labels.namespace }} is using more of its {{ $labels.resource }} ResourceQuota than the configured hard limit ({{ $value | humanizePercentage }} of quota), indicating a misconfiguration or inconsistency between actual usage and the enforced quota.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

  # Replace job="apiserver" with the actual job name in your Prometheus configuration (kube-prometheus-stack uses "apiserver" by default).
- alert: KubernetesClientCertificateExpiresSoon
  expr: apiserver_client_certificate_expiration_seconds_count{job="apiserver"} > 0 and histogram_quantile(0.01, sum by (job, le) (rate(apiserver_client_certificate_expiration_seconds_bucket{job="apiserver"}[5m]))) < 24*60*60
  for: 0m
  labels:
    severity: critical
  annotations:
    summary: Kubernetes client certificate expires soon (instance {{ $labels.instance }})
    description: "A client certificate used to authenticate to the apiserver is expiring in less than 24.0 hours.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"

  # Replace job="apiserver" with the actual job name in your Prometheus configuration (kube-prometheus-stack uses "apiserver" by default).
- alert: KubernetesClientCertificateExpiresNextWeek
  expr: apiserver_client_certificate_expiration_seconds_count{job="apiserver"} > 0 and histogram_quantile(0.01, sum by (job, le) (rate(apiserver_client_certificate_expiration_seconds_bucket{job="apiserver"}[5m]))) < 7*24*60*60
  for: 0m
  labels:
    severity: warning
  annotations:
    summary: Kubernetes client certificate expires next week (instance {{ $labels.instance }})
    description: "A client certificate used to authenticate to the apiserver is expiring next week.\n  VALUE = {{ $value }}\n  LABELS = {{ $labels }}"