从‘弱口令汇编’到实战防御:手把手教你用HashiCorp Vault动态管理那些不能说的秘密
2026/6/12 18:21:58
kubectl create namespace monitoringhelm repoaddprometheus-community https://prometheus-community.github.io/helm-charts helm repo update helminstallmonitoring prometheus-community/kube-prometheus-stack\--namespacemonitoring\--setgrafana.service.type=NodePort\--setprometheus.service.type=NodePort\--setalertmanager.enabled=truekubectl get svc-nmonitoring grafana访问:
http://你的k3s节点IP:3000账号密码:
用户:admin 密码:prom-operator进入 Grafana → Dashboards → Import → 输入编号即可
1576016240186099471001217873导入后自动有图、自动连线、无需配置。
钉钉群 → 添加机器人 → 自定义机器人 → 复制 Webhook URL
kubectl apply-f-<<EOF apiVersion: v1 kind: Secret metadata: name: alertmanager-webhook namespace: monitoring type: Opaque stringData: WEBHOOK_URL: "https://oapi.dingtalk.com/robot/send?access_token=你的钉钉机器人TOKEN" EOFkubectl apply-f-<<EOF apiVersion: monitoring.coreos.com/v1alpha1 kind: AlertmanagerConfig metadata: name: dingtalk-alert namespace: monitoring spec: route: receiver: 'dingtalk' groupBy: ['job'] groupWait: 30s groupInterval: 1m repeatInterval: 2h receivers: - name: 'dingtalk' webhookConfigs: - urlSecret: name: alertmanager-webhook key: WEBHOOK_URL sendResolved: true EOF告警内容自动包含:
kubectl apply-f-<<EOF apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: jenkins namespace: monitoring spec: selector: matchLabels: app: jenkins endpoints: - port: http path: /prometheus EOFkubectl apply-f-<<EOF apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: gitea namespace: monitoring spec: selector: matchLabels: app: gitea endpoints: - port: http path: /metrics EOFkubectl apply-f-<<EOF apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: nexus namespace: monitoring spec: selector: matchLabels: app: nexus endpoints: - port: 8081 path: /service/metrics/prometheus EOFGitea → Jenkins → SonarQube → Nexus → K3s → Prometheus + Grafana + 钉钉告警