Calico CNI IPAM IP Address Block Pool Exhaustion Sentinel

id: calico-cni-ipam-block-allocation-exhaustion-sentinel
namespace: company.networking

inputs:
  - id: calico_metrics_url
    type: STRING
    defaults: "http://calico-node.kube-system:9091/metrics"
    description: Prometheus scrape endpoint for Calico node or felix daemon.

tasks:
  - id: scrape_calico_ipam
    type: io.kestra.plugin.scripts.shell.Commands
    commands:
      - |
        curl -s -f "{{ inputs.calico_metrics_url }}" > /tmp/calico_telemetry.txt

        # Scrape felix_ip_set_total or IPAM block metrics
        IPAM_TOTAL=$(grep -E "^felix_ip_set_total" /tmp/calico_telemetry.txt | awk '{sum+=$2} END {print sum+0}')
        echo "::set-output name=ipam_total::$IPAM_TOTAL::"

  - id: evaluate_ipam_state
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.scrape_calico_ipam.vars.ipam_total | int > 50000 }}"
    then:
      - id: notify_networking_team
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK') }}"
        payload: |
          {
            "channel": "#networking-alerts",
            "attachments": [
              {
                "color": "danger",
                "title": "🚨 Calico IPAM Pool Saturated Alert",
                "text": "Calico CNI at `{{ inputs.calico_metrics_url }}` recorded an IPAM set size of *{{ outputs.scrape_calico_ipam.vars.ipam_total }}*! IP pool CIDR blocks are nearing exhaustion, threatening pod creation failures.",
                "footer": "Kestra Networking Sentinel • Calico CNI"
              }
            ]
          }

errors:
  - id: alert_pipeline_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "channel": "#networking-alerts",
        "attachments": [
          {
            "color": "danger",
            "title": "⚠️ Calico Sentinel Failure",
            "text": "Failed to scrape Calico metrics endpoint. Verify felix metrics port accessibility.",
            "footer": "Kestra Workflow Failure Sentinel"
          }
        ]
      }

triggers:
  - id: periodic_schedule
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "*/30 * * * *"
    disabled: true