Cilium eBPF Map Pressure and Kernel Conntrack Saturation Sentinel

id: cilium-bpf-map-pressure-overflow-sentinel
namespace: company.networking

inputs:
  - id: cilium_metrics_url
    type: STRING
    defaults: "http://cilium.kube-system:9962/metrics"
    description: Prometheus scrape endpoint for Cilium CNI daemon.
  - id: pressure_threshold
    type: FLOAT
    defaults: 0.80
    description: "Maximum allowable eBPF map pressure ratio before alerting (default
      0.80 = 80%)."

tasks:
  - id: query_bpf_pressure
    type: io.kestra.plugin.scripts.shell.Commands
    commands:
      - |
        curl -s -f "{{ inputs.cilium_metrics_url }}" > /tmp/cilium_telemetry.txt

        # Scrape cilium_bpf_map_pressure metric
        MAX_PRESSURE=$(grep -E "^cilium_bpf_map_pressure" /tmp/cilium_telemetry.txt | awk '{if ($2>max) max=$2} END {print max+0}')
        echo "::set-output name=max_pressure::$MAX_PRESSURE::"

  - id: evaluate_bpf_pressure
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.query_bpf_pressure.vars.max_pressure | float >=
      inputs.pressure_threshold }}"
    then:
      - id: notify_networking_team
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK') }}"
        payload: |
          {
            "channel": "#networking-alerts",
            "attachments": [
              {
                "color": "danger",
                "title": "🚨 Cilium eBPF Map Pressure Critical Alert",
                "text": "Cilium node at `{{ inputs.cilium_metrics_url }}` reached peak eBPF map pressure of *{{ outputs.query_bpf_pressure.vars.max_pressure }}* (threshold {{ inputs.pressure_threshold }})! eBPF connection tracking (conntrack) or NAT maps are near overflow, causing kernel packet drops.",
                "footer": "Kestra Networking Sentinel • Cilium eBPF"
              }
            ]
          }

errors:
  - id: alert_pipeline_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "channel": "#networking-alerts",
        "attachments": [
          {
            "color": "danger",
            "title": "⚠️ Cilium Sentinel Failure",
            "text": "Failed to scrape Cilium metrics endpoint. Verify daemonset pod status and network access.",
            "footer": "Kestra Workflow Failure Sentinel"
          }
        ]
      }

triggers:
  - id: periodic_schedule
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "*/15 * * * *"
    disabled: true