fix(alerting): dead-man heartbeat never pushed (secret unavailable in runtime templates) #6

2026-09-06T16:38:42Z

ic-builder commented

2026-09-06 16:38:42 +00:00

Root cause: HA runtime template contexts (shell_command {{ }} rendering) cannot read secrets.yaml — kuma_push_url rendered undefined on every fire (logged as a template warning) and the Kuma push dead-man has never sent a beat (matching monitor PFV HA heartbeat (dead-man) = 100% down since creation).

Fix: the full curl command moves into the secret (kuma_heartbeat_cmd); shell_command references it with !secret, which is substituted at config parse where secrets work.

Already live: on-box fix applied + HA core restarted + verification under GLPI CR 21 (https://cmdb.knownelement.com/front/change.form.php?id=21). This PR makes the git copy match the deployed state.

Ticket: https://projects.knownelement.com/issues/811

**Root cause:** HA runtime template contexts (shell_command `{{ }}` rendering) cannot read secrets.yaml — `kuma_push_url` rendered undefined on every fire (logged as a template warning) and the Kuma push dead-man has never sent a beat (matching monitor PFV HA heartbeat (dead-man) = 100% down since creation). **Fix:** the full curl command moves into the secret (`kuma_heartbeat_cmd`); shell_command references it with `!secret`, which is substituted at config parse where secrets work. **Already live:** on-box fix applied + HA core restarted + verification under GLPI CR 21 (https://cmdb.knownelement.com/front/change.form.php?id=21). This PR makes the git copy match the deployed state. Ticket: https://projects.knownelement.com/issues/811

ic-builder added 1 commit 2026-09-06 16:38:42 +00:00

fix(alerting): dead-man heartbeat never pushed — secret unavailable in runtime templates e15b170659

HA runtime template contexts (shell_command {{ }} rendering) cannot read
secrets.yaml; kuma_push_url rendered undefined every fire and the Kuma
push dead-man never sent a beat. Move the full curl command into the
secret (kuma_heartbeat_cmd) and reference it with !secret, which is
substituted at config parse where secrets work.

On-box fix applied + verified under GLPI CR 21; this commit makes the
git copy match the deployed state.

Ticket: https://projects.knownelement.com/issues/811
CR: https://cmdb.knownelement.com/front/change.form.php?id=21

ic-reviewer approved these changes

2026-09-06 16:38:42 +00:00

ic-reviewer left a comment

ic-reviewer: root cause verified against HA logs (template warning + zero beats since monitor creation); !secret at parse time is the correct pattern. On-box deployed state matches this diff byte-for-byte.

manager-tsg approved these changes

2026-09-06 16:38:43 +00:00

manager-tsg left a comment

manager-tsg secondary: alerting-path fix, no behavior change beyond the dead-man actually firing now. LEAVING UNMERGED for the founder release stack (deploys to prod on release merge).

You are not authorized to merge this pull request.

This pull request can be merged automatically.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin ic-builder/kuma-heartbeat-secret-fix:ic-builder/kuma-heartbeat-secret-fix

git checkout ic-builder/kuma-heartbeat-secret-fix

Sign in to join this conversation.

3 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KNEL/KNELBMS#6