fix(notifications): Group alerts and enforce service access - #216
Merged
Merged
Conversation
![sourceant[bot]](https://avatars.githubusercontent.com/in/1161781?s=60&v=4){kind=small}
Metric alerts now share one incident per rule and resolve only after every affected series recovers. Explicit alert targets remain scoped to their intended recipients.
Fleet readers can retrieve deployment details from peers without receiving permission to mutate those deployments.
Service readers can no longer change DNS records or firewall policy. Object storage and notifications now have independent access controls, and storage attachments require access to the selected deployment.
The branded header retains its dark background in clients that ignore inline CSS, keeping the white logo visible.
Notification delivery now uses the typed path exclusively, keeping the branch clean under CI lint rules.
Operators and viewers no longer inherit administration access. Explicit grants remain available for custom roles.
Operators can manage alerts for assigned deployments. Other deployments, host rules, and notification credentials remain private.
Removing a peer now deletes its generated service credential while preserving user-managed keys with the same display name.
Module permissions and resource grants now have shared implementation and test requirements.
Fleet service credentials follow their own deployment policy. Peer lists remain available when the current server has no deployments.
Deployments can verify non-HTTP services without unsafe HTTP probes. Existing HTTP health configuration remains compatible.
Only the reserved Fleet identity uses its API key as the deployment grant. Other service identities keep the existing permission intersection.
nfebe
force-pushed
the
fix/notification-alert-incidents
branch
from
August 23, 2026 05:55
acee174 to
d7ea678
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Group repeated metric alerts into incidents instead of sending one message for every sample. This also closes permission gaps found while testing peer deployments and new services, and keeps the white email logo visible across mail clients.