fix: added NodeNetworkMulticast
diff --git a/roles/kube_prometheus_stack/README.md b/roles/kube_prometheus_stack/README.md
index e069671..ee45fa8 100644
--- a/roles/kube_prometheus_stack/README.md
+++ b/roles/kube_prometheus_stack/README.md
@@ -113,7 +113,35 @@
## Alerts
-### `etcdDatabaseHighFragmentationRatio`
+### Network
+
+#### `NodeNetworkMulticast`
+
+This alert is triggered when a node is receiving large volumes of multicast
+traffic which can be a sign of a misconfigured network or a malicious actor.
+
+This can result in high CPU usage on the node and can cause the node to become
+unresponsive. Also, it can be the cause of a very high amount of software
+interrupts on the node.
+
+In order to find the root cause of this issue, you can use the following
+commands:
+
+```console
+iftop -ni $DEV -f 'multicast and not broadcast'
+```
+
+With the command above, you're able to see which IP addresses are sending the
+multicast traffic. Once you have the IP address, you can use the following
+command to find the server behind it:
+
+```console
+openstack server list --all-projects --long -n --ip $IP
+```
+
+### etcd
+
+#### `etcdDatabaseHighFragmentationRatio`
```console
kubectl -n kube-system exec svc/kube-prometheus-stack-kube-etcd -- \
diff --git a/roles/kube_prometheus_stack/files/jsonnet/legacy.libsonnet b/roles/kube_prometheus_stack/files/jsonnet/legacy.libsonnet
index 3300e66..a6126f6 100644
--- a/roles/kube_prometheus_stack/files/jsonnet/legacy.libsonnet
+++ b/roles/kube_prometheus_stack/files/jsonnet/legacy.libsonnet
@@ -169,6 +169,24 @@
],
},
{
+ name: 'network',
+ rules: [
+ {
+ alert: 'NodeNetworkMulticast',
+ expr: 'rate(node_network_receive_multicast_total[1m]) > 1000',
+ 'for': '5m',
+ labels: {
+ severity: 'critical',
+ },
+ annotations: {
+ summary: 'High multicast traffic on node {{ $labels.instance }}: {{ $value }} packets/sec',
+ description: 'This can result in high software interrupt load on the node which can bring network performance down.',
+ runbook_url: 'https://github.com/vexxhost/atmosphere/tree/main/roles/kube_prometheus_stack#NodeNetworkMulticast'
+ },
+ },
+ ],
+ },
+ {
name: 'softnet',
rules: [
{