apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: openbao-alerts
  namespace: data
  labels:
    role: alert-rules
spec:
  groups:
    - name: openbao
      rules:
        - alert: VaultSealed
          expr: vault_core_unsealed == 0
          for: 1m
          labels:
            severity: critical
          annotations:
            summary: "OpenBao/Vault is sealed"
            description: "OpenBao/Vault is sealed — automatic unseal may have failed"

        - alert: VaultDown
          expr: up{job=~".*openbao.*"} == 0
          for: 2m
          labels:
            severity: critical
          annotations:
            summary: "OpenBao/Vault is down"
            description: "OpenBao instance {{ $labels.namespace }}/{{ $labels.pod }} is down."