From d1d28776cd5ae8334a2e1cf488ca633a121747c2 Mon Sep 17 00:00:00 2001
From: Aleksandr Bogomiakov <git@hexor.cy>
Date: Thu, 8 Oct 2026 18:00:44 +0100
Subject: [PATCH] Fix migration job reloads and alert context

---
 k8s-ng/core/prom-stack/alertmanager-config.yaml | 4 +++-
 k8s-ng/core/prom-stack/prom-values.yaml         | 5 +++++
 k8s-ng/core/reloader/values.yaml                | 4 +++-
 3 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/k8s-ng/core/prom-stack/alertmanager-config.yaml b/k8s-ng/core/prom-stack/alertmanager-config.yaml
index 9753674..6b1b177 100644
--- a/k8s-ng/core/prom-stack/alertmanager-config.yaml
+++ b/k8s-ng/core/prom-stack/alertmanager-config.yaml
@@ -46,14 +46,16 @@ spec:
 
             {{ if eq .Status "firing" }}🔴{{ else }}🟢{{ end }} {{ with .Annotations.summary }}<b>{{ . | reReplaceAll "&" "&amp;" | reReplaceAll "<" "&lt;" | reReplaceAll ">" "&gt;" }}</b>{{ else }}<b>{{ .Labels.alertname | reReplaceAll "&" "&amp;" | reReplaceAll "<" "&lt;" | reReplaceAll ">" "&gt;" }}</b>{{ end }}
             {{ with .Annotations.description }}{{ . | reReplaceAll "&" "&amp;" | reReplaceAll "<" "&lt;" | reReplaceAll ">" "&gt;" }}{{ end }}
-            {{ if or .Labels.namespace .Labels.pod .Labels.container .Labels.node .Labels.instance }}
+            {{ if or .Labels.namespace .Labels.job_name .Labels.pod .Labels.container .Labels.node .Labels.instance }}
             <b>Context</b>
             {{ with .Labels.namespace }}Namespace: <code>{{ . | reReplaceAll "&" "&amp;" | reReplaceAll "<" "&lt;" | reReplaceAll ">" "&gt;" }}</code>{{ end }}
+            {{ with .Labels.job_name }}Job: <code>{{ . | reReplaceAll "&" "&amp;" | reReplaceAll "<" "&lt;" | reReplaceAll ">" "&gt;" }}</code>{{ else }}
             {{ with .Labels.pod }}Pod: <code>{{ . | reReplaceAll "&" "&amp;" | reReplaceAll "<" "&lt;" | reReplaceAll ">" "&gt;" }}</code>{{ end }}
             {{ with .Labels.container }}Container: <code>{{ . | reReplaceAll "&" "&amp;" | reReplaceAll "<" "&lt;" | reReplaceAll ">" "&gt;" }}</code>{{ end }}
             {{ with .Labels.node }}Node: <code>{{ . | reReplaceAll "&" "&amp;" | reReplaceAll "<" "&lt;" | reReplaceAll ">" "&gt;" }}</code>{{ end }}
             {{ if and (not .Labels.node) .Labels.instance }}Instance: <code>{{ .Labels.instance | reReplaceAll "&" "&amp;" | reReplaceAll "<" "&lt;" | reReplaceAll ">" "&gt;" }}</code>{{ end }}
             {{ end }}
+            {{ end }}
             Started: {{ .StartsAt | tz "Europe/London" | date "2006-01-02 15:04 MST" }}
             <a href="{{ .GeneratorURL | reReplaceAll "&" "&amp;" | reReplaceAll "<" "&lt;" | reReplaceAll ">" "&gt;" }}">📈 Open graph</a>{{ with .Annotations.runbook_url }} · <a href="{{ . | reReplaceAll "&" "&amp;" | reReplaceAll "<" "&lt;" | reReplaceAll ">" "&gt;" }}">📖 Runbook</a>{{ end }}
             {{ end }}
diff --git a/k8s-ng/core/prom-stack/prom-values.yaml b/k8s-ng/core/prom-stack/prom-values.yaml
index ce2ee16..df9ab6d 100644
--- a/k8s-ng/core/prom-stack/prom-values.yaml
+++ b/k8s-ng/core/prom-stack/prom-values.yaml
@@ -1,5 +1,10 @@
 defaultRules:
   create: true
+  # Default rule descriptions reference $labels.cluster. Prometheus external
+  # labels are added only when alerts leave Prometheus, so attach the label to
+  # the rules as well to avoid messages ending with "on cluster .".
+  additionalRuleLabels:
+    cluster: hexor-ng
   rules:
     # k3s embeds these control-plane components and does not expose their
     # conventional metrics Services. Disabling the groups prevents false pages.
diff --git a/k8s-ng/core/reloader/values.yaml b/k8s-ng/core/reloader/values.yaml
index a5401df..dd43454 100644
--- a/k8s-ng/core/reloader/values.yaml
+++ b/k8s-ng/core/reloader/values.yaml
@@ -6,7 +6,9 @@ reloader:
   reloadStrategy: annotations
   ignoreConfigMaps: false
   ignoreSecrets: false
-  ignoreJobs: false
+  # Jobs are one-shot executions. Restarting completed Helm hooks after a
+  # referenced Secret changes can rerun migrations outside the release flow.
+  ignoreJobs: true
   ignoreCronJobs: false
   enableHA: true
   syncAfterRestart: true