k8s: add alert listing/query and filter primitives

Add PrometheusAlerts implementation with:
- Alert fetching from platform and user-workload Prometheus/Thanos
- Rule group fetching with namespace-scoped Thanos tenancy queries
- State-based filtering (firing, pending, silenced)
- Label-based flat filtering with key=value matching
- TLS transport with service CA for in-cluster communication

Signed-off-by: Shirly Radco <sradco@redhat.com>
Signed-off-by: João Vilaça <jvilaca@redhat.com>
Signed-off-by: Aviv Litman <alitman@redhat.com>
Co-authored-by: AI Assistant <noreply@cursor.com>

Author: sradco

pkg/k8s/client.go

@@ -8,6 +8,7 @@ import (
 	"k8s.io/client-go/rest"
 
 	osmv1client "github.com/openshift/client-go/monitoring/clientset/versioned"
+	routeclient "github.com/openshift/client-go/route/clientset/versioned"
 	monitoringv1client "github.com/prometheus-operator/prometheus-operator/pkg/client/versioned"
 	"github.com/sirupsen/logrus"
 )
@@ -22,6 +23,8 @@ type client struct {
 	osmv1clientset        *osmv1client.Clientset
 	config                *rest.Config
 
+	prometheusAlerts *prometheusAlerts
+
 	prometheusRuleManager *prometheusRuleManager
 	namespaceManager      *namespaceManager
 }
@@ -42,6 +45,11 @@ func NewClient(ctx context.Context, config *rest.Config) (Client, error) {
 		return nil, fmt.Errorf("failed to create osmv1 clientset: %w", err)
 	}
 
+	routeClientset, err := routeclient.NewForConfig(config)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create route clientset: %w", err)
+	}
+
 	c := &client{
 		clientset:             clientset,
 		monitoringv1clientset: monitoringv1clientset,
@@ -54,6 +62,8 @@ func NewClient(ctx context.Context, config *rest.Config) (Client, error) {
 		return nil, fmt.Errorf("failed to create PrometheusRule manager: %w", err)
 	}
 
+	c.prometheusAlerts = newPrometheusAlerts(routeClientset, clientset.CoreV1(), config, c.prometheusRuleManager)
+
 	c.namespaceManager, err = newNamespaceManager(ctx, clientset)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create namespace manager: %w", err)
@@ -70,6 +80,10 @@ func (c *client) TestConnection(_ context.Context) error {
 	return nil
 }
 
+func (c *client) PrometheusAlerts() PrometheusAlertsInterface {
+	return c.prometheusAlerts
+}
+
 func (c *client) PrometheusRules() PrometheusRuleInterface {
 	return c.prometheusRuleManager
 }

pkg/k8s/const.go

@@ -1,5 +1,32 @@
 package k8s
 
 const (
-	ClusterMonitoringNamespace = "openshift-monitoring"
+	ClusterMonitoringNamespace        = "openshift-monitoring"
+	UserWorkloadMonitoringNamespace   = "openshift-user-workload-monitoring"
+
+	PlatformRouteName                 = "prometheus-k8s"
+	PlatformAlertmanagerRouteName     = "alertmanager-main"
+	UserWorkloadRouteName             = "prometheus-user-workload"
+	UserWorkloadAlertmanagerRouteName = "alertmanager-user-workload"
+	PrometheusAlertsPath              = "/v1/alerts"
+	PrometheusRulesPath               = "/v1/rules"
+	AlertmanagerAlertsPath            = "/api/v2/alerts"
+	UserWorkloadAlertmanagerPort      = 9095
+	UserWorkloadPrometheusServiceName = "prometheus-user-workload-web"
+	UserWorkloadPrometheusPort        = 9090
+
+	ThanosQuerierServiceName             = "thanos-querier"
+	ThanosQuerierTenancyRulesPortName    = "tenancy-rules"
+	DefaultThanosQuerierTenancyRulesPort = 9093
+	ThanosQuerierTenancyAlertsPath       = "/api/v1/alerts"
+	ThanosQuerierTenancyRulesPath        = "/api/v1/rules"
+	ServiceCAPath                        = "/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
+
+	AlertSourceLabel    = "openshift_io_alert_source"
+	AlertSourcePlatform = "platform"
+	AlertSourceUser     = "user"
+	AlertBackendLabel   = "openshift_io_alert_backend"
+	AlertBackendAM      = "alertmanager"
+	AlertBackendProm    = "prometheus"
+	AlertBackendThanos  = "thanos"
 )