【GitOps·Flux篇】通知与告警：Webhook 集成与事件通知

前言

GitOps 是自动化的，但出了问题你需要知道。Flux 的 notification-controller 可以在同步成功、失败、漂移等事件发生时自动发送通知到 Slack/钉钉/企微/邮件等渠道。本篇完整配置通知系统。

一、通知架构

复制代码

Flux 事件流:

  Source/Sync 事件 → notification-controller → Provider → 通知渠道
                       (事件过滤器)              (通知发送)
                                                    ↓
                                              Slack / 钉钉 / 企微
                                              Teams / Discord
                                              Generic Webhook
                                              Rocket.Chat / Email

三个 CRD

CRD	作用
Provider	定义通知渠道（如 Slack Webhook URL）
Alert	定义告警规则（什么事件发给谁）
Receiver	接收外部 Webhook 触发 Flux 操作

二、配置 Slack 通知

创建 Provider

yaml 复制代码

apiVersion: notification.toolkit.fluxcd.io/v1beta3
kind: Provider
metadata:
  name: slack
  namespace: flux-system
spec:
  type: slack
  channel: deployments       # Slack 频道名
  secretRef:
    name: slack-webhook-url   # 引用 Webhook URL Secret
  username: Flux Bot          # 显示名称

bash 复制代码

# 创建 Slack Webhook Secret
kubectl create secret generic slack-webhook-url \
  --namespace=flux-system \
  --from-literal=address=https://hooks.slack.com/services/xxx/yyy/zzz

创建 Alert

yaml 复制代码

apiVersion: notification.toolkit.fluxcd.io/v1beta3
kind: Alert
metadata:
  name: deploy-alerts
  namespace: flux-system
spec:
  providerRef:
    name: slack              # 引用上面的 Provider
  # 事件源
  eventSources:
    # 监控所有 GitRepository 事件
    - kind: GitRepository
      name: "*"
    # 监控所有 Kustomization 事件
    - kind: Kustomization
      name: "*"
    # 监控所有 HelmRelease 事件
    - kind: HelmRelease
      name: "*"
  # 过滤严重级别
  summary: "Flux deployment notifications"
  # 事件严重级别过滤
  eventSeverity:
    - error                  # 只通知错误事件
    - info                   # 也通知信息事件（成功同步）

Slack 消息格式

复制代码

Flux Bot  [4:30 PM]
ℹ️ Kustomization/myapp-prod
  Applied revision main/abc123
  Message: Reconciliation finished

三、配置钉钉通知

钉钉 Provider

yaml 复制代码

apiVersion: notification.toolkit.fluxcd.io/v1beta3
kind: Provider
metadata:
  name: dingtalk
  namespace: flux-system
spec:
  type: dingtalk
  secretRef:
    name: dingtalk-webhook
  # 钉钉不支持自定义 username

bash 复制代码

# 创建钉钉 Webhook Secret
kubectl create secret generic dingtalk-webhook \
  --namespace=flux-system \
  --from-literal=address=https://oapi.dingtalk.com/robot/send?access_token=xxx

钉钉 Alert

yaml 复制代码

apiVersion: notification.toolkit.fluxcd.io/v1beta3
kind: Alert
metadata:
  name: dingtalk-alerts
  namespace: flux-system
spec:
  providerRef:
    name: dingtalk
  eventSources:
    - kind: Kustomization
      name: "*"
      namespace: flux-system
    - kind: HelmRelease
      name: "*"
      namespace: flux-system
  eventSeverity:
    - error
    - info

四、配置企业微信通知

企微 Provider

yaml 复制代码

apiVersion: notification.toolkit.fluxcd.io/v1beta3
kind: Provider
metadata:
  name: wecom
  namespace: flux-system
spec:
  type: wecom
  secretRef:
    name: wecom-webhook

bash 复制代码

kubectl create secret generic wecom-webhook \
  --namespace=flux-system \
  --from-literal=address=https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=xxx

企微 Alert

yaml 复制代码

apiVersion: notification.toolkit.fluxcd.io/v1beta3
kind: Alert
metadata:
  name: wecom-alerts
  namespace: flux-system
spec:
  providerRef:
    name: wecom
  eventSources:
    - kind: Kustomization
      name: "*"
    - kind: GitRepository
      name: "*"
  eventSeverity:
    - error       # 只通知错误

五、通用 Webhook 通知

自定义 Provider

yaml 复制代码

apiVersion: notification.toolkit.fluxcd.io/v1beta3
kind: Provider
metadata:
  name: custom-webhook
  namespace: flux-system
spec:
  type: generic
  address: https://my-notifier.com/api/flux-events
  secretRef:
    name: webhook-auth
  # 自定义 Headers
  headers:
    Authorization: "Bearer token"
    Content-Type: "application/json"

bash 复制代码

kubectl create secret generic webhook-auth \
  --namespace=flux-system \
  --from-literal=token=my-secret-token

自定义消息模板

yaml 复制代码

apiVersion: notification.toolkit.fluxcd.io/v1beta3
kind: Provider
metadata:
  name: custom-webhook
  namespace: flux-system
spec:
  type: generic
  address: https://my-notifier.com/api/flux-events
  secretRef:
    name: webhook-auth

  # 自定义模板
  template:
    # 自定义请求体
    body: |
      {
        "event": "{{ .InvolvedObject.Kind }}",
        "name": "{{ .InvolvedObject.Name }}",
        "namespace": "{{ .InvolvedObject.Namespace }}",
        "severity": "{{ .Severity }}",
        "message": "{{ .Message }}",
        "timestamp": "{{ .Timestamp }}",
        "revision": "{{ .Revision }}",
        "summary": "{{ .Summary }}"
      }

六、Webhook Receiver：接收外部触发

用途

复制代码

正常流程:
  Git push → Flux 检测（interval间隔）→ 同步

加 Receiver:
  Git push → Git Webhook → Flux Receiver → 立即同步
  → 不用等 interval，即时响应

创建 Receiver

yaml 复制代码

apiVersion: notification.toolkit.fluxcd.io/v1
kind: Receiver
metadata:
  name: github-receiver
  namespace: flux-system
spec:
  type: github                    # GitHub Webhook
  events:
    - push                        # 监听 push 事件
  # 关联的资源
  resources:
    - kind: GitRepository
      name: myapp-deploy
      namespace: flux-system
  # Webhook 密钥
  secretRef:
    name: receiver-token

bash 复制代码

# 创建 Webhook 密钥
kubectl create secret generic receiver-token \
  --namespace=flux-system \
  --from-literal=token=my-webhook-secret

暴露 Receiver 服务

bash 复制代码

# Flux 自动创建 Receiver Service
kubectl get svc -n flux-system
# webhook-receiver   ClusterIP

# 创建 Ingress 暴露到公网
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: flux-receiver
  namespace: flux-system
spec:
  ingressClassName: nginx
  rules:
  - host: flux-webhook.mycompany.com
    http:
      paths:
      - path: /hook/
        pathType: Prefix
        backend:
          service:
            name: webhook-receiver
            port:
              number: 80
EOF

在 GitHub 中配置 Webhook

复制代码

GitHub → Repository → Settings → Webhooks → Add webhook
  Payload URL: https://flux-webhook.mycompany.com/hook/id
  Content type: application/json
  Secret: my-webhook-secret（与 Receiver token 一致）
  Events: Just the push event

培训要点 ：Receiver 把 Flux 的同步延迟从分钟级降到秒级。没有 Receiver 时，Flux 按 interval（通常1分钟）轮询 Git；有了 Receiver，Git push 后 Webhook 直接触发同步。

七、通知过滤与严重级别

严重级别

级别	含义	示例事件
error	错误	同步失败、镜像拉取失败
warning	警告	健康检查不通过
info	信息	同步成功、漂移修复

精确过滤

yaml 复制代码

# 只通知生产环境的事件
apiVersion: notification.toolkit.fluxcd.io/v1beta3
kind: Alert
metadata:
  name: prod-only-alerts
  namespace: flux-system
spec:
  providerRef:
    name: slack
  eventSources:
    # 只监控特定 Kustomization
    - kind: Kustomization
      name: "myapp-prod"
      namespace: flux-system
    - kind: HelmRelease
      name: "redis-prod"
      namespace: redis
  eventSeverity:
    - error        # 生产环境错误才通知
    - warning
  # 排除 dev 环境的事件
  # 通过不在 eventSources 中列出 dev 的资源来实现

八、本篇要点回顾

通知三件套：Provider（渠道）+ Alert（规则）+ Receiver（外部触发）
支持 Slack/钉钉/企微/Teams/Discord/Generic Webhook
eventSeverity 控制通知级别：只通知 error 还是也通知 info
eventSources 精确控制监听哪些资源的哪些事件
Receiver 接收 Git Webhook，把同步延迟从分钟级降到秒级
自定义模板可定制通知消息的格式和内容

下一篇预告：GitOps 进阶篇开始：《密钥管理：Sealed Secrets、SOPS 与 External Secrets》。