apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: vault-rules
  namespace: storage
spec:
  groups:
    - name: vault.rules
      interval: 15s
      rules:
        - alert: VaultHighErrorRate
          expr: |
            (
              sum(rate(vault_core_handle_request_total{error="true"}[5m]))
              /
              sum(rate(vault_core_handle_request_total[5m]))
            ) > 0.05
          for: 10m
          labels:
            severity: warning
          annotations:
            summary: "High error rate on Vault"
            description: "Error rate exceeded 5% for 10 minutes. Value: {{ $value | humanizePercentage }}"

        - alert: VaultSealed
          expr: |
            vault_core_unsealed == 0
          for: 1m
          labels:
            severity: critical
          annotations:
            summary: "Vault is sealed"
            description: "Vault has been sealed for 1 minute. Immediate attention required."