cloudflare/pint
Publicmirrored from https://github.com/cloudflare/pintAvailable
docs/index.md
276lines · modecode
| 1 | --- |
| 2 | layout: default |
| 3 | title: Documentation |
| 4 | nav_order: 1 |
| 5 | has_children: true |
| 6 | --- |
| 7 | |
| 8 | # pint |
| 9 | |
| 10 | pint is a Prometheus rule linter/validator. |
| 11 | |
| 12 | ## Requirements |
| 13 | |
| 14 | pint will run checks on Prometheus alerting & recording rules to detect potential problems |
| 15 | with those rules. |
| 16 | Some checks rely only on the rule itself and can be run "offline" - without talking to any |
| 17 | Prometheus server. |
| 18 | You can run pint in "offline" if you: |
| 19 | |
| 20 | - Don't pass any configuration file to pint. |
| 21 | - You pass configuration file to pint that **doesn't** contain any `prometheus` definition. |
| 22 | - You pass `--offline` flag to `pint` command. |
| 23 | |
| 24 | Most checks included in pint will require sending queries to a running Prometheus server where |
| 25 | those rules are, or would be, deployed. |
| 26 | Those checks are enabled if you pass a configuration file to pint that includes at least one |
| 27 | `prometheus` block. |
| 28 | Checks might use various Prometheus |
| 29 | [HTTP API endpoints](https://prometheus.io/docs/prometheus/latest/querying/api/) to retrieve |
| 30 | extra information, for example Prometheus configuration or metrics metadata. |
| 31 | If you run pint against a different service, like [Thanos](https://thanos.io/) some checks |
| 32 | might return problems due to API call errors, since not all Prometheus HTTP APIs are supported by it. |
| 33 | In that case you might want to disable failing checks in pint configuration file. |
| 34 | |
| 35 | ## Usage |
| 36 | |
| 37 | There are three modes it works in: |
| 38 | |
| 39 | - CI PR linting |
| 40 | - Ad-hoc linting of a selected files or directories |
| 41 | - A daemon that continuously checks selected files or directories and expose metrics describing |
| 42 | all discovered problems. |
| 43 | |
| 44 | ### Pull Requests |
| 45 | |
| 46 | Run it with `pint ci`. |
| 47 | |
| 48 | It currently supports git for which it will find all commits on the current branch that are not |
| 49 | present in the parent branch and scan all modified files included in those changes. |
| 50 | |
| 51 | Results can optionally be reported using |
| 52 | [BitBucket API](https://developer.atlassian.com/server/bitbucket/rest/) |
| 53 | or [GitHub API](https://docs.github.com/en/rest) to generate a report with any found issues. |
| 54 | |
| 55 | Exit code will be one (1) if any issues were detected with severity `Bug` or higher. This permits running |
| 56 | `pint` in your CI system whilst at the same you will get detailed reports on your source control system. |
| 57 | |
| 58 | If any commit on the PR contains `[skip ci]` or `[no ci]` somewhere in the commit message then pint will |
| 59 | skip running all checks. |
| 60 | |
| 61 | #### GitHub Actions |
| 62 | |
| 63 | The easiest way of using `pint` with GitHub Actions is by using |
| 64 | [prymitive/pint-action](https://github.com/prymitive/pint-action). |
| 65 | Here's an example workflow: |
| 66 | |
| 67 | {% raw %} |
| 68 | |
| 69 | ```yaml |
| 70 | name: pint |
| 71 | |
| 72 | on: |
| 73 | push: |
| 74 | branches: |
| 75 | - main |
| 76 | pull_request: |
| 77 | branches: |
| 78 | - main |
| 79 | |
| 80 | jobs: |
| 81 | pint: |
| 82 | runs-on: ubuntu-latest |
| 83 | steps: |
| 84 | - uses: actions/checkout@v4 |
| 85 | with: |
| 86 | fetch-depth: 0 |
| 87 | |
| 88 | - name: Run pint |
| 89 | uses: prymitive/pint-action@v1 |
| 90 | with: |
| 91 | token: ${{ github.token }} |
| 92 | # directory containing Prometheus rules |
| 93 | workdir: 'rules' |
| 94 | ``` |
| 95 | |
| 96 | {% endraw %} |
| 97 | |
| 98 | To customise pint checks create a `.pint.hcl` file in the root of your repository. |
| 99 | See [Configuration](configuration.md) for a description of all options. |
| 100 | |
| 101 | If your repository contains other files, not only Prometheus rules, then tell pint |
| 102 | to only check selected paths when running checks on a pull request: |
| 103 | |
| 104 | ```js |
| 105 | ci { |
| 106 | include = [ "rules/dev/.*.yml", "rules/prod/.*" ] |
| 107 | } |
| 108 | ``` |
| 109 | |
| 110 | When pint runs checks after a push to a branch (for example after a merge), then |
| 111 | it will pass `workdir` option to `pint lint`, which means that all files inside |
| 112 | `rules` directory will be checked. |
| 113 | |
| 114 | ### Ad-hoc |
| 115 | |
| 116 | Lint specified files and report any found issue. |
| 117 | |
| 118 | You can lint selected files: |
| 119 | |
| 120 | ```shell |
| 121 | pint lint rules.yml |
| 122 | ``` |
| 123 | |
| 124 | or directories: |
| 125 | |
| 126 | ```shell |
| 127 | pint lint path/to/dir |
| 128 | ``` |
| 129 | |
| 130 | or both: |
| 131 | |
| 132 | ```shell |
| 133 | pint lint path/to/dir file.yml path/file.yml path/dir |
| 134 | ``` |
| 135 | |
| 136 | ### Watch mode |
| 137 | |
| 138 | Run pint as a daemon in watch mode: |
| 139 | |
| 140 | ```shell |
| 141 | pint watch rules.yml |
| 142 | ``` |
| 143 | |
| 144 | By default it will start a HTTP server on port `8080` and run all checks every |
| 145 | 10 minutes. This can be customised by passing extra flags to the `watch` command. |
| 146 | Run `pint watch -h` to see all available flags. |
| 147 | |
| 148 | Query `/metrics` to see all expose metrics, example with default flags: |
| 149 | |
| 150 | ```shell |
| 151 | curl -s http://localhost:8080/metrics |
| 152 | ``` |
| 153 | |
| 154 | Or setup Prometheus scrape job: |
| 155 | |
| 156 | ```yaml |
| 157 | scrape_configs: |
| 158 | - job_name: pint |
| 159 | static_configs: |
| 160 | - targets: ['localhost:8080'] |
| 161 | ``` |
| 162 | |
| 163 | Available metrics: |
| 164 | |
| 165 | - `pint_problem` - exported for every problem detected by pint. |
| 166 | To avoid exposing too many metrics at once pass `--max-problems` flag to watch command. |
| 167 | When this flag is set pint will expose only up to `--max-problems` value number of |
| 168 | `pint_problem` metrics. |
| 169 | - `pint_problems` - this metric is the total number of all problems detected by pint, |
| 170 | including those not exported due to the `--max-problems` flag. |
| 171 | |
| 172 | `pint problem` metric can include `owner` label for each rule. This is useful |
| 173 | to route alerts based on metrics to the right team. |
| 174 | To set a rule owner add a `# pint file/owner $owner` comment in a file, to set |
| 175 | an owner for all rules in that file. You can also set an owner per rule, by adding |
| 176 | `# pint rule/owner $owner` comment around given rule. |
| 177 | |
| 178 | Example: |
| 179 | |
| 180 | ```yaml |
| 181 | # pint file/owner bob |
| 182 | |
| 183 | - alert: ... |
| 184 | expr: ... |
| 185 | |
| 186 | # pint rule/owner alice |
| 187 | - alert: ... |
| 188 | expr: ... |
| 189 | ``` |
| 190 | |
| 191 | Here's an example alert you can use for problems detected by pint: |
| 192 | |
| 193 | {% raw %} |
| 194 | |
| 195 | ```yaml |
| 196 | - alert: Pint Problem Detected |
| 197 | # pint_problem is only present if pint detects any problems |
| 198 | # pint disable promql/series(pint_problem) |
| 199 | expr: | |
| 200 | sum without(instance, problem) (pint_problem) > 0 |
| 201 | for: 1h |
| 202 | annotations: |
| 203 | summary: | |
| 204 | {{ with printf "pint_problem{filename='%s', name='%s', reporter='%s'}" .Labels.filename .Labels.name .Labels.reporter | query }} |
| 205 | {{ . | first | label "problem" }} |
| 206 | {{ end }} |
| 207 | docs: "https://cloudflare.github.io/pint/checks/{{ $labels.reporter }}.html" |
| 208 | ``` |
| 209 | |
| 210 | {% endraw %} |
| 211 | |
| 212 | ## Release Notes |
| 213 | |
| 214 | See [changelog](changelog.md) for history of changes. |
| 215 | |
| 216 | ## Quick start |
| 217 | |
| 218 | Requirements: |
| 219 | |
| 220 | - [Git](https://git-scm.com/) |
| 221 | - [Go](https://golang.org/) - current stable release |
| 222 | |
| 223 | Steps: |
| 224 | |
| 225 | 1. Download a binary from [Releases](https://github.com/cloudflare/pint/releases) page |
| 226 | or build from source: |
| 227 | |
| 228 | ```shell |
| 229 | git clone https://github.com/cloudflare/pint.git |
| 230 | cd pint |
| 231 | make |
| 232 | ``` |
| 233 | |
| 234 | 2. Run a simple syntax check on Prometheus |
| 235 | [alerting](https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/) |
| 236 | or [recording](https://prometheus.io/docs/prometheus/latest/configuration/recording_rules/) |
| 237 | rules file(s). |
| 238 | |
| 239 | ```shell |
| 240 | ./pint lint /etc/prometheus/*.rules.yml |
| 241 | ``` |
| 242 | |
| 243 | 3. Configuration file is optional, but without it pint will only run very basic |
| 244 | syntax checks. See [configuration](configuration.md) for details on |
| 245 | config syntax. |
| 246 | By default pint will try to load configuration from `.pint.hcl`, you can |
| 247 | specify a different path using `--config` flag: |
| 248 | |
| 249 | ```shell |
| 250 | ./pint --config /etc/pint.hcl lint /etc/prometheus/rules/*.yml |
| 251 | ``` |
| 252 | |
| 253 | There are docker images available on [GitHub](https://github.com/cloudflare/pint/pkgs/container/pint). |
| 254 | Example usage: |
| 255 | |
| 256 | ```shell |
| 257 | docker run --mount=type=bind,source="$(pwd)",target=/rules,readonly ghcr.io/cloudflare/pint pint lint /rules |
| 258 | ``` |
| 259 | |
| 260 | ## License |
| 261 | |
| 262 | ```text |
| 263 | Copyright (c) 2021-2023 Cloudflare, Inc. |
| 264 | |
| 265 | Licensed under the Apache License, Version 2.0 (the "License"); |
| 266 | you may not use this file except in compliance with the License. |
| 267 | You may obtain a copy of the License at |
| 268 | |
| 269 | http://www.apache.org/licenses/LICENSE-2.0 |
| 270 | |
| 271 | Unless required by applicable law or agreed to in writing, software |
| 272 | distributed under the License is distributed on an "AS IS" BASIS, |
| 273 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 274 | See the License for the specific language governing permissions and |
| 275 | limitations under the License. |
| 276 | ``` |
| 277 | |