From 265b967a4c5e23e8e8aa3c0ad02d88b53457a3b8 Mon Sep 17 00:00:00 2001
From: Le Quang Tho <92069270+letho1608@users.noreply.github.com>
Date: Sat, 28 Mar 2026 09:18:48 +0700
Subject: [PATCH] feat: create dns alerts enricher for targetdown alerts

Create a new action that enriches TargetDown alerts when they're related to coreDns but kubeDns is being used instead. This will help users understand why they're getting irrelevant alerts and how to fix them.

Affected files: dns_alerts.py

Signed-off-by: Le Quang Tho <92069270+letho1608@users.noreply.github.com>
---
 playbooks/robusta_playbooks/dns_alerts.py | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 playbooks/robusta_playbooks/dns_alerts.py

diff --git a/playbooks/robusta_playbooks/dns_alerts.py b/playbooks/robusta_playbooks/dns_alerts.py
new file mode 100644
index 000000000..ebec95894
--- /dev/null
+++ b/playbooks/robusta_playbooks/dns_alerts.py
@@ -0,0 +1,22 @@
+import logging
+from robusta.api import *
+
+
+@action
+def dns_target_down_enricher(alert: PrometheusKubernetesAlert):
+    """
+    Enrich TargetDown alerts for DNS pods when kube-dns is used instead of CoreDNS.
+    """
+    if not alert.job.startswith("kube-dns"):
+        return
+
+    alert.override_finding_attributes(
+        description=(
+            "TargetDown alert fired for kube-dns pods, but your cluster is configured "
+            "to use CoreDNS. This alert is likely a false positive.\n\n"
+            "To resolve this, either:\n"
+            "1. Disable the kube-dns scrape job in your Prometheus configuration, or\n"
+            "2. Update the alert rule to exclude kube-dns when CoreDNS is in use."
+        ),
+        severity=FindingSeverity.INFO,
+    )