fix: add --cluster.label to alertmanager

pkg/alertmanager/statefulset.go

@@ -306,6 +306,17 @@ func makeStatefulSetSpec(a *monitoringv1.Alertmanager, config Config, tlsAssetSe
 		amArgs = append(amArgs, fmt.Sprintf("--cluster.peer-timeout=%s", a.Spec.ClusterPeerTimeout))
 	}
 
+	// If multiple Alertmanager clusters are deployed on the same cluster, it can happen
+	// that because pod IP addresses are recycled, an Alertmanager instance from cluster B
+	// connects with cluster A.
+	// --cluster.label flag was introduced in alertmanager v0.26, this helps to block
+	// any traffic that is not meant for the cluster.
+	// The value is hardcoded and the value is guaranteed to be unique in a given cluster but
+	// if there's a use case, we can consider a new field in the CRD.
+	if version.GTE(semver.MustParse("0.26.0")) {
+		amArgs = append(amArgs, fmt.Sprintf("--cluster.label=%s/%s", a.Namespace, a.Name))
+	}
+
 	isHTTPS := a.Spec.Web != nil && a.Spec.Web.TLSConfig != nil && version.GTE(semver.MustParse("0.22.0"))
 
 	livenessProbeHandler := v1.ProbeHandler{

pkg/alertmanager/statefulset_test.go

@@ -1186,6 +1186,48 @@ func TestAutomountServiceAccountToken(t *testing.T) {
 		}
 	}
 }
+
+func TestClusterLabel(t *testing.T) {
+	tt := []struct {
+		scenario                string
+		version                 string
+		expectedClusterLabelArg bool
+	}{{
+		scenario:                "--cluster.label set by default for version >= v0.26.0",
+		version:                 "0.26.0",
+		expectedClusterLabelArg: true,
+	}, {
+		scenario:                "no --cluster.label set for older versions",
+		version:                 "0.25.0",
+		expectedClusterLabelArg: false,
+	}}
+
+	for _, ts := range tt {
+		t.Run(ts.scenario, func(t *testing.T) {
+			a := monitoringv1.Alertmanager{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "alertmanager",
+					Namespace: "monitoring",
+				},
+				Spec: monitoringv1.AlertmanagerSpec{
+					Replicas: toPtr(int32(1)),
+					Version:  ts.version,
+				},
+			}
+
+			ss, err := makeStatefulSetSpec(&a, defaultTestConfig, nil)
+			require.NoError(t, err)
+
+			args := ss.Template.Spec.Containers[0].Args
+			if ts.expectedClusterLabelArg {
+				require.Contains(t, args, "--cluster.label=monitoring/alertmanager")
+				return
+			}
+			require.NotContains(t, args, "--cluster.label")
+		})
+	}
+}
+
 func containsString(sub string) func(string) bool {
 	return func(x string) bool {
 		return strings.Contains(x, sub)