feat(monitoring): enable node-exporter ethtool collector and add NIC ring/pause alerts

[adrianreza]

Background

Incident in Zendesk #369707 / RCA in #369908: the smoking gun on the affected Mellanox mlx5 bonds was sustained rx_no_buffer and tx_pause_frames counters, indicating ring buffer exhaustion and upstream backpressure. node-exporter ships an ethtool collector that exposes these counters but it is not enabled in our deployment.

Current state: roles/kube_prometheus_stack/vars/main.yml configures node-exporter extraArgs without --collector.ethtool.

Proposal

1. Enable --collector.ethtool (and consider --collector.textfile, --collector.hwmon) on node-exporter.
2. Add alerts for sustained NIC ring buffer exhaustion / pause-frame storms on physical interfaces:
   • NodeNICReceiveNoBuffer — rate(node_ethtool_rx_no_buffer_total[5m]) > 0 sustained
   • NodeNICTransmitPauseFrames — rate(node_ethtool_tx_pause_frames_total[5m]) > 0 sustained
3. Add runbook entries.

Acceptance criteria

• node-exporter extraArgs updated
• Two alert rules + promtool tests
• Runbook entries in doc/source/admin/monitoring.rst
• Release note via reno new
• Verify scrape volume impact is acceptable

References

• Zendesk #369908 (RCA), #369707 (source incident)
• Distinct from feat(monitoring): add Geneve and bond MTU drift alerts #3888 (Geneve/bond MTU) and feat(monitoring): add VM packets drop alert #3889 (libvirt VM tap drops) — this targets host physical NIC counters