keycloak: coverage tests + dashboard + reword cross-cutting tags

conformance/tests/l2-behavioral/keycloak-monitored/chainsaw-test.yaml

@@ -0,0 +1,81 @@
+# =============================================================================
+# L2 BEHAVIORAL — the IdP is monitored  (R-OBS-01)                      [RUNNABLE]
+# Spec: docs/10 observability. Impl: platform/keycloak/servicemonitor.yaml (Keycloak ServiceMonitor,
+# carried via platform-config per the F-MON1 split) + the CNPG PodMonitor.
+#
+# GIVEN a ServiceMonitor for Keycloak,
+# WHEN  Prometheus reconciles its scrape config
+#   ->  THEN Prometheus carries a `serviceMonitor/keycloak` scrape pool in its active targets — the IdP
+#       is monitored (metrics/health), R-OBS-01. (The KeycloakDown / KeycloakDatabaseDown alerts in
+#       platform/monitoring/alerts.yaml consume this signal + kube-state-metrics.)
+# =============================================================================
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: keycloak-monitored
+  labels:
+    conformance.home.k3s/R-OBS-01: "true"
+  annotations:
+    conformance.home.k3s/requirements: "R-OBS-01"
+    conformance.home.k3s/layer: "L2"
+    conformance.home.k3s/safety-critical: "false"
+    conformance.home.k3s/executable: "true"
+    conformance.home.k3s/intent: >-
+      Prometheus discovers the Keycloak ServiceMonitor and carries it as an active scrape pool.
+spec:
+  timeouts:
+    apply: 60s
+    assert: 3m
+    exec: 3m
+  steps:
+    - name: keycloak-servicemonitor-exists
+      try:
+        - assert:
+            resource:
+              apiVersion: monitoring.coreos.com/v1
+              kind: ServiceMonitor
+              metadata:
+                name: keycloak
+                namespace: keycloak
+    - name: prometheus-carries-the-keycloak-scrape-pool
+      try:
+        - apply:
+            resource:
+              apiVersion: batch/v1
+              kind: Job
+              metadata:
+                name: keycloak-target-probe
+              spec:
+                backoffLimit: 3
+                activeDeadlineSeconds: 150
+                template:
+                  spec:
+                    restartPolicy: Never
+                    containers:
+                      - name: probe
+                        image: busybox:1.36.1
+                        command:
+                          - sh
+                          - -c
+                          - |
+                            set -u
+                            prom="http://kube-prometheus-stack-prometheus.monitoring.svc.cluster.local:9090"
+                            for i in $(seq 1 12); do
+                              out="$(wget -q -O - "$prom/api/v1/targets" 2>/dev/null || true)"
+                              if echo "$out" | grep -q 'serviceMonitor/keycloak'; then
+                                echo KEYCLOAK_TARGET_PRESENT_OK; exit 0
+                              fi
+                              echo "poll $i: keycloak scrape pool not yet present"; sleep 10
+                            done
+                            echo "FAIL: Prometheus has no serviceMonitor/keycloak scrape pool"; exit 1
+        - assert:
+            resource:
+              apiVersion: batch/v1
+              kind: Job
+              metadata:
+                name: keycloak-target-probe
+              status:
+                succeeded: 1
+      finally:
+        - script:
+            content: 'echo "teardown: chainsaw deletes the per-test namespace (Job included)"'