WIP keycloak stack (gate probe)

platform/keycloak/servicemonitor.yaml

@@ -0,0 +1,32 @@
+---
+# ServiceMonitor for Keycloak (R-OBS-01, docs/10). CR of monitoring.coreos.com (kube-prometheus-stack,
+# Phase 4) — CARRIED BY platform-config so it is not applied in the same pass as the CRD-installing
+# HelmRelease (F-MON1). Prometheus discovers ServiceMonitors in all namespaces
+# (serviceMonitorSelectorNilUsesHelmValues=false).
+#
+# Keycloak 26 exposes health + Prometheus metrics on the MANAGEMENT interface (port 9000, path
+# /metrics) once metrics-enabled/health-enabled are set (see keycloak-instance.yaml additionalOptions).
+# We select the operator-created keycloak-service (which selects the Keycloak pods) and scrape the pods'
+# management port by number via targetPort.
+# TODO(WS-SEC, bring-up): confirm the management port number/name the operator exposes (9000 default)
+#   and adjust targetPort if the pinned operator changes it. The KeycloakDown / KeycloakDatabaseDown
+#   alerts (platform/monitoring/alerts.yaml) key on kube-state-metrics and fire regardless of this SM.
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: keycloak
+  namespace: keycloak
+  labels:
+    release: kube-prometheus-stack
+spec:
+  namespaceSelector:
+    matchNames:
+      - keycloak
+  selector:
+    matchLabels:
+      app: keycloak
+  endpoints:
+    - targetPort: 9000
+      path: /metrics
+      scheme: http
+      interval: 30s