WIP keycloak stack (gate probe)

platform/monitoring/alerts.yaml

@@ -305,9 +305,12 @@ spec:
     - name: platform-health.identity
       rules:
         - alert: KeycloakDown
+          # Scope to the Keycloak SERVER StatefulSet pods (keycloak-0, keycloak-1). The keycloak
+          # namespace also holds the operator (keycloak-operator-*) and DB (keycloak-db-*) pods, so an
+          # un-scoped max() would be masked by those being ready — this must reflect the IdP itself.
           expr: |
-            max(kube_pod_status_ready{namespace="keycloak", condition="true"}) == 0
-            or absent(kube_pod_status_ready{namespace="keycloak"})
+            max(kube_pod_status_ready{namespace="keycloak", pod=~"keycloak-[0-9]+", condition="true"}) == 0
+            or absent(kube_pod_status_ready{namespace="keycloak", pod=~"keycloak-[0-9]+"})
           for: 5m
           labels:
             severity: critical
@@ -316,10 +319,11 @@ spec:
             description: "No ready Keycloak pod for 5m — SSO is unavailable and dependent services cannot authenticate (docs/15)."
             runbook_url: "https://home.keithjackson.dev/runbooks/keycloak-down"
         - alert: KeycloakDatabaseDown
-          # Keycloak's PostgreSQL (Longhorn-backed, DR-critical). Metric from postgres-exporter or
-          # the bundled chart; confirm label set at bring-up.
+          # Keycloak's PostgreSQL runs as a CloudNativePG Cluster `keycloak-db` (pods keycloak-db-N).
+          # DR-critical, Longhorn-backed. (CNPG also exports cnpg_* metrics via its PodMonitor.)
           expr: |
-            max(kube_pod_status_ready{namespace="keycloak", pod=~".*postgres.*", condition="true"}) == 0
+            max(kube_pod_status_ready{namespace="keycloak", pod=~"keycloak-db-.*", condition="true"}) == 0
+            or absent(kube_pod_status_ready{namespace="keycloak", pod=~"keycloak-db-.*"})
           for: 5m
           labels:
             severity: critical