---
# Scrape of cloudflared's own metrics server (:2000, `metrics:` in config.yaml) on every replica.
#
# A Service + ServiceMonitor in ONE file rather than a PodMonitor, on purpose: the repo's L0 checks
# (servicemonitor-ports-resolve, alert-metrics-have-scrape-targets assertion 4) can then prove the
# monitor's port is a port this Service actually defines. A PodMonitor would have to be declared as
# an unauditable exception. The Service is headless and carries only the metrics port — it is not a
# way into the tunnel, and nothing routes to it but Prometheus (networkpolicy.yaml admits only the
# monitoring namespace on :2000).
#
# kube-prometheus-stack runs with serviceMonitorSelectorNilUsesHelmValues: false, so this is
# selected from any namespace; the `release` label is kept for consistency.
apiVersion: v1
kind: Service
metadata:
  name: cloudflared-metrics
  namespace: cloudflared
  labels:
    app.kubernetes.io/name: cloudflared
spec:
  clusterIP: None
  selector:
    app.kubernetes.io/name: cloudflared
  ports:
    - name: metrics
      port: 2000
      targetPort: metrics
      protocol: TCP
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: cloudflared
  namespace: cloudflared
  labels:
    app.kubernetes.io/name: cloudflared
    release: kube-prometheus-stack
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: cloudflared
  endpoints:
    - port: metrics
      path: /metrics
      interval: 30s