---
# ServiceMonitor for Keycloak (R-OBS-01, docs/10). CR of monitoring.coreos.com (kube-prometheus-stack,
# Phase 4) — CARRIED BY platform-config so it is not applied in the same pass as the CRD-installing
# HelmRelease (F-MON1). Prometheus discovers ServiceMonitors in all namespaces
# (serviceMonitorSelectorNilUsesHelmValues=false).
#
# Keycloak 26 exposes health + Prometheus metrics on the MANAGEMENT interface (port 9000, path
# /metrics) once metrics-enabled/health-enabled are set (see keycloak-instance.yaml additionalOptions).
# We select the operator-created keycloak-service (which selects the Keycloak pods) and scrape the pods'
# management port by number via targetPort.
# SOLE OWNER: the operator's own ServiceMonitor (same name `keycloak`) is switched OFF in
#   keycloak-instance.yaml (spec.serviceMonitor.enabled: false) — 26.x defaults it ON and its apply
#   409-looped against this object on 2026-11-08. Keep exactly one of the two.
# TODO(WS-SEC, bring-up): confirm the management port number/name the operator exposes (9000 default)
#   and adjust targetPort if the pinned operator changes it. The KeycloakDown / KeycloakDatabaseDown
#   alerts (platform/monitoring/alerts.yaml) key on kube-state-metrics and fire regardless of this SM.
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: keycloak
  namespace: keycloak
  labels:
    release: kube-prometheus-stack
spec:
  namespaceSelector:
    matchNames:
      - keycloak
  selector:
    matchLabels:
      app: keycloak
  endpoints:
    - targetPort: 9000
      path: /metrics
      scheme: http
      interval: 30s