---
# Prometheus scrape of the aggregate-only /metrics (:9090). Only the `metrics` port of the shared
# Service; networkpolicy.yaml admits only Prometheus on it. kube-prometheus-stack selects
# ServiceMonitors from any namespace; the `release` label is kept for consistency.
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: vuln-scanner
  namespace: vuln-scanner
  labels:
    app.kubernetes.io/name: vuln-scanner
    release: kube-prometheus-stack
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: vuln-scanner
  endpoints:
    - port: metrics
      path: /metrics
      interval: 60s