---
# ServiceMonitors so the platform Prometheus (kube-prometheus-stack, monitoring ns) scrapes the
# KubeVirt + CDI control-plane metrics (docs/10 — "KubeVirt: VM crash-loops / failed launches" is a
# first-class platform-health signal). These are CRs of the monitoring.coreos.com CRD installed by the
# kube-prometheus-stack HelmRelease, so — like platform/monitoring/alerts.yaml — they are applied by
# the `platform-config` Flux Kustomization (dependsOn: platform), NOT in the controllers pass (F-MON1).
#
# Prometheus discovers ServiceMonitors cluster-wide (serviceMonitorSelectorNilUsesHelmValues:false in
# platform/monitoring/kube-prometheus-stack.yaml), so these can live beside their target Services.
# NOTE (verify at bring-up, same convention as alerts.yaml): KubeVirt serves metrics over HTTPS with a
# self-signed internal cert (insecureSkipVerify) on the port named `metrics`. virt-operator does NOT
# ship its own ServiceMonitor, so this one is required.
#
# CDI is intentionally NOT scraped here: the cdi-operator manages its own `service-monitor-cdi`
# (scheme https + a cdi-metrics-reader-token, owned by the cdi-operator Deployment) which backs CDI's
# shipped recording rules (kubevirt_cdi_operator_up / cluster:kubevirt_cdi_operator_up:sum) and the
# CDIOperatorDown alert. A second http ServiceMonitor here added down (400) targets for the same pods,
# poisoning that up-aggregation to 0 and firing a false CDIOperatorDown — so it was removed.
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: kubevirt
  namespace: kubevirt
  labels:
    release: kube-prometheus-stack
spec:
  selector:
    matchLabels:
      prometheus.kubevirt.io: "true"
  namespaceSelector:
    matchNames:
      - kubevirt
  endpoints:
    - port: metrics
      scheme: https
      tlsConfig:
        insecureSkipVerify: true
      honorLabels: true
      interval: 30s