jakman85andClaude Opus 5.5
09f219fe7f
servicemonitor-ports-resolve could not audit a PodMonitor with no in-repo Service, and no-plaintext-secrets requires a template's secret value to be a bare placeholder. Co-Authored-By: Claude Opus 5.5 <[email protected]>
46 lines
1.4 KiB
YAML
46 lines
1.4 KiB
YAML
---
|
|
# Scrape of cloudflared's own metrics server (:2000, `metrics:` in config.yaml) on every replica.
|
|
#
|
|
# A Service + ServiceMonitor in ONE file rather than a PodMonitor, on purpose: the repo's L0 checks
|
|
# (servicemonitor-ports-resolve, alert-metrics-have-scrape-targets assertion 4) can then prove the
|
|
# monitor's port is a port this Service actually defines. A PodMonitor would have to be declared as
|
|
# an unauditable exception. The Service is headless and carries only the metrics port — it is not a
|
|
# way into the tunnel, and nothing routes to it but Prometheus (networkpolicy.yaml admits only the
|
|
# monitoring namespace on :2000).
|
|
#
|
|
# kube-prometheus-stack runs with serviceMonitorSelectorNilUsesHelmValues: false, so this is
|
|
# selected from any namespace; the `release` label is kept for consistency.
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: cloudflared-metrics
|
|
namespace: cloudflared
|
|
labels:
|
|
app.kubernetes.io/name: cloudflared
|
|
spec:
|
|
clusterIP: None
|
|
selector:
|
|
app.kubernetes.io/name: cloudflared
|
|
ports:
|
|
- name: metrics
|
|
port: 2000
|
|
targetPort: metrics
|
|
protocol: TCP
|
|
---
|
|
apiVersion: monitoring.coreos.com/v1
|
|
kind: ServiceMonitor
|
|
metadata:
|
|
name: cloudflared
|
|
namespace: cloudflared
|
|
labels:
|
|
app.kubernetes.io/name: cloudflared
|
|
release: kube-prometheus-stack
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: cloudflared
|
|
endpoints:
|
|
- port: metrics
|
|
path: /metrics
|
|
interval: 30s
|