jakman85andClaude Opus 5.5
35ba875380
The 26.x Keycloak operator creates its own ServiceMonitor named after the CR (keycloak/keycloak) when metrics are enabled; spec.serviceMonitor.enabled defaults true. That collides with the Flux-owned platform/keycloak/ servicemonitor.yaml: the operator's PATCH 409s, it exhausts retries, the CR stays Ready=False/HasErrors=True, and platform-config (wait: true) stalls every downstream Kustomization. Keep the repo's ServiceMonitor (conformance L0/L2 and the dashboard are written against it; the operator's scrapes the same port 9000 /metrics) and set spec.serviceMonitor.enabled: false. Co-Authored-By: Claude Opus 5.5 <[email protected]>
36 lines
1.6 KiB
YAML
36 lines
1.6 KiB
YAML
---
|
|
# ServiceMonitor for Keycloak (R-OBS-01, docs/10). CR of monitoring.coreos.com (kube-prometheus-stack,
|
|
# Phase 4) — CARRIED BY platform-config so it is not applied in the same pass as the CRD-installing
|
|
# HelmRelease (F-MON1). Prometheus discovers ServiceMonitors in all namespaces
|
|
# (serviceMonitorSelectorNilUsesHelmValues=false).
|
|
#
|
|
# Keycloak 26 exposes health + Prometheus metrics on the MANAGEMENT interface (port 9000, path
|
|
# /metrics) once metrics-enabled/health-enabled are set (see keycloak-instance.yaml additionalOptions).
|
|
# We select the operator-created keycloak-service (which selects the Keycloak pods) and scrape the pods'
|
|
# management port by number via targetPort.
|
|
# SOLE OWNER: the operator's own ServiceMonitor (same name `keycloak`) is switched OFF in
|
|
# keycloak-instance.yaml (spec.serviceMonitor.enabled: false) — 26.x defaults it ON and its apply
|
|
# 409-looped against this object on 2026-11-08. Keep exactly one of the two.
|
|
# TODO(WS-SEC, bring-up): confirm the management port number/name the operator exposes (9000 default)
|
|
# and adjust targetPort if the pinned operator changes it. The KeycloakDown / KeycloakDatabaseDown
|
|
# alerts (platform/monitoring/alerts.yaml) key on kube-state-metrics and fire regardless of this SM.
|
|
apiVersion: monitoring.coreos.com/v1
|
|
kind: ServiceMonitor
|
|
metadata:
|
|
name: keycloak
|
|
namespace: keycloak
|
|
labels:
|
|
release: kube-prometheus-stack
|
|
spec:
|
|
namespaceSelector:
|
|
matchNames:
|
|
- keycloak
|
|
selector:
|
|
matchLabels:
|
|
app: keycloak
|
|
endpoints:
|
|
- targetPort: 9000
|
|
path: /metrics
|
|
scheme: http
|
|
interval: 30s
|