docs(monitoring): record the ESO scrape's trust boundary and real grant scope (REN-100)

Comment-only. No manifest field changes, so `kustomize build` output is
byte-identical before and after.

Two gaps in what REN-103's merged scrape says about itself, both raised in
review of PR #994/#996:

  * The metrics endpoint is plain HTTP with no authentication. That is chart
    2.11.0's default (`metrics.listen.secure.enabled` and
    `metrics.listen.auth.enabled` both false, values.yaml:365-369) and this
    repo overrides neither, so what actually bounds the exposure is the
    CiliumNetworkPolicy, not the endpoint. A reader adding `tlsConfig` to the
    PodMonitor would have broken the scrape; say so in the file.

  * The network policy comment implied the grant reaches the controller. It
    does not: the CNP's `endpointSelector` is {}, so monitoring→:8080 is
    admitted for all three ESO deployments, which all serve metrics on that
    port. Only the controller is scraped, because the PodMonitor's selector is
    exact on the unsuffixed name. Reachable-but-unvisited is the accurate
    description and the one a future reader needs.

Also corrected two counts in the same comment. The port-scoping is not unique
in this directory — home-assistant-ns.yaml does it too, so 17 of the other 18
`monitoring` grants are namespace-wide, not all 18. And there is no single
"health port": the controller's is 8082, the webhook's and cert-controller's
are 8081 (values.yaml:501-504, 564-570, 882-885).

Revert: `git revert` this commit. It restores the previous comment text and
touches no applied field.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

kubernetes/apps/monitoring-rules/external-secrets-podmonitor.yaml

@@ -29,6 +29,17 @@
 # been dropped and the metric would have stayed absent. The matching ingress rule
 # is added to infrastructure/network-policies/external-secrets-ns.yaml in the
 # same pull request. Without it this file is decoration.
+#
+# NO TLS AND NO AUTH ON THIS SCRAPE, and that is the chart's posture rather than
+# an omission here. In 2.11.0 `metrics.listen.secure.enabled` and
+# `metrics.listen.auth.enabled` are both false (values.yaml:365-369) and
+# infrastructure/external-secrets/helmrelease.yaml overrides neither, so the
+# controller serves /metrics over plain HTTP to anything that can reach :8080.
+# Hence no `scheme`, no `tlsConfig` and no `bearerTokenSecret` below: adding
+# them would break the scrape, not harden it. What limits exposure is the
+# network policy — a single port from a single namespace — so turning on
+# `secure.enabled` here would mean a Helm upgrade of ESO to close a hole the
+# CiliumNetworkPolicy already closes.
 apiVersion: monitoring.coreos.com/v1
 kind: PodMonitor
 metadata:

kubernetes/infrastructure/network-policies/external-secrets-ns.yaml

@@ -16,13 +16,24 @@ spec:
     # dropped and `externalsecret_status_condition` held 0 series.
     #
     # Port-restricted, unlike the equivalent rule in velero-ns.yaml, which admits
-    # `monitoring` to the whole namespace. 8080 is the metrics port and the only
-    # thing `monitoring` has any business reaching here; the webhook (10250) and
-    # the health port stay closed to it. 8080 is the chart default
+    # `monitoring` to the whole namespace. Only home-assistant-ns.yaml does the
+    # same; the other 17 `monitoring` grants in this directory are namespace-wide.
+    # 8080 is the metrics port and the only thing `monitoring` has any business
+    # reaching here; the webhook (10250) and the health ports (8082 on the
+    # controller, 8081 on the other two) stay closed to it. 8080 is the chart
+    # default
     # (`metrics.listen.port`) and helmrelease.yaml does not override it — if that
     # is ever overridden, this port and the PodMonitor's named `metrics` endpoint
     # both have to follow.
     #
+    # Scoped by PORT, not by pod: this CNP's `endpointSelector` is {}, so the
+    # grant reaches all three of the chart's deployments — controller, webhook,
+    # cert-controller — which all serve metrics on 8080. Only the controller is
+    # scraped today (the PodMonitor's selector is exact on the unsuffixed name),
+    # so the extra two are reachable-but-unvisited. Deliberate: adding a monitor
+    # for either later needs no policy change, and neither exposes more than
+    # controller-runtime internals on that port.
+    #
     # The consumer is apps/monitoring-rules/external-secrets-podmonitor.yaml.
     # Additive: this rule cannot deny anything previously allowed, so ESO's
     # existing reachability to OpenBao and the apiserver is unchanged.