Merge pull request 'feat(monitoring): blackbox-http probe for shelly-manager /health (REN-533)' (#1105) from atlas/ren-533-shelly-manager-probe into master

kubernetes/apps/monitoring-rules/probes-blackbox.yaml

@@ -261,6 +261,32 @@ spec:
         # at 2b71dda1, and the tested one-line deletion for this target alone
         # is the second command listed there (20 -> 19 targets).
         - http://paperless.paperless.svc.cluster.local:80/accounts/login/
+        # anchor: shelly-manager-app-health
+        # APP-HEALTH probe for shelly-manager (REN-531/REN-533). Same rule as
+        # the blocks above (monitoring-vantage-point-rule): shelly.renner.uno
+        # sits behind the shelly-manager-gate outpost, so only the in-cluster
+        # Service can tell a dead app from a live gate.
+        #
+        # /health is unauthenticated and answers a plain 200 — not a 3xx —
+        # per the app's own test (shelly-manager repo,
+        # AuthenticationTests.Health_IsUnauthenticated); it is also the pod's
+        # kubelet liveness/readiness path
+        # (../home-assistant/shelly-manager-deployment.yaml). AllowedHosts is
+        # "*", so the cluster-local Host header is accepted. Service :80 ->
+        # container :8080 (../home-assistant/shelly-manager-service.yaml).
+        #
+        # NO CiliumNetworkPolicy change: the home-assistant default-deny
+        # admits the whole monitoring namespace on every port
+        # (../../infrastructure/network-policies/home-assistant-ns.yaml,
+        # "Prometheus scrape" rule). If that rule is ever narrowed to
+        # Prometheus alone, add a blackbox-exporter grant on :8080 in a
+        # DEDICATED policy selecting shelly-manager — not on the {} selector,
+        # where :8080 is shared by three apps. The EGRESS paragraph above
+        # applies too: a future monitoring egress block must list
+        # home-assistant.
+        #
+        # REVERT: delete the target line below.
+        - http://shelly-manager.home-assistant.svc.cluster.local:80/health
 # WAN-path probes of the public edge BY PROXY IP. The name-based
 # home.renner.uno probe above resolves in-cluster (CoreDNS/k8s_gateway)
 # and never leaves the LAN — the vantage-point blind spot that let the