claude-botandClaude Opus 5.5
469abc9305
The authentik chart renders server/servicemonitor.yaml whenever server.metrics.serviceMonitor.enabled is set, without checking .Capabilities for monitoring.coreos.com (verified in chart 2026.8.3). The authentik Kustomization does not depend on monitoring, so on an empty cluster the Helm install fails until kube-prometheus-stack has installed the CRDs. The chart's ServiceMonitor is switched off and declared standalone in monitoring-rules, as cilium and velero already do. The selector matches the live Service authentik-server-metrics (port metrics, 9300); the new name differs from the chart's authentik-server, so the two never contend for one object while production rolls over. authentik-outpost-servicemonitors.yaml hand-wrote a headless Service ak-outpost-local-radius-metrics and a ServiceMonitor for it, because the radius outpost controller used not to expose its metrics port. authentik 2026.8.3 does: the operator creates that Service (http-metrics 9300) and its own ServiceMonitor. On a cold cluster the operator created the Service first, with a ClusterIP; clusterIP is immutable, so the dry-run of the hand-written clusterIP: None copy failed and took the whole monitoring-rules Kustomization with it (restore test run 29). The file goes; the operator owns both. No alert rule refers to the radius job. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
25 lines
640 B
YAML
25 lines
640 B
YAML
---
|
|
# authentik server metrics. The chart's metrics Service stays; only its
|
|
# ServiceMonitor is declared here (see apps/authentik/helmrelease.yaml).
|
|
apiVersion: monitoring.coreos.com/v1
|
|
kind: ServiceMonitor
|
|
metadata:
|
|
name: authentik-server-metrics
|
|
namespace: authentik
|
|
labels:
|
|
release: kube-prometheus-stack
|
|
spec:
|
|
namespaceSelector:
|
|
matchNames:
|
|
- authentik
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: authentik
|
|
app.kubernetes.io/instance: authentik
|
|
app.kubernetes.io/component: server-metrics
|
|
endpoints:
|
|
- port: metrics
|
|
path: /metrics
|
|
interval: 30s
|
|
scrapeTimeout: 3s
|