Add platform infrastructure configuration

services/observability/targets/README.md

@@ -0,0 +1,24 @@
+# Platform metric targets
+
+This component declares the manually owned monitor resources and counterpart
+NetworkPolicy needed to onboard existing platform services into the home
+Prometheus instance.
+
+The owners remain authoritative for their endpoint activation:
+
+- Gitea chart: `/metrics` and its generated ServiceMonitor
+- Keycloak Operator: management metrics and its generated ServiceMonitor
+- CloudNativePG: the declared `metrics` Pod port through a manual PodMonitor
+- AIStor: the v3 per-bucket usage endpoint through a manual ServiceMonitor
+- packaged Traefik chart: its dedicated metrics Service and ServiceMonitor
+
+The AIStor endpoint uses `MINIO_PROMETHEUS_AUTH_TYPE=public`, but no public
+route is created. Port 9000 remains protected by the namespace default-deny and
+the exact Prometheus/client allow policies. Because S3 and metrics share that
+L4 port, an already-authorized S3 client can also reach the credential-less
+metrics path; HTTP-path isolation is not expressible with NetworkPolicy.
+
+The first inventory is captured before blackbox is deployed. Grafana already
+exists and must be recorded explicitly as a preexisting, verify-only substrate
+target; it is not owned or rolled back by this component.
+

services/observability/targets/aistor/service-monitor.yaml

@@ -0,0 +1,28 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: aistor-bucket-usage
+  namespace: object-storage
+  labels:
+    app.kubernetes.io/name: minio-aistor
+    app.kubernetes.io/component: bucket-usage-metrics
+    app.kubernetes.io/part-of: platform
+    observability.hyeonworks.com/instance: home
+spec:
+  jobLabel: aistor.min.io/objectStore
+  selector:
+    matchLabels:
+      aistor.min.io/objectStore: minio-aistor
+  namespaceSelector:
+    matchNames:
+      - object-storage
+  endpoints:
+    - port: http-minio
+      path: /minio/metrics/v3/cluster/usage/buckets
+      interval: 60s
+      scrapeTimeout: 10s
+      relabelings:
+        - action: keep
+          sourceLabels:
+            - __meta_kubernetes_service_name
+          regex: minio

services/observability/targets/cloudnative-pg/pod-monitor.yaml

@@ -0,0 +1,24 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: platform-postgres
+  namespace: platform-data
+  labels:
+    app.kubernetes.io/name: platform-postgres
+    app.kubernetes.io/component: database-metrics
+    app.kubernetes.io/part-of: platform
+    observability.hyeonworks.com/instance: home
+spec:
+  jobLabel: cnpg.io/cluster
+  selector:
+    matchLabels:
+      cnpg.io/cluster: platform-postgres
+  namespaceSelector:
+    matchNames:
+      - platform-data
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics
+      interval: 30s
+      scrapeTimeout: 10s
+

services/observability/targets/counterpart-network-policies.yaml

@@ -0,0 +1,108 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: traefik-preserve-ingress-and-allow-prometheus-metrics
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/name: traefik
+    app.kubernetes.io/part-of: platform
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: traefik
+      app.kubernetes.io/instance: traefik-kube-system
+  policyTypes:
+    - Ingress
+  ingress:
+    # Preserve the pre-policy HTTP, HTTPS, and health reachability. The new
+    # policy isolates the selected Pod, so omitting these ports would break the
+    # existing NodePort and controller health paths.
+    - ports:
+        - protocol: TCP
+          port: 8000
+        - protocol: TCP
+          port: 8443
+        - protocol: TCP
+          port: 8080
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: observability
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: prometheus
+              app.kubernetes.io/instance: observability-core-kube-pr-prometheus
+      ports:
+        - protocol: TCP
+          port: 9100
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: observability-allow-prometheus-platform-targets
+  namespace: observability
+  labels:
+    app.kubernetes.io/name: prometheus
+    app.kubernetes.io/part-of: platform-observability
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: prometheus
+      app.kubernetes.io/instance: observability-core-kube-pr-prometheus
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: gitea
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: gitea
+              app.kubernetes.io/instance: gitea
+      ports:
+        - protocol: TCP
+          port: 3000
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: keycloak
+          podSelector:
+            matchLabels:
+              app: keycloak
+              app.kubernetes.io/instance: keycloak
+              app.kubernetes.io/managed-by: keycloak-operator
+      ports:
+        - protocol: TCP
+          port: 9000
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: platform-data
+          podSelector:
+            matchLabels:
+              cnpg.io/cluster: platform-postgres
+      ports:
+        - protocol: TCP
+          port: 9187
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: object-storage
+          podSelector:
+            matchLabels:
+              aistor.min.io/objectStore: minio-aistor
+      ports:
+        - protocol: TCP
+          port: 9000
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+              app.kubernetes.io/instance: traefik-kube-system
+      ports:
+        - protocol: TCP
+          port: 9100

services/observability/targets/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - cloudnative-pg/pod-monitor.yaml
+  - aistor/service-monitor.yaml
+  - counterpart-network-policies.yaml
+