This component declares the manually owned monitor resources and counterpart NetworkPolicy needed to onboard existing platform services into the home Prometheus instance.

The owners remain authoritative for their endpoint activation:

Gitea chart: /metrics and its generated ServiceMonitor
Keycloak Operator: management metrics and its generated ServiceMonitor
CloudNativePG: the declared metrics Pod port through a manual PodMonitor
AIStor: the v3 per-bucket usage endpoint through a manual ServiceMonitor
packaged Traefik chart: its dedicated metrics Service and ServiceMonitor

The AIStor endpoint uses MINIO_PROMETHEUS_AUTH_TYPE=public, but no public route is created. Port 9000 remains protected by the namespace default-deny and the exact Prometheus/client allow policies. Because S3 and metrics share that L4 port, an already-authorized S3 client can also reach the credential-less metrics path; HTTP-path isolation is not expressible with NetworkPolicy.

The first inventory is captured before blackbox is deployed. Grafana already exists and must be recorded explicitly as a preexisting, verify-only substrate target; it is not owned or rolled back by this component.