Repository navigation
feat(monitoring): add optional PodMonitor and metrics policy - #1
Draft
cooktheryan wants to merge 3 commits into
Draft
cooktheryan wants to merge 3 commits into
cooktheryan wants to merge 3 commits into
Conversation
cooktheryan
force-pushed
the
feat/issue-1302-rollout-operator
branch
3 times, most recently
from
November 4, 2026 20:35
6a11771 to
0dd3490
Compare
cooktheryan
force-pushed
the
issue-23-monitoring
branch
4 times, most recently
from
November 6, 2026 16:54
bc6bf87 to
68c479b
Compare
Opt-in PodMonitor and metrics-only NetworkPolicy for managed data planes, with ownership-checked cleanup when monitoring is disabled or no usable listeners remain. The reserved metrics port 9902 stays out of the data-plane listeners and Service ports, and a listener requesting it is rejected without blocking valid siblings. The metrics contract moves the admin endpoint to a dedicated admin.metrics_address, so health and metrics no longer need public admin access. Only this monitoring work and its contract stay in this change; the HA rollout, rollout-test, routing, hostname, route-status, and deployment rollout-policy changes live in the rollout branch. Signed-off-by: Ryan Cook <rcook@redhat.com>
cooktheryan
force-pushed
the
issue-23-monitoring
branch
from
November 6, 2026 17:04
68c479b to
1dcc293
Compare
Signed-off-by: Ryan Cook <rcook@redhat.com>
- Pass the borrowed usable listeners into route attachment and namespace filtering; both helpers now accept Borrow<GatewayListeners>, so a reconcile no longer clones every listener. - Terminate a listener with no routes with a 404 static response, which Praxis 0.7.5 needs instead of an empty router chain, and update the generate tests accordingly. - Compare the recreated NetworkPolicy and PodMonitor with their expected specs after the listener is restored, not only their existence. - Run the monitoring test's enabled and disabled-cleanup phases in CI, installing the PodMonitor CRD and toggling the operator Deployment's PRAXIS_MONITORING_ENABLED between runs; the disabled no-CRD phase already runs with the integration suite. Signed-off-by: Ryan Cook <rcook@redhat.com>
cooktheryan
force-pushed
the
issue-23-monitoring
branch
from
November 6, 2026 19:16
77aa186 to
05c3620
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes praxis-proxy#23
Configuration
Set
PRAXIS_MONITORING_ENABLED=trueto enable the resources. The monitoring namespace and Prometheus pod label selector are configurable withPRAXIS_MONITORING_NAMESPACEandPRAXIS_MONITORING_POD_SELECTOR.This PR targets the rollout-contract branch from PR praxis-proxy#24 so the diff is limited to the monitoring follow-up; merge it after that branch lands or retarget it to main once the 9902 metrics contract is available there.
Validation
cargo +nightly fmt --checkon changed Rust filescargo clippy -p praxis-operator --all-targets -- -D warningscargo test -p praxis-operator --lib— 477 passedgit diff --checkThe generated NetworkPolicy intentionally does not restrict the data listener. Clusters whose CNI applies policy to node-originated kubelet probes need a separate node-CIDR allowance.