Initial commit

infrastructure/istio/manifests/mesh/monitoring.yaml

@@ -0,0 +1,68 @@
+# Istio Ambient Prometheus Monitors
+# Required for Kiali to display traffic graphs
+#
+# PodMonitor (ztunnel): Scrapes ztunnel L4 metrics from all nodes
+# PodMonitor (waypoint): Scrapes waypoint proxy L7 metrics
+# ServiceMonitor (istiod): Scrapes istiod control plane metrics
+#
+# All require label 'release: kube-prometheus-stack' to be picked up
+# by the Prometheus Operator's selector.
+---
+# ztunnel metrics - L4 mTLS traffic metrics from ambient mesh
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: ztunnel
+  namespace: istio-system
+  labels:
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchLabels:
+      app: ztunnel
+  namespaceSelector:
+    matchNames:
+      - istio-system
+  podMetricsEndpoints:
+    - path: /stats/prometheus
+      port: http-monitoring
+      interval: 30s
+---
+# Waypoint proxy metrics - L7 AuthorizationPolicy + ext_authz metrics
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: istio-waypoint
+  namespace: istio-system
+  labels:
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchExpressions:
+      - key: gateway.networking.k8s.io/gateway-name
+        operator: Exists
+  namespaceSelector:
+    any: true
+  podMetricsEndpoints:
+    - path: /stats/prometheus
+      port: http-envoy-prom
+      interval: 30s
+---
+# istiod control plane metrics (unchanged from sidecar mode)
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: istiod
+  namespace: istio-system
+  labels:
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchLabels:
+      istio: pilot
+  namespaceSelector:
+    matchNames:
+    - istio-system
+  endpoints:
+  - port: http-monitoring
+    interval: 30s