# Istio Ambient Prometheus Monitors
# Required for Kiali to display traffic graphs
#
# PodMonitor (ztunnel): Scrapes ztunnel L4 metrics from all nodes
# PodMonitor (waypoint): Scrapes waypoint proxy L7 metrics
# ServiceMonitor (istiod): Scrapes istiod control plane metrics
#
# All require label 'release: kube-prometheus-stack' to be picked up
# by the Prometheus Operator's selector.
---
# ztunnel metrics - L4 mTLS traffic metrics from ambient mesh
apiVersion: monitoring.coreos.com/v1
kind: PodMonitor
metadata:
  name: ztunnel
  namespace: istio-system
  labels:
    release: kube-prometheus-stack
spec:
  selector:
    matchLabels:
      app: ztunnel
  namespaceSelector:
    matchNames:
      - istio-system
  podMetricsEndpoints:
    - path: /stats/prometheus
      port: ztunnel-stats
      interval: 30s
---
# Waypoint proxy metrics - L7 AuthorizationPolicy + ext_authz metrics
apiVersion: monitoring.coreos.com/v1
kind: PodMonitor
metadata:
  name: istio-waypoint
  namespace: istio-system
  labels:
    release: kube-prometheus-stack
spec:
  selector:
    matchExpressions:
      - key: gateway.networking.k8s.io/gateway-name
        operator: Exists
  namespaceSelector:
    any: true
  podMetricsEndpoints:
    - path: /stats/prometheus
      port: http-envoy-prom
      interval: 30s
---
# istiod control plane metrics (unchanged from sidecar mode)
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: istiod
  namespace: istio-system
  labels:
    release: kube-prometheus-stack
spec:
  selector:
    matchLabels:
      istio: pilot
  namespaceSelector:
    matchNames:
    - istio-system
  endpoints:
  - port: http-monitoring
    interval: 30s