Fix spire-server PodMonitor controller-manager port names (#932)

The PodMonitor targeted the port name prom-cm, but controller-manager containers expose pm-cm (and auto-suffixed/overridable names for external managers), so their metrics were never scraped. Resolve port names through a shared helper and enumerate every controller-manager in the PodMonitor. Signed-off-by: sabsari <[email protected]> Co-authored-by: Claude Opus 4.8 <[email protected]>
2026-08-30 08:44:56 -07:00
parent cb0f08e53a
commit 85ab0fa5ab
3 changed files with 174 additions and 27 deletions
@@ -810,6 +810,104 @@ spire-server:
 			}
 		})
 	})
+	Describe("spire-server.telemetry.podMonitor controller-manager ports", func() {
+		podMonitorTmpl := "spire/charts/spire-server/templates/podmonitor.yaml"
+		serverTmpl := "spire/charts/spire-server/templates/server-resource.yaml"
+
+		It("targets the real main controller-manager port name, not the legacy prom-cm", func() {
+			objs, err := ValueStringRender(chart, `
+spire-server:
+  controllerManager:
+    enabled: true
+  telemetry:
+    prometheus:
+      enabled: true
+      podMonitor:
+        enabled: true
+`)
+			Expect(err).Should(Succeed())
+			podMonitor := objs[podMonitorTmpl]
+			Expect(podMonitor).Should(ContainSubstring("- port: prom"))
+			Expect(podMonitor).Should(ContainSubstring("- port: pm-cm"))
+			// Regression: the PodMonitor used to hardcode a port name the container never renders.
+			Expect(podMonitor).ShouldNot(ContainSubstring("prom-cm"))
+			// The endpoint must match the actual container port.
+			Expect(objs[serverTmpl]).Should(ContainSubstring("name: pm-cm"))
+		})
+
+		It("enumerates external controller-managers, honouring auto-suffix and prometheusPortName override", func() {
+			objs, err := ValueStringRender(chart, `
+spire-server:
+  controllerManager:
+    enabled: true
+  telemetry:
+    prometheus:
+      enabled: true
+      podMonitor:
+        enabled: true
+  kubeConfigs:
+    child01:
+      kubeConfig: |
+        apiVersion: v1
+        kind: Config
+    verylongclustername:
+      kubeConfig: |
+        apiVersion: v1
+        kind: Config
+  externalControllerManagers:
+    enabled: true
+    clusters:
+      child01:
+        kubeConfigName: child01
+      verylongclustername:
+        kubeConfigName: verylongclustername
+        prometheusPortName: prom-ext2
+`)
+			Expect(err).Should(Succeed())
+			podMonitor := objs[podMonitorTmpl]
+			server := objs[serverTmpl]
+			// Auto-suffixed external CM and the overridden one must both be scraped,
+			// and each endpoint must match a real container port name.
+			for _, port := range []string{"pm-cm", "pm-cm-child01", "prom-ext2"} {
+				Expect(podMonitor).Should(ContainSubstring("- port: " + port))
+				Expect(server).Should(ContainSubstring("name: " + port))
+			}
+		})
+
+		It("derives external controller-managers from kubeConfigs when clusters is the default {}", func() {
+			objs, err := ValueStringRender(chart, `
+spire-server:
+  controllerManager:
+    enabled: true
+  telemetry:
+    prometheus:
+      enabled: true
+      podMonitor:
+        enabled: true
+  kubeConfigs:
+    child01:
+      kubeConfig: |
+        apiVersion: v1
+        kind: Config
+    child02:
+      kubeConfig: |
+        apiVersion: v1
+        kind: Config
+  externalControllerManagers:
+    enabled: true
+    clusters: {}
+`)
+			Expect(err).Should(Succeed())
+			podMonitor := objs[podMonitorTmpl]
+			server := objs[serverTmpl]
+			// clusters={} (the chart default) falls back to kubeConfigs, so each
+			// kubeConfig-derived controller-manager must be scraped and match its port.
+			for _, port := range []string{"pm-cm", "pm-cm-child01", "pm-cm-child02"} {
+				Expect(podMonitor).Should(ContainSubstring("- port: " + port))
+				Expect(server).Should(ContainSubstring("name: " + port))
+			}
+		})
+	})
 	Describe("spire-server.dataStore.sql.postgres passwordless", func() {
 		It("omits password and the -dbpw Secret for cert auth with an empty password", func() {
 			objs, err := ValueStringRender(chart, `