From c3a11bccec6ec80fee52b037533abb2deba4cd02 Mon Sep 17 00:00:00 2001 From: Admin Bot Date: Tue, 29 Sep 2026 22:08:02 +0800 Subject: [PATCH] fix(netpol): allow Prometheus scrape of gateway /metrics MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Selector used a plain `name: monitoring` label, but only ingress-nginx carries that label in this cluster — every other namespace has just kubernetes.io/metadata.name. The rule matched nothing, so the new api-gateway ServiceMonitor discovered all 3 replicas but every scrape died with context deadline exceeded. Switch to kubernetes.io/metadata.name: monitoring. --- k8s/network-policy.yaml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/k8s/network-policy.yaml b/k8s/network-policy.yaml index c82ec15..619dace 100644 --- a/k8s/network-policy.yaml +++ b/k8s/network-policy.yaml @@ -21,11 +21,17 @@ spec: ports: - protocol: TCP port: 8080 - # Allow from Prometheus scraping (if in monitoring namespace) + # Allow from Prometheus scraping (monitoring namespace) + # MUST select on kubernetes.io/metadata.name, not a plain `name:` label. + # Only ingress-nginx carries a plain `name` label in this cluster; every + # other namespace has just kubernetes.io/metadata.name, so `name: monitoring` + # matched nothing and silently denied every Prometheus scrape of :8080 + # (surfaced as context-deadline-exceeded on all 3 gateway replicas while the + # ServiceMonitor itself was discovered and healthy). - from: - namespaceSelector: matchLabels: - name: monitoring + kubernetes.io/metadata.name: monitoring ports: - protocol: TCP port: 8080 -- 2.54.0