feat(helm): scrape Envoy Gateway proxy metrics via PodMonitor#48
Open
dmathur0 wants to merge 4 commits into
Open
feat(helm): scrape Envoy Gateway proxy metrics via PodMonitor#48dmathur0 wants to merge 4 commits into
dmathur0 wants to merge 4 commits into
Conversation
Add a PodMonitor that selects the Envoy Gateway data-plane proxy pods
(app.kubernetes.io/name=envoy, component=proxy) and scrapes their
Prometheus metrics ("metrics" port at /stats/prometheus). Gated behind
ingress.type=envoyGateway plus monitoring.podMonitors.envoyProxy.enabled
(off by default), with the gateway namespace defaulting to
networkPolicy.gatewayNamespace.
dmathur0
requested review from
jojung1,
polarweasel,
ryanheffernan,
spidercensus,
susanhooks and
zsblevins
as code owners
📝 WalkthroughWalkthroughAdds installer-managed Envoy Gateway proxy PodMonitor generation and conditional installation when Envoy Gateway and observability are enabled, documents that the chart does not scrape those pods, and adds unit plus live-cluster validation for the PodMonitor manifest and deployed resource. ChangesEnvoy Gateway Proxy PodMonitor
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Collaborator
Author
|
our clusters already came with this podmonitor from the envoy gateway install looks like |
Envoy Gateway proxies are a shared, cluster-scoped resource and only emit prometheus.io/scrape annotations (no PodMonitor), which operator/CR-based scrapers like the bundled Alloy stack ignore. A per-release chart PodMonitor also duplicate-scraped every gateway proxy and collided with the broad PodMonitor that gateway-owning deployments (e.g. prod ArgoCD) already ship. Move scraping to whoever installs Envoy Gateway: drop the chart-level monitoring.podMonitors.envoyProxy PodMonitor and instead have the TUI installer apply one cluster-scoped PodMonitor in envoy-gateway-system, gated on install_envoy_gateway AND observability_enabled (so the monitoring CRDs and the Alloy scraper both exist), applied after the CRDs register.
Add a live-cluster integration test that verifies the installer-managed cluster-scoped envoy-proxy PodMonitor exists in envoy-gateway-system with the expected proxy selector and metrics/stats endpoint. Gated behind a skipif on OBSERVABILITY (mirroring test_probe_labels.py): skipped at collection unless the kind job deploys the observability stack, where a missing PodMonitor is then a real failure of the envoy-gateway + observability install path.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@installer/src/nv_config_manager_installer/deployer.py`:
- Around line 702-706: The selector in the Envoy scrape manifest is too loose
because it only matches component=proxy and managed-by=envoy-gateway, missing
the stable app.kubernetes.io/name=envoy label. Update the selector in the
deployer logic that builds this manifest to include the Envoy pod label set,
then adjust the related unit test and live-cluster assertion so they expect the
tightened selector from the same manifest-building path.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: b6356ea3-68ca-4390-8f8e-8a3b74fe17ea
📒 Files selected for processing (4)
deploy/helm/values.yamlinstaller/src/nv_config_manager_installer/deployer.pyinstaller/tests/test_deployer.pysrc/tests/integration/test_envoy_proxy_podmonitor.py
✅ Files skipped from review due to trivial changes (1)
- deploy/helm/values.yaml
Comment on lines
+702
to
+706
| "selector": { | ||
| "matchLabels": { | ||
| "app.kubernetes.io/component": "proxy", | ||
| "app.kubernetes.io/managed-by": "envoy-gateway", | ||
| }, |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Add the stable Envoy pod label to the selector.
This manifest does not implement the PR’s advertised target contract: it matches component=proxy plus managed-by=envoy-gateway, but omits app.kubernetes.io/name=envoy. With namespaceSelector.any: true, that makes the scrape target depend on a looser implementation detail instead of the stated Envoy pod label set. Please tighten the selector here, then update the unit and live-cluster assertions to match.
Suggested change
"selector": {
"matchLabels": {
+ "app.kubernetes.io/name": "envoy",
"app.kubernetes.io/component": "proxy",
"app.kubernetes.io/managed-by": "envoy-gateway",
},
},📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| "selector": { | |
| "matchLabels": { | |
| "app.kubernetes.io/component": "proxy", | |
| "app.kubernetes.io/managed-by": "envoy-gateway", | |
| }, | |
| "selector": { | |
| "matchLabels": { | |
| "app.kubernetes.io/name": "envoy", | |
| "app.kubernetes.io/component": "proxy", | |
| "app.kubernetes.io/managed-by": "envoy-gateway", | |
| }, |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@installer/src/nv_config_manager_installer/deployer.py` around lines 702 -
706, The selector in the Envoy scrape manifest is too loose because it only
matches component=proxy and managed-by=envoy-gateway, missing the stable
app.kubernetes.io/name=envoy label. Update the selector in the deployer logic
that builds this manifest to include the Envoy pod label set, then adjust the
related unit test and live-cluster assertion so they expect the tightened
selector from the same manifest-building path.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add a PodMonitor that selects the Envoy Gateway data-plane proxy pods (app.kubernetes.io/name=envoy, component=proxy) and scrapes their Prometheus metrics ("metrics" port at /stats/prometheus). Gated behind ingress.type=envoyGateway plus monitoring.podMonitors.envoyProxy.enabled (off by default), with the gateway namespace defaulting to networkPolicy.gatewayNamespace.
Description
Validation
The kind integration test is manual due to taking ~30 min to complete. When the PR is ready for review,
run Actions -> Kind Integration -> Run workflow against the copy-pr-bot generated
pull-request/<PR_NUMBER>branch. Use the defaulttest_pathfor the full suite,or narrow it only while debugging.
Passing Kind Integration run:
Checklist
CONTRIBUTING.md.docs screenshots, or Helm/rendered outputs.
Summary by CodeRabbit
New Features
Documentation
Bug Fixes