fix: replace deprecated CNPG enablePodMonitor with TLS-configured PodMonitor #103

New issue

Closed

opened 2026-03-17 04:31:26 +00:00 by forgejo_admin · 0 comments

forgejo_admin commented

2026-03-17 04:31:26 +00:00

Owner

Lineage

todo-cnpg-metrics-exporter (no plan ancestry)

Repo

forgejo_admin/pal-e-platform

User Story

As a platform operator
I want CNPG postgres metrics scraped reliably by Prometheus
So that database observability is not silently broken by a deprecated auto-generated PodMonitor

Context

The CNPG operator's enablePodMonitor: true auto-generates a PodMonitor that is missing TLS configuration, causing Prometheus to drop the CNPG metrics target on port 9187. The port IS listening and serving metrics, but the scrape target stays down. Additionally, enablePodMonitor is deprecated in CNPG 1.28 and will be removed in a future release. The fix is to set enablePodMonitor = false and create a manual PodMonitor resource with the correct selector labels. The CA cert exists in the woodpecker-db-ca secret in the woodpecker namespace.

File Targets

Files the agent should modify:

terraform/main.tf -- change enablePodMonitor = true to false, add new kubernetes_manifest resource for the manual PodMonitor

Files the agent should NOT touch:

Any other terraform files -- this is scoped to the CNPG monitoring block only

Acceptance Criteria

When I run tofu plan, then the CNPG cluster shows monitoring.enablePodMonitor changing to false
When I run tofu plan, then a new PodMonitor resource woodpecker-db is created
When I run kubectl get podmonitor -n woodpecker after apply, then woodpecker-db appears
When I check Prometheus targets after apply, then the CNPG postgres target shows UP

Test Expectations

tofu fmt -check -recursive passes
tofu validate passes (requires state, CI-only)
Run command: cd terraform && tofu fmt -check -recursive

Constraints

Start with plain HTTP PodMonitor (no TLS in podMetricsEndpoints) -- port 9187 serves HTTP by default
Add TLS config in a follow-up if needed after verifying the manual PodMonitor works
Place the new resource between woodpecker_postgres and woodpecker_postgres_scheduled_backup

Checklist

PR opened
Tests pass
No unrelated changes

todo-cnpg-metrics-exporter
pal-e-platform -- project this affects

### Lineage `todo-cnpg-metrics-exporter` (no plan ancestry) ### Repo `forgejo_admin/pal-e-platform` ### User Story As a platform operator I want CNPG postgres metrics scraped reliably by Prometheus So that database observability is not silently broken by a deprecated auto-generated PodMonitor ### Context The CNPG operator's `enablePodMonitor: true` auto-generates a PodMonitor that is missing TLS configuration, causing Prometheus to drop the CNPG metrics target on port 9187. The port IS listening and serving metrics, but the scrape target stays down. Additionally, `enablePodMonitor` is deprecated in CNPG 1.28 and will be removed in a future release. The fix is to set `enablePodMonitor = false` and create a manual `PodMonitor` resource with the correct selector labels. The CA cert exists in the `woodpecker-db-ca` secret in the woodpecker namespace. ### File Targets Files the agent should modify: - `terraform/main.tf` -- change `enablePodMonitor = true` to `false`, add new `kubernetes_manifest` resource for the manual PodMonitor Files the agent should NOT touch: - Any other terraform files -- this is scoped to the CNPG monitoring block only ### Acceptance Criteria - [ ] When I run `tofu plan`, then the CNPG cluster shows monitoring.enablePodMonitor changing to false - [ ] When I run `tofu plan`, then a new PodMonitor resource `woodpecker-db` is created - [ ] When I run `kubectl get podmonitor -n woodpecker` after apply, then `woodpecker-db` appears - [ ] When I check Prometheus targets after apply, then the CNPG postgres target shows UP ### Test Expectations - [ ] `tofu fmt -check -recursive` passes - [ ] `tofu validate` passes (requires state, CI-only) - Run command: `cd terraform && tofu fmt -check -recursive` ### Constraints - Start with plain HTTP PodMonitor (no TLS in podMetricsEndpoints) -- port 9187 serves HTTP by default - Add TLS config in a follow-up if needed after verifying the manual PodMonitor works - Place the new resource between `woodpecker_postgres` and `woodpecker_postgres_scheduled_backup` ### Checklist - [ ] PR opened - [ ] Tests pass - [ ] No unrelated changes ### Related - `todo-cnpg-metrics-exporter` - `pal-e-platform` -- project this affects