charts: add monitoring for wonderwall-forward-auth

charts/wonderwall-forward-auth/templates/deployment.yaml

@@ -55,6 +55,9 @@ spec:
             - containerPort: 8080
               name: http
               protocol: TCP
+            - containerPort: 8081
+              name: http-metrics
+              protocol: TCP
           readinessProbe:
             httpGet:
               path: /oauth2/ping

charts/wonderwall-forward-auth/templates/networkpolicy.yaml

@@ -7,6 +7,13 @@ metadata:
   name: {{ include "wonderwall-forward-auth.fullname" . }}
 spec:
   ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: nais-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: prometheus
     - from:
         - namespaceSelector:
             matchLabels:

charts/wonderwall-forward-auth/templates/prometheusrule.yaml

@@ -0,0 +1,27 @@
+{{- if .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" }}
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: {{ include "wonderwall-forward-auth.fullname" . }}
+  labels:
+    {{- include "wonderwall-forward-auth.labels" . | nindent 4 }}
+spec:
+  groups:
+    - name: "wonderwall-forward-auth"
+      rules:
+        - alert: wonderwall-forward-auth (Zitadel) reports a high amount of internal errors
+          expr: sum(increase(requests_total{service="{{ include "wonderwall-forward-auth.fullname" . }}", namespace="{{ .Release.Namespace }}", code="500"}[5m])) > 30
+          for: 5m
+          annotations:
+            summary: Wonderwall has responded with HTTP 500 for a high amount of requests within the last 5 minutes.
+            consequence: This probably means that end-users are having trouble with authentication.
+            action: |
+              * Check the logs and metrics in the dashboard
+              * Check the Valkey instance in the cluster
+              * Check the Zitadel dashboard: <https://monitoring.nais.io/d/bel6280x2srggc/>
+            dashboard_url: "https://monitoring.nais.io/d/ben86a369fj7kd"
+          labels:
+            severity: critical
+            namespace: {{ .Release.Namespace }}
+{{ end }}

charts/wonderwall-forward-auth/templates/service.yaml

@@ -12,5 +12,9 @@ spec:
       port: 80
       protocol: TCP
       targetPort: http
+    - name: http-metrics
+      port: 8081
+      protocol: TCP
+      targetPort: http-metrics
   selector:
     {{- include "wonderwall-forward-auth.selectorLabels" . | nindent 4 }}

charts/wonderwall-forward-auth/templates/servicemonitor.yaml

@@ -0,0 +1,20 @@
+{{- if .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" }}
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ include "wonderwall-forward-auth.fullname" . }}
+  labels: {{- include "wonderwall-forward-auth.labels" . | nindent 4 }}
+spec:
+  endpoints:
+    - interval: 1m
+      port: http-metrics
+      scrapeTimeout: 10s
+      path: "/"
+  namespaceSelector:
+    matchNames:
+      - {{ .Release.Namespace }}
+  selector:
+    matchLabels:
+      {{- include "wonderwall-forward-auth.selectorLabels" . | nindent 6 }}
+{{- end }}