Red Hat OpenShift Container Platform

Configuring metrics collection for SPIRE Server by using a ServiceMonitor

To collect custom metrics from the SPIRE Server, create a ServiceMonitor custom resource (CR). This configuration enables the Prometheus Operator to scrape metrics from the default endpoint, which helps you monitor your SPIRE deployment.

The SPIRE Server operand exposes metrics by default on port 9402 at the /metrics endpoint. You can configure metrics collection for the SPIRE Server by creating a ServiceMonitor custom resource (CR) that enables the Prometheus Operator to collect custom metrics.

Prerequisites

You have access to the cluster as a user with the cluster-admin cluster role.
You have installed the Zero Trust Workload Identity Manager.
You have deployed the SPIRE Server operand in the cluster.
You have enabled the user workload monitoring.

Procedure

Create the ServiceMonitor CR:

Create the YAML file that defines the ServiceMonitor CR:

Example servicemonitor-spire-server file

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
labels:
  app.kubernetes.io/name: server
  app.kubernetes.io/instance: spire
name: spire-server-metrics
namespace: zero-trust-workload-identity-manager
spec:
endpoints:
- port: metrics
  interval: 30s
  path: /metrics
selector:
  matchLabels:
    app.kubernetes.io/name: server
    app.kubernetes.io/instance: spire
namespaceSelector:
  matchNames:
  - zero-trust-workload-identity-manager

Create the ServiceMonitor CR by running the following command:
```
$ oc create -f servicemonitor-spire-server.yaml
```
After the ServiceMonitor CR is created, the user workload Prometheus instance begins metrics collection from the SPIRE Server. The collected metrics are labeled with job="spire-server".

Verification

In the Red Hat OpenShift Container Platform web console, navigate to Observe → Targets.
In the Label filter field, enter the following label to filter the metrics targets:
```
$ service=zero-trust-workload-identity-manager-metrics-service
```
Confirm that the Status column shows Up for the spire-server-metrics entry.