feat(prometheus): set service monitor label selector

.gitignore

@@ -140,3 +140,4 @@ dist
 /custom
 /private/
 .mcp.json
+/.playwright-mcp/

prometheus/justfile

@@ -119,6 +119,9 @@ install: check-env
         --wait \
         -f values.yaml
 
+    # Label monitoring namespace to enable self-monitoring
+    kubectl label namespace ${PROMETHEUS_NAMESPACE} buun.channel/enable-monitoring=true --overwrite
+
     admin_password=$(just admin-password)
 
     echo ""

prometheus/values.gomplate.yaml

@@ -60,6 +60,13 @@ prometheus:
             requests:
               storage: 50Gi
 
+    # ServiceMonitor selection
+    # Select ServiceMonitors with release label only in namespaces with enable-monitoring label
+    serviceMonitorSelectorNilUsesHelmValues: true
+    serviceMonitorNamespaceSelector:
+      matchLabels:
+        buun.channel/enable-monitoring: "true"
+
 {{- if .Env.PROMETHEUS_HOST }}
   ingress:
     enabled: true

vault/justfile

@@ -454,3 +454,7 @@ write-policy name file:
 # Login to Vault using OIDC
 login:
     @vault login -method=oidc
+
+# NOTE: Vault monitoring is not supported
+# Reason: Prometheus ServiceMonitor does not support custom HTTP headers (X-Vault-Token)
+# Alternative: Use Vault Exporter or manual Prometheus scrape_configs