From ecea0c668adc9d06673ae4ce0ad5cd37d33d7217 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Tue, 7 Jul 2026 00:02:28 +1000
Subject: [PATCH] cert-manager: scrape webhook + cainjector metrics
 (VMServiceScrape)

Follow-up to #239. cert-manager already exposes metrics services
(webhook :9402 metrics, cainjector :9402 http-metrics) but nothing
scraped them. Add a VMServiceScrape so the observability VMAgent collects
cert-manager metrics (cert issuance, controller sync, etc.).
---
 apps/base/cert-manager/kustomization.yaml   |  1 +
 apps/base/cert-manager/vmservicescrape.yaml | 17 +++++++++++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 apps/base/cert-manager/vmservicescrape.yaml

diff --git a/apps/base/cert-manager/kustomization.yaml b/apps/base/cert-manager/kustomization.yaml
index 23bd056..f1fcada 100644
--- a/apps/base/cert-manager/kustomization.yaml
+++ b/apps/base/cert-manager/kustomization.yaml
@@ -7,3 +7,4 @@ resources:
   - serviceaccount.yaml
   - clusterrole.yaml
   - clusterrolebinding.yaml
+  - vmservicescrape.yaml
diff --git a/apps/base/cert-manager/vmservicescrape.yaml b/apps/base/cert-manager/vmservicescrape.yaml
new file mode 100644
index 0000000..dc9b255
--- /dev/null
+++ b/apps/base/cert-manager/vmservicescrape.yaml
@@ -0,0 +1,17 @@
+---
+# Scrape cert-manager webhook + cainjector metrics endpoints.
+# Picked up by the observability VMAgent (selectAllByDefault).
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMServiceScrape
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cert-manager
+  endpoints:
+    - port: metrics
+      path: /metrics
+    - port: http-metrics
+      path: /metrics
-- 
2.47.3