From d934099fc585358bc37f371540b2a82b4f5a7b5a Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sat, 19 Sep 2026 15:08:00 +1000
Subject: [PATCH] Add VMPodScrape for authentik-server metrics

Scrape django_prometheus metrics on authentik-server pods (:9300);
only ldap-outpost and redis-exporter were scraped in this namespace.
---
 apps/base/authentik/kustomization.yaml      |  1 +
 apps/base/authentik/server-vmpodscrape.yaml | 16 ++++++++++++++++
 2 files changed, 17 insertions(+)
 create mode 100644 apps/base/authentik/server-vmpodscrape.yaml

diff --git a/apps/base/authentik/kustomization.yaml b/apps/base/authentik/kustomization.yaml
index 8aa078a..0752eaf 100644
--- a/apps/base/authentik/kustomization.yaml
+++ b/apps/base/authentik/kustomization.yaml
@@ -19,6 +19,7 @@ resources:
   - redis-deployment.yaml
   - redis-pvc.yaml
   - redis-service.yaml
+  - server-vmpodscrape.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
   - vmpodscrape.yaml
diff --git a/apps/base/authentik/server-vmpodscrape.yaml b/apps/base/authentik/server-vmpodscrape.yaml
new file mode 100644
index 0000000..93ed3f2
--- /dev/null
+++ b/apps/base/authentik/server-vmpodscrape.yaml
@@ -0,0 +1,16 @@
+---
+# Scrape the authentik server's django_prometheus endpoint (:9300). Picked up
+# by the observability VMAgent (selectAllByDefault).
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: authentik-server
+  namespace: authentik
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: authentik
+      app.kubernetes.io/component: server
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics
-- 
2.47.3