Skip to main content

Release 0.5.35 — Prometheus ServiceMonitor Fix and OpenFGA Metrics

Sri Aradhyula
Sri Aradhyula

Released: 2026-07-02 Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.35 Previous release: 0.5.34

Highlights​

0.5.35 resolves persistent TargetDown Prometheus alerts for agentgateway, keycloak, openfga, and audit-service by fixing label-selector gaps in the umbrella ServiceMonitor and adding a dedicated OpenFGA metrics ServiceMonitor.

Bug Fixes​

Prometheus umbrella ServiceMonitor no longer scrapes label-less services​

The umbrella servicemonitor.yaml used a NotIn label selector on app.kubernetes.io/component to exclude per-component services. However, agentgateway, keycloak, openfga, and audit-service lack that label entirely — Kubernetes evaluates a NotIn selector on a missing key as true, so these services were included and produced permanently-failing TargetDown targets (their /metrics endpoints are not on the umbrella SM's http port).

Fixed by adding a matching NotIn exclusion on app.kubernetes.io/name for these four services. Each service that has a metrics endpoint now has its own dedicated ServiceMonitor:

ServiceServiceMonitorPort
agentgatewayservicemonitor-agentgateway.yaml15000 (admin)
keycloakservicemonitor-keycloak.yaml9000 (management)
openfgaservicemonitor-openfga.yaml2112 (metrics)
audit-service— (no metrics endpoint)—

(#2106)

OpenFGA Prometheus metrics port exposed​

The OpenFGA deployment and service now expose the built-in Prometheus metrics port (2112), which OpenFGA serves by default. The new dedicated servicemonitor-openfga.yaml targets this port instead of the API port (8080). (#2106)

Breaking Changes​

No breaking changes. Drop-in upgrade from 0.5.34.

Upgrade Guide: 0.5.34 → 0.5.35​

No values changes required. After upgrading, verify Prometheus targets:

helm upgrade ai-platform-engineering \
  oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
  --version 0.5.35 \
  -f your-values.yaml

Verify the four dedicated ServiceMonitors are created:

kubectl get servicemonitor -n <namespace>
# expect: caipe-metrics, caipe-agentgateway-metrics, caipe-keycloak-metrics, caipe-openfga-metrics