fix(observability): make worker PodMonitor targets resolvable

deploy/stacks/observability/charts/nvcf-default-monitors/values.yaml

@@ -92,5 +92,5 @@ computePlane:
           operator: Exists
     interval: 30s
     path: /metrics
-    port: metrics
+    port: worker-metrics
     labels: {}

deploy/stacks/observability/environments/base.yaml

@@ -188,5 +188,5 @@ defaultMonitors:
             operator: Exists
       interval: 30s
       path: /metrics
-      port: metrics
+      port: worker-metrics
       labels: {}

deploy/stacks/observability/tests/profile-defaults.sh

@@ -49,6 +49,7 @@ profile_release_json() {
   cat "$output_file"
 }
 
+# profile_releases_csv returns the sorted release names enabled for an observability profile.
 profile_releases_csv() {
   local profile="$1"
   shift
@@ -59,6 +60,7 @@ profile_releases_csv() {
     paste -sd, -
 }
 
+# render_monitors renders default monitor manifests for an observability profile.
 render_monitors() {
   local profile="$1"
   local output_name="$2"
@@ -74,6 +76,7 @@ render_monitors() {
     template --output-dir "$output_dir" >/dev/null
 }
 
+# monitor_targets_csv returns the sorted monitor kinds and names rendered in an output directory.
 monitor_targets_csv() {
   local output_dir="$1"
   local file
@@ -353,6 +356,12 @@ assert_yaml_value "$worker_monitor_manifest" \
 assert_yaml_value "$worker_monitor_manifest" \
   '.spec.selector.matchExpressions[0].operator' Exists \
   'worker pod label expression operator'
+assert_yaml_value "$worker_monitor_manifest" \
+  '.spec.podMetricsEndpoints[0].port' worker-metrics \
+  'worker metrics port'
+assert_yaml_value "$work_dir/compute-monitor-values.yaml" \
+  '.computePlane.worker.port' worker-metrics \
+  'compute worker metrics Helmfile value'
 
 # The application chart owns its Service labels. Compare them with the shared
 # ServiceMonitor selector so an application label change cannot silently break

src/compute-plane-services/nvca/pkg/operator/reconcile/manifests/netpol/allow-ingress-monitoring.yaml

@@ -28,6 +28,8 @@ spec:
       protocol: TCP
     - port: 8888
       protocol: TCP
+    - port: worker-metrics
+      protocol: TCP
     - port: 10103
       protocol: TCP
     - port: 18888

src/compute-plane-services/nvca/pkg/operator/reconcile/nvcaagent_reconcile_test.go

@@ -41,6 +41,7 @@ import (
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/util/intstr"
 	"k8s.io/utils/ptr"
 	"sigs.k8s.io/yaml"
 
@@ -2479,6 +2480,7 @@ func TestGetInternalPersistentStorageConfig(t *testing.T) {
 	}
 }
 
+// TestGetNetworkPoliciesDataEmptyDDCSIPList verifies generated network policies without DDCS CIDRs.
 func TestGetNetworkPoliciesDataEmptyDDCSIPList(t *testing.T) {
 	expNPNames := []string{
 		EgressNetworkPolicyNameKey,
@@ -2501,7 +2503,15 @@ func TestGetNetworkPoliciesDataEmptyDDCSIPList(t *testing.T) {
 	got, err := bc.getNetworkPoliciesData(newTestContext(), nb)
 	require.NoError(t, err)
 	assert.Len(t, got, len(expNPNames))
-	assertNetworkPolicyAllowsTCPPort(t, got[IngressNetworkPolicyNameKey], IngressNetworkPolicyNameKey, 8888)
+	assertNetworkPolicyAllowsTCPPort(
+		t, got[IngressNetworkPolicyNameKey], IngressNetworkPolicyNameKey, intstr.FromInt32(8888),
+	)
+	assertNetworkPolicyAllowsTCPPort(
+		t, got[IngressNetworkPolicyNameKey], IngressNetworkPolicyNameKey, intstr.FromString("worker-metrics"),
+	)
+	assertNetworkPolicyOmitsTCPPort(
+		t, got[IngressNetworkPolicyNameKey], IngressNetworkPolicyNameKey, intstr.FromInt32(9089),
+	)
 	b := &bytes.Buffer{}
 	require.NoError(t, err)
 	for _, k := range expNPNames {
@@ -2511,6 +2521,7 @@ func TestGetNetworkPoliciesDataEmptyDDCSIPList(t *testing.T) {
 	assert.Equal(t, stripSPDXHeaders(readTestdataFile(t, filepath.Join("testdata", "netpols.yaml"))), stripSPDXHeaders(b.String()))
 }
 
+// TestGetNetworkPoliciesDataWithDDCSIPList verifies generated network policies with DDCS CIDRs.
 func TestGetNetworkPoliciesDataWithDDCSIPList(t *testing.T) {
 	expNPNames := []string{
 		EgressNetworkPolicyNameKey,
@@ -2534,7 +2545,15 @@ func TestGetNetworkPoliciesDataWithDDCSIPList(t *testing.T) {
 	got, err := bc.getNetworkPoliciesData(newTestContext(), nb)
 	require.NoError(t, err)
 	assert.Len(t, got, len(expNPNames))
-	assertNetworkPolicyAllowsTCPPort(t, got[IngressNetworkPolicyNameKey], IngressNetworkPolicyNameKey, 8888)
+	assertNetworkPolicyAllowsTCPPort(
+		t, got[IngressNetworkPolicyNameKey], IngressNetworkPolicyNameKey, intstr.FromInt32(8888),
+	)
+	assertNetworkPolicyAllowsTCPPort(
+		t, got[IngressNetworkPolicyNameKey], IngressNetworkPolicyNameKey, intstr.FromString("worker-metrics"),
+	)
+	assertNetworkPolicyOmitsTCPPort(
+		t, got[IngressNetworkPolicyNameKey], IngressNetworkPolicyNameKey, intstr.FromInt32(9089),
+	)
 	b := &bytes.Buffer{}
 	require.NoError(t, err)
 	for _, k := range expNPNames {
@@ -2544,7 +2563,8 @@ func TestGetNetworkPoliciesDataWithDDCSIPList(t *testing.T) {
 	assert.Equal(t, stripSPDXHeaders(readTestdataFile(t, filepath.Join("testdata", "netpols_with_ddcs.yaml"))), stripSPDXHeaders(b.String()))
 }
 
-func assertNetworkPolicyAllowsTCPPort(t *testing.T, policyYAML, policyName string, port int32) {
+// assertNetworkPolicyAllowsTCPPort verifies a policy allows a numeric or named TCP destination port.
+func assertNetworkPolicyAllowsTCPPort(t *testing.T, policyYAML, policyName string, port intstr.IntOrString) {
 	t.Helper()
 
 	var policy netv1.NetworkPolicy
@@ -2556,13 +2576,34 @@ func assertNetworkPolicyAllowsTCPPort(t *testing.T, policyYAML, policyName strin
 			if networkPolicyPort.Port == nil || networkPolicyPort.Protocol == nil {
 				continue
 			}
-			if networkPolicyPort.Port.IntVal == port && *networkPolicyPort.Protocol == corev1.ProtocolTCP {
+			if *networkPolicyPort.Port == port && *networkPolicyPort.Protocol == corev1.ProtocolTCP {
 				return
 			}
 		}
 	}
 
-	assert.Failf(t, "missing TCP port", "%s should allow TCP port %d", policyName, port)
+	assert.Failf(t, "missing TCP port", "%s should allow TCP port %q", policyName, port.String())
+}
+
+// assertNetworkPolicyOmitsTCPPort verifies a policy does not explicitly declare a numeric or named TCP port.
+func assertNetworkPolicyOmitsTCPPort(t *testing.T, policyYAML, policyName string, port intstr.IntOrString) {
+	t.Helper()
+
+	var policy netv1.NetworkPolicy
+	require.NoError(t, yaml.Unmarshal([]byte(policyYAML), &policy))
+	require.Equal(t, policyName, policy.Name)
+
+	for _, ingressRule := range policy.Spec.Ingress {
+		for _, networkPolicyPort := range ingressRule.Ports {
+			if networkPolicyPort.Port == nil || networkPolicyPort.Protocol == nil {
+				continue
+			}
+			assert.Falsef(t,
+				*networkPolicyPort.Port == port && *networkPolicyPort.Protocol == corev1.ProtocolTCP,
+				"%s should not explicitly declare TCP port %q", policyName, port.String(),
+			)
+		}
+	}
 }
 
 func TestGetEffectiveK8sNetworkCIDRs(t *testing.T) {

src/compute-plane-services/nvca/pkg/operator/reconcile/testdata/netpols.yaml

@@ -74,6 +74,8 @@ spec:
       protocol: TCP
     - port: 8888
       protocol: TCP
+    - port: worker-metrics
+      protocol: TCP
     - port: 10103
       protocol: TCP
     - port: 18888

src/compute-plane-services/nvca/pkg/operator/reconcile/testdata/netpols_with_ddcs.yaml

@@ -80,6 +80,8 @@ spec:
       protocol: TCP
     - port: 8888
       protocol: TCP
+    - port: worker-metrics
+      protocol: TCP
     - port: 10103
       protocol: TCP
     - port: 18888