feat: add operator observability metrics and Grafana dashboard

.github/workflows/ci.yaml

@@ -149,7 +149,7 @@ jobs:
         run: |
           set -euo pipefail
 
-          ./hack/package-helm-chart.sh \
+          ./hack/package-release-helm-chart.sh \
             0.0.0-snapshot \
             v0.0.0-snapshot
 
@@ -212,7 +212,7 @@ jobs:
             }
           ' "${rendered}"; then
             echo "The packaged Helm chart does not contain the complete GitHubRepositoryRuleset RBAC." >&2
-            echo "Check config/rbac/role.yaml and hack/package-helm-chart.sh." >&2
+            echo "Check config/rbac/role.yaml and hack/package-release-helm-chart.sh." >&2
             exit 1
           fi
 

.github/workflows/release.yaml

@@ -237,7 +237,7 @@ jobs:
         run: |
           set -euo pipefail
 
-          ./hack/package-helm-chart.sh \
+          ./hack/package-release-helm-chart.sh \
             "${CHART_VERSION}" \
             "${APP_VERSION}"
 
@@ -316,7 +316,7 @@ jobs:
           ' "${rendered}"; then
             echo "The packaged Helm chart does not contain the complete GitHubRepositoryRuleset RBAC." >&2
             echo "Publishing has been stopped." >&2
-            echo "Check config/rbac/role.yaml and hack/package-helm-chart.sh." >&2
+            echo "Check config/rbac/role.yaml and hack/package-release-helm-chart.sh." >&2
             exit 1
           fi
 

.pre-commit-config.yaml

@@ -106,7 +106,7 @@ repos:
 
             rm -rf dist/helm
 
-            ./hack/package-helm-chart.sh \
+            ./hack/package-release-helm-chart.sh \
               "${chart_version}" \
               "${app_version}"
 

README.md

@@ -176,6 +176,7 @@ policies or upgrading CRD schemas.
 - [Getting started](docs/getting-started.md)
 - [Custom resources and examples](docs/resources.md)
 - [Operations, upgrades and troubleshooting](docs/operations.md)
+- [Grafana dashboard](dashboards/grafana/README.md)
 - [Helm chart](charts/github-platform-operator/README.md)
 - [Development guide](docs/development.md)
 - [Release process](docs/releasing.md)

charts/github-platform-operator/Chart.yaml

@@ -2,35 +2,47 @@ apiVersion: v2
 name: github-platform-operator
 description: Kubernetes operator for managing GitHub repositories, access and Actions configuration
 type: application
-version: 0.1.0
-appVersion: "v0.1.0"
+
+# Release versions are injected into the packaged chart by the release pipeline.
+version: 0.0.0
+appVersion: "v0.0.0"
+
 home: https://github.com/pierinho13/github-platform-operator
+
 sources:
   - https://github.com/pierinho13/github-platform-operator
+
 maintainers:
   - name: pierinho13
     email: pierinho13@gmail.com
     url: https://github.com/pierinho13
+
 keywords:
   - github
   - github-actions
   - kubernetes
   - operator
   - platform-engineering
+
 annotations:
   artifacthub.io/category: integration-delivery
   artifacthub.io/license: Apache-2.0
   artifacthub.io/operator: "true"
   artifacthub.io/operatorCapabilities: Full Lifecycle
+
+  # artifacthub.io/changes is generated only in the packaged release chart from
+  # Conventional Commits since the previous Git tag.
+
   artifacthub.io/signKey: |
     fingerprint: DBBC4A49D2BB68565A9BCC383CA8825330932B17
     url: https://raw.githubusercontent.com/pierinho13/github-platform-operator/main/helm-signing-key.asc
+
   artifacthub.io/links: |
     - name: Source
       url: https://github.com/pierinho13/github-platform-operator
     - name: Documentation
       url: https://github.com/pierinho13/github-platform-operator#documentation
     - name: Getting Started
       url: https://github.com/pierinho13/github-platform-operator/blob/main/docs/getting-started.md
-    - name: support
-      url: https://github.com/pierinho13/github-platform-operator/issues
+    - name: Support
+      url: https://github.com/pierinho13/github-platform-operator/issues

charts/github-platform-operator/README.md

@@ -170,6 +170,12 @@ helm show values \
   oci://ghcr.io/pierinho13/charts/github-platform-operator
 ```
 
+The operator exposes standard `controller-runtime` metrics plus GitHub API and
+rate-limit metrics. An importable Grafana dashboard is available in the source
+repository at `dashboards/grafana/github-platform-operator.json`. See the
+[operations guide](https://github.com/pierinho13/github-platform-operator/blob/main/docs/operations.md#metrics-and-grafana)
+for scraping and dashboard details.
+
 ## CRDs and upgrades
 
 The chart includes generated CRDs under `crds/`. Helm installs them before the

config/manager/kustomization.yaml

@@ -1,2 +1,8 @@
 resources:
 - manager.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+images:
+- name: controller
+  newName: example.com/github-platform-operator
+  newTag: v0.0.1

dashboards/grafana/README.md

@@ -0,0 +1,40 @@
+# Grafana dashboard
+
+`github-platform-operator.json` is an importable Grafana dashboard for the
+operator's Prometheus metrics.
+
+It combines the custom GitHub API metrics exported by the operator with the
+standard metrics already exposed by `controller-runtime`, the Go runtime and
+the process collector.
+
+## Prerequisite
+
+Prometheus must scrape the operator `/metrics` endpoint. The project already
+ships the metrics Service and a ServiceMonitor example under
+[`config/prometheus`](../../config/prometheus).
+
+When secure metrics are enabled, the Prometheus service account must be allowed
+to read the authenticated `/metrics` endpoint. See
+[`docs/operations.md`](../../docs/operations.md#metrics-and-grafana) for the
+operational notes.
+
+## Import
+
+In Grafana, use **Dashboards → New → Import**, upload
+`github-platform-operator.json`, and select the Prometheus data source.
+
+The dashboard includes:
+
+- GitHub API request volume and HTTP status codes
+- GitHub API p95 latency
+- transport errors
+- rate-limit remaining/limit/reset state
+- primary and secondary rate-limit events
+- shared rate-limit gate blocking time
+- controller reconciliation rate, errors and p95 duration
+- workqueue depth
+- process CPU, resident memory and Go goroutines
+
+The dashboard intentionally avoids repository, organization, username and token
+labels to keep metric cardinality bounded and to avoid exposing sensitive
+identifiers through Prometheus labels.