fix(vault): correct ServiceMonitor selector for metrics scraping

[jdwillmsen]

@

JDWLABS-31

Problem

The vault-metrics ServiceMonitor (tenants/platform/services/vault/postInstall/servicemonitor.yaml) selected on:

selector:
  matchLabels:
    app.kubernetes.io/name: vault
    component: server

The live platform-vault Service in namespace vault does not carry a component: server label. Its labels are app.kubernetes.io/instance=platform-vault, app.kubernetes.io/managed-by=Helm, app.kubernetes.io/name=vault, helm.sh/chart=vault-0.30.1. component: server is the Service's pod selector, not a label on the Service object — and ServiceMonitor.spec.selector matches Service labels. So the ServiceMonitor matched no Service, had no scrape target, and vault_core_unsealed returned 0 series.

Fix

Select on the Service's real labels:

selector:
  matchLabels:
    app.kubernetes.io/name: vault
    app.kubernetes.io/instance: platform-vault

namespaceSelector, path, params, and port: http (8200 exists and is correct) are unchanged.

Verification

• kubectl get svc -n vault -l app.kubernetes.io/name=vault,app.kubernetes.io/instance=platform-vault → returns platform-vault and platform-vault-internal (-ui and -injector carry different name labels and are naturally excluded).
• Port http confirmed on 8200: [{"name":"http","port":8200,...},{"name":"https-internal","port":8201,...}].
• kubectl apply --dry-run=server → servicemonitor.monitoring.coreos.com/vault-metrics configured.
• YAML parse OK.

🤖 Generated with Claude Code
@