Observability

The controller and node agent each expose a Prometheus metrics endpoint over plain HTTP at /metrics:

Component	Port	Workload
Controller	9080	lace-controller Deployment
Node agent	9082	lace-node DaemonSet

Both run on the host network, so the endpoints are reachable on the node’s address at those ports.

Metrics Services

The chart creates a Service per component so the endpoints can be referenced by a stable name:

• lace-controller-metrics — selects the controller Pod, named port metrics → 9080.
• lace-node-metrics — selects all node agent Pods, named port metrics → 9082.

Both live in the release namespace (kube-system in the install docs) and carry the label lace.local/metrics: "true" so a routing policy can select them. Override the labels with metrics.serviceLabels.

Reaching the endpoints from a monitoring Network

Run Prometheus in its own Network and grant it routing to the metrics Services with a ServiceRoutingPolicy that selects them by label:

apiVersion: lace-cni.io/v1alpha1
kind: ServiceRoutingPolicy
metadata:
  name: monitoring-to-metrics
spec:
  src:
    name: monitoring
  dest:
    matchLabels:
      lace.local/metrics: "true"

This lets any Pod in the monitoring Network reach both metrics Services, while keeping them unreachable from every other Network. Set src to your monitoring Network — by name as above, or by matchLabels on the Network’s labels.

Scraping with Prometheus

The chart does not ship a ServiceMonitor, since the Prometheus Operator (and its CRDs) is typically not installed when the CNI is. Once the operator is present, apply your own ServiceMonitor resources pointing at the Services above:

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: lace-controller
  namespace: kube-system
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: lace-cni
      app.kubernetes.io/component: controller
  endpoints:
  - port: metrics
    path: /metrics

---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: lace-node
  namespace: kube-system
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: lace-cni
      app.kubernetes.io/component: node
  endpoints:
  - port: metrics
    path: /metrics

Match the metadata.labels and namespace to whatever your Prometheus instance’s serviceMonitorSelector and serviceMonitorNamespaceSelector require.