openshift.io/cluster-monitoring incorrectly set as annotation instead of a label

[pstefka]

According to the OCP docs, if cluster monitoring should scrape a namespace, label openshift.io/cluster-monitoring: "true" should be set.

Openshifts's Cert manager operator however incorrectly sets an annotation openshift.io/cluster-monitoring: "true" instead of a label:

apiVersion: v1
kind: Namespace
metadata:
  annotations:
    openshift.io/cluster-monitoring: "true"
    ...
  creationTimestamp: "2025-10-24T11:36:25Z"
  labels:
    kubernetes.io/metadata.name: cert-manager
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/audit-version: latest
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest
  name: cert-manager
  resourceVersion: "86164062"
  uid: e0f7b893-2732-4de8-b253-302098bc74b1
spec:
  finalizers:
  - kubernetes
status:
  phase: Active

Checked with 1.15.1, and 1.17.0 with the same result.

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[bharath-b-rh]

Hi @pstefka ,

Thank you for the feedback!

The openshift.io/cluster-monitoring is obsolete and is no longer required for user workload monitoring, but instead we need to create/update a configmap for the same.
Below the configmap that should be created for user workload monitoring.

apiVersion: v1
kind: ConfigMap
metadata:
  name: cluster-monitoring-config
  namespace: openshift-monitoring
data:
  config.yaml: |
    enableUserWorkload: true

Let me work on the changes to remove the annotation.

[bharath-b-rh]

/remove-lifecycle stale

[pstefka]

Hi @bharath-b-rh,

IMHO that is not correct. By adding the label openshift.io/cluster-monitoring the namespace is scraped by the platform monitoring, and not the user workload monitoring. The real consequense are the prometheusrules, which are present by default for platform monitoring only.

As such, it would be better to really change the annotation to a label.

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[bharath-b-rh]

/remove-lifecycle stale