[keystone] add apache_exporter sidecar for Apache worker/scoreboard metrics

[tz3]

Summary

• Adds apache_exporter sidecar to the keystone-api deployment to expose Apache HTTP server metrics
• Enables mod_status via a new status.conf mounted at /etc/apache2/conf-enabled/status.conf
• Scrapes /server-status?auto on localhost and exposes metrics on port 9117
• Wires up prometheus.io/port_1: "9117" annotation so the existing pods_metric_port_1 Prometheus job picks it up
• Feature-gated behind api.apacheMetrics.enabled (defaults to false)

Metrics exposed

• apache_workers (busy/idle worker count)
• apache_scoreboard (per-state worker slots)
• apache_accesses_total (total request count, requires ExtendedStatus On)

Test plan

• Deployed to qa-de-3 with apacheMetrics.enabled: true
• Pods running 4/4 (apache-exporter sidecar added)
• Metrics confirmed on port 9117: apache_scoreboard, apache_workers, apache_accesses_total
• Verify pods_metric_port_1 Prometheus job scrapes the targets end-to-end

[rajivmucheli]

Can this be implemented for barbican as well ?

[rajivmucheli]

I think keystone and barbican are the only 2 openstack services running on apache, hence we could add this exporter to common charts at a later stage.

[tz3]

@rajivmucheli yes we can do the same for barbican, WDYT creating a dedicated pr and do the same?
Or just make a shared one with shared config for both?

[rajivmucheli]

@rajivmucheli yes we can do the same for barbican, WDYT creating a dedicated pr and do the same?

Or just make a shared one with shared config for both?

Shared config in common folder if there will be continuous development and image update. Else a dedicated PR for barbican.

[bbobrov]

Please explain why this change is needed.

[bbobrov]

where does it come from and who is the maintainer in our team?

[tz3]

where does it come from and who is the maintainer in our team?

Image added to shared-app-images pipeline: https://github.wdf.sap.corp/cc/base-images/pull/105. Current Keppel image is manually pushed for QA testing only. Maintainer: identity team.

Please explain why this change is needed.

Related task: https://github.wdf.sap.corp/sap-cloud-infrastructure/foundation-issues/issues/1696

[bbobrov]

I am fine with the patch, but lets get the image with the exporter built by our CIs first.