#Monitor an instance

The Operator can inject a redis_exporter sidecar. The exporter listens on port 9121 and serves metrics at /metrics.

#Configure the exporter

The high-level API enables the exporter unless spec.exporter.disable is true. Set resources explicitly for predictable scheduling:

spec:
  exporter:
    disable: false
    resources:
      requests:
        cpu: 50m
        memory: 128Mi
      limits:
        cpu: 100m
        memory: 384Mi

Disable it only when another monitoring mechanism is installed:

kubectl -n default patch valkey valkey-cluster --type=merge \
  -p '{"spec":{"exporter":{"disable":true}}}'

#Verify exporter health

For Cluster architecture, the instance Service exposes the metrics port:

kubectl -n default get service valkey-cluster
kubectl -n default port-forward service/valkey-cluster 9121:9121

In another terminal:

curl --fail --silent http://127.0.0.1:9121/metrics | head

For Failover or Replica, discover the headless metrics Service, whose name starts with rfr-, and port-forward it:

kubectl -n default get service -l buf.red/name=valkey-failover
kubectl -n default port-forward service/rfr-valkey-failover 9121:9121

The Failover metrics Service exists even when the exporter is disabled, because it is also the headless governing Service of the data StatefulSet. Before treating the Service as a scrape target, verify that the selected Pods actually contain a ready exporter container and that /metrics responds.

You can also inspect the sidecar directly:

kubectl -n default get pods -l buf.red/name=valkey-cluster
kubectl -n default logs <pod-name> -c exporter --tail=200

#Integrate scraping

The ServiceMonitor shipped with the Operator selects Operator metrics. It does not by itself scrape Valkey data-plane Services. Create a ServiceMonitor, PodMonitor, or equivalent scrape configuration that matches the Services in your environment, and verify target health in your monitoring system.

When TLS and access control list (ACL) authentication are enabled, the Operator supplies the exporter with its ACL identity and TLS files, and the exporter resolves its password from the referenced Kubernetes Secret through the API rather than receiving it in an environment variable. Do not copy credentials into scrape configuration. The implementation uses redis_exporter; validate every required metric against the delivered exporter image and the selected Valkey line, especially 9.1.