Add a PodMonitoring for ate-api-server

docs/observability.md

@@ -133,6 +133,10 @@ To explore metrics locally:
 
 > **Note:** Storage is ephemeral (`emptyDir`), so metrics are lost when the Prometheus pod restarts.
 
+### Cloud Metrics with Google Managed Prometheus (GKE Cluster)
+
+For Google Cloud (GKE) deployments with Google Managed Prometheus (GMP), `PodMonitoring` resources are located in [`manifests/ate-install/monitoring/`](../manifests/ate-install/monitoring/) and applied automatically by `./hack/install-ate.sh --deploy-ate-system`.
+
 > **Roadmap Note (Actor-Level Metrics):** A comprehensive metrics roadmap is under active development to support both system operators and workload analysis. Planned OpenTelemetry instrumentation focuses on control plane latency, state snapshot performance, fleet utilization density, and enriching metrics with standardized actor labels for seamless aggregation across pod transitions.
 
 ---

hack/install-ate.sh

@@ -162,7 +162,7 @@ render_ate_system_manifests() {
     kubectl kustomize manifests/ate-install/kind --load-restrictor LoadRestrictionsNone | run_ko resolve -f -
   else
     # Build everything resolved with base manifests for GKE
-    run_ko resolve -f manifests/ate-install
+    run_ko resolve -f manifests/ate-install -f manifests/ate-install/monitoring
   fi
 }
 
@@ -357,6 +357,9 @@ deploy_ate_apiserver() {
   ensure_apiserver_prerequisites
 
   run_ko apply -f manifests/ate-install/ate-api-server.yaml
+  if [[ "${ATE_INSTALL_KIND:-false}" == "false" ]]; then
+    run_kubectl apply -f manifests/ate-install/monitoring/ate-api-server.yaml
+  fi
   run_kubectl rollout status deployment/ate-api-server -n ate-system --timeout=120s
 }
 
@@ -390,6 +393,9 @@ deploy_atenet() {
 
   run_ko apply -f manifests/ate-install/atenet-router.yaml
   run_ko apply -f manifests/ate-install/atenet-dns.yaml
+  if [[ "${ATE_INSTALL_KIND:-false}" == "false" ]]; then
+    run_kubectl apply -f manifests/ate-install/monitoring/atenet-router.yaml
+  fi
   run_kubectl rollout status deployment/atenet-router -n ate-system --timeout=120s
   # The Deployment in atenet-dns.yaml is named "dns"; every other resource in
   # that file is "atenet-dns". Waiting on the filename rather than the actual
@@ -500,14 +506,17 @@ delete_ate_system() {
     kubectl kustomize manifests/ate-install/kind --load-restrictor LoadRestrictionsNone \
       | run_kubectl delete --ignore-not-found -f -
   else
-    run_kubectl delete --ignore-not-found -f manifests/ate-install
+    run_kubectl delete --ignore-not-found -f manifests/ate-install -f manifests/ate-install/monitoring
   fi
   run_kubectl delete --ignore-not-found -f manifests/ate-install/generated
 }
 
 delete_atenet() {
   log_step "delete_atenet"
   run_kubectl delete --ignore-not-found -f manifests/ate-install/atenet-router.yaml
+  if [[ "${ATE_INSTALL_KIND:-false}" == "false" ]]; then
+    run_kubectl delete --ignore-not-found -f manifests/ate-install/monitoring/atenet-router.yaml
+  fi
 }
 
 deploy_benchmarks() {

manifests/ate-install/monitoring/ate-api-server.yaml

@@ -0,0 +1,29 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: monitoring.googleapis.com/v1
+kind: PodMonitoring
+metadata:
+  name: ate-api-server
+  namespace: ate-system
+  labels:
+    app: ate-api-server
+spec:
+  selector:
+    matchLabels:
+      app: ate-api-server
+  endpoints:
+  - port: prometheus
+    path: /metrics
+    interval: 30s

tools/setup-gcp/dashboards/README.md

@@ -18,6 +18,8 @@ Dashboards are created/updated (idempotently) by setup:
 go run ./tools/setup-gcp create dashboards   # also part of: bootstrap
 ```
 
+Google Managed Prometheus (`PodMonitoring`) manifests for ATE metrics scraping are located in [`manifests/ate-install/monitoring/`](../../../manifests/ate-install/monitoring/) (`atenet-router.yaml` and `ate-api-server.yaml`). These are applied automatically when deploying Agent Substrate on GKE (`./hack/install-ate.sh --deploy-ate-system`).
+
 Or apply any single file by hand:
 
 ```sh