OIDCPolicy View: Metrics Tab with Perses Panels

[R-Lawton]

Context

Add a Metrics tab to the OIDCPolicy details page showing OIDC authentication metrics using embedded Perses panels. This answers: "Are OIDC auth flows succeeding? Are users being redirected correctly? What's the auth latency?"

Depends on the shared Perses infrastructure established in #220.

Requirements

New Metrics tab

Add a console.tab/horizontalNav on OIDCPolicy (extensions.kuadrant.io/v1alpha1):

• Tab name: "Metrics"
• Tab href: metrics

Panels:

Panel	Metric	Panel Type
Auth Decisions Over Time	sum(rate(auth_server_authconfig_response_status{authconfig=~"<name>|<name>-callback", namespace="<ns>"}[5m])) by (status)	TimeSeriesChart stacked (OK / UNAUTHENTICATED / PERMISSION_DENIED)
Auth Latency	histogram_quantile(0.50, rate(auth_server_authconfig_duration_seconds_bucket{authconfig=~"<name>|<name>-callback", namespace="<ns>"}[5m])) (repeat for p95, p99)	TimeSeriesChart (3 lines: p50, p95, p99)
Total Evaluations	sum(rate(auth_server_authconfig_total{authconfig=~"<name>|<name>-callback", namespace="<ns>"}[5m]))	StatChart (evaluations/s)
Main vs Callback Split	sum(rate(auth_server_authconfig_total{authconfig="<name>", namespace="<ns>"}[5m])) and sum(rate(auth_server_authconfig_total{authconfig="<name>-callback", namespace="<ns>"}[5m]))	TimeSeriesChart (2 series)

Controls:

• Time range selector: 15m, 1h, 6h, 24h, 7d (default: 1h)

AuthConfig name mapping

OIDCPolicy creates two AuthPolicy resources under the hood, resulting in two AuthConfigs in Authorino:

1. <oidcpolicy-name> — main flow (JWT auth + redirect to IDP login)
2. <oidcpolicy-name>-callback — callback flow (code-for-token exchange)

Both produce auth_server_authconfig_* metrics. Queries should match both using regex: authconfig=~"<name>|<name>-callback".

Deep metrics (opt-in)

With --deep-metrics-enabled on Authorino or metrics: true on individual evaluators, additional evaluator-level metrics are available:

• auth_server_evaluator_total{evaluator_type="IDENTITY_JWT"} — JWT validation counts
• auth_server_evaluator_denied{evaluator_type="IDENTITY_JWT"} — JWT validation failures
• auth_server_evaluator_duration_seconds{evaluator_type="IDENTITY_JWT"} — JWT validation latency

Empty states

• No OIDC data: "No OIDC metrics available. Metrics will appear once requests are evaluated by this policy."
• Authorino metrics not available: "OIDC metrics require Authorino to be configured with metrics enabled."
• Prometheus unavailable: shared EmptyMetricsState component from Overview Page: Migrate to Perses Metrics Panels and Add Observability Tab #220

Notes

• Requires React 18 upgrade (OCP 4.22+ only)