e92f118bda
swarm-metrics reads the swarm's VictoriaMetrics from inside an agent
container: query, query-range, series, labels and label-values, each one
GET against the store's Prometheus read API through the gateway, printing
the store's JSON. It authenticates the way swarm-logs does, with the
agent's own queue secret read from bao under the agent's leaf, sent as
a swarm-agent bearer.
On the metrics store's host the read API's auth map gains an agent arm
ahead of the Grafana one. It routes to swarm-metrics-agent-auth, a
swarm-logs-auth instance logged in under the existing swarm-metrics-auth
leaf, whose bao grant now includes swarm/agents/+/queue read. The check is
rate-limited per address like the log store's
(deploy.victoriametrics.agentAuth{Rate,Burst,VerdictTtl}).
nix/agent-modules/metrics.nix installs the wrapped binary when the hive
forwards HIVE_AGENT_METRICS_URL (from swarm.victoriametrics.domain) and a
store address, the same gate as swarm-logs. Adds the base:swarm-metrics
skill and the CLI reference with its freshness check.
Fixes #5395
66 lines
2.3 KiB
Nix
66 lines
2.3 KiB
Nix
# `swarm-metrics` on this agent's PATH, configured for this swarm's metrics
|
|
# store. The sibling of ./logs.nix, in the same shape for the same reasons:
|
|
# the binary defaults nothing (see `swarm-metrics/README.md`), so it is
|
|
# installed wrapped, and it is gated on the secret store's address as well as
|
|
# on the store URL, because the identity it presents is the agent's own queue
|
|
# secret read from that store.
|
|
{
|
|
lib,
|
|
pkgs,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.services.hyperhive.agent.metrics;
|
|
baoCfg = config.services.hyperhive.agent.bao;
|
|
configured = cfg.url != null && baoCfg.addr != null;
|
|
|
|
# The coordinates ./logs.nix gives `swarm-logs`. Paths and a name only: a
|
|
# value in `--set` lands in the world-readable nix store.
|
|
wrapperEnv = {
|
|
HIVE_AGENT_METRICS_URL = cfg.url;
|
|
HIVE_AGENT_NAME = config.services.hyperhive.agent.user.name;
|
|
BAO_ADDR = baoCfg.addr;
|
|
BAO_CLIENT_CERT = baoCfg.clientCertFile;
|
|
BAO_CLIENT_KEY = baoCfg.clientKeyFile;
|
|
BAO_CACERT = "/run/credentials/hive-agent.service/hive-agent-bao-server-ca";
|
|
};
|
|
|
|
swarmMetricsConfigured = pkgs.symlinkJoin {
|
|
name = "swarm-metrics-configured";
|
|
paths = [ config.services.hyperhive.agent.packages.swarm-metrics ];
|
|
nativeBuildInputs = [ pkgs.makeWrapper ];
|
|
postBuild = ''
|
|
wrapProgram $out/bin/swarm-metrics ${
|
|
lib.concatStringsSep " " (
|
|
lib.mapAttrsToList (name: value: "--set ${name} ${lib.escapeShellArg value}") wrapperEnv
|
|
)
|
|
}
|
|
'';
|
|
};
|
|
in
|
|
{
|
|
options.services.hyperhive.agent.metrics = {
|
|
url = lib.mkOption {
|
|
type = lib.types.nullOr lib.types.str;
|
|
default = null;
|
|
example = "https://metrics.example.com";
|
|
description = ''
|
|
The swarm metrics store's gateway origin, as this container reaches
|
|
it. `swarm-metrics` appends the read API's paths (`/api/v1/query`,
|
|
...) to it.
|
|
|
|
Set by the generated meta flake from the host's own
|
|
{option}`services.hyperhive.swarm.victoriametrics.domain`.
|
|
|
|
`null` means this hive has not been given the metrics store's address
|
|
for its agents, and `swarm-metrics` is then not installed at all.
|
|
Not defaulted: a guessed address resolves cleanly to the wrong place.
|
|
'';
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf configured {
|
|
environment.systemPackages = [ swarmMetricsConfigured ];
|
|
};
|
|
}
|