e92f118bda
swarm-metrics reads the swarm's VictoriaMetrics from inside an agent
container: query, query-range, series, labels and label-values, each one
GET against the store's Prometheus read API through the gateway, printing
the store's JSON. It authenticates the way swarm-logs does, with the
agent's own queue secret read from bao under the agent's leaf, sent as
a swarm-agent bearer.
On the metrics store's host the read API's auth map gains an agent arm
ahead of the Grafana one. It routes to swarm-metrics-agent-auth, a
swarm-logs-auth instance logged in under the existing swarm-metrics-auth
leaf, whose bao grant now includes swarm/agents/+/queue read. The check is
rate-limited per address like the log store's
(deploy.victoriametrics.agentAuth{Rate,Burst,VerdictTtl}).
nix/agent-modules/metrics.nix installs the wrapped binary when the hive
forwards HIVE_AGENT_METRICS_URL (from swarm.victoriametrics.domain) and a
store address, the same gate as swarm-logs. Adds the base:swarm-metrics
skill and the CLI reference with its freshness check.
Fixes #5395
27 lines
768 B
TOML
27 lines
768 B
TOML
[package]
|
|
name = "swarm-metrics"
|
|
version.workspace = true
|
|
readme = "README.md"
|
|
edition.workspace = true
|
|
|
|
[[bin]]
|
|
name = "swarm-metrics"
|
|
path = "src/main.rs"
|
|
|
|
[dependencies]
|
|
anyhow.workspace = true
|
|
clap.workspace = true
|
|
clap-markdown = "0.1"
|
|
# The agent-token spelling the gateway's responder parses, and the rustls
|
|
# provider the store client needs.
|
|
swarm-queue-client.workspace = true
|
|
# The read of this agent's own queue secret.
|
|
swarm-secret-client.workspace = true
|
|
# Only to drive that one async read; the query itself is blocking.
|
|
tokio.workspace = true
|
|
# Blocking, not async: this binary makes one request (two on a 401) and
|
|
# exits, so a reactor would exist only to be torn down.
|
|
reqwest = { workspace = true, features = ["blocking"] }
|
|
|
|
[lints]
|
|
workspace = true
|