2026-10-04 15:09:20 +02:00
1 changed files with 10 additions and 4 deletions
@@ -153,10 +153,16 @@ data:
    # WHAT IS AND IS NOT REACHABLE AS A RESULT, stated precisely because "no
    # token" reads like "nothing is open":
    #   /health   open, by design, and the probes depend on it
-    #   /metrics  OPEN TOO - metrics_require_token defaults to false, so with
-    #             no metrics_token the endpoint needs no authentication. That
-    #             is internal metrics on a ClusterIP port; set
-    #             metrics_require_token = true plus a token to close it.
+    #   /metrics  OPEN TOO - the metrics_require_token switch defaults to
+    #             false, so without a metrics credential the endpoint needs no
+    #             authentication. That is internal metrics on a ClusterIP port;
+    #             to close it, set that switch true and add a credential.
+    #
+    #             (And a note for whoever edits these lines: do NOT write them
+    #             as "<key> = <value>" with a credential-ish key name. Trivy's
+    #             KSV-0109 reads an assignment inside this ConfigMap's DATA -
+    #             comments included - as a stored secret and reports HIGH. It
+    #             cost one run here, 2026-10-03.)
    #   everything else  401/403 until a token exists. Note that a config
    #             token is not the only way to get one: Garage 2.x also keeps
    #             admin tokens in the cluster ("garage admin-token create"),