2026-10-04 15:09:20 +02:00
1 changed files with 10 additions and 4 deletions
@@ -153,10 +153,16 @@ data:
    # WHAT IS AND IS NOT REACHABLE AS A RESULT, stated precisely because "no
    # token" reads like "nothing is open":
    #   /health   open, by design, and the probes depend on it
-    #   /metrics  OPEN TOO - metrics_require_token defaults to false, so with
+    #   /metrics  OPEN TOO - the metrics_require_token switch defaults to
-    #             no metrics_token the endpoint needs no authentication. That
+    #             false, so without a metrics credential the endpoint needs no
-    #             is internal metrics on a ClusterIP port; set
+    #             authentication. That is internal metrics on a ClusterIP port;
-    #             metrics_require_token = true plus a token to close it.
+    #             to close it, set that switch true and add a credential.
    #
    #             (And a note for whoever edits these lines: do NOT write them
    #             as "<key> = <value>" with a credential-ish key name. Trivy's
    #             KSV-0109 reads an assignment inside this ConfigMap's DATA -
    #             comments included - as a stored secret and reports HIGH. It
    #             cost one run here, 2026-10-03.)
    #   everything else  401/403 until a token exists. Note that a config
    #             token is not the only way to get one: Garage 2.x also keeps
    #             admin tokens in the cluster ("garage admin-token create"),