From fc794d26592ccbe4409b736fc48d049f73dfb5d1 Mon Sep 17 00:00:00 2001 From: Justin Klein Date: Sat, 3 Oct 2026 20:42:28 +0000 Subject: [PATCH] garage: name what the admin port actually serves /metrics needs no authentication in this configuration either - metrics_require_token defaults to false - and an admin token can also come from the cluster (garage admin-token create), not only from garage.toml. --- garage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/garage.md b/garage.md index fe60a8d..a5bb706 100644 --- a/garage.md +++ b/garage.md @@ -13,7 +13,7 @@ That trade is deliberate, and the price is the first thing to understand about t | Ingress | **off by default**, built to the convention so it can be switched on | | External dependencies | none — no database, no cache, no other service | | Secrets | 2 × `OnePasswordItem`, four fields in total | -| Network | ClusterIP Service on 3900 (S3) and 3903 (admin). No RPC port in the Service, and no NetworkPolicy yet | +| Network | ClusterIP Service on 3900 (S3) and 3903 (admin). No RPC port in the Service, and no NetworkPolicy yet. The admin port serves two things unauthenticated — `/health` (token-free by design, the probes need it) and `/metrics` (`metrics_require_token` defaults to **false**) — and answers everything else with 401/403 until an admin token exists, from the config *or* from `garage admin-token create` | | Install-test | `ci/garage/` (fixtures + test values) | ## Prerequisites