Description
Enabling Prometheus currently retains the wildcard :2112 listener. Tokenless requests then validate with a warning but return HTTP 403, so the smallest apparent opt-in starts successfully and cannot be scraped. Make the minimal local opt-in safe and useful without weakening network-reachable authentication.
Acceptance Criteria
- #1 With only Prometheus enabled and no token, the default listener is loopback-only and GET /metrics from the same host returns 200
- #2 A network-reachable bind still requires a token or the explicit allow_unauthenticated acknowledgement
- #3 A configured token is enforced on loopback and network-reachable binds
- #4 Defaults, example config, generated env reference, validation warnings, and focused auth tests agree
Definition of Done
- #1 go build ./… && go vet ./… && go test -race ./…
- #2 golangci-lint run
- #3 scripts/regen-generated.sh (only if a generated artifact’s inputs changed)
Implementation Plan
Implement the frozen loopback listener default and auth matrix test-first; regenerate config and Helm references; verify focused and repository Go gates.
Implementation Notes
Implemented and locally validated in bundled pause snapshot 2cf46446d5c6a7a30ea6f7d0c54d61ec9889d522. Emergency stop occurred before the final clean SECURITY verdict, exact-head CI, and live scrape proof. Resume by rerunning the read-only security review on this exact tree, then exact-head CI and live verification.
Final evidence: SECURITY CLEAN on the accumulated source diff; integrated GATE passed at 538761804dba35e1f513cfc9848668b594aaa131; exact-head CI run 33047209645 succeeded. The exact image ran on the live deployment host with a loopback-only listener, authenticated GET /metrics returned 200, and the sentinel was present.
Final Summary
Safe loopback defaults, fail-closed remote exposure, effective-token Helm validation, and auth tests are committed in 2cf46446d5c6a7a30ea6f7d0c54d61ec9889d522; parked pending final security, CI, and live proof.
Completion: verified by clean security review, full gate, exact-head CI, and live authenticated scrape.