# Prometheus scrape configuration for the TrustPin attestation verifier 1.0.0.
# Instructions: https://docs.trustpin.cloud/attestation/operations
#
# /metrics is on the monitor port (9090), which must stay on your private
# network. With TRUSTPIN_MONITOR_API_KEY set, Prometheus sends the key as its
# basic-auth password; any user name is accepted.
global:
  scrape_interval: 15s
  evaluation_interval: 15s

scrape_configs:
  # A verifier at a fixed address, for example a Docker Compose service.
  - job_name: attest-verifier
    static_configs:
      - targets: ["verifier:9090"]
    basic_auth:
      username: prometheus
      password_file: /etc/prometheus/monitor-api-key   # holds TRUSTPIN_MONITOR_API_KEY

  # Kubernetes: the console's deployment bundle annotates the verifier pods
  # with prometheus.io/scrape, prometheus.io/port and prometheus.io/path.
  - job_name: attest-verifier-k8s
    kubernetes_sd_configs:
      - role: pod
    basic_auth:
      username: prometheus
      password_file: /etc/prometheus/secrets/attest-verifier/TRUSTPIN_MONITOR_API_KEY
    relabel_configs:
      - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
        action: keep
        regex: "true"
      - source_labels: [__meta_kubernetes_pod_label_app_kubernetes_io_name]
        action: keep
        regex: attest-verifier
      - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
        action: replace
        regex: ([^:]+)(?::\d+)?;(\d+)
        replacement: $1:$2
        target_label: __address__
      - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
        action: replace
        target_label: __metrics_path__
        regex: (.+)
      - source_labels: [__meta_kubernetes_namespace]
        target_label: namespace
      - source_labels: [__meta_kubernetes_pod_name]
        target_label: pod

rule_files:
  - alerts.yml