Read-only role (or scoped permissions) for the Prometheus exporter

The Prometheus exporter (spacelift-io/prometheus-exporter) currently requires an Admin API key because some of the metrics fields it queries are gated behind admin access. This forces us to distribute admin-scoped credentials to every cluster running a private worker pool, purely to expose queue depth, worker counts, and billing usage to Prometheus. Please add a read-only role (or scoped permissions) that grants only what the exporter needs, assignable via IdP group mapping and usable with OIDC API keys the same way other roles are. Reducing the exporter's permission floor to a space-scoped read role would eliminate credential sprawl, align the exporter with least-privilege posture, and make it defensible in regulated environments where admin scope on a metrics collector is a hard audit finding.

WorkaroundEvery cluster running a worker pool must currently hold an Admin API key just to scrape metrics. This spreads write-capable credentials across environments that only need read access, and it is not defensible under least-privilege review.
ProblemNone that preserves least privilege. OIDC API keys (--api-key-secret-file) let us rotate the admin secret aggressively, but rotation shrinks the exposure window; it does not shrink scope. The key still holds full admin.

Please authenticate to join the conversation.

Upvoters

Linked requests

Board

💡 Feature Requests

Tags

Access Control

Date

About 5 hours ago

Subscribe to request

Get notified by email when there are changes.