kms: gate metrics endpoint by config

Author: kvinwang

kms/kms.toml

@@ -38,6 +38,12 @@ cache_dir = "/usr/share/dstack/images"
 download_url = "http://localhost:8000/{OS_IMAGE_HASH}.tar.gz"
 download_timeout = "2m"
 
+[core.metrics]
+# Expose unauthenticated Prometheus metrics on /metrics.
+# Keep disabled unless the KMS RPC listener is protected by network policy
+# or another access-control layer.
+enabled = false
+
 [core.auth_api]
 type = "webhook"
 

kms/src/config.rs

@@ -46,6 +46,15 @@ pub(crate) struct KmsConfig {
     /// agent socket.
     #[serde(default = "default_true")]
     pub enforce_self_authorization: bool,
+    #[serde(default)]
+    pub metrics: MetricsConfig,
+}
+
+#[derive(Debug, Clone, Deserialize, Default)]
+pub(crate) struct MetricsConfig {
+    /// Whether to expose the unauthenticated Prometheus `/metrics` endpoint.
+    #[serde(default)]
+    pub enabled: bool,
 }
 
 fn default_true() -> bool {

kms/src/main.rs

@@ -137,6 +137,7 @@ async fn main() -> Result<()> {
     }
 
     let pccs_url = config.pccs_url.clone();
+    let metrics_enabled = config.metrics.enabled;
     let state = main_service::KmsState::new(config).context("Failed to initialize KMS state")?;
     let figment = figment
         .clone()
@@ -147,17 +148,22 @@ async fn main() -> Result<()> {
                 res.set_raw_header("X-App-Version", app_version());
             })
         }))
-        .attach(AdHoc::on_response(
-            "Record KMS attestation metrics",
-            |req, res| Box::pin(async move { record_attestation_metrics(req, res) }),
-        ))
         .mount(
             "/prpc",
             ra_rpc::prpc_routes!(KmsState, RpcHandler, trim: "KMS."),
         )
-        .mount("/", rocket::routes![metrics])
         .manage(state);
 
+    if metrics_enabled {
+        info!("Prometheus metrics endpoint enabled at /metrics");
+        rocket = rocket
+            .attach(AdHoc::on_response(
+                "Record KMS attestation metrics",
+                |req, res| Box::pin(async move { record_attestation_metrics(req, res) }),
+            ))
+            .mount("/", rocket::routes![metrics]);
+    }
+
     let verifier = QuoteVerifier::new(pccs_url);
     rocket = rocket.manage(verifier);