Migrate to apiv2

.github/workflows/docker.yaml

@@ -22,17 +22,17 @@ jobs:
 
     steps:
       - name: Log in to the container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ secrets.DOCKER_REGISTRY_USER }}
           password: ${{ secrets.DOCKER_REGISTRY_TOKEN }}
 
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
           cache: false
@@ -53,10 +53,10 @@ jobs:
           make all
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Push image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           push: true

Dockerfile

@@ -1,4 +1,4 @@
-FROM scratch
+FROM gcr.io/distroless/static-debian13:nonroot
 COPY bin/metal-metrics-exporter /metal-metrics-exporter
 USER 999
 ENTRYPOINT ["/metal-metrics-exporter"]

api-calls.md

@@ -0,0 +1,13 @@
+# Required token permissions
+
+| subject | methods                                        |
+|:-------:|------------------------------------------------|
+|         | /metalstack.admin.v2.ImageService/Usage        |
+|         | /metalstack.admin.v2.MachineService/Issues     |
+|         | /metalstack.admin.v2.MachineService/List       |
+|         | /metalstack.admin.v2.MachineService/ListBMC    |
+|         | /metalstack.admin.v2.NetworkService/List       |
+|         | /metalstack.admin.v2.PartitionService/Capacity |
+|         | /metalstack.admin.v2.ProjectService/List       |
+|         | /metalstack.admin.v2.SwitchService/List        |
+|         | /metalstack.infra.v2.ComponentService/Ping     |

deploy/metal-metrics-exporter-deployment.yaml

@@ -31,16 +31,11 @@ spec:
                 secretKeyRef:
                   name: metal-metrics-exporter-config
                   key: url
-            - name: METAL_API_HMAC
+            - name: METAL_API_TOKEN_FILE
               valueFrom:
                 secretKeyRef:
                   name: metal-metrics-exporter-config
-                  key: hmac
-            - name: METAL_API_AUTH_TYPE
-              valueFrom:
-                secretKeyRef:
-                  key: authtype
-                  name: metal-metrics-exporter-config
+                  key: token
           securityContext:
             runAsUser: 999
             allowPrivilegeEscalation: false

deploy/metal-metrics-exporter-secret.yaml

@@ -5,5 +5,4 @@ metadata:
 type: Opaque
 stringData:
   url: "https://api.example.com/metal"
-  hmac: "XXXX"
-  authtype: "Metal-View"
+  token: "XXXX"

deploy/metal-token-refresher.yaml

@@ -0,0 +1,58 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: metrics-exporter-token-refresher
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: metrics-exporter-token-refresher
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "update", "patch"]
+- apiGroups: [""]
+  resources: ["secrets"]
+  resourceNames: ["metal-metrics-exporter-config"]
+  verbs: ["get", "update", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: metrics-exporter-token-refresher
+subjects:
+- kind: ServiceAccount
+  name: metrics-exporter-token-refresher
+roleRef:
+  kind: Role
+  name: metrics-exporter-token-refresher
+  apiGroup: rbac.authorization.k8s.io
+
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: metrics-exporter-token-refresher
+spec:
+  schedule: "@hourly"
+  jobTemplate:
+    metadata:
+      name: metrics-exporter-token-refresher
+    spec:
+      template:
+        spec:
+          serviceAccountName: metrics-exporter-token-refresher
+          restartPolicy: OnFailure
+          containers:
+          - name: token-refresher
+            image: ghcr.io/metal-stack/metal-token-refresher
+            env:
+            - name: METAL_APISERVER_URL
+              value: http://metal-apiserver:8080
+            - name: TOKEN_SECRET_NAMESPACE
+              value: "metal-control-plane"
+            - name: TOKEN_SECRET_NAME
+              value: "metal-metrics-exporter-config"
+            - name: TOKEN_SECRET_KEY
+              value: "token"
+

go.mod

@@ -1,71 +1,29 @@
 module github.com/metal-stack/metal-metrics-exporter
 
-go 1.26
+go 1.26.5
 
 require (
-	github.com/metal-stack/metal-go v0.43.0
-	github.com/metal-stack/metal-lib v0.23.5
-	github.com/prometheus/client_golang v1.23.2
-	golang.org/x/sync v0.19.0
+	github.com/metal-stack/api v0.5.1
+	github.com/metal-stack/metal-lib v0.26.3
+	github.com/prometheus/client_golang v1.24.1
+	golang.org/x/sync v0.22.0
+	google.golang.org/protobuf v1.36.12
 )
 
 require (
+	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.12-20260709200747-435963d16310.1 // indirect
+	connectrpc.com/connect v1.20.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/coreos/go-oidc/v3 v3.17.0 // indirect
-	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.3 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
-	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-openapi/analysis v0.24.2 // indirect
-	github.com/go-openapi/errors v0.22.6 // indirect
-	github.com/go-openapi/jsonpointer v0.22.4 // indirect
-	github.com/go-openapi/jsonreference v0.21.4 // indirect
-	github.com/go-openapi/loads v0.23.2 // indirect
-	github.com/go-openapi/runtime v0.29.2 // indirect
-	github.com/go-openapi/spec v0.22.3 // indirect
-	github.com/go-openapi/strfmt v0.25.0 // indirect
-	github.com/go-openapi/swag v0.25.4 // indirect
-	github.com/go-openapi/swag/cmdutils v0.25.4 // indirect
-	github.com/go-openapi/swag/conv v0.25.4 // indirect
-	github.com/go-openapi/swag/fileutils v0.25.4 // indirect
-	github.com/go-openapi/swag/jsonname v0.25.4 // indirect
-	github.com/go-openapi/swag/jsonutils v0.25.4 // indirect
-	github.com/go-openapi/swag/loading v0.25.4 // indirect
-	github.com/go-openapi/swag/mangling v0.25.4 // indirect
-	github.com/go-openapi/swag/netutils v0.25.4 // indirect
-	github.com/go-openapi/swag/stringutils v0.25.4 // indirect
-	github.com/go-openapi/swag/typeutils v0.25.4 // indirect
-	github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
-	github.com/go-openapi/validate v0.25.1 // indirect
-	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
-	github.com/goccy/go-json v0.10.5 // indirect
 	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/gorilla/mux v1.8.1 // indirect
-	github.com/lestrrat-go/blackmagic v1.0.4 // indirect
-	github.com/lestrrat-go/httpcc v1.0.1 // indirect
-	github.com/lestrrat-go/httprc/v3 v3.0.4 // indirect
-	github.com/lestrrat-go/jwx/v3 v3.0.13 // indirect
-	github.com/lestrrat-go/option/v2 v2.0.0 // indirect
-	github.com/metal-stack/security v0.9.5 // indirect
+	github.com/klauspost/compress v1.19.2 // indirect
+	github.com/klauspost/connect-compress/v2 v2.1.1 // indirect
+	github.com/minio/minlz v1.2.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.67.5 // indirect
-	github.com/prometheus/procfs v0.19.2 // indirect
-	github.com/segmentio/asm v1.2.1 // indirect
-	go.mongodb.org/mongo-driver v1.17.9 // indirect
-	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/otel v1.40.0 // indirect
-	go.opentelemetry.io/otel/metric v1.40.0 // indirect
-	go.opentelemetry.io/otel/trace v1.40.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.3 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.48.0 // indirect
-	golang.org/x/net v0.50.0 // indirect
-	golang.org/x/oauth2 v0.35.0 // indirect
-	golang.org/x/sys v0.41.0 // indirect
-	golang.org/x/text v0.34.0 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
+	github.com/prometheus/common v0.70.1 // indirect
+	github.com/prometheus/procfs v0.21.1 // indirect
+	golang.org/x/sys v0.47.0 // indirect
 )