Put metrics behind auth in enterprise/e2e/public (for Grafana)

[jviotti]

Signed-off-by: Juan Cruz Viotti jv@jviotti.com

[augmentcode]

🤖 Augment PR Summary

Summary: This PR intends to protect the public instance's Prometheus metrics endpoint with a bearer API key for Grafana.

• Adds a metrics policy to the public instance configuration for /self/v1/metrics.
• Hashes the deployment secret before passing it to the KraftCloud instance.
• Wires a local environment file through Docker Compose for public-sandbox tests.
• Adds Hurl coverage for anonymous denial, hashed-key handling, successful scraping, health access, and CORS preflight.

Technical notes: The workflow verifies both unauthenticated rejection and authenticated Prometheus exposition after deploy.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 1 suggestion posted.

Comment augment review to trigger a new review at any time.

[augmentcode]

enterprise/e2e/public/one.json:14 creates a second authentication member at line 23; Core preserves duplicate members and Configuration::parse reads the first one, so it selects identity rather than sha256. The stored digest therefore will not match either local-development-only in the Hurl suite or the raw Grafana token in deployment, causing the tests and authenticated scrape check to return 401.

Severity: high

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

[cubic-dev-ai]

All reported issues were addressed across 5 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[github-actions]

Benchmark Index (enterprise)

Details

Benchmark suite	Current: f25a093	Previous: 2951d52	Ratio
Add one schema (0 existing)	330 ms	289 ms	1.14
Add one schema (100 existing)	153 ms	102 ms	1.50
Add one schema (1000 existing)	154 ms	157 ms	0.98
Add one schema (10000 existing)	1176 ms	834 ms	1.41
Update one schema (1 existing)	92 ms	88 ms	1.05
Update one schema (101 existing)	96 ms	101 ms	0.95
Update one schema (1001 existing)	149 ms	149 ms	1
Update one schema (10001 existing)	904 ms	792 ms	1.14
Cached rebuild (1 existing)	8 ms	10 ms	0.80
Cached rebuild (101 existing)	14 ms	12 ms	1.17
Cached rebuild (1001 existing)	60 ms	39 ms	1.54
Cached rebuild (10001 existing)	260 ms	277 ms	0.94
Index 100 schemas	490 ms	399 ms	1.23
Index 1000 schemas	1652 ms	1255 ms	1.32
Index 10000 schemas	16721 ms	11792 ms	1.42
Index 10000 schemas (custom meta-schema)	16364 ms	13677 ms	1.20
Index 10000 schemas ($ref fan-out)	12664 ms	13947 ms	0.91

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Benchmark Index (community)

Details

Benchmark suite	Current: f25a093	Previous: 2951d52	Ratio
Add one schema (0 existing)	472 ms	365 ms	1.29
Add one schema (100 existing)	31 ms	46 ms	0.67
Add one schema (1000 existing)	80 ms	98 ms	0.82
Add one schema (10000 existing)	727 ms	745 ms	0.98
Update one schema (1 existing)	57 ms	31 ms	1.84
Update one schema (101 existing)	27 ms	41 ms	0.66
Update one schema (1001 existing)	201 ms	100 ms	2.01
Update one schema (10001 existing)	790 ms	765 ms	1.03
Cached rebuild (1 existing)	7 ms	12 ms	0.58
Cached rebuild (101 existing)	10 ms	12 ms	0.83
Cached rebuild (1001 existing)	37 ms	42 ms	0.88
Cached rebuild (10001 existing)	247 ms	312 ms	0.79
Index 100 schemas	566 ms	660 ms	0.86
Index 1000 schemas	1204 ms	1518 ms	0.79
Index 10000 schemas	12460 ms	13591 ms	0.92
Index 10000 schemas (custom meta-schema)	14192 ms	15495 ms	0.92
Index 10000 schemas ($ref fan-out)	13820 ms	15713 ms	0.88

This comment was automatically generated by workflow using github-action-benchmark.