Deploy the read-only gateway.

The same hardened container supports Cloudflare directly and Prometheus-compatible monitoring across Kubernetes, AWS, Azure, GCP, and private infrastructure. A custom gateway can implement the same protocol for any other provider.

Store all values in a secret manager or an uncommitted environment file. Generate a separate gateway bearer value of at least 32 characters.

INFRASTRUCTURE_ADAPTER=prometheus
INFRASTRUCTURE_GATEWAY_TOKEN=<random gateway bearer>
INFRASTRUCTURE_RESOURCE_CATALOG=[{"id":"service:api","kind":"service","name":"Production API"}]
PROMETHEUS_BASE_URL=http://prometheus.monitoring.svc:9090
PROMETHEUS_QUERIES={"service:api":{"requests":"sum(rate(http_requests_total{service=\"api\"}[5m]))"}}
PROMETHEUS_LABEL_ALLOWLIST=["job","instance","region"]

docker run --rm -p 8787:8787 \
  --env-file /secure/path/gateway.env \
  ghcr.io/abendayan/verisual-infrastructure-gateway:edge

Pin the image by digest for production. Never place provider or gateway credentials in image layers, Helm values, source control, or a command argument.

`PROMETHEUS_QUERIES` maps each exact resource ID to operator-authored PromQL. The Infrastructure Agent may select a configured metric name, but it cannot submit PromQL, change label selectors, or exceed ten provider requests in one action.

{
  "service:api": {
    "requests": "sum(rate(http_requests_total{service=\"api\"}[5m]))",
    "errors": "sum(rate(http_requests_total{service=\"api\",status=~\"5..\"}[5m]))",
    "latency_p99": "histogram_quantile(0.99, sum by (le) (rate(http_request_duration_seconds_bucket{service=\"api\"}[5m])))"
  }
}

Only labels named in `PROMETHEUS_LABEL_ALLOWLIST` are returned. Exclude customer IDs, email addresses, request paths containing identifiers, and any label that may contain a secret.

Create a dedicated account API token with Workers Scripts Read and Account Analytics Read. The resource scope is an exact JSON array of Worker IDs; unrelated Workers returned by the account API are removed inside the gateway.

INFRASTRUCTURE_ADAPTER=cloudflare
INFRASTRUCTURE_GATEWAY_TOKEN=<random gateway bearer>
INFRASTRUCTURE_RESOURCE_SCOPES=["cloudflare:worker:api-production"]
CLOUDFLARE_ACCOUNT_ID=<32-character account ID>
CLOUDFLARE_API_TOKEN=<dedicated read-only API token>

The adapter exposes Worker inventory, bounded request/error/subrequest telemetry, deployment history, and exact deployment inspection. It does not expose logs, cost, quota, or mutations.

Create an existing Secret containing `INFRASTRUCTURE_GATEWAY_TOKEN` and, when required, `PROMETHEUS_BEARER_TOKEN` or `CLOUDFLARE_API_TOKEN`. Install the Verisual gateway Helm chart with resource catalog and query mappings in a separate values file.

kubectl -n observability create secret generic verisual-infrastructure-gateway-secrets \
  --from-literal=INFRASTRUCTURE_GATEWAY_TOKEN="$INFRASTRUCTURE_GATEWAY_TOKEN" \
  --from-literal=PROMETHEUS_BEARER_TOKEN="$PROMETHEUS_BEARER_TOKEN"

helm upgrade --install verisual-infra \
  oci://ghcr.io/abendayan/charts/verisual-infrastructure-gateway \
  --version 0.1.0 \
  --namespace observability \
  --set existingSecret=verisual-infrastructure-gateway-secrets \
  --values gateway-values.yaml

Configure an ingress or edge tunnel with valid public HTTPS. The chart disables service-account token mounting, runs without root, drops Linux capabilities, and uses a read-only root filesystem.

Verify the public endpoint from outside the private network before saving it in Verisual:

curl --fail --silent \
  --header "Authorization: Bearer $INFRASTRUCTURE_GATEWAY_TOKEN" \
  https://infra-gateway.example.com/v1/capabilities

Then open Projects → Infrastructure and enter the HTTPS origin, environment, exact resource scopes, approved console origins, and the gateway bearer token. Verisual verifies and snapshots the read-only capability manifest before saving.

• Use a dedicated read-only provider identity.
• Scope both the provider identity and gateway resource catalog.
• Terminate valid HTTPS at a trusted ingress or edge.
• Rate-limit failed bearer authentication at the edge.
• Keep provider payloads, logs, and labels free of secrets.
• Rotate the provider and gateway credentials on a schedule.
• Pin the container digest and review upgrades before rollout.

Email support@verisual.com for a custom adapter review. Never send credentials in a support request.