[lukekim]

What

Documents that the Prometheus metrics endpoint (spiced --metrics) is not covered by API keys, and adds guidance to bind it to a loopback or private interface.

• features/observability: new Restrict Access to the Metrics Endpoint section. It says /metrics checks no API key and needs no client certificate under mTLS, that its labels include dataset names and HTTP route templates, and that TLS encrypts the connection without restricting who can scrape. It recommends --metrics 127.0.0.1:9090 when the scraper is on the same host, and keeping the port off public load balancers and ingress, using a NetworkPolicy, in containers and Kubernetes. It also notes that the Helm chart binds 0.0.0.0:9090.
• features/observability: corrects Default Configuration. The endpoint is disabled unless --metrics is set. It does not listen on 9090 by default.
• api/auth: one paragraph under HTTP, next to the existing /health and /v1/ready note, saying API keys do not protect /metrics. It links to the new section.

Applied to docs/ (trunk) and versioned_docs/version-2.4.x/, because v2.4.0 behaves the same way.

Why

The auth page didn't mention /metrics, and the TLS page only says it is "always accessible". A reader who enables API keys could reasonably assume the metrics listener is covered too. This is documentation of existing behavior, not a vulnerability. Whether to offer optional auth on /metrics is tracked separately.

Verified against code (spiceai v2.4.0)

• crates/runtime/src/metrics_server/mod.rs: start() binds its own listener and wraps it only in the runtime TLS acceptor. handle_http_request() serves /health and /metrics with a rate limiter and no auth check.
• bin/spiced/src/lib.rs: --metrics is Option<SocketAddr>, documented as "disabled by default".
• deploy/chart/templates/deployment.yaml: the default command passes --metrics 0.0.0.0:9090.
• crates/runtime/src/http/routes.rs (track_metrics): the path label is the axum MatchedPath, which is the route template. dataset_load_state{dataset=...} carries dataset names.

No site build was run locally. The CI Deploy build passed (https://github.com/spiceai/docs/actions/runs/40736405684), and it runs with onBrokenLinks, onBrokenAnchors and onBrokenMarkdownLinks set to throw, so the new links and anchors resolve.

[github-actions]

✅ Pull with Spice Passed

Passing checks:

• ✅ Title meets minimum length requirement (10 characters)
• ✅ Has at least one of the required labels: area/blog, area/docs, area/cookbook, dependencies
• ✅ No banned labels detected
• ✅ Has at least one assignee: lukekim, spiceemma

[github-actions]

🔍 Pull with Spice Failed

Passing checks:

• ✅ Title meets minimum length requirement (10 characters)
• ✅ No banned labels detected

Failed checks:

• ❌ Please select at least one of the required labels for this pull request: area/blog, area/docs, area/cookbook, dependencies
• ❌ At least one assignee is required for this pull request.

Please address these issues and update your pull request.

[github-actions]

🔍 Pull with Spice Failed

Passing checks:

• ✅ Title meets minimum length requirement (10 characters)
• ✅ No banned labels detected
• ✅ Has at least one assignee: lukekim

Failed checks:

• ❌ Please select at least one of the required labels for this pull request: area/blog, area/docs, area/cookbook, dependencies

Please address these issues and update your pull request.

[github-actions]

🚀 deployed to https://55f488b3.spiceai-org-website.pages.dev

[Copilot]

🟢 Approved

The documentation-only clarification of metrics access and authentication limitations has no active review issues.

No open issues 🎉

What changed in this PR

This documentation-only PR clarifies that API keys do not protect the separate Prometheus metrics listener and explains how to restrict network access. The guidance covers both trunk and version 2.4.x.

Changes:

• Corrects the metrics default: the endpoint is disabled unless --metrics is configured.
• Documents authentication and TLS limitations, with loopback binding and container/Kubernetes access guidance.
• Links authentication documentation to the new metrics access section.

File	Description
website/​versioned_docs/​version-2.4.x/​features/​observability/​index.md	Corrects defaults and adds metrics access guidance for 2.4.x.
website/​versioned_docs/​version-2.4.x/​api/​auth/​index.md	Documents the metrics API-key exception and links to access guidance.
website/​docs/​features/​observability/​index.md	Corrects defaults and adds metrics access guidance for trunk.
website/​docs/​api/​auth/​index.md	Documents the metrics API-key exception and links to access guidance.

_{Review effort: Balanced}

[github-actions]

🚀 deployed to https://2b40c55a.spiceai-org-website.pages.dev