Prometheus

Getting Started with ClusterNest Managed Prometheus ClusterNest Managed Prometheus runs Cortex behind a Prometheus-compatible remote-write/query API, so any tool that speaks the Prometheus HTTP API (Prometheus itself, Grafana Agent, an OpenTelemetry Collector, Grafana) works against it without changes. This guide creates a cluster, fetches its credentials, and runs a first query.

Pushing Metrics into ClusterNest Managed Prometheus Every cluster comes with a write credential, scoped to exactly the push paths and nothing else

Querying ClusterNest Managed Prometheus and Wiring Up Grafana The query API lives under the /prometheus prefix on the cluster's endpoint, using the readonly (or admin) credential:

Managing ClusterNest Managed Prometheus Credentials Every cluster has three static Basic-auth credentials, each scoped to a different slice of the API:

Alert Rules & Alertmanager on ClusterNest Managed Prometheus Every cluster runs Cortex's ruler (rule evaluation) and its own per-cluster Alertmanager instance. All of it is admin-only except the read-only rule evaluation view:

JWT/OIDC Federation for ClusterNest Managed Prometheus Alongside the static admin/readonly/write credentials (which always exist and can't be turned off), a cluster can also trust one or more external JWT issuers directly - your own OIDC identity provider, or a Kubernetes cluster's own apiserver authenticating its workloads via their projected ServiceAccount tokens. A token presented as a Bearer credential is checked against every configured source; if it verifies, it receives whichever access level(s) its claims match.

Migrating an Existing Prometheus Setup to ClusterNest Managed Prometheus Moving from a self-hosted Prometheus or VictoriaMetrics deployment is a remote_write endpoint and credential swap - nothing ClusterNest-specific about the migration mechanics themselves.