Resource: clusternest_prometheus

Example Usage

resource "clusternest_prometheus" "test" {
  name            = "metrics"
  tier            = "standard"
  organization_id = 123

  # Optional: who may sign in to this cluster, alongside the static
  # admin/readonly/write credentials below. A new cluster gets the
  # ClusterNest sign-in (type "builtin"), which also signs browsers in to the
  # query UI; set auth_sources to change that. A "jwt" source lets your own
  # identity provider authenticate directly against the Prometheus-compatible
  # endpoint. Here, only a token whose "sub" claim matches grants push-only
  # access - a broader, claims-free grant would give every token from this
  # source that same access instead. A "saml" source (at most one) signs
  # users in on the cluster's web UI through your SAML identity provider;
  # register the cluster URL followed by /_tap/saml/acs as its assertion
  # consumer service URL. Here, only the user whose NameID is "alice" gets
  # read-only access. A "jwt" source with ui_login also signs people in to the
  # query UI through your OpenID Connect provider, as a public (PKCE) or a
  # confidential client; register the cluster URL followed by
  # /_tap/oidc/<name>/callback as its redirect URI.
  auth_sources = [
    {
      name = "organization"
      type = "builtin"
    },
    {
      name     = "idp"
      type     = "jwt"
      issuer   = "https://idp.example.com"
      jwks_url = "https://idp.example.com/jwks"
      grants = [
        { role = "write", claims = { sub = "remote-write-agent" } },
      ]
    },
    {
      name             = "corp-sso"
      type             = "saml"
      idp_metadata_url = "https://sso.example.com/metadata"
      idp_entity_id    = "https://sso.example.com/entity"
      sp_entity_id     = "https://metrics.example.com/saml/metadata"
      grants = [
        { role = "readonly", claims = { sub = "alice" } },
      ]
    },
    {
      name               = "entra"
      type               = "jwt"
      issuer             = "https://login.example.com/tenant/v2.0"
      oidc_discovery_url = "https://login.example.com/tenant/v2.0/.well-known/openid-configuration"
      ui_login           = true
      client_id          = "metrics-ui"
      client_type        = "confidential"
      client_secret      = var.entra_client_secret
      scope              = "openid profile email groups offline_access"
      grants = [
        { role = "readonly", claims = { groups = "sre" } },
      ]
    },
  ]
}

data "clusternest_prometheus_credentials" "test" {
  cluster_id = clusternest_prometheus.test.id
}

output "prometheus_url" {
  value = clusternest_prometheus.test.url
}

output "admin_password" {
  value = data.clusternest_prometheus_credentials.test.admin
}

output "readonly_password" {
  value     = data.clusternest_prometheus_credentials.test.readonly
  sensitive = true
}

output "write_password" {
  value     = data.clusternest_prometheus_credentials.test.write
  sensitive = true
}

variable "entra_client_secret" {
  type      = string
  sensitive = true
}

Schema

Required

• name (String) Cluster name, unique within the organization. Lowercase letters, digits, and hyphens only.
• organization_id (Number) Organization the cluster is created in.

Optional

• auth_sources (Attributes List) Identity providers whose tokens may authenticate directly against this cluster’s Prometheus-compatible endpoint: JWT issuers and a SAML identity provider you bring (each granted its own access level), and the ClusterNest sign-in (type builtin), which also signs browsers in to the query UI. A new cluster has the ClusterNest sign-in unless this is set; set an empty list to leave it out. Leaving this out of an existing cluster keeps its current sources; set an empty list to remove them all. (see below for nested schema)
• capacity_multiplier (Number) Scaling multiplier for cluster capacity. Values above 3 are only available on the advanced tier.
• custom_hostname (String) Custom domain to serve the Prometheus-compatible endpoint on, instead of the generated default hostname.
• ip_allowlist (List of String) IP addresses or subnets allowed to reach the Prometheus endpoint.
• maintenance_window (Attributes) Weekly recurring window (UTC) during which maintenance may be performed on this cluster. Must be at least 2 hours (120 minutes) long. Leave unset to allow maintenance at any time. (see below for nested schema)
• retention_period (String) The following optional suffixes are supported: h (hour), d (day), w (week), y (year). If suffix isn’t set, then the duration is counted in months
• tier (String) Sizing/pricing tier the cluster runs at.
• version (String) Cortex version to run.

Read-Only

• id (Number) Unique identifier of the cluster.
• url (String) URL of the Prometheus-compatible endpoint.

Nested Schema for auth_sources

Optional:

• audiences (List of String) Allowed aud claim values; a token matching any one of these is accepted. Empty means any audience is accepted. jwt sources only.
• ca_cert (String) Base64-encoded PEM CA bundle to trust when fetching this source’s JWKS/discovery document (jwt) or the identity provider’s metadata (saml) over TLS, replacing (not extending) the system trust store for that fetch only. jwt and saml sources only.
• client_id (String) OAuth client ID registered with the identity provider. Required when ui_login is enabled, and it is also the audience of the ID token, so audiences, if set, must include it. jwt sources only.
• client_secret (String, Sensitive) OAuth client secret, for a confidential client. Write-only: the API never returns it, and Terraform keeps the configured value. jwt sources only.
• client_type (String) Whether the OAuth client is public (the cluster relies on PKCE alone, the default) or confidential (it also authenticates with client_secret). Only used when ui_login is enabled. jwt sources only.
• grants (Attributes List) Access levels this source can grant. A token verified by this source receives every grant whose claims requirements it satisfies; its effective access is the union of those (e.g. a token matching both a write grant and a broader admin grant gets admin access). A grant with no claims matches any token or user this source verifies. Required for jwt and saml sources. (see below for nested schema)
• idp_entity_id (String) Entity ID of the identity provider. saml sources only.
• idp_metadata_url (String) URL of the identity provider’s SAML metadata document (https:// only). The host must resolve to a public address as seen by the API’s own DNS. saml sources only.
• issuer (String) The trusted token issuer (the JWT’s iss claim). jwt sources only.
• jwks_url (String) Static JWKS endpoint (https:// only) to fetch signing keys from. Exactly one of jwks_url or oidc_discovery_url is required. jwt sources only.
• name (String) Required. Identifies this source within the cluster. Lowercase letters, digits and hyphens, at most 32 characters. Must be unique within the cluster’s auth_sources.
• oidc_discovery_url (String) OIDC discovery document URL (https:// only); its advertised JWKS endpoint is resolved once and used from then on. Exactly one of jwks_url or oidc_discovery_url is required. jwt sources only.
• scope (String) Space-separated OAuth scopes to request during sign-in, openid profile email by default. Must include openid. A grant can only match claims the ID token carries, and many providers only include groups when that scope is requested. Browsers stay signed in past the ID token’s expiry when the provider issues a refresh token, which most providers only do when offline_access is in the scope. jwt sources only.
• sp_entity_id (String) Entity ID this Prometheus cluster identifies itself as to the identity provider. Register the cluster URL followed by /_tap/saml/acs as the assertion consumer service URL with the provider. saml sources only.
• token_auth_method (String) How a confidential client authenticates to the identity provider’s token endpoint: client_secret_basic (the default) or client_secret_post, which some providers such as Google need. jwt sources only.
• type (String) Required. Kind of source: jwt (a JWT issuer you bring), saml (a SAML identity provider you bring, which signs users in on the cluster’s web UI; at most one per cluster) or builtin (the ClusterNest sign-in: members with an owner, admin or write role get full access, members with the read role get read-only access). A cluster can have at most one builtin source.
• ui_login (Boolean) Offer this source as a sign-in option on the cluster’s query UI, next to the other sign-in methods. Needs oidc_discovery_url and client_id, and the name must then be lowercase letters, digits and hyphens. Register the cluster URL followed by /_tap/oidc//callback as the redirect URI with the identity provider. jwt sources only.

Nested Schema for auth_sources.grants

Required:

• role (String) Access level granted to a token or signed-in user matching this grant: admin (full access), readonly (read-only), or write (push-only).

Optional:

• claims (Map of String) Claims a JWT must carry, or SAML attributes a user must have, to receive this grant, as exact-match name -> required value pairs. The subject (JWT sub, SAML NameID) is matched with {“sub”: “…”}. Omit to match anything the source authenticates.

Nested Schema for maintenance_window

Required:

• day_of_week (String) Day of the week the window recurs on, UTC.
• end_time (String) Before start_time means the window wraps past midnight into the next day (e.g. start_time=‘23:00’, end_time=‘01:00’ is a 2-hour window). Equal to start_time means the full 24 hours are available on day_of_week - distinct from leaving maintenance_window unset entirely, which means every day, any time.
• start_time (String) Start of the window, 24h “HH:MM”, UTC.