feat(metrics): add public metrics endpoint configuration and update documentation (#92)

helm/garage-ui/README.md

@@ -689,16 +689,17 @@ Enable Prometheus metrics scraping (requires Prometheus Operator):
 serviceMonitor:
   enabled: true
   interval: 30s
-  path: /api/v1/monitoring/metrics
+  # /metrics is served only when config.auth.metrics_public is true
+  path: /metrics
   labels:
     prometheus: kube-prometheus
 ```
 
 ### Metrics Endpoint
 
-The application exposes metrics at:
-- Path: `/api/v1/monitoring/metrics`
-- Format: Prometheus format (proxies Garage Admin API metrics)
+The application exposes Prometheus-format metrics (proxying the Garage Admin API) at:
+- `/api/v1/monitoring/metrics`: always registered, requires authentication.
+- `/metrics`: top-level, unauthenticated. Served ONLY when `config.auth.metrics_public` is `true`. Use this for Prometheus scraping when authentication is enabled, and restrict access with a NetworkPolicy / trusted scrape network.
 
 ### Health Checks
 

helm/garage-ui/values.schema.json

@@ -199,6 +199,11 @@
                 }
               }
             },
+            "metrics_public": {
+              "type": "boolean",
+              "description": "Expose Prometheus metrics at top-level /metrics without authentication (required for scraping when auth is enabled). Restrict access with a NetworkPolicy.",
+              "default": false
+            },
             "admin": {
               "type": "object",
               "description": "Admin authentication settings (username/password)",
@@ -846,7 +851,7 @@
         "path": {
           "type": "string",
           "description": "Metrics endpoint path",
-          "default": "/api/v1/monitoring/metrics"
+          "default": "/metrics"
         },
         "labels": {
           "type": "object",

helm/garage-ui/values.yaml

@@ -74,6 +74,14 @@ config:
       name: ""
       key: "jwt-key.pem"
 
+    # Expose Prometheus metrics at top-level /metrics WITHOUT authentication.
+    # Required for Prometheus to scrape when auth (admin/token/oidc) is enabled,
+    # since scrapers do not send credentials. Pairs with serviceMonitor below.
+    # WARNING: exposes operational cluster telemetry (bucket counts, request
+    # rates, storage sizes) unauthenticated, with no object data or secrets. Restrict
+    # access with a NetworkPolicy / trusted scrape network.
+    metrics_public: false
+
     # Admin authentication (username/password)
     admin:
       enabled: false
@@ -236,7 +244,9 @@ readinessProbe:
 serviceMonitor:
   enabled: false
   interval: 30s
-  path: /api/v1/monitoring/metrics
+  # Scrape path. The default /metrics is served only when
+  # config.auth.metrics_public is true (required when authentication is enabled).
+  path: /metrics
   labels: {}
 
 # NetworkPolicy