Case Study: Prometheus & Actuator Observability Cloaking
This case study demonstrates how to protect internal telemetry, metrics scrapers, and diagnostic dumps from public disclosure while preserving uninterrupted collection by internal monitoring pipelines (Prometheus, Datadog, Grafana).
The Threat Model
Most modern microservices expose operational metrics and health dashboards out-of-the-box:
- Prometheus Scrape Endpoints:
/metrics - Spring Boot Actuator:
/actuator,/actuator/env,/actuator/heapdump,/actuator/loggers - Go Runtime Profiling:
/debug/pprof,/debug/vars
When exposed to the public internet, these endpoints leak proprietary architecture details, server environment variables, memory layouts, and query patterns to competitive reconnaissance bots and exploit kits.
The Solution: Ingress Masking via RouteWarden
RouteWarden intercepts all requests directed at diagnostic and metrics paths:
- Public Traffic: Receives a cloaked
404 Not Foundresponse. - Authorized Scrapers: Requests originating from the internal monitoring cluster (e.g. Prometheus pod CIDR
10.244.0.0/16or VPC subnet) bypass the filter and receive live metrics.
Configuration (Traefik, Caddy & NGINX)
# dynamic_conf.ymlhttp: middlewares: metrics-cloak: plugin: routewarden: enabled: true enableDefaultPatterns: true # Guard metrics, profiling, and actuator endpoints pathPatterns: - '(?i)^/(metrics|server-metrics|telemetry)(/.*)?$' - '(?i)^/actuator(/.*)?$' - '(?i)^/debug/(pprof|vars)(/.*)?$' # Allow internal Prometheus scraper & Kubernetes VPC allowedIps: - "10.0.0.50/32" # Dedicated Prometheus server IP - "10.244.0.0/16" # Internal Kubernetes Pod Network - "127.0.0.1" # Localhost diagnostic agent response: mode: json statusCode: 404 body: '{"error":"Not Found","message":"The requested URL was not found on this server"}' routers: app-router: rule: "Host(`app.example.com`)" entryPoints: - websecure middlewares: - metrics-cloak service: app-service