Unified APM Credential (VictoriaMetrics VMUser)

The Polycrate API provides one APM credential per organization covering metrics, logs and traces, rolled out as a VMUser in the VMAuth namespace. System configuration keys and organization behaviour.

Unified APM Credential (VictoriaMetrics VMUser)

Overview

The Polycrate API provides one APM credential resource per organization (apmstack_credential). It covers metrics, logs and traces and is rolled out via a VMUser in the VMAuth namespace of the configured Kubernetes cluster.

The former separate foreign keys for metrics, logs and traces credentials have been merged. Existing data is migrated to the new structure.

System configuration

Under System Config → Integration: APM Stack (category integrations_apm), the following apply, among others:

Field / key Purpose
system_apm_cluster Kubernetes cluster in which the VMAuth operator applies the VMUser (analogous to system_host_cluster, but for APM).
SYSTEM_APM_STACK Reference to the central APM stack (including the VMAuth K8s app).
SYSTEM_APM_CREDENTIALS_ENABLED Master switch: when off, no APM credentials are created or synchronized.
APM_VMAUTH_NAMESPACE Namespace of the VMAuth deployment (target for VMUser CRs).
APM_METRICS_TARGET_MODE crd (VMCluster insert/select) or static with APM_METRICS_STATIC_URL.
APM_METRICS_STATIC_URL, APM_LOGS_STATIC_URL, APM_TRACES_STATIC_URL Optional static targets for VictoriaLogs/VictoriaTraces or for metrics in static mode.

The system configuration can also be read and written via GET/PATCH /api/v1/system/config/; system_apm_cluster appears there as a UUID string (empty = not set).

Behaviour for organizations

  • With system APM credentials enabled and system_apm_cluster set, the API reconciles a VMUser with canonical path prefixes under /apm/... (see implementation, Spec 27).
  • Without a cluster or with the toggle disabled, no VMUser/credentials are created.
  • When an organization is deleted, the VMUser and credential are cleaned up on a best-effort basis.

Further topics