Cloud Metrics

Scrape pipeline for cloud datastore metrics. Installing this blueprint is the explicit opt-in: it owns a dedicated ryvn-collector release, the reader identity, and the rendered allowlist fragment through the normal blueprint lifecycle — collection starts only after the reader binding lands on the dedicated collector. A datastore installation emitting the cloud_metrics output declares collectable resources; it never installs or enables this blueprint by itself — Ryvn modules emit it by default and foreign Terraform modules can emit the same shape to opt in.

One blueprint covers every provider: each child is conditioned on the environment's provider, so an installation materializes only the identity + collector pair for the cloud it runs on.

On AWS the identity composes two shared modules: the reader child renders the read-only CloudWatch/RDS/tag policy, and the identity child binds it to the dedicated collector's ServiceAccount through aws-workload-identity via an EKS Pod Identity association. The collector child runs the same ryvn-collector chart as the platform install with the core pipelines off — no duplicate scrapes — and its own ServiceAccount. The rendered allowlist — the tag-gated YACE discovery fragment the hub's reconcile writes as blueprint inputs — lands on the collector release itself: the chart carries it in its own release-owned ConfigMap. Both tag (ryvn.app/cloud-metrics=<environment-id>) and allowlist must admit a resource before its series reach Mimir.