Skip to content

Admin guide

This guide is for people who deploy and operate grex: install the binary, image, or Helm chart; configure listeners and TLS; scrape metrics; and understand process lifecycle.

Responsibilities

  • Choose listen addresses and network exposure for the three listeners
  • Deploy on Kubernetes with Helm when running in a cluster
  • Configure OpAMP TLS/mTLS for collectors
  • Set fleet heartbeat / stale / required attribute policy
  • Scrape Prometheus endpoints with safe cardinality limits
  • Integrate with orchestrator health probes (/healthz, /readyz)

Contents

Page Description
Install Binary, Docker, Compose, Helm overview
Releases Versioned artifacts + changelog
Deploy with Helm Kubernetes install, TLS, Ingress, scrapes
Configuration YAML + GREX_* reference
TLS and mTLS OpAMP server TLS and client certs
Authentication Current state + planned UI/API auth
Health and lifecycle Probes, drain, shutdown
Scaling with gateways OpAMP gateway topology
High availability Target multi-replica architecture (mostly design, not yet shipped)

Security posture (today)

Surface Protection today
OpAMP listener Optional TLS + optional mTLS (tls.*)
UI / API listener Open — auth not implemented yet
Telemetry listener Unauthenticated scrape of metrics/health; optional pprof

Run the UI and telemetry listeners on trusted networks (or behind a gateway you control) until UI authentication ships. Prefer mTLS on OpAMP for any non-lab collector fleet.