Prometheus metrics

Availability All editions — Community and up.

The controller exposes Prometheus metrics at /metrics for monitoring sessions, proxy health, auth and integrations.

Securing the endpoint

/metrics is off until you set TESSERA_METRICS_TOKEN — without it the endpoint returns 404. Generate a random value and pass it as a bearer token (see Configuration):

curl -H "Authorization: Bearer $TESSERA_METRICS_TOKEN" https://tessera.example.com/metrics

Scrape config:

scrape_configs:
  - job_name: tessera
    scheme: https
    authorization:
      credentials: <TESSERA_METRICS_TOKEN>
    static_configs:
      - targets: ["tessera.example.com"]

Exported metrics

Metric	Type	Labels	Meaning
tessera_build_info	gauge	version	Build version (value is always 1).
tessera_http_requests_total	counter	method, code	API requests by method and status class.
tessera_http_request_duration_seconds	histogram	—	API request latency.
tessera_http_requests_in_flight	gauge	—	Requests currently being served.
tessera_sessions_started_total	counter	kind	Sessions created, by target kind.
tessera_sessions_active	gauge	kind	Currently active proxied sessions.
tessera_sessions_closed_total	counter	kind	Sessions ended, by target kind.
tessera_session_duration_seconds	histogram	—	Session length.
tessera_k8s_requests_total	counter	verb	Proxied apiserver requests by verb.
tessera_commands_blocked_total	counter	—	Commands/queries blocked in read-only mode.
tessera_proxy_errors_total	counter	kind	Proxy session errors by target kind.
tessera_access_requests_total	counter	event	Just-in-time access requests by event.
tessera_auth_logins_total	counter	method, outcome	Login attempts by method and outcome (outcome is one of success, failure, blocked, disabled).
tessera_notifications_total	counter	channel, outcome	Notification deliveries.
tessera_audit_export_total	counter	outcome	Audit-export deliveries to your SIEM.

Plus the standard Go runtime and process collectors (go_*, process_*).

Useful queries

# Active sessions by kind
tessera_sessions_active

# API error rate
sum(rate(tessera_http_requests_total{code=~"5.."}[5m]))
  / sum(rate(tessera_http_requests_total[5m]))

# Blocked commands (read-only enforcement) over time
rate(tessera_commands_blocked_total[5m])

# Failed logins (anything that isn't a success — failure, blocked or disabled)
rate(tessera_auth_logins_total{outcome!="success"}[5m])