Remove Prometheus metrics support

OpenTelemetry tracing is sufficient. Drop the metrics and
metrics-exporter-prometheus crates, the metrics_bind config field,
the PrometheusBuilder listener, and the corresponding docs. Add a
regression test ensuring metrics_bind is rejected as unknown.

Author: sl5-guy

README.md

@@ -41,13 +41,12 @@ Copy `config.example.toml` to `config.toml` and edit it. Key sections:
 | `rules[].extension_value` | Value to match in the extension |
 | `rules[].allowed_destinations` | List of `host` or `host:port` entries. Port defaults to `443` if omitted. |
 
-**`[observability]`** -- Logging, tracing, and metrics.
+**`[observability]`** -- Logging and tracing.
 
 | Field | Required | Description |
 |---|---|---|
 | `log_level` | yes | `tracing` filter (e.g. `info`, `debug`, `agent_gateway=debug`) |
 | `otlp_endpoint` | no | OTLP gRPC endpoint for distributed tracing |
-| `metrics_bind` | no | `host:port` for Prometheus metrics scraping |
 
 ## Running
 

config.example.toml

@@ -7,7 +7,6 @@ client_ca_path = "certs/client-ca.pem"
 [observability]
 log_level = "info"
 otlp_endpoint = "http://localhost:4317"
-metrics_bind = "0.0.0.0:9090"
 
 # Custom extension OID to extract from client certs
 [policy]

src/config.rs

@@ -27,7 +27,6 @@ pub struct ServerConfig {
 pub struct ObservabilityConfig {
     pub log_level: String,
     pub otlp_endpoint: Option<String>,
-    pub metrics_bind: Option<String>,
 }
 
 #[derive(Debug, Deserialize)]
@@ -62,11 +61,6 @@ impl Config {
             x509_parser::oid_registry::Oid::from_str(&self.policy.client_ext_oid)
                 .map_err(|e| anyhow::anyhow!("invalid policy.client_ext_oid: {e:?}"))?;
 
-        if let Some(ref bind) = self.observability.metrics_bind {
-            bind.parse::<std::net::SocketAddr>()
-                .map_err(|e| anyhow::anyhow!("invalid observability.metrics_bind: {e}"))?;
-        }
-
         for (i, rule) in self.policy.rules.iter().enumerate() {
             anyhow::ensure!(
                 !rule.extension_value.is_empty(),

src/observability.rs

@@ -1,4 +1,3 @@
-use std::net::SocketAddr;
 use std::sync::OnceLock;
 
 use anyhow::Context;
@@ -49,17 +48,6 @@ pub fn init(config: &ObservabilityConfig) -> anyhow::Result<()> {
         .try_init()
         .context("initializing tracing subscriber")?;
 
-    if let Some(ref bind) = config.metrics_bind {
-        let addr: SocketAddr = bind
-            .parse()
-            .with_context(|| format!("invalid metrics_bind: {bind}"))?;
-
-        metrics_exporter_prometheus::PrometheusBuilder::new()
-            .with_http_listener(addr)
-            .install()
-            .context("installing Prometheus metrics exporter")?;
-    }
-
     Ok(())
 }
 

tests/integration.rs

@@ -365,6 +365,34 @@ allowed_destinations = ["{dest}"]
     assert!(make("[::1]").is_ok());
 }
 
+#[test]
+fn config_rejects_removed_metrics_bind_field() {
+    let toml = r#"
+[server]
+listen_addr = "0.0.0.0:8443"
+tls_cert_path = "c.pem"
+tls_key_path = "k.pem"
+client_ca_path = "ca.pem"
+
+[observability]
+log_level = "info"
+metrics_bind = "0.0.0.0:9090"
+
+[policy]
+client_ext_oid = "1.3.6.1.4.1.57264.1.1"
+
+[[policy.rules]]
+extension_value = "x"
+allowed_destinations = ["api.example.com"]
+"#;
+    let tmpdir = std::env::temp_dir().join("agent_gw_test_config");
+    std::fs::create_dir_all(&tmpdir).ok();
+    let path = tmpdir.join("reject_metrics_bind.toml");
+    std::fs::write(&path, toml).unwrap();
+    let result = agent_gateway::config::Config::load(&path);
+    assert!(result.is_err(), "metrics_bind should be rejected as an unknown field");
+}
+
 // ---- Proxy Destination parsing ----
 
 fn parse_dest(authority: &str) -> Result<Destination, String> {