On 17/11/2025 11:07, Joan Gilabert wrote:

Hello everyone,

As discussed during the 2026.1 PTG[1], it was decided to deprecate the prometheus datasource[2] during this cycle, in favor of the aetos datasource[3]. The aetos datasource provides the same functionality as the prometheus one, but with the advantage of multi-tenancy and Kestone-based authentication. just a side note, the prometheus datasocue today does support http basic auth and can in theory do mtls however we do not test that today and just directly use the supprot for that in the python-observablity client.

Watcher is an admin ownly service and we do not passhtough acces to the backend datasouces so the reason for adopting Ateos is not to close a gap in multi-tenancy or authenticated access to prometheus but it is intended to simplify access by converging on aetos as the arbiter of access control for Prometheus rather then having multiple ways to connect to it. i.e. watcher, horizon or the openstack cli will use Aetos as a common gateway to Prometheus and can delegate multi tenant access enforcement as approate to Aetos instead of having to implement tha tour selves Watcher wont directlly use that capablity since our usage is inherinly cross tenant but we could if we ever had a need too without having to implement it in watcher.

Let us know if there are any objections.  A patch to deprecate the prometheus datasource is proposed[4].

[1] https://etherpad.opendev.org/p/watcher-2026.1-ptg#L207 [2] https://docs.openstack.org/watcher/latest/datasources/prometheus.html [3] https://docs.openstack.org/watcher/latest/datasources/aetos.html [4] https://review.opendev.org/c/openstack/watcher/+/966672

Regards,

Joan Francesc