From 55e41897efa741dd7c63957ded27286b64124195 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Tue, 7 Jul 2026 00:05:30 +1000 Subject: [PATCH] vmagent: set consul datacenter (fix 0 discovered targets) (#240) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why The Consul SD job discovered **0 targets**. vmagent logs showed it reaching the puppet Consul fine (TLS/connectivity OK) but getting `403` on `GET /v1/agent/self`: the anonymous token `lacks permission 'agent:read'`. VictoriaMetrics calls `/v1/agent/self` only to auto-detect the datacenter; catalog/health reads (what SD actually needs) work anonymously. ## Fix Set `datacenter: au-syd1` on the consul_sd_config so VM skips the `agent/self` call. No consul token needed. ## Verify after sync vmagent `/targets` → `consul` job shows the puppet targets (haproxy/ceph/gitea/node/…) up. Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/240 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- apps/base/observability/vmagent.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/apps/base/observability/vmagent.yaml b/apps/base/observability/vmagent.yaml index d1c4d62..efe229c 100644 --- a/apps/base/observability/vmagent.yaml +++ b/apps/base/observability/vmagent.yaml @@ -99,6 +99,10 @@ spec: consul_sd_configs: - server: consul.service.consul:443 scheme: https + # Set datacenter explicitly so VM does not call /v1/agent/self + # (which needs agent:read that the anonymous token lacks); catalog + # and health reads work anonymously. + datacenter: au-syd1 tls_config: ca_file: /etc/vmagent-tls/ca.crt relabel_configs: