Node components on a Syself Autopilot cluster expose Prometheus metrics, and where a component binds decides how you scrape it and whether it is ever reachable from the internet. A component on the pod network binds a pod IP and sits behind a ClusterIP Service, so you scrape it like any in-cluster endpoint. A component on the host network binds 127.0.0.1, so nothing outside the node can reach it, whatever the firewall says, and you scrape it from a node-local collector.

The host-network rule has no exception: every host-network metrics listener binds loopback, except the kubelet, which binds the node IP but requires authentication. Node IPs are public here, so an unauthenticated /metrics on 0.0.0.0 would publish on a routable address.

Health-daemon metrics#

The health daemon is part of the Syself node agent (syself-node). It is the node-problem-detector: it turns node problems into Kubernetes NodeConditions and events, and it exports Prometheus metrics on 127.0.0.1:20257 on every node. The endpoint is plain HTTP with no auth, which is why it stays on loopback.

Where each component binds#

Host network (loopback)#

These share the node's network namespace and bind 127.0.0.1. Scrape them from a node-local, host-network DaemonSet.

Pod network (Service)#

These bind a pod IP behind a ClusterIP Service. Scrape them like any in-cluster endpoint, with a Service or a ServiceMonitor.

Why every listener is loopback or authenticated#

Nodes carry public IPs and there is no private network. Almost every metrics endpoint is unauthenticated (etcd 2381, KubeGate 8080, the health daemon 20257, and all of Cilium serve plain HTTP with no token), so a host-network process that bound 0.0.0.0 would publish that data on a routable, internet-facing address. Binding 127.0.0.1 means the host firewall is not the only thing in front of these endpoints: if a firewall rule is ever mis-edited or fails to apply, a loopback listener is still unreachable.

Cilium's Envoy metrics listener is the exception, and it is off for a different reason. These clusters block L7 network policy , so Envoy does no L7 work and its metrics on 9964 would be empty. That listener is also the one the upstream chart cannot bind to loopback, so rather than publish an empty endpoint on the node address, those Envoy metrics are disabled. Nothing useful is lost.

What to scrape and how#

Scrape the loopback endpoints from a host-network DaemonSet. Set hostNetwork: true and dnsPolicy: ClusterFirstWithHostNet so the collector shares each node's network namespace and dials 127.0.0.1 directly. That path never leaves the node, so it needs no firewall rule.

A scraper pod that is not on the host network cannot reach these ports. Its packet leaves the pod namespace and arrives at the node's host endpoint, where the default-deny host firewall drops anything not explicitly allowed. That is why a ServiceMonitor pointed at 127.0.0.1 on the node cannot work, and why the loopback endpoints have no Service to select.

The pod-network endpoints are the opposite: they are ordinary ClusterIP Services, reachable from any namespace, and a normal Service or ServiceMonitor picks them up. Syself does not ship the Prometheus Operator CRDs, so if you use ServiceMonitors you install the operator and write your own.

Map a firing condition to its metric#

When a NodeCondition fires and you want the time series behind it, the health daemon on 20257 is the source. The condition itself shows in problem_gauge there. A one-shot event that set no condition shows as an increment on problem_counter. A repair loop restarting a broken unit shows on syself_node_unit_restarts{unit}, and a fast climb there is what escalates to ServiceNotRecovering.

Related#

• Ports and listeners : every port a node opens, not just the metrics ones.
• Node health conditions : the conditions the health-daemon metrics correspond to, and which ones trigger replacement.
• Collect logs with the log collector : the diagnostics bundle to send when a metric points at a problem you cannot resolve.