refactor(fmds): serve /metrics through the shared metrics-endpoint crate

[chet]

fmds served /metrics from its own axum router -- a nest("/metrics", ...) over a hand-written export_metrics handler. That duplicates the shared metrics-endpoint crate the rest of the fleet uses, so this hands fmds's existing Prometheus registry to metrics_endpoint::run_metrics_endpoint and deletes the bespoke router.

• The metrics server now builds a MetricsEndpointConfig over the registry http_request_metrics::init() produces and serves it, keeping the same bind address and task structure.
• metrics_router and export_metrics are gone, along with their now-unused axum and encoder imports; init() (the meter setup) is untouched.

The endpoint serves the same registry through the same TextEncoder, so /metrics stays byte-identical; it also answers /health, /ready, and / on the same port, matching the other migrated services.

This supports #3180

[chet]

@coderabbitai full_review, thanks!

[coderabbitai]

@chet, sure thing — kicking off a full review of all the changes in this PR now.

ヽ(•‿•)ノ

✅ Action performed

Full review finished.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 5122fad1-36d7-43ad-bba3-c71fe7bcb1cd

📥 Commits

Reviewing files that changed from the base of the PR and between b8b33a5 and 30d83a6.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• crates/fmds/Cargo.toml
• crates/fmds/src/http_request_metrics.rs
• crates/fmds/src/main.rs

---

Summary by CodeRabbit

• Refactor
  • Switched the Prometheus /metrics server to the shared metrics endpoint service instead of locally wiring an HTTP router.
  • Preserved Prometheus collection via the existing registry and continued recording per-request HTTP counts and latency.
  • Retained the existing startup and error logging behavior for metrics serving.
• Chores
  • Added the local metrics-endpoint dependency to the fmds crate.

Walkthrough

fmds now uses the shared metrics-endpoint crate for Prometheus serving. Its local Axum metrics router and text encoding handler are removed, while registry initialization and HTTP request instrumentation remain.

Changes

Metrics endpoint migration

Layer / File(s)	Summary
Shared endpoint wiring crates/fmds/Cargo.toml, crates/fmds/src/main.rs	Adds the local metrics-endpoint dependency and replaces manual server setup with MetricsEndpointConfig and run_metrics_endpoint.
Local serving removal crates/fmds/src/http_request_metrics.rs	Removes the local Axum /metrics router, export handler, and Prometheus text encoding imports while retaining instrumentation.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• NVIDIA/infra-controller#3474: Modifies the shared metrics endpoint configuration used by this migration.
• NVIDIA/infra-controller#3525: Makes a similar migration from local Axum metrics serving to the shared endpoint crate.
• NVIDIA/infra-controller#3527: Makes a similar shared metrics-endpoint integration change.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: switching fmds to the shared metrics-endpoint crate for /metrics.
Description check	✅ Passed	The description accurately describes the refactor and its impact on the metrics server, router, and endpoint behavior.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/fmds/src/main.rs`:
- Around line 120-121: Update the log immediately before
metrics_endpoint::run_metrics_endpoint to say “starting” instead of “listening,”
or remove it, since binding has not succeeded yet. Keep the runner’s post-bind
listening log as the authoritative success message.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ef8174fb-d958-49ee-b8e9-22f5807d583c

📥 Commits

Reviewing files that changed from the base of the PR and between 8abff94 and d792d83.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• crates/fmds/Cargo.toml
• crates/fmds/src/http_request_metrics.rs
• crates/fmds/src/main.rs

[chet]

Good catch @coderabbitai -- removed the premature "Prometheus /metrics listening" log. It fired before the bind, and the shared run_metrics_endpoint already logs "Starting metrics listener" (with the address) after binding, so that's now the single authoritative line; a bind failure still surfaces via the error log.

[chet]

@coderabbitai full_review, thanks!

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

@chet, thanks for the clarification — that's the right call. Relying solely on the shared crate's post-bind "Starting metrics listener" log avoids the misleading pre-bind message, and the error log still covers bind failures. Confirmed as addressed.

[coderabbitai]

@chet, on it — kicking off a full review of all the changes in this PR now.

✅ Action performed

Full review finished.

[github-actions]

🔍 Container Scan Summary

Service	Total	Critical	High	Medium	Low	Other
boot-artifacts-aarch64	3	0	0	3	0	0
boot-artifacts-x86_64	3	0	0	3	0	0
forge-admin-cli-x86_64	259	13	30	78	7	131
machine-validation-runner	807	40	234	288	36	209
machine_validation	807	40	234	288	36	209
machine_validation-aarch64	807	40	234	288	36	209
nvmetal-carbide	807	40	234	288	36	209
TOTAL	3493	173	966	1236	151	967

Per-CVE detail lives in the per-service grype-* artifacts (JSON + SARIF). Severity counts only — no CVE IDs published here.