[proxy] forward Bedrock cost-allocation metadata + per-provider metadata_disabled

Stamp the caller's user and authorizing group onto AWS Bedrock requests via the
X-Amzn-Bedrock-Request-Metadata header (reusing the JSONMetadata identity-inject
shape with a Bedrock-charset sanitizer), so spend can be attributed in AWS Cost
Management. Add a per-provider metadata_disabled flag (default off) that
suppresses identity metadata injection while leaving catalog routing headers
intact.

client/cmd/root.go

@@ -23,7 +23,6 @@ import (
 	"google.golang.org/grpc/credentials/insecure"
 
 	daddr "github.com/netbirdio/netbird/client/internal/daemonaddr"
-	"github.com/netbirdio/netbird/client/internal/localmetrics"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 )
 
@@ -32,8 +31,6 @@ const (
 	dnsResolverAddress       = "dns-resolver-address"
 	enableRosenpassFlag      = "enable-rosenpass"
 	rosenpassPermissiveFlag  = "rosenpass-permissive"
-	enableLocalMetricsFlag   = "enable-local-metrics"
-	localMetricsAddressFlag  = "local-metrics-address"
 	preSharedKeyFlag         = "preshared-key"
 	interfaceNameFlag        = "interface-name"
 	wireguardPortFlag        = "wireguard-port"
@@ -82,8 +79,6 @@ var (
 	updateSettingsDisabled bool
 	captureEnabled         bool
 	networksDisabled       bool
-	localMetricsEnabled    bool
-	localMetricsAddr       string
 
 	rootCmd = &cobra.Command{
 		Use:          "netbird",
@@ -217,8 +212,6 @@ func init() {
 	upCmd.PersistentFlags().BoolVar(&rosenpassEnabled, enableRosenpassFlag, false, "[Experimental] Enable Rosenpass feature. If enabled, the connection will be post-quantum secured via Rosenpass.")
 	upCmd.PersistentFlags().BoolVar(&rosenpassPermissive, rosenpassPermissiveFlag, false, "[Experimental] Enable Rosenpass in permissive mode to allow this peer to accept WireGuard connections without requiring Rosenpass functionality from peers that do not have Rosenpass enabled.")
 	upCmd.PersistentFlags().BoolVar(&autoConnectDisabled, disableAutoConnectFlag, false, "Disables auto-connect feature. If enabled, then the client won't connect automatically when the service starts.")
-	upCmd.PersistentFlags().BoolVar(&localMetricsEnabled, enableLocalMetricsFlag, false, "Enables a local Prometheus /metrics endpoint exposing connection state (peers, latency, P2P vs relay).")
-	upCmd.PersistentFlags().StringVar(&localMetricsAddr, localMetricsAddressFlag, localmetrics.DefaultListenAddress, "Listen address of the local Prometheus /metrics endpoint.")
 	upCmd.PersistentFlags().BoolVar(&lazyConnEnabled, enableLazyConnectionFlag, false, "Deprecated: no longer used. Lazy connections are controlled by the server and the NB_LAZY_CONN environment variable.")
 	_ = upCmd.PersistentFlags().MarkDeprecated(enableLazyConnectionFlag, "no longer used; lazy connections are controlled by the server and the NB_LAZY_CONN environment variable")
 

client/cmd/up.go

@@ -499,13 +499,6 @@ func setupSetConfigReq(customDNSAddressConverted []byte, cmd *cobra.Command, pro
 		req.DisableIpv6 = &disableIPv6
 	}
 
-	if cmd.Flag(enableLocalMetricsFlag).Changed {
-		req.EnableLocalMetrics = &localMetricsEnabled
-	}
-	if cmd.Flag(localMetricsAddressFlag).Changed {
-		req.LocalMetricsAddress = &localMetricsAddr
-	}
-
 	return &req
 }
 
@@ -623,14 +616,6 @@ func setupConfig(customDNSAddressConverted []byte, cmd *cobra.Command, configFil
 		ic.DisableIPv6 = &disableIPv6
 	}
 
-	if cmd.Flag(enableLocalMetricsFlag).Changed {
-		ic.LocalMetricsEnabled = &localMetricsEnabled
-	}
-
-	if cmd.Flag(localMetricsAddressFlag).Changed {
-		ic.LocalMetricsAddress = &localMetricsAddr
-	}
-
 	return &ic, nil
 }
 
@@ -693,14 +678,6 @@ func setupLoginRequest(providedSetupKey string, customDNSAddressConverted []byte
 		loginRequest.DisableAutoConnect = &autoConnectDisabled
 	}
 
-	if cmd.Flag(enableLocalMetricsFlag).Changed {
-		loginRequest.EnableLocalMetrics = &localMetricsEnabled
-	}
-
-	if cmd.Flag(localMetricsAddressFlag).Changed {
-		loginRequest.LocalMetricsAddress = &localMetricsAddr
-	}
-
 	if cmd.Flag(interfaceNameFlag).Changed {
 		if err := parseInterfaceName(interfaceName); err != nil {
 			return nil, err

client/internal/debug/debug.go

@@ -676,8 +676,6 @@ func (g *BundleGenerator) addCommonConfigFields(configContent *strings.Builder)
 	configContent.WriteString(fmt.Sprintf("BlockLANAccess: %v\n", g.internalConfig.BlockLANAccess))
 	configContent.WriteString(fmt.Sprintf("BlockInbound: %v\n", g.internalConfig.BlockInbound))
 	configContent.WriteString(fmt.Sprintf("DisableIPv6: %v\n", g.internalConfig.DisableIPv6))
-	configContent.WriteString(fmt.Sprintf("LocalMetricsEnabled: %v\n", g.internalConfig.LocalMetricsEnabled))
-	configContent.WriteString(fmt.Sprintf("LocalMetricsAddress: %s\n", g.internalConfig.LocalMetricsAddress))
 
 	if g.internalConfig.DisableNotifications != nil {
 		configContent.WriteString(fmt.Sprintf("DisableNotifications: %v\n", *g.internalConfig.DisableNotifications))

client/internal/localmetrics/localmetrics.go

@@ -1,243 +0,0 @@
-// Package localmetrics exposes client connection state as a local
-// Prometheus /metrics endpoint.
-package localmetrics
-
-import (
-	"context"
-	"errors"
-	"net"
-	"net/http"
-	"net/netip"
-	"sync"
-	"time"
-
-	"github.com/prometheus/client_golang/prometheus"
-	"github.com/prometheus/client_golang/prometheus/promhttp"
-	dto "github.com/prometheus/client_model/go"
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/peer"
-)
-
-// DefaultListenAddress is used when local metrics are enabled without an explicit address.
-const DefaultListenAddress = "127.0.0.1:9191"
-
-const (
-	shutdownTimeout   = 3 * time.Second
-	readHeaderTimeout = 5 * time.Second
-	readTimeout       = 10 * time.Second
-	writeTimeout      = 30 * time.Second
-	idleTimeout       = time.Minute
-)
-
-// statusSource provides the connection state snapshots the collector reads on scrape.
-type statusSource interface {
-	GetPeerStates() []peer.State
-	GetManagementState() peer.ManagementState
-	GetSignalState() peer.SignalState
-}
-
-// GathererProvider returns the current client metrics gatherer, or nil when
-// no engine is running. It is called on every scrape.
-type GathererProvider func() prometheus.Gatherer
-
-// Manager runs the local /metrics HTTP endpoint according to the active
-// client configuration. Reconcile is safe to call on every config change.
-type Manager struct {
-	status        statusSource
-	clientMetrics GathererProvider
-
-	mu   sync.Mutex
-	srv  *http.Server
-	addr string
-}
-
-// NewManager creates a manager that serves metrics from status and
-// clientMetrics and shuts down when ctx is canceled.
-func NewManager(ctx context.Context, status statusSource, clientMetrics GathererProvider) *Manager {
-	m := &Manager{status: status, clientMetrics: clientMetrics}
-	go func() {
-		<-ctx.Done()
-		m.Stop()
-	}()
-	return m
-}
-
-// Reconcile starts, stops, or restarts the metrics endpoint to match the
-// desired state. An empty addr falls back to DefaultListenAddress.
-func (m *Manager) Reconcile(enabled bool, addr string) {
-	if addr == "" {
-		addr = DefaultListenAddress
-	}
-	warnIfNotLoopback(addr)
-
-	m.mu.Lock()
-	defer m.mu.Unlock()
-
-	if !enabled {
-		m.stop()
-		return
-	}
-	if m.srv != nil && m.addr == addr {
-		return
-	}
-	m.stop()
-
-	registry := prometheus.NewRegistry()
-	registry.MustRegister(newCollector(m.status))
-
-	gatherers := prometheus.Gatherers{registry, prometheus.GathererFunc(func() ([]*dto.MetricFamily, error) {
-		if m.clientMetrics == nil {
-			return nil, nil
-		}
-		g := m.clientMetrics()
-		if g == nil {
-			return nil, nil
-		}
-		return g.Gather()
-	})}
-
-	mux := http.NewServeMux()
-	mux.Handle("/metrics", promhttp.HandlerFor(gatherers, promhttp.HandlerOpts{}))
-
-	srv := &http.Server{
-		Addr:              addr,
-		Handler:           mux,
-		ReadHeaderTimeout: readHeaderTimeout,
-		ReadTimeout:       readTimeout,
-		WriteTimeout:      writeTimeout,
-		IdleTimeout:       idleTimeout,
-	}
-	m.srv = srv
-	m.addr = addr
-
-	log.Infof("serving local metrics on http://%s/metrics", addr)
-	go func() {
-		if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
-			log.Errorf("failed to serve local metrics on %s: %v", addr, err)
-		}
-	}()
-}
-
-// Stop shuts down the metrics endpoint if it is running.
-func (m *Manager) Stop() {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	m.stop()
-}
-
-// stop shuts down the running server. Callers must hold m.mu.
-func (m *Manager) stop() {
-	if m.srv == nil {
-		return
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), shutdownTimeout)
-	defer cancel()
-	if err := m.srv.Shutdown(ctx); err != nil {
-		log.Debugf("failed to shut down local metrics server: %v", err)
-	}
-	m.srv = nil
-	m.addr = ""
-}
-
-// collector converts status recorder snapshots into Prometheus metrics at scrape time.
-type collector struct {
-	status statusSource
-
-	managementConnected *prometheus.Desc
-	signalConnected     *prometheus.Desc
-	peersTotal          *prometheus.Desc
-	peersConnected      *prometheus.Desc
-	peerLatency         *prometheus.Desc
-}
-
-func newCollector(status statusSource) *collector {
-	return &collector{
-		status: status,
-		managementConnected: prometheus.NewDesc(
-			"netbird_management_connected",
-			"Whether the client is connected to the management service (1 connected, 0 disconnected).",
-			nil, nil,
-		),
-		signalConnected: prometheus.NewDesc(
-			"netbird_signal_connected",
-			"Whether the client is connected to the signal service (1 connected, 0 disconnected).",
-			nil, nil,
-		),
-		peersTotal: prometheus.NewDesc(
-			"netbird_peers",
-			"Number of peers known to this client.",
-			nil, nil,
-		),
-		peersConnected: prometheus.NewDesc(
-			"netbird_peers_connected",
-			"Number of connected peers by connection type.",
-			[]string{"connection_type"}, nil,
-		),
-		peerLatency: prometheus.NewDesc(
-			"netbird_peer_latency_seconds",
-			"Round-trip latency per directly connected peer; relayed connections have no latency measurement.",
-			[]string{"peer"}, nil,
-		),
-	}
-}
-
-// Describe implements prometheus.Collector.
-func (c *collector) Describe(ch chan<- *prometheus.Desc) {
-	ch <- c.managementConnected
-	ch <- c.signalConnected
-	ch <- c.peersTotal
-	ch <- c.peersConnected
-	ch <- c.peerLatency
-}
-
-// Collect implements prometheus.Collector.
-func (c *collector) Collect(ch chan<- prometheus.Metric) {
-	ch <- prometheus.MustNewConstMetric(c.managementConnected, prometheus.GaugeValue, boolToFloat(c.status.GetManagementState().Connected))
-	ch <- prometheus.MustNewConstMetric(c.signalConnected, prometheus.GaugeValue, boolToFloat(c.status.GetSignalState().Connected))
-
-	peers := c.status.GetPeerStates()
-	ch <- prometheus.MustNewConstMetric(c.peersTotal, prometheus.GaugeValue, float64(len(peers)))
-
-	var p2p, relayed float64
-	for _, p := range peers {
-		if p.ConnStatus != peer.StatusConnected {
-			continue
-		}
-		if p.Relayed {
-			relayed++
-			continue
-		}
-		p2p++
-
-		if latency := p.Latency.Seconds(); latency > 0 {
-			ch <- prometheus.MustNewConstMetric(c.peerLatency, prometheus.GaugeValue, latency, p.FQDN)
-		}
-	}
-	ch <- prometheus.MustNewConstMetric(c.peersConnected, prometheus.GaugeValue, p2p, "p2p")
-	ch <- prometheus.MustNewConstMetric(c.peersConnected, prometheus.GaugeValue, relayed, "relay")
-}
-
-func boolToFloat(b bool) float64 {
-	if b {
-		return 1
-	}
-	return 0
-}
-
-// warnIfNotLoopback logs a warning when the listen address cannot be
-// confirmed to be local-only, since the endpoint exposes peer and
-// connectivity details without authentication.
-func warnIfNotLoopback(addr string) {
-	host, _, err := net.SplitHostPort(addr)
-	if err != nil {
-		return
-	}
-	if host == "localhost" {
-		return
-	}
-	if ip, err := netip.ParseAddr(host); err == nil && ip.Unmap().IsLoopback() {
-		return
-	}
-	log.Warnf("local metrics endpoint listens on non-loopback address %s and is reachable from the network without authentication", addr)
-}

client/internal/localmetrics/localmetrics_test.go

@@ -1,97 +0,0 @@
-package localmetrics
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"net"
-	"net/http"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/prometheus/client_golang/prometheus/testutil"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/internal/peer"
-)
-
-type stubStatus struct {
-	peers      []peer.State
-	management peer.ManagementState
-	signal     peer.SignalState
-}
-
-func (s *stubStatus) GetPeerStates() []peer.State              { return s.peers }
-func (s *stubStatus) GetManagementState() peer.ManagementState { return s.management }
-func (s *stubStatus) GetSignalState() peer.SignalState         { return s.signal }
-
-func testStatus() *stubStatus {
-	return &stubStatus{
-		management: peer.ManagementState{Connected: true},
-		signal:     peer.SignalState{Connected: true},
-		peers: []peer.State{
-			{FQDN: "peer-a.netbird.cloud", IP: "100.90.0.1", ConnStatus: peer.StatusConnected, Relayed: false, Latency: 12 * time.Millisecond},
-			{FQDN: "peer-b.netbird.cloud", IP: "100.90.0.2", ConnStatus: peer.StatusConnected, Relayed: false, Latency: 36 * time.Millisecond},
-			{FQDN: "peer-c.netbird.cloud", IP: "100.90.0.3", ConnStatus: peer.StatusConnected, Relayed: true},
-			{FQDN: "peer-d.netbird.cloud", IP: "100.90.0.4", ConnStatus: peer.StatusIdle},
-		},
-	}
-}
-
-func TestCollector(t *testing.T) {
-	c := newCollector(testStatus())
-
-	expected := `
-# HELP netbird_management_connected Whether the client is connected to the management service (1 connected, 0 disconnected).
-# TYPE netbird_management_connected gauge
-netbird_management_connected 1
-# HELP netbird_peer_latency_seconds Round-trip latency per directly connected peer; relayed connections have no latency measurement.
-# TYPE netbird_peer_latency_seconds gauge
-netbird_peer_latency_seconds{peer="peer-a.netbird.cloud"} 0.012
-netbird_peer_latency_seconds{peer="peer-b.netbird.cloud"} 0.036
-# HELP netbird_peers Number of peers known to this client.
-# TYPE netbird_peers gauge
-netbird_peers 4
-# HELP netbird_peers_connected Number of connected peers by connection type.
-# TYPE netbird_peers_connected gauge
-netbird_peers_connected{connection_type="p2p"} 2
-netbird_peers_connected{connection_type="relay"} 1
-# HELP netbird_signal_connected Whether the client is connected to the signal service (1 connected, 0 disconnected).
-# TYPE netbird_signal_connected gauge
-netbird_signal_connected 1
-`
-	require.NoError(t, testutil.CollectAndCompare(c, strings.NewReader(expected)))
-}
-
-func TestServe(t *testing.T) {
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
-	require.NoError(t, err, "must find a free port")
-	addr := ln.Addr().String()
-	require.NoError(t, ln.Close())
-
-	ctx, cancel := context.WithCancel(context.Background())
-	t.Cleanup(cancel)
-	m := NewManager(ctx, testStatus(), nil)
-	m.Reconcile(true, addr)
-
-	var body string
-	require.Eventually(t, func() bool {
-		resp, err := http.Get(fmt.Sprintf("http://%s/metrics", addr))
-		if err != nil {
-			return false
-		}
-		defer resp.Body.Close()
-		data, err := io.ReadAll(resp.Body)
-		if err != nil || resp.StatusCode != http.StatusOK {
-			return false
-		}
-		body = string(data)
-		return true
-	}, 2*time.Second, 50*time.Millisecond, "metrics endpoint should come up")
-
-	assert.Contains(t, body, "netbird_peers 4")
-	assert.Contains(t, body, `netbird_peers_connected{connection_type="relay"} 1`)
-	assert.Contains(t, body, `netbird_peer_latency_seconds{peer="peer-a.netbird.cloud"} 0.012`)
-}

client/internal/metrics/influxdb.go

@@ -45,13 +45,30 @@ func (m *influxDBMetrics) RecordConnectionStages(
 	isReconnection bool,
 	timestamps ConnectionStageTimestamps,
 ) {
-	signalingReceivedToConnection, connectionToWgHandshake, totalDuration := timestamps.Durations()
+	var signalingReceivedToConnection, connectionToWgHandshake, totalDuration float64
+
+	if !timestamps.SignalingReceived.IsZero() && !timestamps.ConnectionReady.IsZero() {
+		signalingReceivedToConnection = timestamps.ConnectionReady.Sub(timestamps.SignalingReceived).Seconds()
+	}
+
+	if !timestamps.ConnectionReady.IsZero() && !timestamps.WgHandshakeSuccess.IsZero() {
+		connectionToWgHandshake = timestamps.WgHandshakeSuccess.Sub(timestamps.ConnectionReady).Seconds()
+	}
+
+	if !timestamps.SignalingReceived.IsZero() && !timestamps.WgHandshakeSuccess.IsZero() {
+		totalDuration = timestamps.WgHandshakeSuccess.Sub(timestamps.SignalingReceived).Seconds()
+	}
+
+	attemptType := "initial"
+	if isReconnection {
+		attemptType = "reconnection"
+	}
 
 	connTypeStr := connectionType.String()
 	tags := fmt.Sprintf("deployment_type=%s,connection_type=%s,attempt_type=%s,version=%s,os=%s,arch=%s,peer_id=%s,connection_pair_id=%s",
 		agentInfo.DeploymentType.String(),
 		connTypeStr,
-		attemptType(isReconnection),
+		attemptType,
 		agentInfo.Version,
 		agentInfo.OS,
 		agentInfo.Arch,
@@ -77,7 +94,7 @@ func (m *influxDBMetrics) RecordConnectionStages(
 	m.trimLocked()
 
 	log.Tracef("peer connection metrics [%s, %s, %s]: signalingReceived→connection: %.3fs, connection→wg_handshake: %.3fs, total: %.3fs",
-		agentInfo.DeploymentType.String(), connTypeStr, attemptType(isReconnection), signalingReceivedToConnection, connectionToWgHandshake, totalDuration)
+		agentInfo.DeploymentType.String(), connTypeStr, attemptType, signalingReceivedToConnection, connectionToWgHandshake, totalDuration)
 }
 
 func (m *influxDBMetrics) RecordSyncDuration(_ context.Context, agentInfo AgentInfo, duration time.Duration) {

client/internal/metrics/metrics.go

@@ -89,21 +89,6 @@ type ConnectionStageTimestamps struct {
 	WgHandshakeSuccess time.Time
 }
 
-// Durations returns the stage durations in seconds. A duration is zero when
-// either of its timestamps is missing.
-func (c ConnectionStageTimestamps) Durations() (signalingToConnection, connectionToWgHandshake, total float64) {
-	if !c.SignalingReceived.IsZero() && !c.ConnectionReady.IsZero() {
-		signalingToConnection = c.ConnectionReady.Sub(c.SignalingReceived).Seconds()
-	}
-	if !c.ConnectionReady.IsZero() && !c.WgHandshakeSuccess.IsZero() {
-		connectionToWgHandshake = c.WgHandshakeSuccess.Sub(c.ConnectionReady).Seconds()
-	}
-	if !c.SignalingReceived.IsZero() && !c.WgHandshakeSuccess.IsZero() {
-		total = c.WgHandshakeSuccess.Sub(c.SignalingReceived).Seconds()
-	}
-	return signalingToConnection, connectionToWgHandshake, total
-}
-
 // String returns a human-readable representation of the connection stage timestamps
 func (c ConnectionStageTimestamps) String() string {
 	return fmt.Sprintf("ConnectionStageTimestamps{SignalingReceived=%v, ConnectionReady=%v, WgHandshakeSuccess=%v}",
@@ -294,11 +279,3 @@ func (c *ClientMetrics) stopPushLocked() {
 	c.wg.Wait()
 	c.push.Store(nil)
 }
-
-// attemptType returns the metric label for an initial vs reconnection attempt.
-func attemptType(isReconnection bool) string {
-	if isReconnection {
-		return "reconnection"
-	}
-	return "initial"
-}

client/internal/metrics/metrics_default.go

@@ -2,24 +2,10 @@
 
 package metrics
 
-import "github.com/prometheus/client_golang/prometheus"
-
 // NewClientMetrics creates a new ClientMetrics instance
 func NewClientMetrics(agentInfo AgentInfo) *ClientMetrics {
 	return &ClientMetrics{
-		impl:      newPrometheusMetrics(newInfluxDBMetrics()),
+		impl:      newInfluxDBMetrics(),
 		agentInfo: agentInfo,
 	}
 }
-
-// PrometheusGatherer returns the registry with the mirrored Prometheus
-// metrics, or nil when unavailable.
-func (c *ClientMetrics) PrometheusGatherer() prometheus.Gatherer {
-	if c == nil {
-		return nil
-	}
-	if pm, ok := c.impl.(*prometheusMetrics); ok {
-		return pm.Gatherer()
-	}
-	return nil
-}

client/internal/metrics/prometheus.go

@@ -1,119 +0,0 @@
-//go:build !js
-
-package metrics
-
-import (
-	"context"
-	"io"
-	"strconv"
-	"time"
-
-	"github.com/prometheus/client_golang/prometheus"
-)
-
-// prometheusMetrics mirrors recorded client metrics into a Prometheus
-// registry for the local /metrics endpoint, then delegates to the wrapped
-// implementation. Export and Reset pass through untouched: Prometheus
-// metrics are cumulative and pull-based.
-type prometheusMetrics struct {
-	next     metricsImplementation
-	registry *prometheus.Registry
-
-	connectionStages  *prometheus.HistogramVec
-	syncDuration      prometheus.Histogram
-	syncPhaseDuration *prometheus.HistogramVec
-	loginDuration     *prometheus.HistogramVec
-}
-
-func newPrometheusMetrics(next metricsImplementation) *prometheusMetrics {
-	connectionBuckets := []float64{.05, .1, .25, .5, 1, 2.5, 5, 10, 30, 60}
-
-	m := &prometheusMetrics{
-		next:     next,
-		registry: prometheus.NewRegistry(),
-		connectionStages: prometheus.NewHistogramVec(prometheus.HistogramOpts{
-			Name:    "netbird_peer_connection_stage_duration_seconds",
-			Help:    "Duration of peer connection establishment stages.",
-			Buckets: connectionBuckets,
-		}, []string{"stage", "connection_type", "attempt_type"}),
-		syncDuration: prometheus.NewHistogram(prometheus.HistogramOpts{
-			Name:    "netbird_sync_duration_seconds",
-			Help:    "Duration of management sync message processing.",
-			Buckets: prometheus.DefBuckets,
-		}),
-		syncPhaseDuration: prometheus.NewHistogramVec(prometheus.HistogramOpts{
-			Name:    "netbird_sync_phase_duration_seconds",
-			Help:    "Duration of individual sync processing phases.",
-			Buckets: prometheus.DefBuckets,
-		}, []string{"phase"}),
-		loginDuration: prometheus.NewHistogramVec(prometheus.HistogramOpts{
-			Name:    "netbird_login_duration_seconds",
-			Help:    "Duration of logins to the management service.",
-			Buckets: prometheus.DefBuckets,
-		}, []string{"success"}),
-	}
-
-	m.registry.MustRegister(m.connectionStages, m.syncDuration, m.syncPhaseDuration, m.loginDuration)
-	return m
-}
-
-// Gatherer returns the registry holding the mirrored metrics.
-func (m *prometheusMetrics) Gatherer() prometheus.Gatherer {
-	return m.registry
-}
-
-// RecordConnectionStages implements metricsImplementation.
-func (m *prometheusMetrics) RecordConnectionStages(
-	ctx context.Context,
-	agentInfo AgentInfo,
-	connectionPairID string,
-	connectionType ConnectionType,
-	isReconnection bool,
-	timestamps ConnectionStageTimestamps,
-) {
-	attempt := attemptType(isReconnection)
-	connType := connectionType.String()
-
-	signalingToConnection, connectionToWgHandshake, total := timestamps.Durations()
-	if signalingToConnection > 0 {
-		m.connectionStages.WithLabelValues("signaling_to_connection", connType, attempt).Observe(signalingToConnection)
-	}
-	if connectionToWgHandshake > 0 {
-		m.connectionStages.WithLabelValues("connection_to_wg_handshake", connType, attempt).Observe(connectionToWgHandshake)
-	}
-	if total > 0 {
-		m.connectionStages.WithLabelValues("total", connType, attempt).Observe(total)
-	}
-
-	m.next.RecordConnectionStages(ctx, agentInfo, connectionPairID, connectionType, isReconnection, timestamps)
-}
-
-// RecordSyncDuration implements metricsImplementation.
-func (m *prometheusMetrics) RecordSyncDuration(ctx context.Context, agentInfo AgentInfo, duration time.Duration) {
-	m.syncDuration.Observe(duration.Seconds())
-	m.next.RecordSyncDuration(ctx, agentInfo, duration)
-}
-
-// RecordSyncPhase implements metricsImplementation.
-func (m *prometheusMetrics) RecordSyncPhase(ctx context.Context, agentInfo AgentInfo, phase string, duration time.Duration) {
-	m.syncPhaseDuration.WithLabelValues(phase).Observe(duration.Seconds())
-	m.next.RecordSyncPhase(ctx, agentInfo, phase, duration)
-}
-
-// RecordLoginDuration implements metricsImplementation.
-func (m *prometheusMetrics) RecordLoginDuration(ctx context.Context, agentInfo AgentInfo, duration time.Duration, success bool) {
-	m.loginDuration.WithLabelValues(strconv.FormatBool(success)).Observe(duration.Seconds())
-	m.next.RecordLoginDuration(ctx, agentInfo, duration, success)
-}
-
-// Export implements metricsImplementation by delegating to the wrapped
-// implementation; Prometheus metrics are pulled via the registry instead.
-func (m *prometheusMetrics) Export(w io.Writer) error {
-	return m.next.Export(w)
-}
-
-// Reset implements metricsImplementation by delegating to the wrapped
-// implementation; Prometheus metrics must not be cleared on push.
-func (m *prometheusMetrics) Reset() {
-	m.next.Reset()
-}

client/internal/peer/status.go

@@ -1172,18 +1172,6 @@ func (d *Status) GetResolvedDomainsStates() map[domain.Domain]ResolvedDomainInfo
 	return maps.Clone(d.resolvedDomainsStates)
 }
 
-// GetPeerStates returns a snapshot of all known peer states.
-func (d *Status) GetPeerStates() []State {
-	d.mux.RLock()
-	defer d.mux.RUnlock()
-
-	states := make([]State, 0, len(d.peers))
-	for _, state := range d.peers {
-		states = append(states, state)
-	}
-	return states
-}
-
 // GetFullStatus gets full status
 func (d *Status) GetFullStatus() FullStatus {
 	fullStatus := FullStatus{

client/internal/profilemanager/config.go

@@ -102,9 +102,6 @@ type ConfigInput struct {
 	DNSLabels domain.List
 
 	MTU *uint16
-
-	LocalMetricsEnabled *bool
-	LocalMetricsAddress *string
 }
 
 // Config Configuration type
@@ -145,11 +142,6 @@ type Config struct {
 
 	DNSLabels domain.List
 
-	// LocalMetricsEnabled enables the local Prometheus /metrics endpoint.
-	LocalMetricsEnabled bool
-	// LocalMetricsAddress is the listen address of the local /metrics endpoint.
-	LocalMetricsAddress string
-
 	// SSHKey is a private SSH key in a PEM format
 	SSHKey string
 
@@ -394,18 +386,6 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.LocalMetricsEnabled != nil && *input.LocalMetricsEnabled != config.LocalMetricsEnabled {
-		log.Infof("switching local metrics to %t", *input.LocalMetricsEnabled)
-		config.LocalMetricsEnabled = *input.LocalMetricsEnabled
-		updated = true
-	}
-
-	if input.LocalMetricsAddress != nil && *input.LocalMetricsAddress != config.LocalMetricsAddress {
-		log.Infof("switching local metrics address to %s", *input.LocalMetricsAddress)
-		config.LocalMetricsAddress = *input.LocalMetricsAddress
-		updated = true
-	}
-
 	if input.NetworkMonitor != nil && (config.NetworkMonitor == nil || *input.NetworkMonitor != *config.NetworkMonitor) {
 		log.Infof("switching Network Monitor to %t", *input.NetworkMonitor)
 		config.NetworkMonitor = input.NetworkMonitor
@@ -730,12 +710,6 @@ func (config *Config) applyMDMPolicy(policy *mdm.Policy) {
 	applyBool(mdm.KeyDisableAutoConnect, func(v bool) { config.DisableAutoConnect = v })
 	applyBool(mdm.KeyRosenpassEnabled, func(v bool) { config.RosenpassEnabled = v })
 	applyBool(mdm.KeyRosenpassPermissive, func(v bool) { config.RosenpassPermissive = v })
-	applyBool(mdm.KeyEnableLocalMetrics, func(v bool) { config.LocalMetricsEnabled = v })
-
-	if v, ok := policy.GetString(mdm.KeyLocalMetricsAddress); ok {
-		config.LocalMetricsAddress = v
-		logApplied(mdm.KeyLocalMetricsAddress, v)
-	}
 
 	if v, ok := policy.GetInt(mdm.KeyWireguardPort); ok {
 		// REG_DWORD is 32-bit; UDP port range is 1-65535. Clamp at the

client/internal/profilemanager/config_mdm_test.go

@@ -130,32 +130,6 @@ func TestApply_MDMBoolKeysOverrideOnDiskValue(t *testing.T) {
 	assert.True(t, cfg.Policy().HasKey(mdm.KeyRosenpassEnabled))
 }
 
-func TestApply_MDMLocalMetrics(t *testing.T) {
-	tmp := filepath.Join(t.TempDir(), "config.json")
-
-	// Seed without MDM.
-	withMDMPolicy(t, mdm.NewPolicy(nil))
-	_, err := UpdateOrCreateConfig(ConfigInput{
-		ConfigPath:          tmp,
-		LocalMetricsEnabled: boolPtr(false),
-	})
-	require.NoError(t, err)
-
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
-		mdm.KeyEnableLocalMetrics:  true,
-		mdm.KeyLocalMetricsAddress: "127.0.0.1:9292",
-	}))
-
-	cfg, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: tmp})
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
-
-	assert.True(t, cfg.LocalMetricsEnabled, "MDM override should flip on-disk false to true")
-	assert.Equal(t, "127.0.0.1:9292", cfg.LocalMetricsAddress)
-	assert.True(t, cfg.Policy().HasKey(mdm.KeyEnableLocalMetrics))
-	assert.True(t, cfg.Policy().HasKey(mdm.KeyLocalMetricsAddress))
-}
-
 func TestApply_MDMLazyConnection(t *testing.T) {
 	cases := []struct {
 		name string

client/mdm/policy.go

@@ -47,8 +47,6 @@ const (
 	KeyRosenpassEnabled    = "rosenpassEnabled"
 	KeyRosenpassPermissive = "rosenpassPermissive"
 	KeyWireguardPort       = "wireguardPort"
-	KeyEnableLocalMetrics  = "enableLocalMetrics"
-	KeyLocalMetricsAddress = "localMetricsAddress"
 
 	// Split tunnel is modeled as a single conceptual policy with two
 	// registry/plist values. KeySplitTunnelMode is the discriminator

client/proto/daemon.pb.go

@@ -343,8 +343,6 @@ type LoginRequest struct {
 	DisableSSHAuth                *bool   `protobuf:"varint,38,opt,name=disableSSHAuth,proto3,oneof" json:"disableSSHAuth,omitempty"`
 	SshJWTCacheTTL                *int32  `protobuf:"varint,39,opt,name=sshJWTCacheTTL,proto3,oneof" json:"sshJWTCacheTTL,omitempty"`
 	DisableIpv6                   *bool   `protobuf:"varint,40,opt,name=disable_ipv6,json=disableIpv6,proto3,oneof" json:"disable_ipv6,omitempty"`
-	EnableLocalMetrics            *bool   `protobuf:"varint,41,opt,name=enable_local_metrics,json=enableLocalMetrics,proto3,oneof" json:"enable_local_metrics,omitempty"`
-	LocalMetricsAddress           *string `protobuf:"bytes,42,opt,name=local_metrics_address,json=localMetricsAddress,proto3,oneof" json:"local_metrics_address,omitempty"`
 	unknownFields                 protoimpl.UnknownFields
 	sizeCache                     protoimpl.SizeCache
 }
@@ -660,20 +658,6 @@ func (x *LoginRequest) GetDisableIpv6() bool {
 	return false
 }
 
-func (x *LoginRequest) GetEnableLocalMetrics() bool {
-	if x != nil && x.EnableLocalMetrics != nil {
-		return *x.EnableLocalMetrics
-	}
-	return false
-}
-
-func (x *LoginRequest) GetLocalMetricsAddress() string {
-	if x != nil && x.LocalMetricsAddress != nil {
-		return *x.LocalMetricsAddress
-	}
-	return ""
-}
-
 type LoginResponse struct {
 	state                   protoimpl.MessageState `protogen:"open.v1"`
 	NeedsSSOLogin           bool                   `protobuf:"varint,1,opt,name=needsSSOLogin,proto3" json:"needsSSOLogin,omitempty"`
@@ -4226,8 +4210,6 @@ type SetConfigRequest struct {
 	DisableSSHAuth                *bool                `protobuf:"varint,33,opt,name=disableSSHAuth,proto3,oneof" json:"disableSSHAuth,omitempty"`
 	SshJWTCacheTTL                *int32               `protobuf:"varint,34,opt,name=sshJWTCacheTTL,proto3,oneof" json:"sshJWTCacheTTL,omitempty"`
 	DisableIpv6                   *bool                `protobuf:"varint,35,opt,name=disable_ipv6,json=disableIpv6,proto3,oneof" json:"disable_ipv6,omitempty"`
-	EnableLocalMetrics            *bool                `protobuf:"varint,36,opt,name=enable_local_metrics,json=enableLocalMetrics,proto3,oneof" json:"enable_local_metrics,omitempty"`
-	LocalMetricsAddress           *string              `protobuf:"bytes,37,opt,name=local_metrics_address,json=localMetricsAddress,proto3,oneof" json:"local_metrics_address,omitempty"`
 	unknownFields                 protoimpl.UnknownFields
 	sizeCache                     protoimpl.SizeCache
 }
@@ -4507,20 +4489,6 @@ func (x *SetConfigRequest) GetDisableIpv6() bool {
 	return false
 }
 
-func (x *SetConfigRequest) GetEnableLocalMetrics() bool {
-	if x != nil && x.EnableLocalMetrics != nil {
-		return *x.EnableLocalMetrics
-	}
-	return false
-}
-
-func (x *SetConfigRequest) GetLocalMetricsAddress() string {
-	if x != nil && x.LocalMetricsAddress != nil {
-		return *x.LocalMetricsAddress
-	}
-	return ""
-}
-
 type SetConfigResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
@@ -7019,7 +6987,7 @@ var File_daemon_proto protoreflect.FileDescriptor
 const file_daemon_proto_rawDesc = "" +
 	"\n" +
 	"\fdaemon.proto\x12\x06daemon\x1a google/protobuf/descriptor.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1egoogle/protobuf/duration.proto\"\x0e\n" +
-	"\fEmptyRequest\"\x92\x14\n" +
+	"\fEmptyRequest\"\xef\x12\n" +
 	"\fLoginRequest\x12\x1a\n" +
 	"\bsetupKey\x18\x01 \x01(\tR\bsetupKey\x12&\n" +
 	"\fpreSharedKey\x18\x02 \x01(\tB\x02\x18\x01R\fpreSharedKey\x12$\n" +
@@ -7064,9 +7032,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\x1denableSSHRemotePortForwarding\x18% \x01(\bH\x18R\x1denableSSHRemotePortForwarding\x88\x01\x01\x12+\n" +
 	"\x0edisableSSHAuth\x18& \x01(\bH\x19R\x0edisableSSHAuth\x88\x01\x01\x12+\n" +
 	"\x0esshJWTCacheTTL\x18' \x01(\x05H\x1aR\x0esshJWTCacheTTL\x88\x01\x01\x12&\n" +
-	"\fdisable_ipv6\x18( \x01(\bH\x1bR\vdisableIpv6\x88\x01\x01\x125\n" +
-	"\x14enable_local_metrics\x18) \x01(\bH\x1cR\x12enableLocalMetrics\x88\x01\x01\x127\n" +
-	"\x15local_metrics_address\x18* \x01(\tH\x1dR\x13localMetricsAddress\x88\x01\x01B\x13\n" +
+	"\fdisable_ipv6\x18( \x01(\bH\x1bR\vdisableIpv6\x88\x01\x01B\x13\n" +
 	"\x11_rosenpassEnabledB\x10\n" +
 	"\x0e_interfaceNameB\x10\n" +
 	"\x0e_wireguardPortB\x17\n" +
@@ -7094,9 +7060,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\x1e_enableSSHRemotePortForwardingB\x11\n" +
 	"\x0f_disableSSHAuthB\x11\n" +
 	"\x0f_sshJWTCacheTTLB\x0f\n" +
-	"\r_disable_ipv6B\x17\n" +
-	"\x15_enable_local_metricsB\x18\n" +
-	"\x16_local_metrics_address\"\xb5\x01\n" +
+	"\r_disable_ipv6\"\xb5\x01\n" +
 	"\rLoginResponse\x12$\n" +
 	"\rneedsSSOLogin\x18\x01 \x01(\bR\rneedsSSOLogin\x12\x1a\n" +
 	"\buserCode\x18\x02 \x01(\tR\buserCode\x12(\n" +
@@ -7389,7 +7353,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\f_profileNameB\v\n" +
 	"\t_username\"'\n" +
 	"\x15SwitchProfileResponse\x12\x0e\n" +
-	"\x02id\x18\x01 \x01(\tR\x02id\"\xbb\x12\n" +
+	"\x02id\x18\x01 \x01(\tR\x02id\"\x98\x11\n" +
 	"\x10SetConfigRequest\x12\x1a\n" +
 	"\busername\x18\x01 \x01(\tR\busername\x12 \n" +
 	"\vprofileName\x18\x02 \x01(\tR\vprofileName\x12$\n" +
@@ -7429,9 +7393,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\x1denableSSHRemotePortForwarding\x18  \x01(\bH\x15R\x1denableSSHRemotePortForwarding\x88\x01\x01\x12+\n" +
 	"\x0edisableSSHAuth\x18! \x01(\bH\x16R\x0edisableSSHAuth\x88\x01\x01\x12+\n" +
 	"\x0esshJWTCacheTTL\x18\" \x01(\x05H\x17R\x0esshJWTCacheTTL\x88\x01\x01\x12&\n" +
-	"\fdisable_ipv6\x18# \x01(\bH\x18R\vdisableIpv6\x88\x01\x01\x125\n" +
-	"\x14enable_local_metrics\x18$ \x01(\bH\x19R\x12enableLocalMetrics\x88\x01\x01\x127\n" +
-	"\x15local_metrics_address\x18% \x01(\tH\x1aR\x13localMetricsAddress\x88\x01\x01B\x13\n" +
+	"\fdisable_ipv6\x18# \x01(\bH\x18R\vdisableIpv6\x88\x01\x01B\x13\n" +
 	"\x11_rosenpassEnabledB\x10\n" +
 	"\x0e_interfaceNameB\x10\n" +
 	"\x0e_wireguardPortB\x17\n" +
@@ -7456,9 +7418,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\x1e_enableSSHRemotePortForwardingB\x11\n" +
 	"\x0f_disableSSHAuthB\x11\n" +
 	"\x0f_sshJWTCacheTTLB\x0f\n" +
-	"\r_disable_ipv6B\x17\n" +
-	"\x15_enable_local_metricsB\x18\n" +
-	"\x16_local_metrics_address\"\x13\n" +
+	"\r_disable_ipv6\"\x13\n" +
 	"\x11SetConfigResponse\"Q\n" +
 	"\x11AddProfileRequest\x12\x1a\n" +
 	"\busername\x18\x01 \x01(\tR\busername\x12 \n" +

client/proto/daemon.proto

@@ -242,9 +242,6 @@ message LoginRequest {
   optional bool disableSSHAuth = 38;
   optional int32 sshJWTCacheTTL = 39;
   optional bool disable_ipv6 = 40;
-
-  optional bool enable_local_metrics = 41;
-  optional string local_metrics_address = 42;
 }
 
 message LoginResponse {
@@ -760,9 +757,6 @@ message SetConfigRequest {
   optional bool disableSSHAuth = 33;
   optional int32 sshJWTCacheTTL = 34;
   optional bool disable_ipv6 = 35;
-
-  optional bool enable_local_metrics = 36;
-  optional string local_metrics_address = 37;
 }
 
 message SetConfigResponse{}

client/server/mdm.go

@@ -301,8 +301,6 @@ func mdmManagedFieldConflicts(msg *proto.SetConfigRequest, policy *mdm.Policy) [
 		conflictBool(mdm.KeyDisableServerRoutes, msg.DisableServerRoutes),
 		conflictBool(mdm.KeyBlockInbound, msg.BlockInbound),
 		conflictInt64(mdm.KeyWireguardPort, msg.WireguardPort),
-		conflictBool(mdm.KeyEnableLocalMetrics, msg.EnableLocalMetrics),
-		conflictString(mdm.KeyLocalMetricsAddress, msg.GetLocalMetricsAddress()),
 	})
 }
 
@@ -348,9 +346,7 @@ func setConfigRequestHasConfigOverrides(msg *proto.SetConfigRequest) bool {
 		msg.EnableSSHLocalPortForwarding != nil ||
 		msg.EnableSSHRemotePortForwarding != nil ||
 		msg.DisableSSHAuth != nil ||
-		msg.SshJWTCacheTTL != nil ||
-		msg.EnableLocalMetrics != nil ||
-		msg.LocalMetricsAddress != nil
+		msg.SshJWTCacheTTL != nil
 }
 
 // loginRequestHasConfigOverrides reports whether the LoginRequest
@@ -385,9 +381,7 @@ func loginRequestHasConfigOverrides(msg *proto.LoginRequest) bool {
 		msg.BlockLanAccess != nil ||
 		msg.DisableNotifications != nil ||
 		len(msg.DnsLabels) > 0 || msg.CleanDNSLabels ||
-		msg.BlockInbound != nil ||
-		msg.EnableLocalMetrics != nil ||
-		msg.LocalMetricsAddress != nil
+		msg.BlockInbound != nil
 }
 
 // loginRequestMDMConflicts mirrors mdmManagedFieldConflicts but for the
@@ -428,8 +422,6 @@ func loginRequestMDMConflicts(msg *proto.LoginRequest, policy *mdm.Policy) []str
 		conflictBool(mdm.KeyDisableServerRoutes, msg.DisableServerRoutes),
 		conflictBool(mdm.KeyBlockInbound, msg.BlockInbound),
 		conflictInt64(mdm.KeyWireguardPort, msg.WireguardPort),
-		conflictBool(mdm.KeyEnableLocalMetrics, msg.EnableLocalMetrics),
-		conflictString(mdm.KeyLocalMetricsAddress, msg.GetLocalMetricsAddress()),
 	})
 }
 

client/server/server.go

@@ -23,9 +23,6 @@ import (
 
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/expose"
-	"github.com/prometheus/client_golang/prometheus"
-
-	"github.com/netbirdio/netbird/client/internal/localmetrics"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	sleephandler "github.com/netbirdio/netbird/client/internal/sleep/handler"
 	"github.com/netbirdio/netbird/client/mdm"
@@ -102,7 +99,6 @@ type Server struct {
 
 	statusRecorder *peer.Status
 	sessionWatcher *internal.SessionWatcher
-	localMetrics   *localmetrics.Manager
 
 	probeThrottle       *probeThrottle
 	persistSyncResponse bool
@@ -159,28 +155,9 @@ func New(ctx context.Context, logFile string, configFile string, profilesDisable
 	s.sleepHandler = sleephandler.New(agent)
 	s.startSleepDetector()
 
-	s.localMetrics = localmetrics.NewManager(ctx, s.statusRecorder, s.clientMetricsGatherer)
-
 	return s
 }
 
-// clientMetricsGatherer returns the Prometheus gatherer of the running
-// engine's client metrics, or nil when no engine is running.
-func (s *Server) clientMetricsGatherer() prometheus.Gatherer {
-	s.mutex.Lock()
-	connectClient := s.connectClient
-	s.mutex.Unlock()
-
-	if connectClient == nil {
-		return nil
-	}
-	engine := connectClient.Engine()
-	if engine == nil {
-		return nil
-	}
-	return engine.GetClientMetrics().PrometheusGatherer()
-}
-
 func (s *Server) Start() error {
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
@@ -261,7 +238,6 @@ func (s *Server) Start() error {
 
 	s.statusRecorder.UpdateManagementAddress(config.ManagementURL.String())
 	s.statusRecorder.UpdateRosenpass(config.RosenpassEnabled, config.RosenpassPermissive)
-	s.localMetrics.Reconcile(config.LocalMetricsEnabled, config.LocalMetricsAddress)
 
 	if s.sessionWatcher == nil {
 		s.sessionWatcher = internal.NewSessionWatcher(s.rootCtx, s.statusRecorder)
@@ -440,18 +416,11 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques
 		return nil, err
 	}
 
-	updatedConf, err := profilemanager.UpdateConfig(config)
-	if err != nil {
+	if _, err := profilemanager.UpdateConfig(config); err != nil {
 		log.Errorf("failed to update profile config: %v", err)
 		return nil, fmt.Errorf("failed to update profile config: %w", err)
 	}
 
-	if activeProf, err := s.profileManager.GetActiveProfileState(); err == nil {
-		if activePath, err := activeProf.FilePath(); err == nil && activePath == config.ConfigPath {
-			s.localMetrics.Reconcile(updatedConf.LocalMetricsEnabled, updatedConf.LocalMetricsAddress)
-		}
-	}
-
 	return &proto.SetConfigResponse{}, nil
 }
 
@@ -521,8 +490,6 @@ func (s *Server) setConfigInputFromRequest(msg *proto.SetConfigRequest) (profile
 
 	config.RosenpassEnabled = msg.RosenpassEnabled
 	config.RosenpassPermissive = msg.RosenpassPermissive
-	config.LocalMetricsEnabled = msg.EnableLocalMetrics
-	config.LocalMetricsAddress = msg.LocalMetricsAddress
 	config.DisableAutoConnect = msg.DisableAutoConnect
 	config.ServerSSHAllowed = msg.ServerSSHAllowed
 	config.NetworkMonitor = msg.NetworkMonitor
@@ -978,7 +945,6 @@ func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpR
 
 	s.statusRecorder.UpdateManagementAddress(s.config.ManagementURL.String())
 	s.statusRecorder.UpdateRosenpass(s.config.RosenpassEnabled, s.config.RosenpassPermissive)
-	s.localMetrics.Reconcile(s.config.LocalMetricsEnabled, s.config.LocalMetricsAddress)
 
 	s.clientRunning = true
 	s.clientRunningChan = make(chan struct{})

client/server/setconfig_mdm_test.go

@@ -132,30 +132,6 @@ func TestSetConfig_MDMReject_MultipleFields(t *testing.T) {
 	}, v.GetFields())
 }
 
-func TestSetConfig_MDMReject_LocalMetrics(t *testing.T) {
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
-		mdm.KeyEnableLocalMetrics:  true,
-		mdm.KeyLocalMetricsAddress: "127.0.0.1:9191",
-	}))
-
-	s, ctx, profName, username, _ := setupServerWithProfile(t)
-
-	enabled := false
-	addr := "0.0.0.0:9999"
-	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
-		ProfileName:         profName,
-		Username:            username,
-		EnableLocalMetrics:  &enabled,
-		LocalMetricsAddress: &addr,
-	})
-
-	v := extractViolation(t, err)
-	assert.ElementsMatch(t, []string{
-		mdm.KeyEnableLocalMetrics,
-		mdm.KeyLocalMetricsAddress,
-	}, v.GetFields())
-}
-
 func TestSetConfig_MDMReject_AllOrNothing(t *testing.T) {
 	// MDM enforces ManagementURL only; user request touches both the
 	// enforced field AND a non-enforced field (RosenpassEnabled).

client/server/setconfig_test.go

@@ -73,8 +73,6 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 	disableIPv6 := true
 	mtu := int64(1280)
 	sshJWTCacheTTL := int32(300)
-	enableLocalMetrics := true
-	localMetricsAddress := "127.0.0.1:9292"
 
 	req := &proto.SetConfigRequest{
 		ProfileName:          profName,
@@ -106,8 +104,6 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 		DnsRouteInterval:     durationpb.New(2 * time.Minute),
 		Mtu:                  &mtu,
 		SshJWTCacheTTL:       &sshJWTCacheTTL,
-		EnableLocalMetrics:   &enableLocalMetrics,
-		LocalMetricsAddress:  &localMetricsAddress,
 	}
 
 	_, err = s.SetConfig(ctx, req)
@@ -154,8 +150,6 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 	require.Equal(t, uint16(mtu), cfg.MTU)
 	require.NotNil(t, cfg.SSHJWTCacheTTL)
 	require.Equal(t, int(sshJWTCacheTTL), *cfg.SSHJWTCacheTTL)
-	require.Equal(t, enableLocalMetrics, cfg.LocalMetricsEnabled)
-	require.Equal(t, localMetricsAddress, cfg.LocalMetricsAddress)
 
 	verifyAllFieldsCovered(t, req)
 }
@@ -208,8 +202,6 @@ func verifyAllFieldsCovered(t *testing.T, req *proto.SetConfigRequest) {
 		"EnableSSHRemotePortForwarding": true,
 		"DisableSSHAuth":                true,
 		"SshJWTCacheTTL":                true,
-		"EnableLocalMetrics":            true,
-		"LocalMetricsAddress":           true,
 	}
 
 	val := reflect.ValueOf(req).Elem()
@@ -269,8 +261,6 @@ func TestCLIFlags_MappedToSetConfig(t *testing.T) {
 		"enable-ssh-remote-port-forwarding": "EnableSSHRemotePortForwarding",
 		"disable-ssh-auth":                  "DisableSSHAuth",
 		"ssh-jwt-cache-ttl":                 "SshJWTCacheTTL",
-		"enable-local-metrics":              "EnableLocalMetrics",
-		"local-metrics-address":             "LocalMetricsAddress",
 	}
 
 	// SetConfigRequest fields that don't have CLI flags (settable only via UI or other means).

go.mod

@@ -98,7 +98,6 @@ require (
 	github.com/pires/go-proxyproto v0.11.0
 	github.com/pkg/sftp v1.13.9
 	github.com/prometheus/client_golang v1.23.2
-	github.com/prometheus/client_model v0.6.2
 	github.com/quic-go/quic-go v0.55.0
 	github.com/redis/go-redis/v9 v9.7.3
 	github.com/rs/xid v1.3.0
@@ -250,7 +249,6 @@ require (
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/koron/go-ssdp v0.0.4 // indirect
 	github.com/kr/fs v0.1.0 // indirect
-	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/lib/pq v1.12.3 // indirect
 	github.com/libdns/libdns v0.2.2 // indirect
 	github.com/lufia/plan9stats v0.0.0-20240513124658-fba389f38bae // indirect
@@ -291,6 +289,7 @@ require (
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
 	github.com/pquerna/otp v1.5.0 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.67.5 // indirect
 	github.com/prometheus/otlptranslator v1.0.0 // indirect
 	github.com/prometheus/procfs v0.19.2 // indirect

management/internals/modules/agentnetwork/catalog/catalog.go

@@ -197,6 +197,12 @@ type JSONMetadataInjection struct {
 	// enforces a 128-char limit per value; oversized values are
 	// truncated rather than failing the request. 0 disables the cap.
 	MaxValueLength int
+	// Sanitize, when true, replaces characters outside the destination's
+	// accepted set with '_' before emitting each value. AWS Bedrock's
+	// X-Amzn-Bedrock-Request-Metadata restricts values to a limited character
+	// class, so unsanitized group display names (e.g. containing spaces) would
+	// make Bedrock reject the request with 400.
+	Sanitize bool
 }
 
 // providers is the canonical list of supported Agent Network providers.
@@ -329,6 +335,18 @@ var providers = []Provider{
 			{ID: "amazon.nova-lite", Label: "Amazon Nova Lite (Bedrock)", InputPer1k: 0.00006, OutputPer1k: 0.00024, ContextWindow: 300000},
 			{ID: "amazon.nova-micro", Label: "Amazon Nova Micro (Bedrock)", InputPer1k: 0.000035, OutputPer1k: 0.00014, ContextWindow: 128000},
 		},
+		// Bedrock accepts a cost-allocation metadata header; stamp the caller's
+		// user + authorizing group so spend can be attributed in AWS Cost
+		// Management. Sanitized because Bedrock restricts the value character set.
+		IdentityInjection: &IdentityInjection{
+			JSONMetadata: &JSONMetadataInjection{
+				Header:         "X-Amzn-Bedrock-Request-Metadata",
+				UserKey:        "user",
+				GroupsKey:      "group",
+				MaxValueLength: 256,
+				Sanitize:       true,
+			},
+		},
 	},
 	{
 		ID:                 "vertex_ai_api",

management/internals/modules/agentnetwork/synthesizer.go

@@ -540,6 +540,7 @@ type identityInjectJSONMetadata struct {
 	UserKey        string `json:"user_key,omitempty"`
 	GroupsKey      string `json:"groups_key,omitempty"`
 	MaxValueLength int    `json:"max_value_length,omitempty"`
+	Sanitize       bool   `json:"sanitize,omitempty"`
 }
 
 // buildIdentityInjectConfigJSON walks the enabled providers and emits
@@ -583,9 +584,11 @@ func buildIdentityInjectConfigJSON(providers []*types.Provider, groupIndex map[s
 func buildIdentityInjectRule(p *types.Provider, entry catalog.Provider) (identityInjectProvider, bool) {
 	rule := identityInjectProvider{ProviderID: p.ID}
 	// Identity-stamping shape (one of HeaderPair / JSONMetadata). Skip the
-	// shape silently when the catalog entry doesn't declare one — extras
-	// can still apply, see below.
-	if entry.IdentityInjection != nil {
+	// shape silently when the catalog entry doesn't declare one, or when the
+	// operator disabled metadata for this provider — extras can still apply,
+	// see below. MetadataDisabled suppresses only the identity dimensions
+	// (user + authorizing group), not the catalog's routing ExtraHeaders.
+	if !p.MetadataDisabled && entry.IdentityInjection != nil {
 		switch {
 		case entry.IdentityInjection.HeaderPair != nil:
 			rule.HeaderPair = buildIdentityHeaderPair(p, entry.IdentityInjection.HeaderPair)
@@ -651,6 +654,7 @@ func buildIdentityJSONMetadata(p *types.Provider, jm *catalog.JSONMetadataInject
 		UserKey:        userKey,
 		GroupsKey:      groupsKey,
 		MaxValueLength: jm.MaxValueLength,
+		Sanitize:       jm.Sanitize,
 	}
 }
 

management/internals/modules/agentnetwork/synthesizer_test.go

@@ -698,6 +698,94 @@ func TestSynthesizeServices_IdentityInject_Portkey_NotCustomizable(t *testing.T)
 		"same fixed-schema guarantee for the groups dimension")
 }
 
+// TestSynthesizeServices_IdentityInject_Bedrock pins Bedrock's cost-allocation
+// metadata: a JSONMetadata shape emitting X-Amzn-Bedrock-Request-Metadata with
+// the reserved user/group keys, sanitized to Bedrock's accepted charset.
+func TestSynthesizeServices_IdentityInject_Bedrock(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	br := newSynthTestProvider()
+	br.ID = "prov-bedrock"
+	br.ProviderID = "bedrock_api"
+	br.UpstreamURL = "https://bedrock-runtime.us-east-1.amazonaws.com"
+	br.APIKey = "bedrock-bearer"
+	br.CreatedAt = time.Date(2026, 4, 2, 0, 0, 0, 0, time.UTC)
+
+	policy := newSynthTestPolicy(br.ID, "grp-eng", "")
+	policy.ID = "pol-bedrock"
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{br},
+		[]*types.Policy{policy},
+		[]*types.Guardrail{})
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	var injectCfg identityInjectConfig
+	for _, m := range services[0].Targets[0].Options.Middlewares {
+		if m.ID == middlewareIDLLMIdentityInject {
+			require.NoError(t, json.Unmarshal(m.ConfigJSON, &injectCfg))
+			break
+		}
+	}
+	require.Len(t, injectCfg.Providers, 1)
+	entry := injectCfg.Providers[0]
+	require.NotNil(t, entry.JSONMetadata, "Bedrock uses the JSONMetadata shape for cost-allocation metadata")
+	assert.Nil(t, entry.HeaderPair, "shapes are mutually exclusive")
+	assert.Equal(t, "X-Amzn-Bedrock-Request-Metadata", entry.JSONMetadata.Header,
+		"the caller identity lands in Bedrock's cost-allocation metadata header")
+	assert.Equal(t, "user", entry.JSONMetadata.UserKey)
+	assert.Equal(t, "group", entry.JSONMetadata.GroupsKey)
+	assert.True(t, entry.JSONMetadata.Sanitize,
+		"Bedrock restricts the metadata value charset, so values must be sanitized")
+}
+
+// TestSynthesizeServices_MetadataDisabled_SuppressesInjection verifies the
+// per-provider opt-out: a provider with MetadataDisabled set emits no
+// identity-inject entry (Bedrock has no catalog ExtraHeaders, so the whole
+// entry is dropped).
+func TestSynthesizeServices_MetadataDisabled_SuppressesInjection(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	br := newSynthTestProvider()
+	br.ID = "prov-bedrock"
+	br.ProviderID = "bedrock_api"
+	br.UpstreamURL = "https://bedrock-runtime.us-east-1.amazonaws.com"
+	br.APIKey = "bedrock-bearer"
+	br.MetadataDisabled = true
+	br.CreatedAt = time.Date(2026, 4, 2, 0, 0, 0, 0, time.UTC)
+
+	policy := newSynthTestPolicy(br.ID, "grp-eng", "")
+	policy.ID = "pol-bedrock"
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{br},
+		[]*types.Policy{policy},
+		[]*types.Guardrail{})
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	var injectCfg identityInjectConfig
+	for _, m := range services[0].Targets[0].Options.Middlewares {
+		if m.ID == middlewareIDLLMIdentityInject {
+			require.NoError(t, json.Unmarshal(m.ConfigJSON, &injectCfg))
+			break
+		}
+	}
+	assert.Empty(t, injectCfg.Providers,
+		"metadata_disabled must drop the provider's identity-inject entry")
+}
+
 // TestSynthesizeServices_IdentityInject_Vercel pins Vercel AI
 // Gateway's wiring: HeaderPair shape with fixed wire names dictated
 // by Vercel's Custom Reporting API (ai-reporting-user /

management/internals/modules/agentnetwork/types/provider.go

@@ -51,6 +51,12 @@ type Provider struct {
 	// private or self-signed certificate. The synthesiser propagates it into
 	// the router route so the proxy dials that provider's upstream insecurely.
 	SkipTLSVerification bool `gorm:"column:skip_tls_verification"`
+	// MetadataDisabled suppresses identity metadata injection for this provider.
+	// Metadata (the caller's user + authorizing group) is injected by default;
+	// when true the synthesiser omits the provider's identity-inject shape, so no
+	// user/group headers (e.g. Bedrock's X-Amzn-Bedrock-Request-Metadata) are
+	// stamped. Catalog ExtraHeaders (routing config) are unaffected.
+	MetadataDisabled bool `gorm:"column:metadata_disabled"`
 	// SessionPrivateKey + SessionPublicKey are the ed25519 keypair the
 	// synthesised reverse-proxy service uses to sign / verify session
 	// JWTs after a successful OIDC handshake. Generated once on
@@ -137,6 +143,9 @@ func (p *Provider) FromAPIRequest(req *api.AgentNetworkProviderRequest) {
 	if req.SkipTlsVerification != nil {
 		p.SkipTLSVerification = *req.SkipTlsVerification
 	}
+	if req.MetadataDisabled != nil {
+		p.MetadataDisabled = *req.MetadataDisabled
+	}
 	// Identity-header overrides for catalogs flagged Customizable.
 	// nil pointer = "field omitted on the wire" → leave the stored
 	// value untouched (per the openapi description). Empty string is
@@ -170,6 +179,7 @@ func (p *Provider) ToAPIResponse() *api.AgentNetworkProvider {
 		Models:              models,
 		Enabled:             p.Enabled,
 		SkipTlsVerification: p.SkipTLSVerification,
+		MetadataDisabled:    p.MetadataDisabled,
 		CreatedAt:           &created,
 		UpdatedAt:           &updated,
 	}

management/internals/modules/agentnetwork/types/provider_test.go

@@ -42,3 +42,38 @@ func TestProvider_SkipTLSVerification_RoundTrip(t *testing.T) {
 	assert.False(t, p.SkipTLSVerification, "explicit false must clear skip_tls_verification")
 	assert.False(t, p.ToAPIResponse().SkipTlsVerification, "response must reflect the cleared value")
 }
+
+// TestProvider_MetadataDisabled_RoundTrip covers the request→provider→response
+// mapping of metadata_disabled, with the same update semantics: nil preserves,
+// explicit false clears.
+func TestProvider_MetadataDisabled_RoundTrip(t *testing.T) {
+	enable := true
+	disable := false
+
+	base := func() *api.AgentNetworkProviderRequest {
+		return &api.AgentNetworkProviderRequest{
+			ProviderId:  "bedrock_api",
+			Name:        "bedrock",
+			UpstreamUrl: "https://bedrock-runtime.us-east-1.amazonaws.com",
+		}
+	}
+
+	p := NewProvider("acc-1")
+
+	req := base()
+	req.MetadataDisabled = &enable
+	p.FromAPIRequest(req)
+	assert.True(t, p.MetadataDisabled, "create with metadata_disabled=true must set the field")
+	assert.True(t, p.ToAPIResponse().MetadataDisabled, "response must surface metadata_disabled")
+
+	// Omitting the field on update leaves the stored value untouched.
+	p.FromAPIRequest(base())
+	assert.True(t, p.MetadataDisabled, "omitting metadata_disabled on update must preserve it")
+
+	// Explicit false clears it (re-enables metadata).
+	req = base()
+	req.MetadataDisabled = &disable
+	p.FromAPIRequest(req)
+	assert.False(t, p.MetadataDisabled, "explicit false must clear metadata_disabled")
+	assert.False(t, p.ToAPIResponse().MetadataDisabled, "response must reflect the cleared value")
+}

proxy/internal/middleware/builtin/llm_identity_inject/factory.go

@@ -64,6 +64,11 @@ type JSONMetadataRule struct {
 	UserKey        string `json:"user_key,omitempty"`
 	GroupsKey      string `json:"groups_key,omitempty"`
 	MaxValueLength int    `json:"max_value_length,omitempty"`
+	// Sanitize replaces characters outside the destination provider's accepted
+	// set with '_' before emitting each value. AWS Bedrock's
+	// X-Amzn-Bedrock-Request-Metadata restricts values to [A-Za-z0-9 +-=._:/@];
+	// group display names with other characters would otherwise 400.
+	Sanitize bool `json:"sanitize,omitempty"`
 }
 
 // Config is the on-wire configuration accepted by the factory. An

proxy/internal/middleware/builtin/llm_identity_inject/middleware.go

@@ -292,15 +292,21 @@ func applyJSONMetadata(rule *JSONMetadataRule, in *middleware.Input) *middleware
 	mutations := &middleware.Mutations{}
 	mutations.HeadersRemove = append(mutations.HeadersRemove, rule.Header)
 
+	emit := func(v string) string {
+		if rule.Sanitize {
+			v = sanitizeMetadataValue(v)
+		}
+		return truncate(v, rule.MaxValueLength)
+	}
 	payload := map[string]string{}
 	if rule.UserKey != "" {
 		if identity := identityFor(in); identity != "" {
-			payload[rule.UserKey] = truncate(identity, rule.MaxValueLength)
+			payload[rule.UserKey] = emit(identity)
 		}
 	}
 	if rule.GroupsKey != "" {
 		if csv := authorisingTagsCSV(in); csv != "" {
-			payload[rule.GroupsKey] = truncate(csv, rule.MaxValueLength)
+			payload[rule.GroupsKey] = emit(csv)
 		}
 	}
 	if len(payload) == 0 {
@@ -359,6 +365,36 @@ func truncate(s string, maxBytes int) string {
 	return s[:maxBytes]
 }
 
+// sanitizeMetadataValue replaces any character outside AWS Bedrock's accepted
+// request-metadata class — letters, digits, space, and + - = . _ : / @ — with
+// '_'. This keeps values (notably the groups CSV, whose commas are rejected, and
+// group display names with arbitrary characters) from making Bedrock reject the
+// request with 400. The result stays opaque to the gateway.
+func sanitizeMetadataValue(s string) string {
+	var b strings.Builder
+	b.Grow(len(s))
+	for _, r := range s {
+		if metadataCharAllowed(r) {
+			b.WriteRune(r)
+		} else {
+			b.WriteByte('_')
+		}
+	}
+	return b.String()
+}
+
+func metadataCharAllowed(r rune) bool {
+	switch {
+	case r >= 'a' && r <= 'z', r >= 'A' && r <= 'Z', r >= '0' && r <= '9':
+		return true
+	}
+	switch r {
+	case ' ', '+', '-', '=', '.', '_', ':', '/', '@':
+		return true
+	}
+	return false
+}
+
 // tagsIDsFromAuthorising reads llm_router's authorising-groups metadata
 // (a CSV of group ids) and returns the parsed slice. Returns nil when
 // the key is absent or empty so the caller can fall back to the full

proxy/internal/middleware/builtin/llm_identity_inject/middleware_test.go

@@ -304,6 +304,46 @@ func TestInject_JSONMetadata_TruncatesValues(t *testing.T) {
 		"per-value byte length must be capped at MaxValueLength")
 }
 
+// TestInject_JSONMetadata_Sanitize pins the AWS-Bedrock sanitization path: when
+// Sanitize is set, characters outside Bedrock's accepted metadata class
+// (notably the groups CSV comma and arbitrary characters in group display
+// names) are replaced with '_' so Bedrock doesn't reject the request. Allowed
+// characters (letters, digits, spaces, and @ . _ : / + - =) pass through.
+func TestInject_JSONMetadata_Sanitize(t *testing.T) {
+	rule := ProviderInjection{
+		ProviderID: portkeyProvider,
+		JSONMetadata: &JSONMetadataRule{
+			Header:         "X-Amzn-Bedrock-Request-Metadata",
+			UserKey:        "user",
+			GroupsKey:      "group",
+			MaxValueLength: 256,
+			Sanitize:       true,
+		},
+	}
+	mw := New(Config{Providers: []ProviderInjection{rule}})
+	in := newInput(portkeyProvider, "alice", []string{"g1", "g2"})
+	in.UserEmail = "alice@example.com"
+	// Group display names carry characters Bedrock rejects (comma, '#'); the CSV
+	// join adds another comma between the two groups.
+	in.UserGroupNames = []string{"Eng,Team", "Ops#1"}
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out.Mutations)
+	require.Len(t, out.Mutations.HeadersAdd, 1)
+	added := out.Mutations.HeadersAdd[0]
+	assert.Equal(t, "X-Amzn-Bedrock-Request-Metadata", added.Key,
+		"the Bedrock cost-allocation header carries the metadata JSON")
+
+	var payload map[string]string
+	require.NoError(t, json.Unmarshal([]byte(added.Value), &payload))
+	assert.Equal(t, "alice@example.com", payload["user"],
+		"'@' and '.' are in Bedrock's accepted set and must be preserved")
+	assert.NotContains(t, payload["group"], ",", "commas must be sanitized — Bedrock rejects them")
+	assert.NotContains(t, payload["group"], "#", "disallowed characters must be sanitized")
+	assert.Contains(t, payload["group"], "Eng", "allowed characters must be preserved")
+}
+
 // TestInject_JSONMetadata_EmptyIdentity_StripsButDoesNotAdd verifies the
 // anti-spoof Remove still fires when there's nothing to stamp.
 func TestInject_JSONMetadata_EmptyIdentity_StripsButDoesNotAdd(t *testing.T) {

shared/management/http/api/openapi.yml

@@ -5164,6 +5164,10 @@ components:
           type: boolean
           description: Whether upstream TLS certificate verification is skipped when the proxy dials this provider's URL. Intended for self-hosted / internal gateways behind a private or self-signed certificate.
           example: false
+        metadata_disabled:
+          type: boolean
+          description: Whether identity metadata injection is disabled for this provider. When enabled (the default), the proxy stamps the caller's user and authorizing group onto upstream requests as provider-specific metadata (e.g. AWS Bedrock's X-Amzn-Bedrock-Request-Metadata header). Set true to suppress it.
+          example: false
         created_at:
           type: string
           format: date-time
@@ -5184,6 +5188,7 @@ components:
         - models
         - enabled
         - skip_tls_verification
+        - metadata_disabled
         - created_at
         - updated_at
     AgentNetworkProviderRequest:
@@ -5240,6 +5245,10 @@ components:
           type: boolean
           description: Skip upstream TLS certificate verification when the proxy dials this provider's URL. For self-hosted / internal gateways behind a private or self-signed certificate. Defaults to false. When omitted on update, the stored value is left unchanged.
           example: false
+        metadata_disabled:
+          type: boolean
+          description: Disable identity metadata injection (the caller's user + authorizing group) for this provider. Defaults to false (metadata is injected). When omitted on update, the stored value is left unchanged.
+          example: false
       required:
         - provider_id
         - name

shared/management/http/api/types.gen.go

@@ -2227,6 +2227,9 @@ type AgentNetworkProvider struct {
 	// IdentityHeaderUserId Wire header name the proxy stamps with the caller's display identity (user email or peer name) when the catalog entry's HeaderPair is `customizable`. Empty disables stamping for this dimension. Ignored when the catalog entry has a fixed HeaderPair (e.g. LiteLLM, Portkey). Used today by Bifrost: typical values are `x-bf-lh-netbird_user_id` (always-on log metadata) or `x-bf-dim-netbird_user_id` (Prometheus / OTEL — requires the label to be pre-declared in the gateway's `client.prometheus_labels` config).
 	IdentityHeaderUserId *string `json:"identity_header_user_id,omitempty"`
 
+	// MetadataDisabled Whether identity metadata injection is disabled for this provider. When enabled (the default), the proxy stamps the caller's user and authorizing group onto upstream requests as provider-specific metadata (e.g. AWS Bedrock's X-Amzn-Bedrock-Request-Metadata header). Set true to suppress it.
+	MetadataDisabled bool `json:"metadata_disabled"`
+
 	// Models Models exposed through this endpoint, with the operator's per-1k input/output prices. Empty means all catalog models are allowed at catalog prices.
 	Models []AgentNetworkProviderModel `json:"models"`
 
@@ -2278,6 +2281,9 @@ type AgentNetworkProviderRequest struct {
 	// IdentityHeaderUserId Wire header name for the caller's display identity. See AgentNetworkProvider.identity_header_user_id. When omitted on a request, the stored value is left unchanged; pass an empty string explicitly to clear it (which disables stamping for this dimension).
 	IdentityHeaderUserId *string `json:"identity_header_user_id,omitempty"`
 
+	// MetadataDisabled Disable identity metadata injection (the caller's user + authorizing group) for this provider. Defaults to false (metadata is injected). When omitted on update, the stored value is left unchanged.
+	MetadataDisabled *bool `json:"metadata_disabled,omitempty"`
+
 	// Models Models exposed through this endpoint, with the operator's per-1k input/output prices. Empty means all catalog models are allowed at catalog prices.
 	Models *[]AgentNetworkProviderModel `json:"models,omitempty"`