feat: add metricsPort parameter to metrics-data-source plugin

  Allow configuring a separate port for scraping model server metrics via
  EndpointPickerConfig plugin parameters. This addresses the gap left by
  the deprecation of --model-server-metrics-port (PR kubernetes-sigs#1886, kubernetes-sigs#2441) which
  had no replacement for the port configuration.

  When metricsPort is set in the metrics-data-source plugin parameters,
  it overrides the inference port encoded in the endpoint's MetricsHost.
  This enables deployments where model servers expose metrics on a
  separate port (e.g., vLLM with --metrics-port) from inference traffic,
  which is required in Istio mTLS STRICT environments.

  Related: kubernetes-sigs#1396, kubernetes-sigs#1556

Author: janghyukjin

pkg/epp/framework/plugins/datalayer/source/http/datasource.go

@@ -21,27 +21,32 @@ import (
 	"crypto/tls"
 	"fmt"
 	"io"
+	"net"
 	"net/url"
 	"reflect"
+	"strconv"
 
 	fwkdl "sigs.k8s.io/gateway-api-inference-extension/pkg/epp/framework/interface/datalayer"
 	fwkplugin "sigs.k8s.io/gateway-api-inference-extension/pkg/epp/framework/interface/plugin"
 )
 
 // HTTPDataSource is a data source that receives its data using HTTP client.
 type HTTPDataSource struct {
-	typedName fwkplugin.TypedName
-	scheme    string // scheme to use
-	path      string // path to use
+	typedName   fwkplugin.TypedName
+	scheme      string // scheme to use
+	path        string // path to use
+	metricsPort int    // when non-zero, overrides the port in MetricsHost for scraping
 
 	client     Client // client (e.g. a wrapped http.Client) used to get data
 	parser     func(io.Reader) (any, error)
 	outputType reflect.Type
 }
 
 // NewHTTPDataSource returns a new data source, configured with
-// the provided scheme, path and certificate verification parameters.
-func NewHTTPDataSource(scheme string, path string, skipCertVerification bool, pluginType string,
+// the provided scheme, path, certificate verification parameters, and an optional metrics port.
+// When metricsPort is non-zero, it overrides the port in the endpoint's MetricsHost for scraping.
+// Pass 0 to use the port already encoded in MetricsHost (default behavior).
+func NewHTTPDataSource(scheme string, path string, skipCertVerification bool, metricsPort int, pluginType string,
 	pluginName string, parser func(io.Reader) (any, error), outputType reflect.Type) (*HTTPDataSource, error) {
 	if scheme != "http" && scheme != "https" {
 		return nil, fmt.Errorf("unsupported scheme: %s", scheme)
@@ -59,11 +64,12 @@ func NewHTTPDataSource(scheme string, path string, skipCertVerification bool, pl
 			Type: pluginType,
 			Name: pluginName,
 		},
-		scheme:     scheme,
-		path:       path,
-		client:     defaultClient,
-		parser:     parser,
-		outputType: outputType,
+		scheme:      scheme,
+		path:        path,
+		metricsPort: metricsPort,
+		client:      defaultClient,
+		parser:      parser,
+		outputType:  outputType,
 	}
 	return dataSrc, nil
 }
@@ -90,9 +96,16 @@ func (dataSrc *HTTPDataSource) Poll(ctx context.Context, ep fwkdl.Endpoint) (any
 }
 
 func (dataSrc *HTTPDataSource) getEndpoint(ep Addressable) *url.URL {
+	host := ep.GetMetricsHost()
+	if dataSrc.metricsPort != 0 {
+		ip, _, err := net.SplitHostPort(host)
+		if err == nil {
+			host = net.JoinHostPort(ip, strconv.Itoa(dataSrc.metricsPort))
+		}
+	}
 	return &url.URL{
 		Scheme: dataSrc.scheme,
-		Host:   ep.GetMetricsHost(),
+		Host:   host,
 		Path:   dataSrc.path,
 	}
 }

pkg/epp/framework/plugins/datalayer/source/metrics/datasource.go

@@ -48,13 +48,19 @@ type metricsDatasourceParams struct {
 	Path string `json:"path"`
 	// InsecureSkipVerify defines whether model server certificate should be verified or not.
 	InsecureSkipVerify bool `json:"insecureSkipVerify"`
+	// MetricsPort defines the port to use for scraping metrics from model server pods.
+	// When set, this overrides the inference port encoded in the endpoint's MetricsHost.
+	// Useful when the model server exposes metrics on a separate port from inference
+	// (e.g., vLLM with --metrics-port 9090).
+	// Defaults to 0, which means the inference port is used.
+	MetricsPort int `json:"metricsPort"`
 }
 
 // NewHTTPMetricsDataSource constructs a MetricsDataSource with the given scheme and path.
 // InsecureSkipVerify defaults to true (matching the factory default).
 // Use this function directly in tests to bypass JSON parameter marshaling.
 func NewHTTPMetricsDataSource(scheme, path, name string) (*http.HTTPDataSource, error) {
-	return http.NewHTTPDataSource(scheme, path, defaultMetricsInsecureSkipVerify,
+	return http.NewHTTPDataSource(scheme, path, defaultMetricsInsecureSkipVerify, 0,
 		MetricsDataSourceType, name, parseMetrics, PrometheusMetricType)
 }
 
@@ -72,7 +78,7 @@ func MetricsDataSourceFactory(name string, parameters json.RawMessage, handle fw
 		}
 	}
 
-	return http.NewHTTPDataSource(cfg.Scheme, cfg.Path, cfg.InsecureSkipVerify, MetricsDataSourceType,
+	return http.NewHTTPDataSource(cfg.Scheme, cfg.Path, cfg.InsecureSkipVerify, cfg.MetricsPort, MetricsDataSourceType,
 		name, parseMetrics, PrometheusMetricType)
 }
 
@@ -89,6 +95,7 @@ const (
 	modelServerMetricsPathFlag               = "model-server-metrics-path"
 	modelServerMetricsSchemeFlag             = "model-server-metrics-scheme"
 	modelServerMetricsInsecureSkipVerifyFlag = "model-server-metrics-https-insecure-skip-verify"
+	modelServerMetricsPortFlag               = "model-server-metrics-port"
 )
 
 // DataSource parameters values - Priority (lowest → highest):
@@ -116,6 +123,10 @@ func defaultDataSourceConfigParams() (*metricsDatasourceParams, error) {
 		cfg.InsecureSkipVerify = insecure
 	}
 
+	if port, ok := fromIntFlag(modelServerMetricsPortFlag); ok {
+		cfg.MetricsPort = port
+	}
+
 	return cfg, nil
 }
 
@@ -129,6 +140,20 @@ func fromStringFlag(name string) (string, bool) {
 	return f.Value.String(), true
 }
 
+// fromIntFlag returns the value of a registered pflag int flag.
+// The second return value is false when the flag is not registered or not set by the user.
+func fromIntFlag(name string) (int, bool) {
+	f := pflag.Lookup(name)
+	if f == nil || !f.Changed {
+		return 0, false
+	}
+	v, err := strconv.Atoi(f.Value.String())
+	if err != nil {
+		return 0, false
+	}
+	return v, true
+}
+
 // fromBoolFlag returns the value of a registered pflag bool flag.
 // The second return value is false when the flag is not registered; no error is returned in that case.
 // An error is returned only when the flag exists but its value cannot be parsed as a bool.

pkg/epp/framework/plugins/datalayer/source/metrics/datasource_test.go

@@ -28,11 +28,11 @@ import (
 )
 
 func TestDatasource(t *testing.T) {
-	_, err := http.NewHTTPDataSource("invalid", "/metrics", true, MetricsDataSourceType,
+	_, err := http.NewHTTPDataSource("invalid", "/metrics", true, 0, MetricsDataSourceType,
 		"metrics-data-source", parseMetrics, PrometheusMetricType)
 	assert.NotNil(t, err, "expected to fail with invalid scheme")
 
-	source, err := http.NewHTTPDataSource("https", "/metrics", true, MetricsDataSourceType,
+	source, err := http.NewHTTPDataSource("https", "/metrics", true, 0, MetricsDataSourceType,
 		"metrics-data-source", parseMetrics, PrometheusMetricType)
 	assert.Nil(t, err, "failed to create HTTP datasource")
 

test/integration/epp/runtime_polling_test.go

@@ -86,7 +86,7 @@ func TestRuntimePollingDispatch(t *testing.T) {
 			r := datalayer.NewRuntime(pollingInterval)
 			ext := mocks.NewPollingExtractor("test-extractor")
 
-			httpSrc, err := httpds.NewHTTPDataSource("http", "/metrics", true, "test-http", "test-source",
+			httpSrc, err := httpds.NewHTTPDataSource("http", "/metrics", true, 0, "test-http", "test-source",
 				parsePrometheusMetrics, reflect.TypeOf(fwkdl.Metrics{}))
 			require.NoError(t, err)
 
@@ -138,7 +138,7 @@ func TestRuntimePollingMultipleExtractors(t *testing.T) {
 	ext1 := mocks.NewPollingExtractor("extractor-1")
 	ext2 := mocks.NewPollingExtractor("extractor-2")
 
-	httpSrc, err := httpds.NewHTTPDataSource("http", "/metrics", true, "test-http", "test-source",
+	httpSrc, err := httpds.NewHTTPDataSource("http", "/metrics", true, 0, "test-http", "test-source",
 		parsePrometheusMetrics, reflect.TypeOf(fwkdl.Metrics{}))
 	require.NoError(t, err)
 
@@ -187,7 +187,7 @@ func TestRuntimePollingEndpointLifecycle(t *testing.T) {
 	r := datalayer.NewRuntime(pollingInterval)
 	ext := mocks.NewPollingExtractor("lifecycle-extractor")
 
-	httpSrc, err := httpds.NewHTTPDataSource("http", "/metrics", true, "test-http", "test-source",
+	httpSrc, err := httpds.NewHTTPDataSource("http", "/metrics", true, 0, "test-http", "test-source",
 		parsePrometheusMetrics, reflect.TypeOf(fwkdl.Metrics{}))
 	require.NoError(t, err)
 
@@ -241,7 +241,7 @@ func TestRuntimePollingWithoutExtractors(t *testing.T) {
 
 	r := datalayer.NewRuntime(50 * time.Millisecond)
 
-	httpSrc, err := httpds.NewHTTPDataSource("http", "/metrics", true, "test-http", "test-source",
+	httpSrc, err := httpds.NewHTTPDataSource("http", "/metrics", true, 0, "test-http", "test-source",
 		parsePrometheusMetrics, reflect.TypeOf(fwkdl.Metrics{}))
 	require.NoError(t, err)
 
@@ -280,7 +280,7 @@ func TestRuntimePollingHTTPError(t *testing.T) {
 	r := datalayer.NewRuntime(pollingInterval)
 	ext := mocks.NewPollingExtractor("error-extractor")
 
-	httpSrc, err := httpds.NewHTTPDataSource("http", "/metrics", true, "test-http", "test-source",
+	httpSrc, err := httpds.NewHTTPDataSource("http", "/metrics", true, 0, "test-http", "test-source",
 		parsePrometheusMetrics, reflect.TypeOf(fwkdl.Metrics{}))
 	require.NoError(t, err)