From 4bf678ee767274d75af14de586b8a61ae7d4114f Mon Sep 17 00:00:00 2001
From: Leszek Jakubowski <2552733+Makdaam@users.noreply.github.com>
Date: Wed, 2 Sep 2026 16:05:22 +0000
Subject: [PATCH 1/2] Configuration for a Billing Prometheus.

---
 .../alerting-rules/values.yaml                |  1 +
 .../billing-prometheus/Chart.yaml             |  8 ++
 .../templates/additional-scrape-config.yaml   | 23 ++++++
 .../templates/externalsecret.yaml             | 47 ++++++++++++
 .../templates/namespace.yaml                  |  8 ++
 .../templates/prometheus.yaml                 | 73 +++++++++++++++++++
 .../templates/serviceaccount.yaml             |  7 ++
 .../billing-prometheus/values.yaml            | 35 +++++++++
 config/defaults.yaml                          | 14 ++++
 .../ephemeral/us-east-1/_merged_config.yaml   | 14 ++++
 .../argocd-values-regional-cluster.yaml       |  4 +
 .../integration/us-east-1/_merged_config.yaml | 14 ++++
 .../argocd-values-regional-cluster.yaml       |  4 +
 deploy/stage/us-east-1/_merged_config.yaml    | 14 ++++
 .../argocd-values-regional-cluster.yaml       |  4 +
 15 files changed, 270 insertions(+)
 create mode 100644 argocd/config/regional-cluster/billing-prometheus/Chart.yaml
 create mode 100644 argocd/config/regional-cluster/billing-prometheus/templates/additional-scrape-config.yaml
 create mode 100644 argocd/config/regional-cluster/billing-prometheus/templates/externalsecret.yaml
 create mode 100644 argocd/config/regional-cluster/billing-prometheus/templates/namespace.yaml
 create mode 100644 argocd/config/regional-cluster/billing-prometheus/templates/prometheus.yaml
 create mode 100644 argocd/config/regional-cluster/billing-prometheus/templates/serviceaccount.yaml
 create mode 100644 argocd/config/regional-cluster/billing-prometheus/values.yaml

diff --git a/argocd/config/regional-cluster/alerting-rules/values.yaml b/argocd/config/regional-cluster/alerting-rules/values.yaml
index 3c9be4a411..e2bf855585 100644
--- a/argocd/config/regional-cluster/alerting-rules/values.yaml
+++ b/argocd/config/regional-cluster/alerting-rules/values.yaml
@@ -9,3 +9,4 @@ sla:
   hcpAvailability:
     # 99.95% availability target — 0.05% error budget over 30 days
     target: 0.9995
+
diff --git a/argocd/config/regional-cluster/billing-prometheus/Chart.yaml b/argocd/config/regional-cluster/billing-prometheus/Chart.yaml
new file mode 100644
index 0000000000..e632b2ba74
--- /dev/null
+++ b/argocd/config/regional-cluster/billing-prometheus/Chart.yaml
@@ -0,0 +1,8 @@
+apiVersion: v2
+name: billing-prometheus
+description: Minimal Prometheus that federates billing metrics from Thanos and remote-writes to Telemeter
+type: application
+version: 0.1.0
+home: https://github.com/openshift-online/rosa-hyperfleet
+maintainers:
+  - name: ROSA HyperFleet Team
diff --git a/argocd/config/regional-cluster/billing-prometheus/templates/additional-scrape-config.yaml b/argocd/config/regional-cluster/billing-prometheus/templates/additional-scrape-config.yaml
new file mode 100644
index 0000000000..0aaa12bb30
--- /dev/null
+++ b/argocd/config/regional-cluster/billing-prometheus/templates/additional-scrape-config.yaml
@@ -0,0 +1,23 @@
+{{- if .Values.billing.telemeterUrl }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: billing-additional-scrape
+  namespace: billing-prometheus
+type: Opaque
+stringData:
+  scrape-config.yaml: |
+    - job_name: thanos-federate
+      scrape_interval: {{ .Values.billing.scrapeInterval }}
+      scrape_timeout: 30s
+      honor_labels: true
+      metrics_path: /federate
+      params:
+        match[]:
+          {{- range .Values.billing.metricAllowList }}
+          - '{{ printf "{__name__=%q}" . }}'
+          {{- end }}
+      static_configs:
+        - targets:
+            - {{ .Values.billing.thanosQueryAddress }}
+{{- end }}
diff --git a/argocd/config/regional-cluster/billing-prometheus/templates/externalsecret.yaml b/argocd/config/regional-cluster/billing-prometheus/templates/externalsecret.yaml
new file mode 100644
index 0000000000..5b7af88e15
--- /dev/null
+++ b/argocd/config/regional-cluster/billing-prometheus/templates/externalsecret.yaml
@@ -0,0 +1,47 @@
+{{- if .Values.billing.telemeterUrl }}
+{{- if not (has .Values.billing.authType (list "bearer" "oauth2")) }}
+{{- fail (printf "billing.authType must be \"bearer\" or \"oauth2\", got: %q" .Values.billing.authType) }}
+{{- end }}
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  {{- if eq .Values.billing.authType "oauth2" }}
+  name: {{ .Values.billing.oauth2.credentialsSecretName }}
+  {{- else }}
+  name: {{ .Values.billing.tokenSecretName }}
+  {{- end }}
+  namespace: billing-prometheus
+  annotations:
+    # ExternalSecret CRD may not exist yet when ArgoCD dry-runs this resource
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+    # Apply before the Prometheus CR (wave 0) so the Secret exists before Prometheus starts.
+    argocd.argoproj.io/sync-wave: "-1"
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: aws-secrets-manager
+    kind: ClusterSecretStore
+  target:
+    {{- if eq .Values.billing.authType "oauth2" }}
+    name: {{ .Values.billing.oauth2.credentialsSecretName }}
+    {{- else }}
+    name: {{ .Values.billing.tokenSecretName }}
+    {{- end }}
+    creationPolicy: Owner
+  data:
+    {{- if eq .Values.billing.authType "oauth2" }}
+    - secretKey: client_id
+      remoteRef:
+        key: {{ .Values.global.cluster_name }}-telemeter-client
+        property: client_id
+    - secretKey: client_secret
+      remoteRef:
+        key: {{ .Values.global.cluster_name }}-telemeter-client
+        property: client_secret
+    {{- else }}
+    - secretKey: {{ .Values.billing.tokenSecretKey }}
+      remoteRef:
+        key: {{ .Values.global.cluster_name }}-telemeter-client
+        property: token
+    {{- end }}
+{{- end }}
diff --git a/argocd/config/regional-cluster/billing-prometheus/templates/namespace.yaml b/argocd/config/regional-cluster/billing-prometheus/templates/namespace.yaml
new file mode 100644
index 0000000000..e2ee82d398
--- /dev/null
+++ b/argocd/config/regional-cluster/billing-prometheus/templates/namespace.yaml
@@ -0,0 +1,8 @@
+{{- if .Values.billing.telemeterUrl }}
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: billing-prometheus
+  labels:
+    kubernetes.io/metadata.name: billing-prometheus
+{{- end }}
diff --git a/argocd/config/regional-cluster/billing-prometheus/templates/prometheus.yaml b/argocd/config/regional-cluster/billing-prometheus/templates/prometheus.yaml
new file mode 100644
index 0000000000..e09b90f479
--- /dev/null
+++ b/argocd/config/regional-cluster/billing-prometheus/templates/prometheus.yaml
@@ -0,0 +1,73 @@
+{{- if .Values.billing.telemeterUrl }}
+{{- if not (has .Values.billing.authType (list "bearer" "oauth2")) }}
+{{- fail (printf "billing.authType must be \"bearer\" or \"oauth2\", got: %q" .Values.billing.authType) }}
+{{- end }}
+apiVersion: monitoring.coreos.com/v1
+kind: Prometheus
+metadata:
+  name: billing
+  namespace: billing-prometheus
+  annotations:
+    # Prometheus CRD may not exist yet when ArgoCD dry-runs this resource
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  replicas: 1
+  # Short retention — this is a pass-through forwarder, not long-term storage.
+  retention: 2h
+  serviceAccountName: billing-prometheus
+
+  # Disable all automatic discovery; only the additionalScrapeConfigs job runs.
+  serviceMonitorSelector: {}
+  serviceMonitorNamespaceSelector:
+    matchLabels:
+      kubernetes.io/metadata.name: billing-prometheus
+  podMonitorSelector: {}
+  podMonitorNamespaceSelector:
+    matchLabels:
+      kubernetes.io/metadata.name: billing-prometheus
+  ruleSelector: {}
+  ruleNamespaceSelector:
+    matchLabels:
+      kubernetes.io/metadata.name: billing-prometheus
+
+  additionalScrapeConfigs:
+    name: billing-additional-scrape
+    key: scrape-config.yaml
+
+  remoteWrite:
+    - url: {{ .Values.billing.telemeterUrl | quote }}
+      {{- if eq .Values.billing.authType "oauth2" }}
+      oauth2:
+        clientId:
+          secret:
+            name: {{ .Values.billing.oauth2.credentialsSecretName }}
+            key: client_id
+        clientSecret:
+          name: {{ .Values.billing.oauth2.credentialsSecretName }}
+          key: client_secret
+        tokenUrl: {{ .Values.billing.oauth2.tokenUrl | quote }}
+        scopes:
+          {{- toYaml .Values.billing.oauth2.scopes | nindent 10 }}
+      {{- else }}
+      authorization:
+        type: Bearer
+        credentials:
+          name: {{ .Values.billing.tokenSecretName }}
+          key: {{ .Values.billing.tokenSecretKey }}
+      {{- end }}
+      # Forward only billing metrics — drop everything else before sending.
+      writeRelabelConfigs:
+        - sourceLabels: [__name__]
+          regex: {{ .Values.billing.metricAllowList | join "|" | quote }}
+          action: keep
+
+  resources:
+    requests:
+      cpu: 50m
+      memory: 256Mi
+    limits:
+      memory: 512Mi
+
+  # No persistent storage needed — short retention, pass-through only.
+  storage: {}
+{{- end }}
diff --git a/argocd/config/regional-cluster/billing-prometheus/templates/serviceaccount.yaml b/argocd/config/regional-cluster/billing-prometheus/templates/serviceaccount.yaml
new file mode 100644
index 0000000000..47858454b9
--- /dev/null
+++ b/argocd/config/regional-cluster/billing-prometheus/templates/serviceaccount.yaml
@@ -0,0 +1,7 @@
+{{- if .Values.billing.telemeterUrl }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: billing-prometheus
+  namespace: billing-prometheus
+{{- end }}
diff --git a/argocd/config/regional-cluster/billing-prometheus/values.yaml b/argocd/config/regional-cluster/billing-prometheus/values.yaml
new file mode 100644
index 0000000000..1a5de58295
--- /dev/null
+++ b/argocd/config/regional-cluster/billing-prometheus/values.yaml
@@ -0,0 +1,35 @@
+# Injected by ApplicationSet at runtime — defaults here for helm lint only
+global:
+  cluster_name: ""
+  aws_region: ""
+
+billing:
+  # Telemeter remote-write endpoint. Set per environment in argocd-values-regional-cluster.yaml.
+  telemeterUrl: ""
+
+  # Authentication method for Telemeter remote-write: "bearer" or "oauth2".
+  authType: bearer
+
+  # Bearer token auth (authType: bearer).
+  # Secret name and key must match the ExternalSecret target below.
+  tokenSecretName: hypershift-telemeter-client
+  tokenSecretKey: token
+
+  # OAuth2 auth (authType: oauth2).
+  oauth2:
+    tokenUrl: "https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token"
+    # Secret created by ExternalSecret holding client_id and client_secret.
+    credentialsSecretName: telemeter-oauth-credentials
+    scopes:
+      - openid
+
+  # Metrics forwarded to Telemeter (regex applied to __name__).
+  # Only matched metrics are remote-written; everything else is dropped.
+  metricAllowList:
+    - hypershift_cluster_vcpus
+
+  # Thanos Query Frontend in-cluster address. Port 9090 served by thanos-operator.
+  thanosQueryAddress: "thanos-query-frontend-thanos-query.thanos:9090"
+
+  # Prometheus scrape / evaluation interval for the billing job.
+  scrapeInterval: 1m
diff --git a/config/defaults.yaml b/config/defaults.yaml
index f9093ae90b..26711803e9 100644
--- a/config/defaults.yaml
+++ b/config/defaults.yaml
@@ -83,6 +83,12 @@ regional_cluster:
   # @doc regional_cluster.node_instance_families EC2 instance families for regional cluster Karpenter NodePool (e.g. m8i, m7i). Sizes are generated by the eks-nodepool Helm chart.
   # @used-by regional_cluster.node_instance_families _context
   node_instance_families: ["m8i", "m7i"]
+  # @doc regional_cluster.telemeter_url Telemeter remote-write endpoint for billing metrics. Empty disables the billing Prometheus.
+  # @used-by regional_cluster.telemeter_url _context
+  telemeter_url: ""
+  # @doc regional_cluster.telemeter_auth_type Authentication method for Telemeter remote-write: "bearer" or "oauth2".
+  # @used-by regional_cluster.telemeter_auth_type _context
+  telemeter_auth_type: "bearer"
   # @doc regional_cluster.hyperfleet_db_instance_class Aurora instance class for HyperFleet DB.
   # @used-by regional_cluster.hyperfleet_db_instance_class pipeline-regional-cluster-inputs/terraform.json.j2
   hyperfleet_db_instance_class: "db.r6g.large"
@@ -182,6 +188,14 @@ applications:
       # @doc applications.regional-cluster.eksNodePool.instanceFamilies Instance families for the regional Karpenter NodePool.
       # @used-by applications.regional-cluster.eksNodePool.instanceFamilies _context
       instanceFamilies: "{{ regional_cluster.node_instance_families }}"
+    billing-prometheus:
+      billing:
+        # @doc applications.regional-cluster.billing-prometheus.billing.telemeterUrl Telemeter remote-write endpoint. Empty disables the billing Prometheus entirely.
+        # @used-by applications.regional-cluster.billing-prometheus.billing.telemeterUrl _context
+        telemeterUrl: "{{ regional_cluster.telemeter_url | default('') }}"
+        # @doc applications.regional-cluster.billing-prometheus.billing.authType Telemeter auth method: "bearer" or "oauth2".
+        # @used-by applications.regional-cluster.billing-prometheus.billing.authType _context
+        authType: "{{ regional_cluster.telemeter_auth_type | default('bearer') }}"
     # @doc applications.regional-cluster.baseDomain DNS base domain for HostedClusters (deployment_name.dns.domain).
     # @used-by applications.regional-cluster.baseDomain _context
     baseDomain: "{% if dns.domain %}{{ deployment_name }}.{{ dns.domain }}{% endif %}"
diff --git a/deploy/ephemeral/us-east-1/_merged_config.yaml b/deploy/ephemeral/us-east-1/_merged_config.yaml
index 378ce90851..87f75973f6 100644
--- a/deploy/ephemeral/us-east-1/_merged_config.yaml
+++ b/deploy/ephemeral/us-east-1/_merged_config.yaml
@@ -86,6 +86,12 @@ regional_cluster:
   # @doc regional_cluster.node_instance_families EC2 instance families for regional cluster Karpenter NodePool (e.g. m8i, m7i). Sizes are generated by the eks-nodepool Helm chart.
   # @used-by regional_cluster.node_instance_families _context
   node_instance_families: ["m8i-flex", "m7i-flex"]
+  # @doc regional_cluster.telemeter_url Telemeter remote-write endpoint for billing metrics. Empty disables the billing Prometheus.
+  # @used-by regional_cluster.telemeter_url _context
+  telemeter_url: ""
+  # @doc regional_cluster.telemeter_auth_type Authentication method for Telemeter remote-write: "bearer" or "oauth2".
+  # @used-by regional_cluster.telemeter_auth_type _context
+  telemeter_auth_type: "bearer"
   # @doc regional_cluster.hyperfleet_db_instance_class Aurora instance class for HyperFleet DB.
   # @used-by regional_cluster.hyperfleet_db_instance_class pipeline-regional-cluster-inputs/terraform.json.j2
   hyperfleet_db_instance_class: "db.t4g.medium"
@@ -185,6 +191,14 @@ applications:
       # @doc applications.regional-cluster.eksNodePool.instanceFamilies Instance families for the regional Karpenter NodePool.
       # @used-by applications.regional-cluster.eksNodePool.instanceFamilies _context
       instanceFamilies: "{{ regional_cluster.node_instance_families }}"
+    billing-prometheus:
+      billing:
+        # @doc applications.regional-cluster.billing-prometheus.billing.telemeterUrl Telemeter remote-write endpoint. Empty disables the billing Prometheus entirely.
+        # @used-by applications.regional-cluster.billing-prometheus.billing.telemeterUrl _context
+        telemeterUrl: "{{ regional_cluster.telemeter_url | default('') }}"
+        # @doc applications.regional-cluster.billing-prometheus.billing.authType Telemeter auth method: "bearer" or "oauth2".
+        # @used-by applications.regional-cluster.billing-prometheus.billing.authType _context
+        authType: "{{ regional_cluster.telemeter_auth_type | default('bearer') }}"
     # @doc applications.regional-cluster.baseDomain DNS base domain for HostedClusters (deployment_name.dns.domain).
     # @used-by applications.regional-cluster.baseDomain _context
     baseDomain: "{% if dns.domain %}{{ deployment_name }}.{{ dns.domain }}{% endif %}"
diff --git a/deploy/ephemeral/us-east-1/argocd-values-regional-cluster.yaml b/deploy/ephemeral/us-east-1/argocd-values-regional-cluster.yaml
index 7d0c2cc10b..0c1d9d4483 100644
--- a/deploy/ephemeral/us-east-1/argocd-values-regional-cluster.yaml
+++ b/deploy/ephemeral/us-east-1/argocd-values-regional-cluster.yaml
@@ -9,6 +9,10 @@ eksNodePool:
   instanceFamilies:
   - m8i-flex
   - m7i-flex
+billing-prometheus:
+  billing:
+    telemeterUrl: ''
+    authType: bearer
 baseDomain: us-east-1.dev0.rosa.devshift.net
 hyperfleet:
   oidcS3Bucket: hypershift--regional-oidc-ssm:///infra/ephemeral/us-east-1/account_id
diff --git a/deploy/integration/us-east-1/_merged_config.yaml b/deploy/integration/us-east-1/_merged_config.yaml
index c9be1c1486..fb05efa0f3 100644
--- a/deploy/integration/us-east-1/_merged_config.yaml
+++ b/deploy/integration/us-east-1/_merged_config.yaml
@@ -86,6 +86,12 @@ regional_cluster:
   # @doc regional_cluster.node_instance_families EC2 instance families for regional cluster Karpenter NodePool (e.g. m8i, m7i). Sizes are generated by the eks-nodepool Helm chart.
   # @used-by regional_cluster.node_instance_families _context
   node_instance_families: ["m8i", "m7i"]
+  # @doc regional_cluster.telemeter_url Telemeter remote-write endpoint for billing metrics. Empty disables the billing Prometheus.
+  # @used-by regional_cluster.telemeter_url _context
+  telemeter_url: ""
+  # @doc regional_cluster.telemeter_auth_type Authentication method for Telemeter remote-write: "bearer" or "oauth2".
+  # @used-by regional_cluster.telemeter_auth_type _context
+  telemeter_auth_type: "bearer"
   # @doc regional_cluster.hyperfleet_db_instance_class Aurora instance class for HyperFleet DB.
   # @used-by regional_cluster.hyperfleet_db_instance_class pipeline-regional-cluster-inputs/terraform.json.j2
   hyperfleet_db_instance_class: "db.r6g.large"
@@ -185,6 +191,14 @@ applications:
       # @doc applications.regional-cluster.eksNodePool.instanceFamilies Instance families for the regional Karpenter NodePool.
       # @used-by applications.regional-cluster.eksNodePool.instanceFamilies _context
       instanceFamilies: "{{ regional_cluster.node_instance_families }}"
+    billing-prometheus:
+      billing:
+        # @doc applications.regional-cluster.billing-prometheus.billing.telemeterUrl Telemeter remote-write endpoint. Empty disables the billing Prometheus entirely.
+        # @used-by applications.regional-cluster.billing-prometheus.billing.telemeterUrl _context
+        telemeterUrl: "{{ regional_cluster.telemeter_url | default('') }}"
+        # @doc applications.regional-cluster.billing-prometheus.billing.authType Telemeter auth method: "bearer" or "oauth2".
+        # @used-by applications.regional-cluster.billing-prometheus.billing.authType _context
+        authType: "{{ regional_cluster.telemeter_auth_type | default('bearer') }}"
     # @doc applications.regional-cluster.baseDomain DNS base domain for HostedClusters (deployment_name.dns.domain).
     # @used-by applications.regional-cluster.baseDomain _context
     baseDomain: "{% if dns.domain %}{{ deployment_name }}.{{ dns.domain }}{% endif %}"
diff --git a/deploy/integration/us-east-1/argocd-values-regional-cluster.yaml b/deploy/integration/us-east-1/argocd-values-regional-cluster.yaml
index dd3e34f6ff..bed5353e24 100644
--- a/deploy/integration/us-east-1/argocd-values-regional-cluster.yaml
+++ b/deploy/integration/us-east-1/argocd-values-regional-cluster.yaml
@@ -9,6 +9,10 @@ eksNodePool:
   instanceFamilies:
   - m8i
   - m7i
+billing-prometheus:
+  billing:
+    telemeterUrl: ''
+    authType: bearer
 baseDomain: us-east-1.int0.rosa.devshift.net
 hyperfleet:
   oidcS3Bucket: PLACEHOLDER-overridden-by-terraform-output
diff --git a/deploy/stage/us-east-1/_merged_config.yaml b/deploy/stage/us-east-1/_merged_config.yaml
index 62ab0e216e..b09070d6c5 100644
--- a/deploy/stage/us-east-1/_merged_config.yaml
+++ b/deploy/stage/us-east-1/_merged_config.yaml
@@ -86,6 +86,12 @@ regional_cluster:
   # @doc regional_cluster.node_instance_families EC2 instance families for regional cluster Karpenter NodePool (e.g. m8i, m7i). Sizes are generated by the eks-nodepool Helm chart.
   # @used-by regional_cluster.node_instance_families _context
   node_instance_families: ["m8i", "m7i"]
+  # @doc regional_cluster.telemeter_url Telemeter remote-write endpoint for billing metrics. Empty disables the billing Prometheus.
+  # @used-by regional_cluster.telemeter_url _context
+  telemeter_url: ""
+  # @doc regional_cluster.telemeter_auth_type Authentication method for Telemeter remote-write: "bearer" or "oauth2".
+  # @used-by regional_cluster.telemeter_auth_type _context
+  telemeter_auth_type: "bearer"
   # @doc regional_cluster.hyperfleet_db_instance_class Aurora instance class for HyperFleet DB.
   # @used-by regional_cluster.hyperfleet_db_instance_class pipeline-regional-cluster-inputs/terraform.json.j2
   hyperfleet_db_instance_class: "db.r6g.large"
@@ -185,6 +191,14 @@ applications:
       # @doc applications.regional-cluster.eksNodePool.instanceFamilies Instance families for the regional Karpenter NodePool.
       # @used-by applications.regional-cluster.eksNodePool.instanceFamilies _context
       instanceFamilies: "{{ regional_cluster.node_instance_families }}"
+    billing-prometheus:
+      billing:
+        # @doc applications.regional-cluster.billing-prometheus.billing.telemeterUrl Telemeter remote-write endpoint. Empty disables the billing Prometheus entirely.
+        # @used-by applications.regional-cluster.billing-prometheus.billing.telemeterUrl _context
+        telemeterUrl: "{{ regional_cluster.telemeter_url | default('') }}"
+        # @doc applications.regional-cluster.billing-prometheus.billing.authType Telemeter auth method: "bearer" or "oauth2".
+        # @used-by applications.regional-cluster.billing-prometheus.billing.authType _context
+        authType: "{{ regional_cluster.telemeter_auth_type | default('bearer') }}"
     # @doc applications.regional-cluster.baseDomain DNS base domain for HostedClusters (deployment_name.dns.domain).
     # @used-by applications.regional-cluster.baseDomain _context
     baseDomain: "{% if dns.domain %}{{ deployment_name }}.{{ dns.domain }}{% endif %}"
diff --git a/deploy/stage/us-east-1/argocd-values-regional-cluster.yaml b/deploy/stage/us-east-1/argocd-values-regional-cluster.yaml
index 7b8919e609..9ecfeddcd0 100644
--- a/deploy/stage/us-east-1/argocd-values-regional-cluster.yaml
+++ b/deploy/stage/us-east-1/argocd-values-regional-cluster.yaml
@@ -9,6 +9,10 @@ eksNodePool:
   instanceFamilies:
   - m8i
   - m7i
+billing-prometheus:
+  billing:
+    telemeterUrl: ''
+    authType: bearer
 baseDomain: us-east-1.stg0.rosa.devshift.org
 hyperfleet:
   oidcS3Bucket: PLACEHOLDER-overridden-by-terraform-output

From a5145ecc1e0ca20620f58654d4dd52bc7b71cb43 Mon Sep 17 00:00:00 2001
From: Leszek Jakubowski <2552733+Makdaam@users.noreply.github.com>
Date: Wed, 2 Sep 2026 16:11:03 +0000
Subject: [PATCH 2/2] Set a placeholder telemetry URL.

---
 config/ephemeral/defaults.yaml                                 | 1 +
 deploy/ephemeral/us-east-1/_merged_config.yaml                 | 2 +-
 deploy/ephemeral/us-east-1/argocd-values-regional-cluster.yaml | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/config/ephemeral/defaults.yaml b/config/ephemeral/defaults.yaml
index 521ee3bfb8..d9ae4cd84e 100644
--- a/config/ephemeral/defaults.yaml
+++ b/config/ephemeral/defaults.yaml
@@ -30,6 +30,7 @@ regional_cluster:
   hyperfleet_db_monitoring_interval: 0
   enable_sre_tools_gateway: true
   enable_sre_public_access: false
+  telemeter_url: "https://127.0.0.99/metrics/v1/receive"
 
 applications:
   regional-cluster:
diff --git a/deploy/ephemeral/us-east-1/_merged_config.yaml b/deploy/ephemeral/us-east-1/_merged_config.yaml
index 87f75973f6..31ac57290c 100644
--- a/deploy/ephemeral/us-east-1/_merged_config.yaml
+++ b/deploy/ephemeral/us-east-1/_merged_config.yaml
@@ -88,7 +88,7 @@ regional_cluster:
   node_instance_families: ["m8i-flex", "m7i-flex"]
   # @doc regional_cluster.telemeter_url Telemeter remote-write endpoint for billing metrics. Empty disables the billing Prometheus.
   # @used-by regional_cluster.telemeter_url _context
-  telemeter_url: ""
+  telemeter_url: "https://127.0.0.99/metrics/v1/receive"
   # @doc regional_cluster.telemeter_auth_type Authentication method for Telemeter remote-write: "bearer" or "oauth2".
   # @used-by regional_cluster.telemeter_auth_type _context
   telemeter_auth_type: "bearer"
diff --git a/deploy/ephemeral/us-east-1/argocd-values-regional-cluster.yaml b/deploy/ephemeral/us-east-1/argocd-values-regional-cluster.yaml
index 0c1d9d4483..f89bc98ec2 100644
--- a/deploy/ephemeral/us-east-1/argocd-values-regional-cluster.yaml
+++ b/deploy/ephemeral/us-east-1/argocd-values-regional-cluster.yaml
@@ -11,7 +11,7 @@ eksNodePool:
   - m7i-flex
 billing-prometheus:
   billing:
-    telemeterUrl: ''
+    telemeterUrl: https://127.0.0.99/metrics/v1/receive
     authType: bearer
 baseDomain: us-east-1.dev0.rosa.devshift.net
 hyperfleet: