Hermetiq Project Integrations Reference

Start with the deployment topology

Project Settings describes what Hermetiq should consume or expose, but a switch does not install the upstream service. Confirm that the deployment has the required endpoint, identity, network route, storage permission, collector, proxy, or event producer before enabling an integration.

Forward BEP to another consumer

Where BEP forwarding is available, it sends the project’s build event stream to a configured downstream gRPC endpoint in addition to Hermetiq’s normal processing. Use it when another authorized system must consume the same build events.

Enter the downstream endpoint exactly as provided by its operator.
Add only the gRPC metadata required by that destination. Treat secret metadata as credentials.
Verify DNS, TLS trust, egress policy, and authentication from the Hermetiq deployment, not only from a developer laptop.
After saving, run a new build and confirm delivery in both Hermetiq and the downstream system.

Forwarding availability and retry behavior depend on the deployment. Coordinate destination changes with the deployment operator before removing an endpoint or credential.

CAS and Bytestream access

Hermetiq uses CAS access to retrieve artifacts such as Bazel JSON profiles and to enrich cache-event analysis where configured. Bytestream access serves blob reads and artifact downloads when the CAS endpoint does not provide the required Bytestream service itself.

Address and instance

Use the gRPC service address and instance name for the storage that contains this project’s artifacts. The instance must match the producing Bazel or Buildbarn configuration.

TLS

Use TLS for protected endpoints and provide the server CA when it is not already trusted by the deployment.

OAuth 2.0

Configure the supported token endpoint and client credentials only when the storage endpoint expects OAuth. Keep the client secret out of source control.

mTLS

Provide a client certificate and private key when the endpoint requires mutual TLS. Rotate them according to the storage operator’s policy.

gRPC metadata

Add project, tenant, authorization, or routing metadata required by the endpoint. Metadata keys and values are specific to that service.

Host aliases

Map Bytestream URI hosts only when artifact URIs name a host different from the client address Hermetiq must dial.

If the CAS endpoint also supports Bytestream reads, enable that capability instead of configuring an unnecessary second client. Customer-managed Buildbarn deployments may alternatively provide a browser mapping managed by the deployment.

Completed actions and cache events

Completed Action Log

Remote execution timing

Enables per-action data produced by the remote-execution integration, such as available queue, input-fetch, execution, output-upload, worker, and action context.

Action Cache Hit Tracker

Cache lookup events

Enables event-level Action Cache analysis when the deployment includes the compatible cache proxy and event pipeline. The project CAS configuration may also be required for enrichment.

These settings do not create historical events. Enable the required deployment components first, then run new builds and verify that the relevant action or cache analytics populate.

Output Files Processing is a separate capability that enriches supported build outputs after BEP ingestion. Enable it only when the deployment has the required artifact access and processing pipeline, then verify a new output rather than expecting old invocations to be backfilled.

Invocation log storage

Projects can store compressed invocation progress logs in supported cloud object storage instead of the deployment’s primary database path. Current customer-managed configuration supports Google Cloud Storage or Azure Blob Storage where the deployment has implemented the required access.

Configure the provider and bucket or container intended for this deployment.
Grant the deployment’s shared/read-write workload identity the documented object permissions; do not create ad hoc per-pod credentials.
Allow network egress to the storage endpoint.
Set a provider lifecycle or TTL rule for the progress-object prefix; object retention is controlled by the storage policy.
Use the connectivity test before enabling the setting, then verify logs from a new invocation.

OpenTelemetry and cost data

OpenTelemetry can connect Hermetiq and Buildbarn service metrics, logs, or traces to the deployment’s configured observability pipeline. In customer-managed Kubernetes, the reference topology uses an OpenTelemetry Collector and can forward metrics to VictoriaMetrics; the exact backends and enabled signals remain deployment-specific.

OpenCost can supply Kubernetes cost inputs used by cost reporting where the backend can reach a configured OpenCost API and the cost-report integration is enabled. OpenCost is optional and disabled by default in the customer-managed chart, so do not expect cost views to populate merely because build ingestion works.

OpenTelemetry check

Verify collector reachability, protocol and TLS settings, project/resource attributes, and recent samples in the configured backend.

OpenCost check

Verify API reachability, cost-report enablement, cluster coverage, time range, and the workload labels used for attribution.

The public dashboard currently exposes Cost Reporting only while the hosted hermetiq-demo project is selected. Configuring OpenCost in a customer-managed deployment does not by itself expose that navigation item; confirm product availability with Hermetiq. The external Metrics Dashboard requires an administrator-configured dashboard URL and the corresponding access permission.

Review infrastructure data sources →