Ideally, I would just need an SSH key inside your machines and the capabilities to open an ssh tunnel inside the firewall to scrape metrics.
Ideally, the metric should get exposed back to the customer.
I am not a big fan of containers when working with data that are irreplaceable. But the use k8s may really help.