title: Grafana setup for Control Core description: Connect Grafana to Control Core diagnostic and shadow discovery log streams. audience: DevOps and SRE timeEstimate: 20 minutes prerequisites:

Kubernetes or Docker Compose deployment
Observability namespace or compose profile enabled

Grafana setup

Control Core diagnostic logs and shadow discovery telemetry can route to Grafana (typically via Loki or Prometheus) when you enable the observability stack in your Helm or Compose deployment.

Enable the stack (Helm)

helm upgrade --install controlcore ./controlcore \
  -f values.yaml \
  --set observability.grafana.enabled=true \
  --set observability.prometheus.enabled=true

Port-forward Grafana for initial login:

kubectl port-forward -n monitoring svc/prometheus-grafana 3000:80

Default credentials are set via Helm values — change grafana.adminPassword before production.

Troubleshooting: If Grafana pod is pending, check PVC storage class and node resources. See Troubleshooting log framework.

Configure log export (OTLP / Loki)

Under observability.otelCollector.exporters in Helm values:

Enable Grafana Loki push (grafanaLoki.enabled=true).
Point Control Plane and Bouncer diagnostic exporters at the in-cluster OTLP endpoint.
Confirm labels include source, service, and environment slug.

See How logging works and Diagnostic logs.

Shadow discovery labels

Shadow mode emits audit and diagnostic lines matching shadow, SHADOW_WOULD_DENY, and discovery patterns. Grafana dashboards shipped with Control Core expect Loki datasource UID loki and label source="alloy-docker" in Compose-based installs — adjust queries for your environment.

Troubleshooting: If Loki receives no lines, verify Bouncer log level is enabled in Settings → Log management and that the collector pod is running. See Remote troubleshooting runbook.

Next step: Grafana dashboards