Control CoreDocs

Grafana setup

Grafana is optional. Control Core does not require Grafana for allow/deny/mask enforcement or for compliance audit. The default compliance path is the Control Plane audit APIs and SIEM outbox (Splunk, Microsoft Sentinel, Elastic, QRadar, or custom). Enable Grafana only when you want in-cluster dashboards for diagnostics or shadow discovery visualization.

Canadian sovereignty: when enabled, Grafana/Loki/Alloy run inside your VPC (or the online-demo perimeter). No observability telemetry leaves that boundary by default. Dependency images are delivered online from your approved / Canadian-region registries.

Prefer an existing SIEM? Skip this page and configure Audit & SIEM integration instead — see also Custom (Kubernetes / Helm) for reusing Splunk or other SIEM tooling.

Enable the stack (Helm) — opt-in only

helm upgrade --install controlcore ./controlcore \
  -f values.yaml \
  --set observability.grafana.enabled=true \
  --set observability.prometheus.enabled=true

Port-forward Grafana for initial login:

kubectl port-forward -n monitoring svc/prometheus-grafana 3000:80

Default credentials are set via Helm values — change grafana.adminPassword before production.

Troubleshooting: If Grafana pod is pending, check PVC storage class and node resources. See Troubleshooting log framework.

Configure log export (OTLP / Loki)

Under observability.otelCollector.exporters in Helm values:

  1. Enable Grafana Loki push (grafanaLoki.enabled=true).
  2. Point Control Plane and Bouncer diagnostic exporters at the in-cluster OTLP endpoint.
  3. Confirm labels include source, service, and environment slug.

See How logging works and Diagnostic logs.

Shadow discovery labels

Shadow mode emits audit and diagnostic lines matching shadow, SHADOW_WOULD_DENY, and discovery patterns. Grafana dashboards shipped with Control Core expect Loki datasource UID loki and label source="alloy-docker" in Compose-based installs — adjust queries for your environment.

Troubleshooting: If Loki receives no lines, verify Bouncer log level is enabled in Settings → Log management and that the collector pod is running. See Remote troubleshooting runbook.

Next step: Grafana dashboards