Ground Control — what's pre-wired and how to use it
The problem this solves
Standing up a production-grade observability stack — scrape configs, log shippers, trace collectors, dashboards, alert rules — takes weeks. And that's before you wire it to every platform component individually.
Ground Control ships pre-wired. Every SmoothGlue platform component is instrumented on Day 0. Dashboards are pre-imported. Alert rules for platform health are pre-configured.
The stack
| Component | Role | Where you interact with it |
|---|---|---|
| Alloy | Collector agent — gathers metrics, logs, and traces from all workloads | Runs as a DaemonSet. No configuration needed. |
| Prometheus | Metrics storage | Grafana data source (pre-configured) |
| Loki | Log aggregation | Grafana Explore → LogQL |
| Tempo | Distributed trace storage | Grafana Explore → TraceQL |
| Grafana | Dashboards, alerting, unified query interface | Console sidebar → Ground Control |
How to access Ground Control
From the Console: Left sidebar → Ground Control. This opens a Grafana session authenticated via Keycloak SSO — same credentials as your Console login. No separate Grafana username or password.
Direct URL: https://grafana.<your-domain> — same SSO flow.
What's pre-wired
All SmoothGlue platform components — GitLab, ArgoCD, Keycloak, Nexus, NeuVector, Vault, Kyverno — have Alloy scrapers pre-configured. You do not need to add scrape targets, configure log shippers, or import dashboards. On Day 0 you will find:
- Dashboards for every platform component (GitLab throughput, ArgoCD sync health, Keycloak auth rates, Nexus storage, NeuVector alerts)
- Log streams for all platform namespaces queryable via Loki in Grafana Explore
- Alert rules for platform health events: node pressure, pod crash loops, certificate expiry, secret rotation due dates, STIG drift detections from Platform Custodian
What Platform Custodian handles vs. what you own
Platform Custodian handles:
- Platform health alert rules (pre-configured, pre-routed to Console alerts)
- Certificate expiry detection and auto-renewal
- Secret rotation scheduling and enforcement
- STIG drift detection and remediation
You own:
- Alert routing destinations — where alerts go (PagerDuty, Slack webhook, email). Configure in Grafana → Alerting → Contact Points. Platform Custodian routes to Console alerts by default; external routing is yours to wire.
- Log retention policy — default is 30 days. Change in the Console under Platform Custodian settings if your compliance baseline requires longer retention.
- Your application's observability — Ground Control instruments the platform, not your applications.
Application observability
Ground Control uses Kubernetes service discovery (via Alloy) to find and scrape workloads. For your application to appear in Grafana:
Metrics: Your app must expose a Prometheus-format /metrics endpoint. Annotate your Kubernetes Service with:
annotations:
prometheus.io/scrape: "true"
prometheus.io/port: "8080"
prometheus.io/path: "/metrics"
Alloy picks this up automatically — no scrape config changes needed.
Logs: Write structured logs (JSON) to stdout. Alloy collects stdout from all pods automatically. Use the app label on your pod spec as the Loki stream selector.
Traces: Instrument your app with OpenTelemetry and configure the OTLP exporter to send to Alloy's OTLP endpoint at http://alloy.<namespace>.svc.cluster.local:4317. Alloy forwards traces to Tempo.