Connected infrastructure

Metrics → Infrastructure queries Grafana Cloud Metrics for the selected app environment. Connect your existing stack, select reviewed targets, install a collector preset, and query a metric. Saving settings does not deploy anything.

Connection

Copy the Metrics query endpoint and numeric instance ID from your Grafana Cloud stack details. Supported HTTPS endpoints are prometheus-*.grafana.net with no path, /api/prom, or /prometheus; use the exact query base provided by Grafana. Use a stack-scoped metrics:read access policy token. It is encrypted in the vault and never sent to the browser. The Grafana stack URL and Prometheus data source UID enable a contextual Explore link.

Settings require Metrics and Credentials write permissions plus a fresh passkey. Every mutation and provider query is audited. Resource results require Metrics read and People PII read, including Management API requests. Rotation, pause, disconnection, token revocation and membership changes invalidate in-flight results. A previously displayed authorized result cannot be recalled.

Collectors

Each of up to twenty reviewed targets has a static cluster label and either Linux hosts or one exact Kubernetes namespace. Presets stamp immutable saaspro_app and saaspro_env identifiers plus the cluster label; queries always include these selectors. Labels supplement a correctly scoped Grafana account and do not replace provider access controls.

Copy the generated Alloy preset from the console. Set GRAFANA_METRICS_WRITE_TOKEN to a separate write-only collector credential. The read token in this console is never inserted into presets.

Linux: run Alloy on the host. Set SPM_NODE_NAME to a unique static host name. Only CPU, memory, load and scrape status are forwarded. A container deployment additionally requires the documented host mounts and exporter path settings; the displayed preset assumes a native Linux service.
Kubernetes: use an existing restricted kube-state-metrics service and set SPM_KUBE_STATE_TARGET to its internal host:port. Run Alloy inside that trusted cluster network; the preset uses HTTP for that internal scrape. The namespace allowlist filters samples before remote write. It does not create service accounts, deploy kube-state-metrics or grant cluster access.

CPU and restart calculations use the maximum observed value per logical core or container before aggregation, so duplicate exporter replicas do not inflate core counts or restart totals. Use one collection owner to avoid ambiguous series. Review the preset and run alloy validate config.alloy before applying it. Custom TLS, existing Helm pipelines and container mounts belong in your deployment configuration. Never expose a kube-state-metrics endpoint to the public internet for this integration.

Reading results

Metric	Meaning
CPU busy	Five-minute non-idle CPU average per host
Memory used	Total minus available memory, as a percentage
Load per CPU	One-minute load divided by observed core count
Collector reachability	Last exporter scrape result: 1 success, 0 failure
Pod readiness	Reported Ready condition: 1 ready, 0 not ready
Container restarts	Five-minute counter increase per pod, possibly fractional
Unavailable replicas	Desired minus available deployment replicas, minimum zero

Queries cover 1, 6 or 24 hours, with 60-second steps or 300-second steps for a full day. Gauges follow Prometheus evaluation/lookback semantics; a point is an evaluated value, not proof of a contemporaneous scrape. Rate and increase windows need five minutes of collector history to settle after startup. Missing resources and nonfinite values stay unknown. Warnings mark results incomplete. These observations do not establish root cause, whole-cluster inventory or an SLO.

One query per environment can run at a time, with 30/minute and 2,000/day limits. The provider has a five-second evaluation timeout inside an eight-second HTTP budget and a fifteen-second reservation. Responses are capped at 512 KiB, twenty resources and 361 samples per resource. Excess resources require a narrower collection target or Grafana Explore; arbitrary PromQL is unavailable. Results remain transient. The connection retains diagnostics, not metric history.

Management API: GET /api/v1/apps/{org}/{app}/metrics/infrastructure with env, target, metric, and range. The API enforces the same controls.

Protocol references

Reviewed 8 September 2026: Grafana Cloud query authentication, Prometheus range-query API, Alloy Linux exporter, Alloy scrape, Alloy relabeling, Alloy validation.