> For the complete documentation index, see [llms.txt](https://docs.hiero.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hiero.org/block-node-home/production-runbook/configure-alloy-telemetry.md). # Configure Alloy Telemetry Grafana Alloy ships Prometheus metrics (remote-write) and Loki logs from the Block Node cluster to the operator's observability infrastructure. Telemetry is opt-out for council Tier 1 operators during the initial deployment period. If you are opting out, skip this page, record the decision with Hashgraph DevOps, and proceed directly to [Network Validation and Go-Live](/block-node-home/production-runbook/network-validation-go-live.md). > **Before starting:** Complete [Install the Block Node](/block-node-home/production-runbook/install-block-node.md). Alloy requires the Kubernetes cluster to be running. *** ## What you need before starting Obtain the following from Hashgraph DevOps through the approved coordination channel: | Value | Placeholder | Notes | | ---------------------------------- | ------------------------------------ | --------------------------------------- | | Prometheus remote-write URL | `` | Non-secret; used on the install command | | Prometheus remote-write username | `` | Non-secret | | Prometheus write-only access token | `` | Secret - deliver via secure channel | | Loki remote-write URL | `` | Non-secret | | Loki remote-write username | `` | Non-secret | | Loki write-only access token | `` | Secret - deliver via secure channel | *** ## Step 1 - Create the credentials Secret **\[OPERATOR]** Alloy reads credentials from a Kubernetes Secret named `grafana-alloy-secrets` in the `grafana-alloy` namespace. Create the namespace and Secret before installing Alloy: ```bash kubectl create namespace grafana-alloy kubectl create secret generic grafana-alloy-secrets \ --namespace=grafana-alloy \ --from-literal=PROMETHEUS_PASSWORD_HASHGRAPH= \ --from-literal=LOKI_PASSWORD_HASHGRAPH= ``` The Secret key names follow the pattern `PROMETHEUS_PASSWORD_` and `LOKI_PASSWORD_`, where `` is the uppercase name used in `--add-prometheus-remote` and `--add-loki-remote` below. For the Hashgraph remote, the name is `HASHGRAPH`. > Destroy any local copy of the credentials file after creating the Secret. The tokens now live only in the cluster. > > **Security note:** Kubernetes Secrets backed by `etcd` are not encrypted at rest by default and may leak sensitive data into swap or temporary files. For production deployments, using an External Secrets Operator integrated with a managed vault (HashiCorp Vault, AWS Secrets Manager, GCP Secret Manager, or similar) is **strongly recommended**. If you use the default `etcd` provider, configure [encryption at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#ensure-all-secrets-are-encrypted) before storing credentials. You can also populate the Secret using the External Secrets Operator from a vault, Terraform, or any other mechanism your organization uses - the manual `kubectl` path above is the simplest path for an initial deployment only. *** ## Step 2 - Install Alloy **\[OPERATOR]** ```bash sudo solo-provisioner alloy cluster install \ --cluster-name= \ --monitor-block-node \ --profile mainnet \ --add-prometheus-remote="name=hashgraph,url=,username=,labelProfile=ops" \ --add-loki-remote="name=hashgraph,url=,username=,labelProfile=ops" ``` The `labelProfile=ops` option automatically injects standard labels into every metric and log stream so Hashgraph can attribute and isolate this operator's telemetry: | Label | Value | | ---------------- | --------------------------- | | `cluster` | `` | | `environment` | Set by label profile | | `instance_type` | `lfh` | | `inventory_name` | Operator node label | | `ip` | Block Node public IP | *** ## Step 3 - Verify Alloy **\[COORDINATED]** Check that the Alloy pod is running: ```bash kubectl -n grafana-alloy get pods ``` Hashgraph DevOps confirms that metrics and logs are landing in the configured remotes. Do not proceed to network validation until Hashgraph confirms Alloy is shipping. *** ## Next step Proceed to [Network Validation and Go-Live](/block-node-home/production-runbook/network-validation-go-live.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.hiero.org/block-node-home/production-runbook/configure-alloy-telemetry.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.