operations
The operations repository runs what lets a team see how its product is doing: the path that carries logs, metrics and traces to Grafana Cloud, the dashboards and alert rules every product gets from its catalog entry, the daily cost report, and the architecture catalog that maps every product. None of it is set up by a team by hand: it all follows from the catalog.
What it is for
Section titled “What it is for”A product that nobody can observe is a product nobody can operate. operations makes sure every product starts with the same observability, without the team building it, and that the platform itself is observed the same way.
What is in it
Section titled “What is in it”roots/telemetry: the telemetry gateways, one pair per edition, production and non-production, running Grafana Alloy, Grafana’s telemetry collector, on Cloud Run and scaling to zero. Applications send traces and metrics with OTLP, the OpenTelemetry protocol, and their logs reach the gateways through a buffer. The endpoints are published so that every product’s Ready output carries them.roots/grafana: the reconciler for the one Grafana Cloud stack. From the catalog it creates the teams and a folder per product, and in each product’s folder a service dashboard, a reliability dashboard and a cost dashboard, with baseline alert rules that evaluate production and route to the team’s contact point.roots/cost: the dataset that receives Google Cloud’s billing export. A dailycost:reportjob turns it into the cost series behind every product’s cost dashboard, with the product’s budget from the catalog as the threshold: orange at 80 percent and red at 100.roots/eventcatalogandeventcatalog/: the architecture catalog. Every repository publishes a description of itself on each merge; an aggregator assembles them into one site, rebuilt after each publication and every hour, atcatalog.projectairframe.devbehind single sign-on.jobs/: the scheduled reports: test coverage, cost and delivery.
How it connects
Section titled “How it connects”- It reads the catalog. The chain after a catalog merge runs this repository’s pipeline second, after landing-zone, so that the identities it grants to already exist.
- It reads landing-zone’s outputs. The telemetry root grants each product’s identities what they need to send telemetry; the Grafana root places each product’s dashboards.
- Products publish to it. A product’s own
infra/grafanaroot publishes its dashboards, and the Grafana root creates them in the product’s folder, so the product never holds a Grafana credential. - Drift reports are not here. Each repository’s own daily schedule plans its roots and keeps one issue per drifting root in that repository. See drift.
Who changes it, and how
Section titled “Who changes it, and how”Changes are merge requests approved by the platform team, with the gate’s approval required. On main, each root plans, passes the policy pack and applies under its own identity, with the Grafana tokens read from Secret Manager at run time.
Some parts of the design are not built yet: the operations agent and the audit agent, the skills for them with their test harness, and the catalog’s MCP server are planned in this repository and do not exist today.
Its always-on cost is about USD 7 a month for the instance of the non-production platform agent, a Grafana Alloy collector of the platform’s own metrics (an agent only in name), plus cents of storage for the billing export; the gateways scale to zero.
Where it lives
In the operations repository: