Legend
UI
UI configuration for links, logs, and metrics on the module dashboardModuleUI
UI configuration for the module. Defines links and metrics to display in the module’s dashboard.UILink[] | null
UILog[] | null
Log sources displayed on the module’s Logs tab. Each entry is a
CloudWatch log group the module emits to.See: UILog(templateable)
UILink
A link displayed in the module UI. Used to provide quick access to external resources like consoles, documentation, etc.string
required
Display name for the link(minLen:1; templateable)
string
required
URL — can use template syntax like << output.xxx >> for dynamic values(templateable)
UILog
A log source displayed in the module UI’s Logs tab. Every field is templateable so module authors can pass an entire log definition (or individual fields) from stack outputs.string
required
Stable identifier for the log source, used as the React key / scope id.(minLen:1; templateable)
string
required
Display name for the log source (shown as the source label).(minLen:1; templateable)
LogSource
required
Data source for the logs. Discriminated on
type: cloudwatch, loki,
or external (a vendor deep link rather than a queryable store).See: LogSource(templateable)boolean | null
Whether this entry is shown at all. Resolved like every other field and
then applied: an entry resolving to
false is DROPPED from the module
instance’s UI before it reaches the API, as if it had never been
written. Absent means enabled — the guard is opt-in.This is how a module follows a provider selection it does not know at
authoring time: list one entry per provider it could render from, each
guarded on the add-ons instance’s rendering-provider list, and let the
resolver keep the ones the user actually chose.Entries that survive and share an id form a FALLBACK CHAIN in listed
order, not a merge — rendering the same lines twice is the failure this
avoids. The dashboard reads the first that can answer and falls to the
next when the agent is offline or the source is missed, saying which
store it settled on. Entries with DIFFERENT ids still merge, which is
what keeps a mixed ECS + EKS environment showing one table.(templateable)UIMetric
A metric displayed in the module UI. Used to show CloudWatch metrics or other time-series data. Every field is templateable so module authors can pass an entire metric definition as a stack output (e.g.<< stack.output.cpu_metric >>) or template individual
fields piecemeal.string
required
Stable identifier for the metric, used as the React key on the dashboard
and in the metric query cache key. Must be unique within a module’s UI.(minLen:1; templateable)
string
required
Display name for the metric(minLen:1; templateable)
enum
required
Chart type for the metricAllowed values:
line | bar | link(templateable)MetricSource
Data source for the metric. Discriminated union —
cloudwatch or
prometheus. The aggregation period (CloudWatch) / step (Prometheus) is
chosen by the requester (frontend) based on the selected time range, not
by the module definition. For cloudwatch the display unit is
auto-detected server-side from the namespace + metric name; for
prometheus it comes from the source’s static unit field.See: MetricSource(templateable)boolean | null
Whether this entry is shown at all. Resolved like every other field and
then applied: an entry resolving to
false is DROPPED from the module
instance’s UI before it reaches the API, as if it had never been
written. Absent means enabled — the guard is opt-in.This is how a module follows a provider selection it does not know at
authoring time: list one entry per provider it could render from, each
guarded on the add-ons instance’s rendering-provider list, and let the
resolver keep the ones the user actually chose.Entries that survive and share an id form a FALLBACK CHAIN in listed
order, not a merge: the dashboard renders the first that can answer and
moves down the chain when it cannot, naming the store it settled on.(templateable)LogSource
Discriminated union of supported log sources:cloudwatch for ECS and EC2
workloads, eks_loki for EKS, external for a vendor Ravion ships to but
cannot read back.The first two are not interchangeable and are not meant to converge. They
differ in where the data lives (an AWS service Ravion calls, versus a
component in the customer’s cluster Ravion reaches through an agent), in what
makes them unavailable, and in what a query costs — so a consumer must
discriminate on type rather than treat a source as a location-agnostic
handle. external is a third thing again: not queryable at all, and every
consumer that issues queries must skip it rather than fail on it.Discriminated union. The type field selects which schema applies.MetricSource
Discriminated union of supported metric data sources. Discriminated by thetype field on each variant: cloudwatch, amp
(Amazon Managed Prometheus), eks_prometheus (a Prometheus reached through
the cluster’s Operator agent) and link (a vendor deep link). The union
exists so additional sources (e.g. Datadog) can be added without breaking
callers.Discriminated union. The type field selects which schema applies.MetricType
Allowed metric chart types.Allowed values:linebarlink
CloudWatchLogSource
A CloudWatch Logs source for a module log stream. Mirrors CloudWatchMetricSource: every field is templateable so module authors can wire concrete values from stack outputs.enum
required
Allowed values:
cloudwatch(templateable)string
required
(minLen:1; templateable)
string
required
(minLen:1; templateable)
string
required
(minLen:1; templateable)
string | null
(templateable)
string | null
(templateable)
EksLokiLogSource
A Loki log source reached through the EKS cluster’s Operator agent.Loki runs inside the customer’s own cluster, storing to S3 in their account, and Ravion reaches it through the Operator agent’s HTTP proxy rather than over any public endpoint. Two consequences show up directly in this shape:- The in-cluster Loki needs no endpoint field. Its service URL is not
templated into a module’s UI; it is the control plane’s own default, and
what permits the agent to reach it is the Operator install’s
httpProxy.allowedEndpointsallowlist. (endpointexists for the separate case of an EXTERNAL Loki — see the field — and naming one is still not a permission: the allowlist judges it.) cluster_arnis the whole addressing scheme. It resolves to the connected agent, and therefore to one cluster in one organization — an ARN belonging to somebody else resolves to nothing.
enum
required
Allowed values:
eks_loki(templateable)string
required
ARN of the EKS cluster whose in-cluster Loki holds these logs. Resolves to
the Operator agent enrolled for that cluster.(minLen:1; templateable)
string
required
LogQL stream selector scoping the source, e.g.
{namespace="prod", app="api"}. The labels available are the ones the
addons module’s collector attaches: namespace, app, workload, plus
level as structured metadata.(minLen:1; templateable)string | null
Base URL of an EXTERNAL Loki to query instead of the in-cluster one — a
Grafana Cloud Logs endpoint, for instance — without the
/loki/api/v1
suffix the control plane appends.The query still goes through the Operator agent named by cluster_arn, and
still only reaches an address that install’s httpProxy.allowedEndpoints
permits. Routing through the agent rather than calling the vendor from
Ravion is what keeps the credential inside the customer’s cluster.(minLen:1; templateable)string | null
Name of a Kubernetes Secret in the Operator namespace holding the credential
the AGENT presents when reaching
endpoint (keys username/password, or
bearer_token).A NAME, never a value — see the identical field on
EksPrometheusMetricSource. Absent means no credential, which is what the
in-cluster Loki takes.(templateable)ExternalLogSource
A log destination Ravion ships to but cannot read back — Datadog, Grafana Cloud, New Relic, OpenSearch, Splunk, a custom OTLP collector.It is a log source in the sense that it is where this workload’s logs went; it is not one in the sense that no query can be issued against it. The Logs tab therefore renders it as an “Open in <provider>” action rather than as rows, beside the rendered store when there is one and alone when there is not. Several are allowed: a cluster may ship to two vendors at once.It deliberately carries no credential and no API endpoint. Ravion holds nothing that would let it query the vendor, which is the whole distinction between this variant and the two that render.enum
required
Allowed values:
external(templateable)string
required
Provider id, matching the add-ons module’s
logs_providers values:
grafana_cloud, datadog, new_relic, opensearch, splunk, otlp.
The dashboard maps it to a human label; an id it does not know is shown
verbatim rather than dropped.(minLen:1; templateable)string
required
Absolute URL the action opens, already scoped to this workload — the
module completes the vendor’s base URL with its own namespace/workload
query so the link lands on the service, not the vendor’s home page.(minLen:1; templateable)
AmpMetricSource
Amazon Managed Prometheus metric source.aws_account_id resolves the
credentials, region + workspace_id name the AMP workspace, and Ravion
signs the PromQL range query with SigV4 and calls AWS directly.Every field is templateable so the whole source can be wired from another
module instance’s stack outputs (e.g. the EKS observability add-ons
instance).enum
required
Metric source discriminator.Allowed values:
amp(templateable)string
required
AWS account ID whose credentials sign the query.(minLen:1; templateable)
string
required
AWS region of the AMP workspace.(minLen:1; templateable)
string
required
Amazon Managed Prometheus workspace ID.(minLen:1; templateable)
string
required
PromQL range query.
$__interval is substituted with the query step.(minLen:1; templateable)string | null
Series legend template, Grafana-style (
{{label}}).(templateable)string | null
Display unit for the chart axis.(templateable)
CloudWatchMetricSource
CloudWatch-backed metric source. Module authors fill this in with literal values or templated references (e.g.<< stack.output.* >>). The server
uses aws_account_id to look up credentials and region to scope the
CloudWatch call — no ARN parsing required. Every field is templateable
so the entire source can be wired from a stack output map.enum
required
Source type discriminatorAllowed values:
cloudwatch(templateable)string
required
Ravion AWS account reference used to resolve credentials for the
CloudWatch call. Accepts either the Flightcontrol AWS account database
ID (e.g.
awsact_123) or the user-provided givenId configured on the
AWS account. The resolver normalizes the value to the DB id before any
downstream use; the givenId form is an input alias only and is never
persisted as the canonical reference. The 12-digit AWS account number is
rejected because the same number can map to multiple connected accounts.(minLen:1; templateable)string
required
AWS region the metric lives in.(minLen:1; templateable)
string
required
CloudWatch namespace(minLen:1; templateable)
string
required
CloudWatch metric name(minLen:1; templateable)
string
required
CloudWatch statistic to apply(minLen:1; templateable)
map<string,string>
required
Dimensions used to scope the metric. Required — no longer derived from
any ARN since the source no longer carries one.(templateable)
EksPrometheusMetricSource
Prometheus metric source reached through the EKS cluster’s Operator agent.cluster_arn names the cluster whose Operator proxies the PromQL query;
the Prometheus itself is the in-cluster one by default, or — with
endpoint — an external Prometheus (Grafana Cloud Metrics, for instance)
that the cluster can reach. The Operator install’s
httpProxy.allowedEndpoints allowlist decides what the agent may call.Availability follows from that: with the agent disconnected the metric is
unavailable, and the dashboard moves down the metric’s fallback chain.Every field is templateable so the whole source can be wired from another
module instance’s stack outputs.enum
required
Metric source discriminator.Allowed values:
eks_prometheus(templateable)string
required
ARN of the EKS cluster whose Operator agent proxies the query. Resolves
to the Operator enrolled for that cluster, and therefore to one cluster
in one organization.(minLen:1; templateable)
string | null
Base URL of an external Prometheus reachable from the cluster. Omit to
query the in-cluster Prometheus the add-ons install.(minLen:1; templateable)
string | null
Name of a Kubernetes Secret, in the Operator’s namespace, whose contents
the AGENT presents to
endpoint. Ravion never reads it.(templateable)string
required
PromQL range query.
$__interval is substituted with the query step.(minLen:1; templateable)string | null
Series legend template, Grafana-style (
{{label}}).(templateable)string | null
Display unit for the chart axis.(templateable)
LinkMetricSource
A metric entry that is not a chart: a vendor Ravion ships metrics to but cannot query. Rendered as an “Open in <provider>” action. Pairs withtype: link on the owning UIMetric.enum
required
Metric source discriminator.Allowed values:
link(templateable)string
required
Observability provider this entry belongs to. One of the provider ids
the add-ons module publishes:
loki, cloudwatch, grafana_cloud,
datadog, new_relic, opensearch, splunk, otlp. The dashboard
turns it into a human label (“Open in Datadog”); an unknown id is shown
verbatim rather than hidden.(minLen:1; templateable)string
required
Absolute URL the “Open in <provider>” action opens. Built by the module
from the vendor’s base URL plus the workload’s own scoping (namespace,
workload name), so the link lands on this service rather than the
vendor’s home page.(minLen:1; templateable)