grafanalisted

# Grafana work `gcx` is the CLI for everything here. `gcx help-tree` prints the command tree and `gcx <command> --help` the flags — read those rather than guess at a command. ## Connect Pomerium fronts the instance and intercepts `/api/*`, meeting a service account token with a 302 to SSO. The token works against the pod, so reach it through a port-forward. Start it as a background Bash command (`run_in_background: true`), which leaves the session free while it runs: ```bash kubectl --kubeconfig "$KUBECONFIG_DEV" -n "$GRAFANA_K8S_NAMESPACE" \ port-forward "svc/$GRAFANA_K8S_SERVICE" 13000:80 ``` Bind the credentials in the same shell as every `gcx` call: ```bash set -a; . ~/.claude/.env; set +a export GRAFANA_SERVER=http://localhost:13000 GRAFANA_ORG_ID=1 \ GRAFANA_TOKEN="$GRAFANA_SERVICE_ACCOUNT_TOKEN" ``` Any of those `.env` names empty → stop and say which one. A guessed token or namespace is a wrong answer wearing the shape of a working one. Keep the token in the environment: it overrides the context in memory and persists nothing. `gcx config set` writes it to the config file and the Keychain instead. Confirm the link with `gcx config check` — it prints connectivity, auth method and Grafana version, and is the first thing to run when a call behaves oddly. ## Read ```bash gcx dashboards list gcx dashboards get <uid> gcx datasources list gcx metrics query '<promql>' -d <uid> --since 1h gcx logs query '<logql>' -d <uid> --since 1h gcx alert rules list gcx