Grafana Learn
Sign in Sign up
Path

Learn to create an access policy token that secures the connection between Kubernetes and Grafana Cloud

Estimated time: 2 min

Create an access policy token

Create an access policy token

In this milestone, you create an access policy token that safeguards against unauthorized access, ensuring a secure connection between Kubernetes and Grafana Cloud.

The generated token is added to the Helm Chart manifest that you run in your Kubernetes cluster.

An access policy token is required for Grafana Alloy to send metrics and logs to Grafana Cloud. Choose how the Helm chart authenticates to Grafana Cloud. You can create a new access policy token, use an existing token, or point the chart at a stored Kubernetes Secret that already exists in your Cluster. Refer to Grafana Cloud Access Policies for more information.

To create a new token:

  1. Click Create a new token.

  2. In the Access policy token name box, enter a name. This name helps you view and revoke the token in Grafana.com later.

  3. In the Expiration date box, select or enter an expiration in days, or keep No expiry.

    The token uses the predefined scopes metrics:read and set:alloy-data-write.

  4. Click Create token.

To use an existing token:

  1. Click Use an existing token.

  2. Paste your token into the box.

To use a stored Kubernetes Secret:

  1. Click Use a stored Kubernetes Secret.

  2. In the Secret name box, enter the name of the Secret that already exists in your Cluster.

  3. In the Namespace box, keep the installation namespace or enter the namespace that holds the Secret.

  4. Optionally, expand the advanced options to change the Username key and Password key if your Secret doesn’t use the default keys username and password.

    The Secret must hold your Grafana Cloud instance ID as the username and an access policy token as the password, with the metrics:read and set:alloy-data-write scopes. The configuration page provides a kubectl command, prefilled with your instance ID, that you can copy to create the Secret. Because the chart reads the token from the Secret at runtime, your token isn’t stored in Grafana and doesn’t appear in the generated Helm command.

  5. Click Next.