Observability workspaces
An Observability workspace is the primary resource for managed metrics and logs on Thalassa Cloud. It replaces the former Prometheus tenant model with a single identity that covers Prometheus-compatible metrics and Loki-compatible logs.
Properties
| Field | Description |
|---|---|
| Identity | Unique ID with prefix obsw- (for example obsw-…) |
| Region | Cloud region where metrics and logs are stored and queried |
| Project | Project scope for IAM and organisation structure |
| Status | Lifecycle: provisioning, ready, updating, failed, deleting, deleted |
| Retention | retentionDays (1–1095); applies to metrics and logs; omit for the regional default |
| Backends | prometheusEnabled and lokiEnabled — both enabled when you create a workspace |
Endpoints (remoteWriteUrl, prometheusQueryUrl, pushUrl, lokiQueryUrl, and related fields) are populated when the workspace reaches ready. Do not configure collectors until the workspace is ready.
Endpoint shape
Regional gateways scope every request to a workspace in the URL path:
https://prometheus.<region>.thalassa.cloud/workspace/<workspace-id>/api/v1/push
https://prometheus.<region>.thalassa.cloud/workspace/<workspace-id>/api/v1/query
https://loki.<region>.thalassa.cloud/workspace/<workspace-id>/loki/api/v1/push
https://loki.<region>.thalassa.cloud/workspace/<workspace-id>/loki/api/v1/queryUse the exact URLs shown on the workspace overview in the console or returned by the API. The workspace ID in the path scopes the request to that workspace.
| Audience | How to call |
|---|---|
| Agents, Grafana, mimirtool | Regional gateway URLs above, with OIDC bearer tokens |
Isolation and security
- Workspaces are isolated by identity. Credentials authorised for one workspace cannot access another.
- Authentication uses Thalassa Cloud OIDC (service account client credentials or personal access tokens).
- Authorisation requires IAM permissions on the workspace and the relevant data-plane resources (Prometheus remote write/query/ruler/Alertmanager; Loki push/query/delete), plus matching token scopes where applicable.
- Control-plane access (
observability_workspace) alone does not grant ingest or query. Grant data-plane policies to the principals that run collectors or dashboards.
See default observability policies.
Retention
Retention is configured once per workspace and applies to all enabled backends.
| Guidance | Typical retentionDays |
|---|---|
| Operational troubleshooting | 7–30 |
| Trend analysis | 30–90 |
| Compliance / capacity history | 90–1095 |
Clearing or lowering retention does not instantly rewrite history; cleanup follows backend retention behaviour. Plan retention before high-volume ingest.
Deletion
You can delete a workspace from the console or API when delete constraints allow it.
| Option | Behaviour |
|---|---|
| Immediate delete | Workspace enters deleting and backends are torn down |
Grace period (gracePeriod=true) | Deletion is scheduled (24 hours); status shows deleting with deleteScheduledAt |
Deleting a workspace removes managed metrics and logs for that identity. Export critical data before delete if you need an offline copy.