K8S Observability Platform
Metrics, logs and alerting for a live WebRTC workload — built to answer 'whose fault is this stall?' in one dashboard.
Metrics
Prometheus
Logs
Loki + Promtail
Packaging
Helm
Target workload
HubStream SFU
The question that started it
Running HubStream across regions produced a recurring, un-debuggable complaint: 'the video froze for a second.' Node CPU looked fine. Pods were healthy. Nothing in the platform's default metrics could tell me whether the stall came from a publisher's uplink, the inter-region pipe, the subscriber's downlink, or the media server itself.
So this stack is not generic Kubernetes monitoring with a WebRTC label on it. It exists to attribute a specific user-visible symptom to a specific layer.
Dashboard overview — the top-level view
Full-width Grafana screenshot; or embed the live panel below
The stack
- Prometheus scrapes cluster metrics plus a custom exporter that surfaces mediasoup transport stats — bitrate, packet loss, RTT, jitter, per producer and consumer
- Loki + Promtail collect signalling and media-server logs, keyed by the same room and peer ids the metrics carry
- Grafana joins the two: one dashboard, one time range, metric spike next to the log line that explains it
- Alert rules on sustained loss and RTT, sized so a single bad client does not page
- Everything packaged as Helm charts, so the stack redeploys with the cluster
Telemetry — packet loss / RTT / jitter over a live call
Screenshot during a real session, ideally with a visible incident
Correlation is the whole feature
The design decision that made the stack useful was propagating room id and peer id as labels on both metric series and log lines. Without that, a dashboard is a wall of pretty graphs and a log search is a separate investigation. With it, clicking a spike gives you the peer, and the peer gives you the log stream — the attribution question answers itself.
The cost is label cardinality, which is a real Prometheus constraint. Peer-level series are kept short-lived and aggregated up to room level for anything retained long term.
Metric spike beside the correlated log lines
A single screenshot of a real incident is worth more than any prose here
What I would do next
- Recording rules for the expensive room-level aggregations
- Synthetic probe clients per region for a continuous baseline that does not depend on real traffic
- SLO-based alerting on call quality rather than raw thresholds