Grafana Mimir

Overview

Grafana Mimir is a long-term Prometheus metrics store you own. This template deploys Mimir in monolithic mode: your own collectors (Prometheus, Grafana Alloy, OpenTelemetry) push metrics in via Prometheus remote_write, and anything that speaks PromQL — your own Grafana, dashboards, scripts — queries them back, with metric blocks durably stored in your object bucket.

This is a self-hosted metrics store for your own metrics from your own sources. It is separate from — and not a replacement for — Control Plane’s built-in observability, which continues to collect and dashboard your workloads’ metrics natively.

Architecture

Mimir — A single-replica stateful workload running all Mimir components in one process (target: all). Remote-write ingest and PromQL query on port 8080, internal gRPC on 9095, memberlist on 7946 (self-contained ring — no Consul or etcd).
Object storage — Metric blocks live in your S3, GCS, or S3-compatible bucket; the persistent volume holds only the ingester WAL/TSDB and compactor workspace.

What Gets Created

Stateful Mimir Workload — Serves remote-write ingest and PromQL query on port 8080.
Volume Set — 20 GiB at /data for the ingester WAL/TSDB and compactor workspace.
Secret — An opaque secret holding the rendered Mimir configuration, mounted as a file.
Identity & Policy — An identity bound to the workload with reveal access to the config secret only, plus cloud access scoped to exactly your bucket (AWS and GCP backends).

This template does not create a GVC. You must deploy it into an existing GVC.

Prerequisites

Mimir requires an existing bucket in one of the supported backends and the access setup for it. Complete the steps for your chosen backend before installing.

AWS S3
Google Cloud Storage
S3-compatible (MinIO, R2, Wasabi)

AWS S3 uses a Control Plane cloud identity — no credentials are stored; the workload’s identity vends temporary credentials at runtime.

Create a bucket

Create an S3 bucket. Set storage.aws.bucket and storage.aws.region to match.

Set up a Cloud Account

If you do not have one, create a Cloud Account for your AWS account. Set storage.aws.cloudAccountName to its name.

Create a bucket-scoped IAM policy

Create an AWS IAM policy with the JSON below (replace YOUR_BUCKET), then set storage.aws.policyName to the policy’s name (bare name, not ARN):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket", "s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
      "Resource": [
        "arn:aws:s3:::YOUR_BUCKET",
        "arn:aws:s3:::YOUR_BUCKET/*"
      ]
    }
  ]
}

Google Cloud Storage uses a Control Plane cloud identity — no credentials are stored.

Create a bucket

Create a GCS bucket. Set storage.gcp.bucket to its name.

Set up a Cloud Account

If you do not have one, create a Cloud Account for your GCP project. Set storage.gcp.cloudAccountName to its name.

Confirm bucket access

No policy to author — the template grants the workload identity roles/storage.objectAdmin scoped to the bucket automatically.

Any S3-compatible server uses static access credentials, since these cannot federate with a cloud account.

Create a bucket

Create your bucket on the server and credentials that can read and write it. Set storage.minio.bucket, storage.minio.accessKey, and storage.minio.accessSecret to match.

Set the endpoint

Set storage.minio.endpoint to the S3 API address as host:port with no scheme (e.g. my-minio:9000), and storage.minio.insecure: true when the endpoint is plain HTTP. For the minio marketplace template deployed in the same GVC, this is WORKLOAD_NAME.GVC_NAME.cpln.local:9000 with insecure: true.

Once your backend is ready, install the template using your preferred method:

UI

Browse, install, and manage templates visually

CLI

Manage templates from your terminal

Terraform

Declare templates in your Terraform configurations

Pulumi

Declare templates in your Pulumi programs

Configuration

The default values.yaml for this template:

image: grafana/mimir:3.1.3

resources: # monolithic Mimir; memory governs ingestable series count
  cpu: 1000m
  memory: 2Gi
  minCpu: 500m
  minMemory: 1Gi

replicas: 1 # 1 for a single instance; 3 or more forms an HA cluster with 3-way replication

storage:
  type: aws # options: aws, gcp, minio

  aws: # AWS S3 — via Control Plane cloud identity
    bucket: my-mimir-bucket # bucket must already exist
    region: us-east-1
    cloudAccountName: my-s3-cloud-account # Control Plane AWS cloud account
    policyName: my-mimir-s3-policy # custom IAM policy granting bucket access (bare name)

  gcp: # Google Cloud Storage — via Control Plane cloud identity
    bucket: my-mimir-bucket # bucket must already exist
    cloudAccountName: my-gcs-cloud-account # Control Plane GCP cloud account

  minio: # Any S3-compatible server (MinIO, R2, Wasabi, …) — static keys + endpoint
    endpoint: my-minio:9000 # host:port, NO scheme
    insecure: true # true when the endpoint is plain HTTP
    bucket: my-mimir-bucket # bucket must already exist
    region: us-east-1
    accessKey: my-minio-username
    accessSecret: my-minio-password

multitenancy:
  enabled: false # when true, every client request must send X-Scope-OrgID: <tenant>

retention:
  period: "0" # blocks retention, e.g. 30d, 13w, 1y — "0" keeps data forever

volumeset:
  capacity: 20 # GiB — ingester WAL/TSDB and compactor workspace at /data

internalAccess:
  type: same-gvc # options: none, same-gvc, same-org, workload-list
  workloads: [] # used with workload-list, e.g. //gvc/GVC/workload/NAME

Resources

image — The Grafana Mimir container image.
resources — CPU and memory for the Mimir container. Memory governs how many active series you can ingest.

Storage Backend

Set storage.type to aws, gcp, or minio, and configure that block. AWS and GCP use a Control Plane cloud identity — no credentials are stored; the workload’s identity vends temporary credentials at runtime. See Prerequisites for the per-backend setup steps.

Field	Backends	Description
`bucket`	all	Target bucket. Must already exist.
`region`	`aws`, `minio`	Bucket region.
`cloudAccountName`	`aws`, `gcp`	Control Plane cloud account granting bucket access.
`policyName`	`aws`	Bare name of the custom bucket-scoped IAM policy.
`endpoint`	`minio`	S3 API address as `host:port` — no scheme.
`insecure`	`minio`	`true` when the endpoint is plain HTTP.
`accessKey` / `accessSecret`	`minio`	Static credentials with access to the bucket.

One bucket serves the whole deployment; the template namespaces its contents internally.

Multitenancy

multitenancy.enabled — When true, every request (push and query) must carry an X-Scope-OrgID: <tenant> header; requests without it are rejected with 401 no org id. Tenants are implicit — writing with a new tenant ID creates it, and each tenant’s series are fully isolated from the others. No provisioning step.

X-Scope-OrgID identifies a tenant; it does not authenticate anyone. Any client that can reach Mimir can send any tenant header. Tenancy is a namespacing mechanism, not a security boundary.

Retention

retention.period — Blocks retention enforced by the compactor, e.g. 30d, 13w, 1y. The default "0" keeps data forever. Changing the period applies to existing blocks too.

Storage Volume

volumeset.capacity — Volume size in GiB for the ingester WAL/TSDB and compactor workspace at /data. Metric blocks are durably stored in your object bucket, not on the volume.

Internal Access

Mimir is internal-only by design — it has no built-in authentication, so this template never exposes a public endpoint. internalAccess.type controls which workloads can reach port 8080:

Type	Description
`none`	No internal access allowed
`same-gvc`	Allow access from all workloads in the same GVC
`same-org`	Allow access from all workloads in the same organization
`workload-list`	Allow access only from specific workloads listed in `workloads`

To serve clients outside Control Plane, front Mimir with your own authenticating proxy behind a custom domain — that proxy is yours to build and operate; the template does not provide one.

Connecting

What	Value
Remote-write ingest (from your collectors)	`http://RELEASE_NAME-mimir.GVC_NAME.cpln.local:8080/api/v1/push`
PromQL / Grafana datasource	`http://RELEASE_NAME-mimir.GVC_NAME.cpln.local:8080/prometheus`
Tenant header (when `multitenancy.enabled`)	`X-Scope-OrgID: <tenant>` on every request

Point your collectors at the ingest endpoint. For Prometheus:

remote_write:
  - url: http://RELEASE_NAME-mimir.GVC_NAME.cpln.local:8080/api/v1/push
    # headers:
    #   X-Scope-OrgID: team-a # only when multitenancy.enabled

Point a Grafana Prometheus datasource at the PromQL URL. Because Mimir is internal-only, collectors and Grafana must run inside the GVC (or org, per internalAccess) to reach it.

Important Notes

After scaling replicas 1 → 3 on a live install, metrics written shortly before the scale-up can be intermittently invisible to queries for up to ~12 hours while their blocks age into the store — no data is lost and it resolves on its own.
Mimir has no built-in authentication, so this template never exposes a public endpoint. The X-Scope-OrgID header identifies a tenant; it does not authenticate anyone. To serve clients outside Control Plane, front Mimir with your own authenticating proxy behind a custom domain.
With multitenancy.enabled: true, every request needs X-Scope-OrgID — pushes and queries without it are rejected; tenants are implicit (no provisioning step).
Transient “Access Denied” warnings in the first seconds of a fresh boot may appear — the workload identity’s cloud credentials are still being issued; Mimir retries and proceeds on its own.
Data lives in your bucket — the volume set only holds the WAL and scratch space. Reinstalling the template against the same bucket resumes with your data; deleting data means emptying the bucket.
Retention is enforced by the compactor — changing retention.period applies to existing blocks too.
After uninstall, re-check your bucket — the terminating replica can re-write a small cluster-seed file (blocks/__mimir_cluster/) minutes after teardown; delete it if you are emptying the bucket.

External References

Grafana Mimir Documentation

Official Grafana Mimir documentation

Prometheus remote_write

Remote-write tuning and best practices

Mimir HTTP API

Ingest, query, and status endpoints reference

Grafana Mimir (GitHub)

Source code and releases

Mimir Template

View the source files, default values, and chart definition

Template Catalog

Templates

Overview

Architecture

What Gets Created

Prerequisites

UI

CLI

Terraform

Pulumi

Configuration

Resources

Storage Backend

Multitenancy

Retention

Storage Volume

Internal Access

Connecting

Important Notes

External References

Grafana Mimir Documentation

Prometheus remote_write

Mimir HTTP API

Grafana Mimir (GitHub)

Mimir Template

​Overview

​Architecture

​What Gets Created

​Prerequisites

UI

CLI

Terraform

Pulumi

​Configuration

​Resources

​Storage Backend

​Multitenancy

​Retention

​Storage Volume

​Internal Access

​Connecting

​Important Notes

​External References

Grafana Mimir Documentation

Prometheus remote_write

Mimir HTTP API

Grafana Mimir (GitHub)

Mimir Template

Overview

Architecture

What Gets Created

Prerequisites

Configuration

Resources

Storage Backend

Multitenancy

Retention

Storage Volume

Internal Access

Connecting

Important Notes

External References