From 520626143d0def65823f148f11182c571bcee945 Mon Sep 17 00:00:00 2001
From: Pratik Mankawde <3397372+pratikmankawde@users.noreply.github.com>
Date: Sat, 15 Aug 2026 16:12:28 +0100
Subject: [PATCH] docs(telemetry): record why the workload stack runs anonymous
 Grafana admin

The setting was flagged in review as unauthenticated admin access. It is
deliberate, and it matches the sibling stack in docker-compose.yml, which
carries the same two variables and the same published port with its intent
in comments. This copy had none, so the reasoning lived only in a review
thread and was rediscovered as a finding each time the file was looked at.

Viewer would break the harness rather than harden it: the validation suite
drives the Grafana API against this instance to confirm each dashboard
provisions and loads, and the dashboards and datasources come from the
read-only mounts on the same service.
---
 docker/telemetry/docker-compose.workload.yaml | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/docker/telemetry/docker-compose.workload.yaml b/docker/telemetry/docker-compose.workload.yaml
index b59dada459..6ab809d705 100644
--- a/docker/telemetry/docker-compose.workload.yaml
+++ b/docker/telemetry/docker-compose.workload.yaml
@@ -88,11 +88,17 @@ services:
 
   grafana:
     image: grafana/grafana:13.1.2
+    # Anonymous Admin is deliberate, and matches the sibling stack in
+    # docker-compose.yml. This stack is an ephemeral local/CI backend that
+    # run-full-validation.sh brings up and tears down around a single run; it
+    # holds no durable data and is never exposed beyond the host. Admin rather
+    # than Viewer because the harness drives the Grafana API against it, and
+    # the dashboards and datasources are provisioned from the mounts below.
     environment:
-      - GF_AUTH_ANONYMOUS_ENABLED=true
-      - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin
+      - GF_AUTH_ANONYMOUS_ENABLED=true # No login required for local dev
+      - GF_AUTH_ANONYMOUS_ORG_ROLE=Admin # Full access without auth
     ports:
-      - "3000:3000"
+      - "3000:3000" # Grafana web UI
     volumes:
       - ./grafana/provisioning:/etc/grafana/provisioning:ro
       - ./grafana/dashboards:/var/lib/grafana/dashboards:ro