How Insights data works
Every Insights feature, from the resource list and the dashboard to lenses, Definitions, and Packages, reads the same data. Hub collects it from your control planes and serves it in one place, so you don't need to visit each control plane to see what's running. This page explains how Hub collects and serves that data, so you know what a result from Insights does and doesn't tell you.
Where the data comes from
Connecting a control plane or space deploys a connector for it. The connector watches the resources on that control plane and sends each change to Hub. Hub stores a record for every resource and serves those records through the Console and the Insights API.
Each record keeps three things about the resource:
- Its identity on the control plane: API version, kind, name, namespace, and UID.
- Where it lives: the control plane, its realm, and its space when it has one.
- What Hub knows about it: when Hub last synced it, the conditions it reports, and how it relates to other resources.
Hub gives each record its own name, which differs from the resource's name on the control plane. Use the resource's name to search, and the record's name to open a single record through the API.
You can't change a record. Data flows only from the control plane into Hub, and Hub never reconciles it back to the control plane.
How fresh the data is
Insights serves the most recent state each connector reported, not a live read from the control plane. A resource that changed a moment ago can still show its earlier state, and a resource created a moment ago may not appear yet.
Each record carries the time Hub last synced it. Check it before you treat a missing resource as gone. Objects outside the Insights API, such as control planes, realms, and spaces, are always current, because Hub stores them itself.
Access-scoped results
Insights returns resources only from the realms you have permission to read from. That rule applies to every list, search, filter, count, and lens, in the Console and in the API:
- Two users who make the same query could get different results.
- A count, such as the number of control planes that run a package, covers only the control planes you can see. It can be lower than the true total.
- A filter or a lens narrows what you can see. It never shows you a resource in a realm you can't read from.
- Organization roles don't inherently grant any permission into a realm. An organization administrator without a realm role sees no resources in that realm.
See Access management for how roles grant permissions in a realm.
How resources relate
Hub tracks the relationships between records as edges. Every edge has an inverse, and Hub serves both directions:
| Relationship | Inverse | Connects |
|---|---|---|
| Composes | Composed by | A composite resource and the resources it creates. |
| References | Referenced by | A resource and the resources it points to, such as a secret or another managed resource. |
Following those edges lets you trace from any resource to the resources around it, across the whole tree, without visiting the control plane.