homelab/k8s-ng/core/prom-stack/alloy-values.yaml

alloy:
  enableReporting: false
  storagePath: /var/lib/alloy
  configMap:
    create: true
    content: |-
      discovery.kubernetes "pods" {
        role = "pod"
      }

      discovery.relabel "pod_logs" {
        targets = discovery.kubernetes.pods.targets

        rule {
          source_labels = ["__meta_kubernetes_namespace"]
          target_label  = "namespace"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_name"]
          target_label  = "pod"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_container_name"]
          target_label  = "container"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_node_name"]
          target_label  = "node"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_label_app"]
          regex         = `(.+)`
          target_label  = "app"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_label_app_kubernetes_io_name"]
          regex         = `(.+)`
          target_label  = "app"
        }
        rule {
          source_labels = ["namespace", "app"]
          separator     = "/"
          regex         = `(.+)/(.+)`
          replacement   = "$1/$2"
          target_label  = "job"
        }
      }

      loki.source.kubernetes "pods" {
        targets    = discovery.relabel.pod_logs.output
        forward_to = [loki.process.pods.receiver]
      }

      loki.process "pods" {
        stage.static_labels {
          values = {
            cluster = "hexor-ng",
          }
        }
        forward_to = [loki.write.local.receiver]
      }

      loki.source.kubernetes_events "cluster_events" {
        job_name   = "integrations/kubernetes/eventhandler"
        log_format = "logfmt"
        forward_to = [loki.process.cluster_events.receiver]
      }

      loki.process "cluster_events" {
        stage.static_labels {
          values = {
            cluster = "hexor-ng",
          }
        }
        forward_to = [loki.write.local.receiver]
      }

      loki.write "local" {
        endpoint {
          url = "http://loki-gateway.prometheus.svc/loki/api/v1/push"
        }
      }
  mounts:
    extra:
      - name: data
        mountPath: /var/lib/alloy
  securityContext:
    allowPrivilegeEscalation: false
    readOnlyRootFilesystem: true
    runAsNonRoot: true
    runAsUser: 473
    runAsGroup: 473
    capabilities:
      drop: [ALL]
    seccompProfile:
      type: RuntimeDefault
  resources:
    requests:
      cpu: 100m
      memory: 128Mi
    limits:
      cpu: "1"
      memory: 1Gi
  livenessProbe:
    httpGet:
      path: /metrics
      port: 12345
      scheme: HTTP
    initialDelaySeconds: 30
    periodSeconds: 30
    timeoutSeconds: 2
    failureThreshold: 3

global:
  podSecurityContext:
    fsGroup: 473
    fsGroupChangePolicy: OnRootMismatch
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault

controller:
  type: deployment
  replicas: 1
  nodeSelector:
    homelab.hexor.cy/pool: core
    homelab.hexor.cy/exposure: external
  priorityClassName: monitoring-critical
  minReadySeconds: 10
  terminationGracePeriodSeconds: 60
  volumes:
    extra:
      - name: data
        emptyDir: {}

configReloader:
  resources:
    requests:
      cpu: 10m
      memory: 50Mi
    limits:
      cpu: 100m
      memory: 128Mi

# Only the API permissions used by pod-log discovery and cluster events.
rbac:
  create: true
  rules:
    - apiGroups: [""]
      resources: [pods, pods/log, namespaces, events]
      verbs: [get, list, watch]
  # Kept separate because the Alloy chart concatenates this list into the
  # ClusterRole. Node metadata is useful for diagnosing a log source.
  clusterRules:
    - apiGroups: [""]
      resources: [nodes]
      verbs: [get, list, watch]

serviceMonitor:
  enabled: true
  interval: 30s