output.yaml

---
# Source: k8s-monitoring/charts/alloy-logs/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
automountServiceAccountToken: true
metadata:
  name: k8smon-alloy-logs
  namespace: default
  labels:
    helm.sh/chart: alloy-logs-0.12.5
    app.kubernetes.io/name: alloy-logs
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
---
# Source: k8s-monitoring/charts/alloy-metrics/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
automountServiceAccountToken: true
metadata:
  name: k8smon-alloy-metrics
  namespace: default
  labels:
    helm.sh/chart: alloy-metrics-0.12.5
    app.kubernetes.io/name: alloy-metrics
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
---
# Source: k8s-monitoring/charts/alloy-receiver/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
automountServiceAccountToken: true
metadata:
  name: k8smon-alloy-receiver
  namespace: default
  labels:
    helm.sh/chart: alloy-receiver-0.12.5
    app.kubernetes.io/name: alloy-receiver
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
---
# Source: k8s-monitoring/templates/destination_secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: "prometheus-k8smon-k8s-monitoring"
  namespace: "default"
type: Opaque
data:
  bearerToken: "c2FtcGxlLWJlYXJlci10b2tlbg=="
---
# Source: k8s-monitoring/templates/alloy-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: k8smon-alloy-metrics
  namespace: default
data:
  config.alloy: |-
    // Destination: prometheus (prometheus)
    otelcol.exporter.prometheus "prometheus" {
      add_metric_suffixes = true
      forward_to = [prometheus.remote_write.prometheus.receiver]
    }
    
    prometheus.remote_write "prometheus" {
      endpoint {
        url = "http://prometheus.prometheus.svc:9090/api/v1/write"
        headers = {
        }
        bearer_token = remote.kubernetes.secret.prometheus.data["bearerToken"]
        tls_config {
          insecure_skip_verify = false
        }
        send_native_histograms = false
    
        queue_config {
          capacity = 10000
          min_shards = 1
          max_shards = 50
          max_samples_per_send = 2000
          batch_send_deadline = "5s"
          min_backoff = "30ms"
          max_backoff = "5s"
          retry_on_http_429 = true
          sample_age_limit = "0s"
        }
    
        write_relabel_config {
          source_labels = ["cluster"]
          regex = ""
          replacement = "bearer-token-example-cluster"
          target_label = "cluster"
        }
        write_relabel_config {
          source_labels = ["k8s.cluster.name"]
          regex = ""
          replacement = "bearer-token-example-cluster"
          target_label = "cluster"
        }
      }
    
      wal {
        truncate_frequency = "2h"
        min_keepalive_time = "5m"
        max_keepalive_time = "8h"
      }
    }
    
    remote.kubernetes.secret "prometheus" {
      name      = "prometheus-k8smon-k8s-monitoring"
      namespace = "default"
    }
    // Feature: Prometheus Operator Objects
    declare "prometheus_operator_objects" {
      argument "metrics_destinations" {
        comment = "Must be a list of metric destinations where collected metrics should be forwarded to"
      }
    
      // Prometheus Operator PodMonitor objects
      prometheus.operator.podmonitors "pod_monitors" {
        clustering {
          enabled = true
        }
        scrape {
          default_scrape_interval = "60s"
        }
        forward_to = argument.metrics_destinations.value
      }
    
      // Prometheus Operator Probe objects
      prometheus.operator.probes "probes" {
        clustering {
          enabled = true
        }
        scrape {
          default_scrape_interval = "60s"
        }
        forward_to = argument.metrics_destinations.value
      }
    
      // Prometheus Operator ServiceMonitor objects
      prometheus.operator.servicemonitors "service_monitors" {
        clustering {
          enabled = true
        }
        scrape {
          default_scrape_interval = "60s"
        }
        forward_to = argument.metrics_destinations.value
      }
    }
    prometheus_operator_objects "feature" {
      metrics_destinations = [
        prometheus.remote_write.prometheus.receiver,
      ]
    }
    // Self Reporting
    prometheus.exporter.unix "kubernetes_monitoring_telemetry" {
      set_collectors = ["textfile"]
      textfile {
        directory = "/etc/alloy"
      }
    }
    
    discovery.relabel "kubernetes_monitoring_telemetry" {
      targets = prometheus.exporter.unix.kubernetes_monitoring_telemetry.targets
      rule {
        target_label = "instance"
        action = "replace"
        replacement = "k8smon"
      }
      rule {
        target_label = "job"
        action = "replace"
        replacement = "integrations/kubernetes/kubernetes_monitoring_telemetry"
      }
    }
    
    prometheus.scrape "kubernetes_monitoring_telemetry" {
      job_name   = "integrations/kubernetes/kubernetes_monitoring_telemetry"
      targets    = discovery.relabel.kubernetes_monitoring_telemetry.output
      scrape_interval = "60s"
      clustering {
        enabled = true
      }
      forward_to = [prometheus.relabel.kubernetes_monitoring_telemetry.receiver]
    }
    
    prometheus.relabel "kubernetes_monitoring_telemetry" {
      rule {
        source_labels = ["__name__"]
        regex = "grafana_kubernetes_monitoring_.*"
        action = "keep"
      }
      forward_to = [
        prometheus.remote_write.prometheus.receiver,
      ]
    }

  self-reporting-metric.prom: |
    
    # HELP grafana_kubernetes_monitoring_build_info A metric to report the version of the Kubernetes Monitoring Helm chart
    # TYPE grafana_kubernetes_monitoring_build_info gauge
    grafana_kubernetes_monitoring_build_info{version="2.0.21", namespace="default"} 1
    # HELP grafana_kubernetes_monitoring_feature_info A metric to report the enabled features of the Kubernetes Monitoring Helm chart
    # TYPE grafana_kubernetes_monitoring_feature_info gauge
    grafana_kubernetes_monitoring_feature_info{feature="applicationObservability", protocols="jaegerthrifthttp", version="1.0.0"} 1
    grafana_kubernetes_monitoring_feature_info{feature="podLogs", method="volumes", version="1.0.0"} 1
    grafana_kubernetes_monitoring_feature_info{feature="prometheusOperatorObjects", sources="ServiceMonitors,PodMonitors,Probes", version="1.0.0"} 1
---
# Source: k8s-monitoring/templates/alloy-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: k8smon-alloy-logs
  namespace: default
data:
  config.alloy: |-
    // Destination: loki (loki)
    otelcol.exporter.loki "loki" {
      forward_to = [loki.write.loki.receiver]
    }
    
    loki.write "loki" {
      endpoint {
        url = "http://loki.loki.svc:3100/loki/api/v1/push"
        bearer_token = env("LOKI_BEARER_TOKEN")
        tls_config {
          insecure_skip_verify = false
        }
        min_backoff_period = "500ms"
        max_backoff_period = "5m"
        max_backoff_retries = "10"
      }
      external_labels = {
        cluster = "bearer-token-example-cluster",
        "k8s_cluster_name" = "bearer-token-example-cluster",
      }
    }
    // Feature: Pod Logs
    declare "pod_logs" {
      argument "logs_destinations" {
        comment = "Must be a list of log destinations where collected logs should be forwarded to"
      }
    
      discovery.relabel "filtered_pods" {
        targets = discovery.kubernetes.pods.targets
        rule {
          source_labels = ["__meta_kubernetes_namespace"]
          action = "replace"
          target_label = "namespace"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_name"]
          action = "replace"
          target_label = "pod"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_container_name"]
          action = "replace"
          target_label = "container"
        }
        rule {
          source_labels = ["__meta_kubernetes_namespace", "__meta_kubernetes_pod_container_name"]
          separator = "/"
          action = "replace"
          replacement = "$1"
          target_label = "job"
        }
    
        // set the container runtime as a label
        rule {
          action = "replace"
          source_labels = ["__meta_kubernetes_pod_container_id"]
          regex = "^(\\S+):\\/\\/.+$"
          replacement = "$1"
          target_label = "tmp_container_runtime"
        }
    
        // make all labels on the pod available to the pipeline as labels,
        // they are omitted before write to loki via stage.label_keep unless explicitly set
        rule {
          action = "labelmap"
          regex = "__meta_kubernetes_pod_label_(.+)"
        }
    
        // make all annotations on the pod available to the pipeline as labels,
        // they are omitted before write to loki via stage.label_keep unless explicitly set
        rule {
          action = "labelmap"
          regex = "__meta_kubernetes_pod_annotation_(.+)"
        }
    
        // explicitly set service_name. if not set, loki will automatically try to populate a default.
        // see https://grafana.com/docs/loki/latest/get-started/labels/#default-labels-for-all-users
        //
        // choose the first value found from the following ordered list:
        // - pod.annotation[resource.opentelemetry.io/service.name]
        // - pod.label[app.kubernetes.io/name]
        // - k8s.pod.name
        // - k8s.container.name
        rule {
          action = "replace"
          source_labels = [
            "__meta_kubernetes_pod_annotation_resource_opentelemetry_io_service_name",
            "__meta_kubernetes_pod_label_app_kubernetes_io_name",
            "__meta_kubernetes_pod_name",
            "__meta_kubernetes_pod_container_name",
          ]
          separator = ";"
          regex = "^(?:;*)?([^;]+).*$"
          replacement = "$1"
          target_label = "service_name"
        }
    
        // set resource attributes
        rule {
          action = "labelmap"
          regex = "__meta_kubernetes_pod_annotation_resource_opentelemetry_io_(.+)"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_logs_job"]
          regex = "(.+)"
          target_label = "job"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_label_app_kubernetes_io_name"]
          regex = "(.+)"
          target_label = "app_kubernetes_io_name"
        }
      }
    
      discovery.kubernetes "pods" {
        role = "pod"
        selectors {
          role = "pod"
          field = "spec.nodeName=" + sys.env("HOSTNAME")
        }
      }
    
      discovery.relabel "filtered_pods_with_paths" {
        targets = discovery.relabel.filtered_pods.output
    
        rule {
          source_labels = ["__meta_kubernetes_pod_uid", "__meta_kubernetes_pod_container_name"]
          separator = "/"
          action = "replace"
          replacement = "/var/log/pods/*$1/*.log"
          target_label = "__path__"
        }
      }
    
      local.file_match "pod_logs" {
        path_targets = discovery.relabel.filtered_pods_with_paths.output
      }
    
      loki.source.file "pod_logs" {
        targets    = local.file_match.pod_logs.targets
        forward_to = [loki.process.pod_logs.receiver]
      }
    
      loki.process "pod_logs" {
        stage.match {
          selector = "{tmp_container_runtime=~\"containerd|cri-o\"}"
          // the cri processing stage extracts the following k/v pairs: log, stream, time, flags
          stage.cri {}
    
          // Set the extract flags and stream values as labels
          stage.labels {
            values = {
              flags  = "",
              stream  = "",
            }
          }
        }
    
        stage.match {
          selector = "{tmp_container_runtime=\"docker\"}"
          // the docker processing stage extracts the following k/v pairs: log, stream, time
          stage.docker {}
    
          // Set the extract stream value as a label
          stage.labels {
            values = {
              stream  = "",
            }
          }
        }
    
        // Drop the filename label, since it's not really useful in the context of Kubernetes, where we already have cluster,
        // namespace, pod, and container labels. Drop any structured metadata. Also drop the temporary
        // container runtime label as it is no longer needed.
        stage.label_drop {
          values = [
            "filename",
            "tmp_container_runtime",
          ]
        }
    
        // Only keep the labels that are defined in the `keepLabels` list.
        stage.label_keep {
          values = ["app_kubernetes_io_name","container","instance","job","level","namespace","pod","service_name","service_namespace","deployment_environment","deployment_environment_name","k8s_pod_name","k8s_namespace_name","k8s_deployment_name","k8s_statefulset_name","k8s_daemonset_name","k8s_cronjob_name","k8s_job_name","k8s_node_name"]
        }
    
        forward_to = argument.logs_destinations.value
      }
    }
    pod_logs "feature" {
      logs_destinations = [
        loki.write.loki.receiver,
      ]
    }
---
# Source: k8s-monitoring/templates/alloy-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: k8smon-alloy-receiver
  namespace: default
data:
  config.alloy: |-
    // Destination: prometheus (prometheus)
    otelcol.exporter.prometheus "prometheus" {
      add_metric_suffixes = true
      forward_to = [prometheus.remote_write.prometheus.receiver]
    }
    
    prometheus.remote_write "prometheus" {
      endpoint {
        url = "http://prometheus.prometheus.svc:9090/api/v1/write"
        headers = {
        }
        bearer_token = remote.kubernetes.secret.prometheus.data["bearerToken"]
        tls_config {
          insecure_skip_verify = false
        }
        send_native_histograms = false
    
        queue_config {
          capacity = 10000
          min_shards = 1
          max_shards = 50
          max_samples_per_send = 2000
          batch_send_deadline = "5s"
          min_backoff = "30ms"
          max_backoff = "5s"
          retry_on_http_429 = true
          sample_age_limit = "0s"
        }
    
        write_relabel_config {
          source_labels = ["cluster"]
          regex = ""
          replacement = "bearer-token-example-cluster"
          target_label = "cluster"
        }
        write_relabel_config {
          source_labels = ["k8s.cluster.name"]
          regex = ""
          replacement = "bearer-token-example-cluster"
          target_label = "cluster"
        }
      }
    
      wal {
        truncate_frequency = "2h"
        min_keepalive_time = "5m"
        max_keepalive_time = "8h"
      }
    }
    
    remote.kubernetes.secret "prometheus" {
      name      = "prometheus-k8smon-k8s-monitoring"
      namespace = "default"
    }
    
    // Destination: loki (loki)
    otelcol.exporter.loki "loki" {
      forward_to = [loki.write.loki.receiver]
    }
    
    loki.write "loki" {
      endpoint {
        url = "http://loki.loki.svc:3100/loki/api/v1/push"
        bearer_token = env("LOKI_BEARER_TOKEN")
        tls_config {
          insecure_skip_verify = false
        }
        min_backoff_period = "500ms"
        max_backoff_period = "5m"
        max_backoff_retries = "10"
      }
      external_labels = {
        cluster = "bearer-token-example-cluster",
        "k8s_cluster_name" = "bearer-token-example-cluster",
      }
    }
    // Destination: tempo (otlp)
    otelcol.auth.bearer "tempo" {
      token = remote.kubernetes.secret.tempo.data["tempoBearerToken"]
    }
    
    otelcol.processor.attributes "tempo" {
      output {
        metrics = [otelcol.processor.transform.tempo.input]
        logs = [otelcol.processor.transform.tempo.input]
        traces = [otelcol.processor.transform.tempo.input]
      }
    }
    
    otelcol.processor.transform "tempo" {
      error_mode = "ignore"
      metric_statements {
        context = "resource"
        statements = [
          `set(attributes["cluster"], "bearer-token-example-cluster")`,
          `set(attributes["k8s.cluster.name"], "bearer-token-example-cluster")`,
        ]
      }
    
      metric_statements {
        context = "datapoint"
        statements = [
          `set(attributes["cluster"], "bearer-token-example-cluster")`,
          `set(attributes["k8s.cluster.name"], "bearer-token-example-cluster")`,
        ]
      }
      log_statements {
        context = "resource"
        statements = [
          `set(attributes["cluster"], "bearer-token-example-cluster")`,
          `set(attributes["k8s.cluster.name"], "bearer-token-example-cluster")`,
        ]
      }
    
      log_statements {
        context = "log"
        statements = [
          `delete_key(attributes, "loki.attribute.labels")`,
          `delete_key(attributes, "loki.resource.labels")`,
          `set(resource.attributes["service.name"], attributes["service_name"]) where resource.attributes["service.name"] == nil and attributes["service_name"] != nil`,
          `delete_key(attributes, "service_name") where attributes["service_name"] != nil`,
          `set(resource.attributes["service.namespace"], attributes["service_namespace"] ) where resource.attributes["service.namespace"] == nil and attributes["service_namespace"] != nil`,
          `delete_key(attributes, "service_namespace") where attributes["service_namespace"] != nil`,
          `set(resource.attributes["deployment.environment.name"], attributes["deployment_environment_name"] ) where resource.attributes["deployment.environment.name"] == nil and attributes["deployment_environment_name"] != nil`,
          `delete_key(attributes, "deployment_environment_name") where attributes["deployment_environment_name"] != nil`,
          `set(resource.attributes["deployment.environment"], attributes["deployment_environment"] ) where resource.attributes["deployment.environment"] == nil and attributes["deployment_environment"] != nil`,
          `delete_key(attributes, "deployment_environment") where attributes["deployment_environment"] != nil`,
        ]
      }
    
      trace_statements {
        context = "resource"
        statements = [
          `set(attributes["cluster"], "bearer-token-example-cluster")`,
          `set(attributes["k8s.cluster.name"], "bearer-token-example-cluster")`,
        ]
      }
    
      output {
        metrics = [otelcol.processor.batch.tempo.input]
        logs = [otelcol.processor.batch.tempo.input]
        traces = [otelcol.processor.batch.tempo.input]
      }
    }
    
    otelcol.processor.batch "tempo" {
      timeout = "2s"
      send_batch_size = 8192
      send_batch_max_size = 0
    
      output {
        metrics = [otelcol.exporter.otlp.tempo.input]
        logs = [otelcol.exporter.otlp.tempo.input]
        traces = [otelcol.exporter.otlp.tempo.input]
      }
    }
    otelcol.exporter.otlp "tempo" {
      client {
        endpoint = "http://tempo.tempo.svc:4317"
        auth = otelcol.auth.bearer.tempo.handler
        headers = {
          "X-Scope-OrgID" = convert.nonsensitive(remote.kubernetes.secret.tempo.data["tenantId"]),
        }
        tls {
          insecure = false
          insecure_skip_verify = false
          ca_pem = convert.nonsensitive(remote.kubernetes.secret.tempo.data["ca"])
          cert_pem = convert.nonsensitive(remote.kubernetes.secret.tempo.data["cert"])
          key_pem = remote.kubernetes.secret.tempo.data["key"]
        }
      }
    
      retry_on_failure {
        enabled = true
        initial_interval = "5s"
        max_interval = "30s"
        max_elapsed_time = "5m"
      }
    }
    
    remote.kubernetes.secret "tempo" {
      name      = "my-tempo-secret"
      namespace = "tempo"
    }
    // Feature: Application Observability
    declare "application_observability" {
      argument "metrics_destinations" {
        comment = "Must be a list of metrics destinations where collected metrics should be forwarded to"
      }
    
      argument "logs_destinations" {
        comment = "Must be a list of log destinations where collected logs should be forwarded to"
      }
    
      argument "traces_destinations" {
        comment = "Must be a list of trace destinations where collected trace should be forwarded to"
      }
    
      // Jaeger Receiver
      otelcol.receiver.jaeger "receiver" {
        protocols {
          thrift_http {
            endpoint = "0.0.0.0:14268"
          }
        }
    
        debug_metrics {
          disable_high_cardinality_metrics = true
        }
        output {
          traces = [otelcol.processor.resourcedetection.default.input]
        }
      }
    
      // Resource Detection Processor
      otelcol.processor.resourcedetection "default" {
        detectors = ["env","system"]
    
        system {
          hostname_sources = ["os"]
        }
    
        output {
          metrics = [otelcol.processor.k8sattributes.default.input]
          logs = [otelcol.processor.k8sattributes.default.input]
          traces = [otelcol.processor.k8sattributes.default.input]
        }
      }
    
      // K8s Attributes Processor
      otelcol.processor.k8sattributes "default" {
        extract {
          metadata = ["k8s.namespace.name","k8s.pod.name","k8s.deployment.name","k8s.statefulset.name","k8s.daemonset.name","k8s.cronjob.name","k8s.job.name","k8s.node.name","k8s.pod.uid","k8s.pod.start_time"]
        }
        pod_association {
          source {
            from = "resource_attribute"
            name = "k8s.pod.ip"
          }
        }
        pod_association {
          source {
            from = "resource_attribute"
            name = "k8s.pod.uid"
          }
        }
        pod_association {
          source {
            from = "connection"
          }
        }
    
        output {
          metrics = [otelcol.processor.transform.default.input]
          logs = [otelcol.processor.transform.default.input]
          traces = [otelcol.processor.transform.default.input, otelcol.connector.host_info.default.input]
        }
      }
    
      // Host Info Connector
      otelcol.connector.host_info "default" {
        host_identifiers = [ "k8s.node.name" ]
    
        output {
          metrics = [otelcol.processor.batch.default.input]
        }
      }
    
      // Transform Processor
      otelcol.processor.transform "default" {
        error_mode = "ignore"
        log_statements {
          context = "resource"
          statements = [
            "set(attributes[\"pod\"], attributes[\"k8s.pod.name\"])",
            "set(attributes[\"namespace\"], attributes[\"k8s.namespace.name\"])",
            "set(attributes[\"loki.resource.labels\"], \"cluster, namespace, job, pod\")",
          ]
        }
    
        output {
          metrics = [otelcol.processor.batch.default.input]
          logs = [otelcol.processor.batch.default.input]
          traces = [otelcol.processor.batch.default.input]
        }
      }
    
      // Batch Processor
      otelcol.processor.batch "default" {
        send_batch_size = 8192
        send_batch_max_size = 0
        timeout = "2s"
    
        output {
          metrics = argument.metrics_destinations.value
          logs = argument.logs_destinations.value
          traces = argument.traces_destinations.value
        }
      }
    }
    application_observability "feature" {
      metrics_destinations = [
        otelcol.exporter.prometheus.prometheus.input,
      ]
      logs_destinations = [
        otelcol.exporter.loki.loki.input,
      ]
      traces_destinations = [
        otelcol.processor.attributes.tempo.input,
      ]
    }
---
# Source: k8s-monitoring/charts/alloy-logs/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: k8smon-alloy-logs
  labels:
    helm.sh/chart: alloy-logs-0.12.5
    app.kubernetes.io/name: alloy-logs
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
rules:
  # Rules which allow discovery.kubernetes to function.
  - apiGroups:
      - ""
      - "discovery.k8s.io"
      - "networking.k8s.io"
    resources:
      - endpoints
      - endpointslices
      - ingresses
      - nodes
      - nodes/proxy
      - nodes/metrics
      - pods
      - services
    verbs:
      - get
      - list
      - watch
  # Rules which allow loki.source.kubernetes and loki.source.podlogs to work.
  - apiGroups:
      - ""
    resources:
      - pods
      - pods/log
      - namespaces
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - "monitoring.grafana.com"
    resources:
      - podlogs
    verbs:
      - get
      - list
      - watch
  # Rules which allow mimir.rules.kubernetes to work.
  - apiGroups: ["monitoring.coreos.com"]
    resources:
      - prometheusrules
    verbs:
      - get
      - list
      - watch
  - nonResourceURLs:
      - /metrics
    verbs:
      - get
  # Rules for prometheus.kubernetes.*
  - apiGroups: ["monitoring.coreos.com"]
    resources:
      - podmonitors
      - servicemonitors
      - probes
    verbs:
      - get
      - list
      - watch
  # Rules which allow eventhandler to work.
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - get
      - list
      - watch
  # needed for remote.kubernetes.*
  - apiGroups: [""]
    resources:
      - "configmaps"
      - "secrets"
    verbs:
      - get
      - list
      - watch
  # needed for otelcol.processor.k8sattributes
  - apiGroups: ["apps"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["extensions"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]
---
# Source: k8s-monitoring/charts/alloy-metrics/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: k8smon-alloy-metrics
  labels:
    helm.sh/chart: alloy-metrics-0.12.5
    app.kubernetes.io/name: alloy-metrics
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
rules:
  # Rules which allow discovery.kubernetes to function.
  - apiGroups:
      - ""
      - "discovery.k8s.io"
      - "networking.k8s.io"
    resources:
      - endpoints
      - endpointslices
      - ingresses
      - nodes
      - nodes/proxy
      - nodes/metrics
      - pods
      - services
    verbs:
      - get
      - list
      - watch
  # Rules which allow loki.source.kubernetes and loki.source.podlogs to work.
  - apiGroups:
      - ""
    resources:
      - pods
      - pods/log
      - namespaces
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - "monitoring.grafana.com"
    resources:
      - podlogs
    verbs:
      - get
      - list
      - watch
  # Rules which allow mimir.rules.kubernetes to work.
  - apiGroups: ["monitoring.coreos.com"]
    resources:
      - prometheusrules
    verbs:
      - get
      - list
      - watch
  - nonResourceURLs:
      - /metrics
    verbs:
      - get
  # Rules for prometheus.kubernetes.*
  - apiGroups: ["monitoring.coreos.com"]
    resources:
      - podmonitors
      - servicemonitors
      - probes
    verbs:
      - get
      - list
      - watch
  # Rules which allow eventhandler to work.
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - get
      - list
      - watch
  # needed for remote.kubernetes.*
  - apiGroups: [""]
    resources:
      - "configmaps"
      - "secrets"
    verbs:
      - get
      - list
      - watch
  # needed for otelcol.processor.k8sattributes
  - apiGroups: ["apps"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["extensions"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]
---
# Source: k8s-monitoring/charts/alloy-receiver/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: k8smon-alloy-receiver
  labels:
    helm.sh/chart: alloy-receiver-0.12.5
    app.kubernetes.io/name: alloy-receiver
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
rules:
  # Rules which allow discovery.kubernetes to function.
  - apiGroups:
      - ""
      - "discovery.k8s.io"
      - "networking.k8s.io"
    resources:
      - endpoints
      - endpointslices
      - ingresses
      - nodes
      - nodes/proxy
      - nodes/metrics
      - pods
      - services
    verbs:
      - get
      - list
      - watch
  # Rules which allow loki.source.kubernetes and loki.source.podlogs to work.
  - apiGroups:
      - ""
    resources:
      - pods
      - pods/log
      - namespaces
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - "monitoring.grafana.com"
    resources:
      - podlogs
    verbs:
      - get
      - list
      - watch
  # Rules which allow mimir.rules.kubernetes to work.
  - apiGroups: ["monitoring.coreos.com"]
    resources:
      - prometheusrules
    verbs:
      - get
      - list
      - watch
  - nonResourceURLs:
      - /metrics
    verbs:
      - get
  # Rules for prometheus.kubernetes.*
  - apiGroups: ["monitoring.coreos.com"]
    resources:
      - podmonitors
      - servicemonitors
      - probes
    verbs:
      - get
      - list
      - watch
  # Rules which allow eventhandler to work.
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - get
      - list
      - watch
  # needed for remote.kubernetes.*
  - apiGroups: [""]
    resources:
      - "configmaps"
      - "secrets"
    verbs:
      - get
      - list
      - watch
  # needed for otelcol.processor.k8sattributes
  - apiGroups: ["apps"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["extensions"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]
---
# Source: k8s-monitoring/charts/alloy-logs/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: k8smon-alloy-logs
  labels:
    helm.sh/chart: alloy-logs-0.12.5
    app.kubernetes.io/name: alloy-logs
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: k8smon-alloy-logs
subjects:
  - kind: ServiceAccount
    name: k8smon-alloy-logs
    namespace: default
---
# Source: k8s-monitoring/charts/alloy-metrics/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: k8smon-alloy-metrics
  labels:
    helm.sh/chart: alloy-metrics-0.12.5
    app.kubernetes.io/name: alloy-metrics
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: k8smon-alloy-metrics
subjects:
  - kind: ServiceAccount
    name: k8smon-alloy-metrics
    namespace: default
---
# Source: k8s-monitoring/charts/alloy-receiver/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: k8smon-alloy-receiver
  labels:
    helm.sh/chart: alloy-receiver-0.12.5
    app.kubernetes.io/name: alloy-receiver
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: k8smon-alloy-receiver
subjects:
  - kind: ServiceAccount
    name: k8smon-alloy-receiver
    namespace: default
---
# Source: k8s-monitoring/charts/alloy-logs/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: k8smon-alloy-logs
  namespace: default
  labels:
    helm.sh/chart: alloy-logs-0.12.5
    app.kubernetes.io/name: alloy-logs
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: networking
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: alloy-logs
    app.kubernetes.io/instance: k8smon
  internalTrafficPolicy: Cluster
  ports:
    - name: http-metrics
      port: 12345
      targetPort: 12345
      protocol: "TCP"
---
# Source: k8s-monitoring/charts/alloy-metrics/templates/cluster_service.yaml
apiVersion: v1
kind: Service
metadata:
  name: k8smon-alloy-metrics-cluster
  namespace: default
  labels:
    helm.sh/chart: alloy-metrics-0.12.5
    app.kubernetes.io/name: alloy-metrics
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: networking
spec:
  type: ClusterIP
  clusterIP: 'None'
  publishNotReadyAddresses: true
  selector:
    app.kubernetes.io/name: alloy-metrics
    app.kubernetes.io/instance: k8smon
  ports:
    # Do not include the -metrics suffix in the port name, otherwise metrics
    # can be double-collected with the non-headless Service if it's also
    # enabled.
    #
    # This service should only be used for clustering, and not metric
    # collection.
    - name: http
      port: 12345
      targetPort: 12345
      protocol: "TCP"
---
# Source: k8s-monitoring/charts/alloy-metrics/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: k8smon-alloy-metrics
  namespace: default
  labels:
    helm.sh/chart: alloy-metrics-0.12.5
    app.kubernetes.io/name: alloy-metrics
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: networking
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: alloy-metrics
    app.kubernetes.io/instance: k8smon
  internalTrafficPolicy: Cluster
  ports:
    - name: http-metrics
      port: 12345
      targetPort: 12345
      protocol: "TCP"
---
# Source: k8s-monitoring/charts/alloy-receiver/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: k8smon-alloy-receiver
  namespace: default
  labels:
    helm.sh/chart: alloy-receiver-0.12.5
    app.kubernetes.io/name: alloy-receiver
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: networking
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: alloy-receiver
    app.kubernetes.io/instance: k8smon
  internalTrafficPolicy: Cluster
  ports:
    - name: http-metrics
      port: 12345
      targetPort: 12345
      protocol: "TCP"
    - name: jaeger-grpc
      port: 14268
      targetPort: 14268
      protocol: TCP
---
# Source: k8s-monitoring/charts/alloy-logs/templates/controllers/daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: k8smon-alloy-logs
  namespace: default
  labels:
    helm.sh/chart: alloy-logs-0.12.5
    app.kubernetes.io/name: alloy-logs
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
spec:
  minReadySeconds: 10
  selector:
    matchLabels:
      app.kubernetes.io/name: alloy-logs
      app.kubernetes.io/instance: k8smon
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: alloy
        k8s.grafana.com/logs.job: integrations/alloy
      labels:
        app.kubernetes.io/name: alloy-logs
        app.kubernetes.io/instance: k8smon
    spec:
      serviceAccountName: k8smon-alloy-logs
      containers:
        - name: alloy
          image: docker.io/grafana/alloy:v1.7.4
          imagePullPolicy: IfNotPresent
          args:
            - run
            - /etc/alloy/config.alloy
            - --storage.path=/tmp/alloy
            - --server.http.listen-addr=0.0.0.0:12345
            - --server.http.ui-path-prefix=/
            - --stability.level=generally-available
          env:
            - name: ALLOY_DEPLOY_MODE
              value: "helm"
            - name: HOSTNAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            -
              name: LOKI_BEARER_TOKEN
              value: sample-bearer-token
          ports:
            - containerPort: 12345
              name: http-metrics
          readinessProbe:
            httpGet:
              path: /-/ready
              port: 12345
              scheme: HTTP
            initialDelaySeconds: 10
            timeoutSeconds: 1
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              add:
              - CHOWN
              - DAC_OVERRIDE
              - FOWNER
              - FSETID
              - KILL
              - SETGID
              - SETUID
              - SETPCAP
              - NET_BIND_SERVICE
              - NET_RAW
              - SYS_CHROOT
              - MKNOD
              - AUDIT_WRITE
              - SETFCAP
              drop:
              - ALL
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - name: config
              mountPath: /etc/alloy
            - name: varlog
              mountPath: /var/log
              readOnly: true
            - name: dockercontainers
              mountPath: /var/lib/docker/containers
              readOnly: true
        - name: config-reloader
          image: ghcr.io/jimmidyson/configmap-reload:v0.14.0
          args:
            - --volume-dir=/etc/alloy
            - --webhook-url=http://localhost:12345/-/reload
          volumeMounts:
            - name: config
              mountPath: /etc/alloy
          resources:
            requests:
              cpu: 1m
              memory: 5Mi
      dnsPolicy: ClusterFirst
      nodeSelector:
        kubernetes.io/os: linux
      tolerations:
        - effect: NoSchedule
          operator: Exists
      volumes:
        - name: config
          configMap:
            name: k8smon-alloy-logs
        - name: varlog
          hostPath:
            path: /var/log
        - name: dockercontainers
          hostPath:
            path: /var/lib/docker/containers
---
# Source: k8s-monitoring/charts/alloy-receiver/templates/controllers/daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: k8smon-alloy-receiver
  namespace: default
  labels:
    helm.sh/chart: alloy-receiver-0.12.5
    app.kubernetes.io/name: alloy-receiver
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
spec:
  minReadySeconds: 10
  selector:
    matchLabels:
      app.kubernetes.io/name: alloy-receiver
      app.kubernetes.io/instance: k8smon
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: alloy
        k8s.grafana.com/logs.job: integrations/alloy
      labels:
        app.kubernetes.io/name: alloy-receiver
        app.kubernetes.io/instance: k8smon
    spec:
      serviceAccountName: k8smon-alloy-receiver
      containers:
        - name: alloy
          image: docker.io/grafana/alloy:v1.7.4
          imagePullPolicy: IfNotPresent
          args:
            - run
            - /etc/alloy/config.alloy
            - --storage.path=/tmp/alloy
            - --server.http.listen-addr=0.0.0.0:12345
            - --server.http.ui-path-prefix=/
            - --stability.level=generally-available
          env:
            - name: ALLOY_DEPLOY_MODE
              value: "helm"
            - name: HOSTNAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          ports:
            - containerPort: 12345
              name: http-metrics
            - containerPort: 14268
              name: jaeger-grpc
              protocol: TCP
          readinessProbe:
            httpGet:
              path: /-/ready
              port: 12345
              scheme: HTTP
            initialDelaySeconds: 10
            timeoutSeconds: 1
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              add:
              - CHOWN
              - DAC_OVERRIDE
              - FOWNER
              - FSETID
              - KILL
              - SETGID
              - SETUID
              - SETPCAP
              - NET_BIND_SERVICE
              - NET_RAW
              - SYS_CHROOT
              - MKNOD
              - AUDIT_WRITE
              - SETFCAP
              drop:
              - ALL
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - name: config
              mountPath: /etc/alloy
        - name: config-reloader
          image: ghcr.io/jimmidyson/configmap-reload:v0.14.0
          args:
            - --volume-dir=/etc/alloy
            - --webhook-url=http://localhost:12345/-/reload
          volumeMounts:
            - name: config
              mountPath: /etc/alloy
          resources:
            requests:
              cpu: 1m
              memory: 5Mi
      dnsPolicy: ClusterFirst
      nodeSelector:
        kubernetes.io/os: linux
      volumes:
        - name: config
          configMap:
            name: k8smon-alloy-receiver
---
# Source: k8s-monitoring/charts/alloy-metrics/templates/controllers/statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: k8smon-alloy-metrics
  namespace: default
  labels:
    helm.sh/chart: alloy-metrics-0.12.5
    app.kubernetes.io/name: alloy-metrics
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
spec:
  replicas: 1
  podManagementPolicy: Parallel
  minReadySeconds: 10
  serviceName: k8smon-alloy-metrics
  selector:
    matchLabels:
      app.kubernetes.io/name: alloy-metrics
      app.kubernetes.io/instance: k8smon
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: alloy
        k8s.grafana.com/logs.job: integrations/alloy
      labels:
        app.kubernetes.io/name: alloy-metrics
        app.kubernetes.io/instance: k8smon
    spec:
      serviceAccountName: k8smon-alloy-metrics
      containers:
        - name: alloy
          image: docker.io/grafana/alloy:v1.7.4
          imagePullPolicy: IfNotPresent
          args:
            - run
            - /etc/alloy/config.alloy
            - --storage.path=/tmp/alloy
            - --server.http.listen-addr=0.0.0.0:12345
            - --server.http.ui-path-prefix=/
            - --cluster.enabled=true
            - --cluster.join-addresses=k8smon-alloy-metrics-cluster
            - --cluster.name=alloy-metrics
            - --stability.level=generally-available
          env:
            - name: ALLOY_DEPLOY_MODE
              value: "helm"
            - name: HOSTNAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          ports:
            - containerPort: 12345
              name: http-metrics
          readinessProbe:
            httpGet:
              path: /-/ready
              port: 12345
              scheme: HTTP
            initialDelaySeconds: 10
            timeoutSeconds: 1
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              add:
              - CHOWN
              - DAC_OVERRIDE
              - FOWNER
              - FSETID
              - KILL
              - SETGID
              - SETUID
              - SETPCAP
              - NET_BIND_SERVICE
              - NET_RAW
              - SYS_CHROOT
              - MKNOD
              - AUDIT_WRITE
              - SETFCAP
              drop:
              - ALL
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - name: config
              mountPath: /etc/alloy
        - name: config-reloader
          image: ghcr.io/jimmidyson/configmap-reload:v0.14.0
          args:
            - --volume-dir=/etc/alloy
            - --webhook-url=http://localhost:12345/-/reload
          volumeMounts:
            - name: config
              mountPath: /etc/alloy
          resources:
            requests:
              cpu: 1m
              memory: 5Mi
      dnsPolicy: ClusterFirst
      nodeSelector:
        kubernetes.io/os: linux
      volumes:
        - name: config
          configMap:
            name: k8smon-alloy-metrics