output.yaml

---
# Source: k8s-monitoring/charts/alloy-logs/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
automountServiceAccountToken: true
metadata:
  name: k8smon-alloy-logs
  namespace: default
  labels:
    helm.sh/chart: alloy-logs-0.12.5
    app.kubernetes.io/name: alloy-logs
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
---
# Source: k8s-monitoring/charts/alloy-metrics/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
automountServiceAccountToken: true
metadata:
  name: k8smon-alloy-metrics
  namespace: default
  labels:
    helm.sh/chart: alloy-metrics-0.12.5
    app.kubernetes.io/name: alloy-metrics
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
---
# Source: k8s-monitoring/charts/alloy-singleton/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
automountServiceAccountToken: true
metadata:
  name: k8smon-alloy-singleton
  namespace: default
  labels:
    helm.sh/chart: alloy-singleton-0.12.5
    app.kubernetes.io/name: alloy-singleton
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
---
# Source: k8s-monitoring/charts/clusterMetrics/charts/kube-state-metrics/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
automountServiceAccountToken: true
metadata:
  labels:    
    helm.sh/chart: kube-state-metrics-5.31.0
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: kube-state-metrics
    app.kubernetes.io/name: kube-state-metrics
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "2.15.0"
    release: k8smon
  name: k8smon-kube-state-metrics
  namespace: default
---
# Source: k8s-monitoring/charts/clusterMetrics/charts/node-exporter/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: k8smon-node-exporter
  namespace: default
  labels:
    helm.sh/chart: node-exporter-4.45.0
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: node-exporter
    app.kubernetes.io/name: node-exporter
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "1.9.0"
    release: k8smon
automountServiceAccountToken: false
---
# Source: k8s-monitoring/charts/clusterMetrics/charts/windows-exporter/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: k8smon-windows-exporter
  namespace: default
  labels:
    helm.sh/chart: windows-exporter-0.9.1
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: windows-exporter
    app.kubernetes.io/name: windows-exporter
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "0.30.5"
    release: k8smon
---
# Source: k8s-monitoring/templates/destination_secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: "otel-endpoint-k8smon-k8s-monitoring"
  namespace: "default"
type: Opaque
data:
  clientId: "bXktY2xpZW50LWlk"
---
# Source: k8s-monitoring/charts/clusterMetrics/charts/windows-exporter/templates/config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: k8smon-windows-exporter
  namespace: default
  labels:
    helm.sh/chart: windows-exporter-0.9.1
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: windows-exporter
    app.kubernetes.io/name: windows-exporter
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "0.30.5"
    release: k8smon
data:
  config.yml: |
    collectors:
      enabled: cpu,cs,container,logical_disk,memory,net,os
    collector:
      service:
        services-where: "Name='containerd' or Name='kubelet'"
---
# Source: k8s-monitoring/templates/alloy-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: k8smon-alloy-metrics
  namespace: default
data:
  config.alloy: |-
    // Destination: otel-endpoint (otlp)
    otelcol.receiver.prometheus "otel_endpoint" {
      output {
        metrics = [otelcol.processor.attributes.otel_endpoint.input]
      }
    }
    otelcol.receiver.loki "otel_endpoint" {
      output {
        logs = [otelcol.processor.attributes.otel_endpoint.input]
      }
    }
    otelcol.auth.oauth2 "otel_endpoint" {
      client_id = convert.nonsensitive(remote.kubernetes.secret.otel_endpoint.data["clientId"])
      client_secret_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
      endpoint_params = {
        client_assertion_type = ["urn:ietf:params:oauth:client-assertion-type:jwt-bearer"],
        grant_type = ["client_credentials"],
      }
      token_url = "https://my.idp/application/o/token/"
    }
    
    otelcol.processor.attributes "otel_endpoint" {
      output {
        metrics = [otelcol.processor.transform.otel_endpoint.input]
        logs = [otelcol.processor.transform.otel_endpoint.input]
        traces = [otelcol.processor.transform.otel_endpoint.input]
      }
    }
    
    otelcol.processor.transform "otel_endpoint" {
      error_mode = "ignore"
      metric_statements {
        context = "resource"
        statements = [
          `set(attributes["cluster"], "oauth2-auth-example")`,
          `set(attributes["k8s.cluster.name"], "oauth2-auth-example")`,
        ]
      }
    
      metric_statements {
        context = "datapoint"
        statements = [
          `set(attributes["cluster"], "oauth2-auth-example")`,
          `set(attributes["k8s.cluster.name"], "oauth2-auth-example")`,
        ]
      }
      log_statements {
        context = "resource"
        statements = [
          `set(attributes["cluster"], "oauth2-auth-example")`,
          `set(attributes["k8s.cluster.name"], "oauth2-auth-example")`,
        ]
      }
    
      log_statements {
        context = "log"
        statements = [
          `delete_key(attributes, "loki.attribute.labels")`,
          `delete_key(attributes, "loki.resource.labels")`,
          `set(resource.attributes["service.name"], attributes["service_name"]) where resource.attributes["service.name"] == nil and attributes["service_name"] != nil`,
          `delete_key(attributes, "service_name") where attributes["service_name"] != nil`,
          `set(resource.attributes["service.namespace"], attributes["service_namespace"] ) where resource.attributes["service.namespace"] == nil and attributes["service_namespace"] != nil`,
          `delete_key(attributes, "service_namespace") where attributes["service_namespace"] != nil`,
          `set(resource.attributes["deployment.environment.name"], attributes["deployment_environment_name"] ) where resource.attributes["deployment.environment.name"] == nil and attributes["deployment_environment_name"] != nil`,
          `delete_key(attributes, "deployment_environment_name") where attributes["deployment_environment_name"] != nil`,
          `set(resource.attributes["deployment.environment"], attributes["deployment_environment"] ) where resource.attributes["deployment.environment"] == nil and attributes["deployment_environment"] != nil`,
          `delete_key(attributes, "deployment_environment") where attributes["deployment_environment"] != nil`,
        ]
      }
    
      trace_statements {
        context = "resource"
        statements = [
          `set(attributes["cluster"], "oauth2-auth-example")`,
          `set(attributes["k8s.cluster.name"], "oauth2-auth-example")`,
        ]
      }
    
      output {
        metrics = [otelcol.processor.batch.otel_endpoint.input]
        logs = [otelcol.processor.batch.otel_endpoint.input]
        traces = [otelcol.processor.batch.otel_endpoint.input]
      }
    }
    
    otelcol.processor.batch "otel_endpoint" {
      timeout = "2s"
      send_batch_size = 8192
      send_batch_max_size = 0
    
      output {
        metrics = [otelcol.exporter.otlp.otel_endpoint.input]
        logs = [otelcol.exporter.otlp.otel_endpoint.input]
        traces = [otelcol.exporter.otlp.otel_endpoint.input]
      }
    }
    otelcol.exporter.otlp "otel_endpoint" {
      client {
        endpoint = "grpc.my.otel.endpoint:443"
        auth = otelcol.auth.oauth2.otel_endpoint.handler
        tls {
          insecure = false
          insecure_skip_verify = false
        }
      }
    
      retry_on_failure {
        enabled = true
        initial_interval = "5s"
        max_interval = "30s"
        max_elapsed_time = "5m"
      }
    }
    
    remote.kubernetes.secret "otel_endpoint" {
      name      = "otel-endpoint-k8smon-k8s-monitoring"
      namespace = "default"
    }
    // Feature: Annotation Autodiscovery
    declare "annotation_autodiscovery" {
      argument "metrics_destinations" {
        comment = "Must be a list of metric destinations where collected metrics should be forwarded to"
      }
    
      discovery.kubernetes "pods" {
        role = "pod"
      }
    
      discovery.relabel "annotation_autodiscovery_pods" {
        targets = discovery.kubernetes.pods.targets
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_scrape"]
          regex = "true"
          action = "keep"
        }
        // Only keep pods that are running, ready, and not init containers.
        rule {
          source_labels = [
            "__meta_kubernetes_pod_phase",
            "__meta_kubernetes_pod_ready",
            "__meta_kubernetes_pod_container_init",
          ]
          regex = "Running;true;false"
          action = "keep"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_name"]
          target_label = "pod"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_container_name"]
          target_label = "container"
        }
        rule {
          source_labels = ["__meta_kubernetes_namespace"]
          target_label = "namespace"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_job"]
          target_label = "job"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_instance"]
          target_label = "instance"
        }
    
        // Rules to choose the right container
        rule {
          source_labels = ["container"]
          target_label = "__tmp_container"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_container"]
          regex = "(.+)"
          target_label = "__tmp_container"
        }
        rule {
          source_labels = ["container"]
          action = "keepequal"
          target_label = "__tmp_container"
        }
        rule {
          action = "labeldrop"
          regex = "__tmp_container"
        }
    
        // Set metrics path
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_path"]
          regex = "(.+)"
          target_label = "__metrics_path__"
        }
    
        // Set metrics scraping URL parameters
        rule {
          action = "labelmap"
          regex = "__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_param_(.+)"
          replacement = "__param_$1"
        }
    
        // Choose the pod port
        // The discovery generates a target for each declared container port of the pod.
        // If the metricsPortName annotation has value, keep only the target where the port name matches the one of the annotation.
        rule {
          source_labels = ["__meta_kubernetes_pod_container_port_name"]
          target_label = "__tmp_port"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_portName"]
          regex = "(.+)"
          target_label = "__tmp_port"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_container_port_name"]
          action = "keepequal"
          target_label = "__tmp_port"
        }
        rule {
          action = "labeldrop"
          regex = "__tmp_port"
        }
    
        // If the metrics port number annotation has a value, override the target address to use it, regardless whether it is
        // one of the declared ports on that Pod.
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_portNumber", "__meta_kubernetes_pod_ip"]
          regex = "(\\d+);(([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4})"
          replacement = "[$2]:$1" // IPv6
          target_label = "__address__"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_portNumber", "__meta_kubernetes_pod_ip"]
          regex = "(\\d+);((([0-9]+?)(\\.|$)){4})" // IPv4, takes priority over IPv6 when both exists
          replacement = "$2:$1"
          target_label = "__address__"
        }
    
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_scheme"]
          regex = "(.+)"
          target_label = "__scheme__"
        }
    
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_scrapeInterval"]
          regex = "(.+)"
          target_label = "__scrape_interval__"
        }
        rule {
          source_labels = ["__scrape_interval__"]
          regex = ""
          replacement = "60s"
          target_label = "__scrape_interval__"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_scrapeTimeout"]
          regex = "(.+)"
          target_label = "__scrape_timeout__"
        }
        rule {
          source_labels = ["__scrape_timeout__"]
          regex = ""
          replacement = "10s"
          target_label = "__scrape_timeout__"
        }
      }
    
      discovery.kubernetes "services" {
        role = "service"
      }
    
      discovery.relabel "annotation_autodiscovery_services" {
        targets = discovery.kubernetes.services.targets
        rule {
          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_scrape"]
          regex = "true"
          action = "keep"
        }
        rule {
          source_labels = ["__meta_kubernetes_service_name"]
          target_label = "service"
        }
        rule {
          source_labels = ["__meta_kubernetes_namespace"]
          target_label = "namespace"
        }
        rule {
          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_job"]
          target_label = "job"
        }
        rule {
          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_instance"]
          target_label = "instance"
        }
    
        // Set metrics path
        rule {
          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_metrics_path"]
          target_label = "__metrics_path__"
        }
    
        // Set metrics scraping URL parameters
        rule {
          action = "labelmap"
          regex = "__meta_kubernetes_service_annotation_k8s_grafana_com_metrics_param_(.+)"
          replacement = "__param_$1"
        }
    
        // Choose the service port
        rule {
          source_labels = ["__meta_kubernetes_service_port_name"]
          target_label = "__tmp_port"
        }
        rule {
          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_metrics_portName"]
          regex = "(.+)"
          target_label = "__tmp_port"
        }
        rule {
          source_labels = ["__meta_kubernetes_service_port_name"]
          action = "keepequal"
          target_label = "__tmp_port"
        }
    
        rule {
          source_labels = ["__meta_kubernetes_service_port_number"]
          target_label = "__tmp_port"
        }
        rule {
          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_metrics_portNumber"]
          regex = "(.+)"
          target_label = "__tmp_port"
        }
        rule {
          source_labels = ["__meta_kubernetes_service_port_number"]
          action = "keepequal"
          target_label = "__tmp_port"
        }
        rule {
          action = "labeldrop"
          regex = "__tmp_port"
        }
    
        rule {
          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_metrics_scheme"]
          regex = "(.+)"
          target_label = "__scheme__"
        }
    
        rule {
          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_metrics_scrapeInterval"]
          regex = "(.+)"
          target_label = "__scrape_interval__"
        }
        rule {
          source_labels = ["__scrape_interval__"]
          regex = ""
          replacement = "60s"
          target_label = "__scrape_interval__"
        }
        rule {
          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_metrics_scrapeTimeout"]
          regex = "(.+)"
          target_label = "__scrape_timeout__"
        }
        rule {
          source_labels = ["__scrape_timeout__"]
          regex = ""
          replacement = "10s"
          target_label = "__scrape_timeout__"
        }
      }
    
      discovery.relabel "annotation_autodiscovery_http" {
        targets = array.concat(discovery.relabel.annotation_autodiscovery_pods.output, discovery.relabel.annotation_autodiscovery_services.output)
        rule {
          source_labels = ["__scheme__"]
          regex = "https"
          action = "drop"
        }
      }
    
      discovery.relabel "annotation_autodiscovery_https" {
        targets = array.concat(discovery.relabel.annotation_autodiscovery_pods.output, discovery.relabel.annotation_autodiscovery_services.output)
        rule {
          source_labels = ["__scheme__"]
          regex = "https"
          action = "keep"
        }
      }
    
      prometheus.scrape "annotation_autodiscovery_http" {
        targets = discovery.relabel.annotation_autodiscovery_http.output
        honor_labels = true
        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
        clustering {
          enabled = true
        }
    
        forward_to = argument.metrics_destinations.value
      }
    
      prometheus.scrape "annotation_autodiscovery_https" {
        targets = discovery.relabel.annotation_autodiscovery_https.output
        honor_labels = true
        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
        tls_config {
          insecure_skip_verify = true
        }
        clustering {
          enabled = true
        }
    
        forward_to = argument.metrics_destinations.value
      }
    }
    annotation_autodiscovery "feature" {
      metrics_destinations = [
        otelcol.receiver.prometheus.otel_endpoint.receiver,
      ]
    }
    // Feature: Cluster Metrics
    declare "cluster_metrics" {
      argument "metrics_destinations" {
        comment = "Must be a list of metric destinations where collected metrics should be forwarded to"
      }
      discovery.kubernetes "nodes" {
        role = "node"
      }
    
      // Kubelet
      discovery.relabel "kubelet" {
        targets = discovery.kubernetes.nodes.targets
      }
    
      prometheus.scrape "kubelet" {
        targets  = discovery.relabel.kubelet.output
        job_name = "integrations/kubernetes/kubelet"
        scheme   = "https"
        scrape_interval = "60s"
        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
    
        tls_config {
          ca_file = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
          insecure_skip_verify = true
          server_name = "kubernetes"
        }
    
        clustering {
          enabled = true
        }
    
        forward_to = [prometheus.relabel.kubelet.receiver]
      }
    
      prometheus.relabel "kubelet" {
        max_cache_size = 100000
        rule {
          source_labels = ["__name__"]
          regex = "up|scrape_samples_scraped|go_goroutines|kubelet_certificate_manager_client_expiration_renew_errors|kubelet_certificate_manager_client_ttl_seconds|kubelet_certificate_manager_server_ttl_seconds|kubelet_cgroup_manager_duration_seconds_bucket|kubelet_cgroup_manager_duration_seconds_count|kubelet_node_config_error|kubelet_node_name|kubelet_pleg_relist_duration_seconds_bucket|kubelet_pleg_relist_duration_seconds_count|kubelet_pleg_relist_interval_seconds_bucket|kubelet_pod_start_duration_seconds_bucket|kubelet_pod_start_duration_seconds_count|kubelet_pod_worker_duration_seconds_bucket|kubelet_pod_worker_duration_seconds_count|kubelet_running_container_count|kubelet_running_containers|kubelet_running_pod_count|kubelet_running_pods|kubelet_runtime_operations_errors_total|kubelet_runtime_operations_total|kubelet_server_expiration_renew_errors|kubelet_volume_stats_available_bytes|kubelet_volume_stats_capacity_bytes|kubelet_volume_stats_inodes|kubelet_volume_stats_inodes_free|kubelet_volume_stats_inodes_used|kubelet_volume_stats_used_bytes|kubernetes_build_info|namespace_workload_pod|process_cpu_seconds_total|process_resident_memory_bytes|rest_client_requests_total|storage_operation_duration_seconds_count|storage_operation_errors_total|volume_manager_total_volumes"
          action = "keep"
        }
    
        forward_to = argument.metrics_destinations.value
      }
    
      // Kubelet Resources
      discovery.relabel "kubelet_resources" {
        targets = discovery.kubernetes.nodes.targets
        rule {
          replacement   = "/metrics/resource"
          target_label  = "__metrics_path__"
        }
        // set the node label
        rule {
          source_labels = ["__meta_kubernetes_node_name"]
          target_label  = "node"
        }
    
        // set the app name if specified as metadata labels "app:" or "app.kubernetes.io/name:" or "k8s-app:"
        rule {
          action = "replace"
          source_labels = [
            "__meta_kubernetes_node_label_app_kubernetes_io_name",
            "__meta_kubernetes_node_label_k8s_app",
            "__meta_kubernetes_node_label_app",
          ]
          separator = ";"
          regex = "^(?:;*)?([^;]+).*$"
          replacement = "$1"
          target_label = "app"
        }
    
        // set a source label
        rule {
          action = "replace"
          replacement = "kubernetes"
          target_label = "source"
        }
      }
    
      prometheus.scrape "kubelet_resources" {
        targets  = discovery.relabel.kubelet_resources.output
        job_name = "integrations/kubernetes/resources"
        scheme   = "https"
        scrape_interval = "60s"
        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
    
        tls_config {
          ca_file = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
          insecure_skip_verify = true
          server_name = "kubernetes"
        }
    
        clustering {
          enabled = true
        }
    
        forward_to = [prometheus.relabel.kubelet_resources.receiver]
      }
    
      prometheus.relabel "kubelet_resources" {
        max_cache_size = 100000
        rule {
          source_labels = ["__name__"]
          regex = "up|scrape_samples_scraped|node_cpu_usage_seconds_total|node_memory_working_set_bytes"
          action = "keep"
        }
    
        forward_to = argument.metrics_destinations.value
      }
    
      // cAdvisor
      discovery.relabel "cadvisor" {
        targets = discovery.kubernetes.nodes.targets
        rule {
          replacement   = "/metrics/cadvisor"
          target_label  = "__metrics_path__"
        }
        rule {
          source_labels = ["__meta_kubernetes_node_name"]
          target_label  = "node"
        }
        // set the app name if specified as metadata labels "app:" or "app.kubernetes.io/name:" or "k8s-app:"
        rule {
          action = "replace"
          source_labels = [
            "__meta_kubernetes_node_label_app_kubernetes_io_name",
            "__meta_kubernetes_node_label_k8s_app",
            "__meta_kubernetes_node_label_app",
          ]
          separator = ";"
          regex = "^(?:;*)?([^;]+).*$"
          replacement = "$1"
          target_label = "app"
        }
    
        // set a source label
        rule {
          action = "replace"
          replacement = "kubernetes"
          target_label = "source"
        }
      }
    
      prometheus.scrape "cadvisor" {
        targets = discovery.relabel.cadvisor.output
        job_name = "integrations/kubernetes/cadvisor"
        scheme = "https"
        scrape_interval = "60s"
        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
    
        tls_config {
          ca_file = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
          insecure_skip_verify = true
          server_name = "kubernetes"
        }
    
        clustering {
          enabled = true
        }
    
        forward_to = [prometheus.relabel.cadvisor.receiver]
      }
    
      prometheus.relabel "cadvisor" {
        max_cache_size = 100000
        rule {
          source_labels = ["__name__"]
          regex = "up|scrape_samples_scraped|container_cpu_cfs_periods_total|container_cpu_cfs_throttled_periods_total|container_cpu_usage_seconds_total|container_fs_reads_bytes_total|container_fs_reads_total|container_fs_writes_bytes_total|container_fs_writes_total|container_memory_cache|container_memory_rss|container_memory_swap|container_memory_working_set_bytes|container_network_receive_bytes_total|container_network_receive_packets_dropped_total|container_network_receive_packets_total|container_network_transmit_bytes_total|container_network_transmit_packets_dropped_total|container_network_transmit_packets_total|machine_memory_bytes"
          action = "keep"
        }
        // Drop empty container labels, addressing https://github.com/google/cadvisor/issues/2688
        rule {
          source_labels = ["__name__","container"]
          separator = "@"
          regex = "(container_cpu_.*|container_fs_.*|container_memory_.*)@"
          action = "drop"
        }
        // Drop empty image labels, addressing https://github.com/google/cadvisor/issues/2688
        rule {
          source_labels = ["__name__","image"]
          separator = "@"
          regex = "(container_cpu_.*|container_fs_.*|container_memory_.*|container_network_.*)@"
          action = "drop"
        }
        // Normalizing unimportant labels (not deleting to continue satisfying <label>!="" checks)
        rule {
          source_labels = ["__name__", "boot_id"]
          separator = "@"
          regex = "machine_memory_bytes@.*"
          target_label = "boot_id"
          replacement = "NA"
        }
        rule {
          source_labels = ["__name__", "system_uuid"]
          separator = "@"
          regex = "machine_memory_bytes@.*"
          target_label = "system_uuid"
          replacement = "NA"
        }
        // Filter out non-physical devices/interfaces
        rule {
          source_labels = ["__name__", "device"]
          separator = "@"
          regex = "container_fs_.*@(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dasd.+)"
          target_label = "__keepme"
          replacement = "1"
        }
        rule {
          source_labels = ["__name__", "__keepme"]
          separator = "@"
          regex = "container_fs_.*@"
          action = "drop"
        }
        rule {
          source_labels = ["__name__"]
          regex = "container_fs_.*"
          target_label = "__keepme"
          replacement = ""
        }
        rule {
          source_labels = ["__name__", "interface"]
          separator = "@"
          regex = "container_network_.*@(en[ospx][0-9].*|wlan[0-9].*|eth[0-9].*)"
          target_label = "__keepme"
          replacement = "1"
        }
        rule {
          source_labels = ["__name__", "__keepme"]
          separator = "@"
          regex = "container_network_.*@"
          action = "drop"
        }
        rule {
          source_labels = ["__name__"]
          regex = "container_network_.*"
          target_label = "__keepme"
          replacement = ""
        }
        forward_to = argument.metrics_destinations.value
      }
      discovery.kubernetes "kube_state_metrics" {
        role = "endpoints"
    
        selectors {
          role = "endpoints"
          label = "app.kubernetes.io/name=kube-state-metrics,release=k8smon"
        }
        namespaces {
          names = ["default"]
        }
      }
    
      discovery.relabel "kube_state_metrics" {
        targets = discovery.kubernetes.kube_state_metrics.targets
    
        // only keep targets with a matching port name
        rule {
          source_labels = ["__meta_kubernetes_endpoint_port_name"]
          regex = "http"
          action = "keep"
        }
    
        rule {
          action = "replace"
          replacement = "kubernetes"
          target_label = "source"
        }
    
      }
    
      prometheus.scrape "kube_state_metrics" {
        targets = discovery.relabel.kube_state_metrics.output
        job_name = "integrations/kubernetes/kube-state-metrics"
        scrape_interval = "60s"
        scheme = "http"
        bearer_token_file = ""
        tls_config {
          insecure_skip_verify = true
        }
    
        clustering {
          enabled = true
        }
        forward_to = [prometheus.relabel.kube_state_metrics.receiver]
      }
    
      prometheus.relabel "kube_state_metrics" {
        max_cache_size = 100000
        rule {
          source_labels = ["__name__"]
          regex = "up|scrape_samples_scraped|kube_configmap_info|kube_configmap_metadata_resource_version|kube_daemonset.*|kube_deployment_metadata_generation|kube_deployment_spec_replicas|kube_deployment_status_condition|kube_deployment_status_observed_generation|kube_deployment_status_replicas_available|kube_deployment_status_replicas_updated|kube_horizontalpodautoscaler_spec_max_replicas|kube_horizontalpodautoscaler_spec_min_replicas|kube_horizontalpodautoscaler_status_current_replicas|kube_horizontalpodautoscaler_status_desired_replicas|kube_job.*|kube_namespace_status_phase|kube_node.*|kube_persistentvolume_status_phase|kube_persistentvolumeclaim_access_mode|kube_persistentvolumeclaim_info|kube_persistentvolumeclaim_labels|kube_persistentvolumeclaim_resource_requests_storage_bytes|kube_persistentvolumeclaim_status_phase|kube_pod_container_info|kube_pod_container_resource_limits|kube_pod_container_resource_requests|kube_pod_container_status_last_terminated_reason|kube_pod_container_status_restarts_total|kube_pod_container_status_waiting_reason|kube_pod_info|kube_pod_owner|kube_pod_spec_volumes_persistentvolumeclaims_info|kube_pod_start_time|kube_pod_status_phase|kube_pod_status_reason|kube_replicaset.*|kube_resourcequota|kube_secret_metadata_resource_version|kube_statefulset.*"
          action = "keep"
        }
        forward_to = argument.metrics_destinations.value
      }
    
      // Node Exporter
      discovery.kubernetes "node_exporter" {
        role = "pod"
    
        selectors {
          role = "pod"
          label = "app.kubernetes.io/name=node-exporter,release=k8smon"
        }
        namespaces {
          names = ["default"]
        }
      }
    
      discovery.relabel "node_exporter" {
        targets = discovery.kubernetes.node_exporter.targets
    
        // keep only the specified metrics port name, and pods that are Running and ready
        rule {
          source_labels = [
            "__meta_kubernetes_pod_container_port_name",
            "__meta_kubernetes_pod_container_init",
            "__meta_kubernetes_pod_phase",
            "__meta_kubernetes_pod_ready",
          ]
          separator = "@"
          regex = "metrics@false@Running@true"
          action = "keep"
        }
    
        // Set the instance label to the node name
        rule {
          source_labels = ["__meta_kubernetes_pod_node_name"]
          action = "replace"
          target_label = "instance"
        }
    
        // set the namespace label
        rule {
          source_labels = ["__meta_kubernetes_namespace"]
          target_label  = "namespace"
        }
    
        // set the pod label
        rule {
          source_labels = ["__meta_kubernetes_pod_name"]
          target_label  = "pod"
        }
    
        // set the container label
        rule {
          source_labels = ["__meta_kubernetes_pod_container_name"]
          target_label  = "container"
        }
    
        // set a workload label
        rule {
          source_labels = [
            "__meta_kubernetes_pod_controller_kind",
            "__meta_kubernetes_pod_controller_name",
          ]
          separator = "/"
          target_label  = "workload"
        }
        // remove the hash from the ReplicaSet
        rule {
          source_labels = ["workload"]
          regex = "(ReplicaSet/.+)-.+"
          target_label  = "workload"
        }
    
        // set the app name if specified as metadata labels "app:" or "app.kubernetes.io/name:" or "k8s-app:"
        rule {
          action = "replace"
          source_labels = [
            "__meta_kubernetes_pod_label_app_kubernetes_io_name",
            "__meta_kubernetes_pod_label_k8s_app",
            "__meta_kubernetes_pod_label_app",
          ]
          separator = ";"
          regex = "^(?:;*)?([^;]+).*$"
          replacement = "$1"
          target_label = "app"
        }
    
        // set the component if specified as metadata labels "component:" or "app.kubernetes.io/component:" or "k8s-component:"
        rule {
          action = "replace"
          source_labels = [
            "__meta_kubernetes_pod_label_app_kubernetes_io_component",
            "__meta_kubernetes_pod_label_k8s_component",
            "__meta_kubernetes_pod_label_component",
          ]
          regex = "^(?:;*)?([^;]+).*$"
          replacement = "$1"
          target_label = "component"
        }
    
        // set a source label
        rule {
          action = "replace"
          replacement = "kubernetes"
          target_label = "source"
        }
      }
    
      prometheus.scrape "node_exporter" {
        targets = discovery.relabel.node_exporter.output
        job_name = "integrations/node_exporter"
        scrape_interval = "60s"
        scheme = "http"
        bearer_token_file = ""
        tls_config {
          insecure_skip_verify = true
        }
    
        clustering {
          enabled = true
        }
        forward_to = [prometheus.relabel.node_exporter.receiver]
      }
    
      prometheus.relabel "node_exporter" {
        max_cache_size = 100000
        rule {
          source_labels = ["__name__"]
          regex = "up|scrape_samples_scraped|node_cpu.*|node_exporter_build_info|node_filesystem.*|node_memory.*|node_network_receive_bytes_total|node_network_receive_drop_total|node_network_transmit_bytes_total|node_network_transmit_drop_total|process_cpu_seconds_total|process_resident_memory_bytes"
          action = "keep"
        }
        // Drop metrics for certain file systems
        rule {
          source_labels = ["__name__", "fstype"]
          separator = "@"
          regex = "node_filesystem.*@(ramfs|tmpfs)"
          action = "drop"
        }
        forward_to = argument.metrics_destinations.value
      }
    
      discovery.kubernetes "windows_exporter_pods" {
        role = "pod"
        namespaces {
          names = ["default"]
        }
        selectors {
          role = "pod"
          label = "app.kubernetes.io/name=windows-exporter,release=k8smon"
        }
      }
    
      discovery.relabel "windows_exporter" {
        targets = discovery.kubernetes.windows_exporter_pods.targets
        rule {
          source_labels = ["__meta_kubernetes_pod_node_name"]
          action = "replace"
          target_label = "instance"
        }
      }
    
      prometheus.scrape "windows_exporter" {
        job_name   = "integrations/windows-exporter"
        targets  = discovery.relabel.windows_exporter.output
        scrape_interval = "60s"
        clustering {
          enabled = true
        }
        forward_to = [prometheus.relabel.windows_exporter.receiver]
      }
    
      prometheus.relabel "windows_exporter" {
        max_cache_size = 100000
        rule {
          source_labels = ["__name__"]
          regex = "up|scrape_samples_scraped|windows_.*|node_cpu_seconds_total|node_filesystem_size_bytes|node_filesystem_avail_bytes|container_cpu_usage_seconds_total"
          action = "keep"
        }
        forward_to = argument.metrics_destinations.value
      }
    }
    cluster_metrics "feature" {
      metrics_destinations = [
        otelcol.receiver.prometheus.otel_endpoint.receiver,
      ]
    }
    // Feature: Prometheus Operator Objects
    declare "prometheus_operator_objects" {
      argument "metrics_destinations" {
        comment = "Must be a list of metric destinations where collected metrics should be forwarded to"
      }
    
      // Prometheus Operator PodMonitor objects
      prometheus.operator.podmonitors "pod_monitors" {
        clustering {
          enabled = true
        }
        scrape {
          default_scrape_interval = "60s"
        }
        forward_to = argument.metrics_destinations.value
      }
    
      // Prometheus Operator Probe objects
      prometheus.operator.probes "probes" {
        clustering {
          enabled = true
        }
        scrape {
          default_scrape_interval = "60s"
        }
        forward_to = argument.metrics_destinations.value
      }
    
      // Prometheus Operator ServiceMonitor objects
      prometheus.operator.servicemonitors "service_monitors" {
        clustering {
          enabled = true
        }
        scrape {
          default_scrape_interval = "60s"
        }
        forward_to = argument.metrics_destinations.value
      }
    }
    prometheus_operator_objects "feature" {
      metrics_destinations = [
        otelcol.receiver.prometheus.otel_endpoint.receiver,
      ]
    }
---
# Source: k8s-monitoring/templates/alloy-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: k8smon-alloy-singleton
  namespace: default
data:
  config.alloy: |-
    // Destination: otel-endpoint (otlp)
    otelcol.receiver.prometheus "otel_endpoint" {
      output {
        metrics = [otelcol.processor.attributes.otel_endpoint.input]
      }
    }
    otelcol.receiver.loki "otel_endpoint" {
      output {
        logs = [otelcol.processor.attributes.otel_endpoint.input]
      }
    }
    otelcol.auth.oauth2 "otel_endpoint" {
      client_id = convert.nonsensitive(remote.kubernetes.secret.otel_endpoint.data["clientId"])
      client_secret_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
      endpoint_params = {
        client_assertion_type = ["urn:ietf:params:oauth:client-assertion-type:jwt-bearer"],
        grant_type = ["client_credentials"],
      }
      token_url = "https://my.idp/application/o/token/"
    }
    
    otelcol.processor.attributes "otel_endpoint" {
      output {
        metrics = [otelcol.processor.transform.otel_endpoint.input]
        logs = [otelcol.processor.transform.otel_endpoint.input]
        traces = [otelcol.processor.transform.otel_endpoint.input]
      }
    }
    
    otelcol.processor.transform "otel_endpoint" {
      error_mode = "ignore"
      metric_statements {
        context = "resource"
        statements = [
          `set(attributes["cluster"], "oauth2-auth-example")`,
          `set(attributes["k8s.cluster.name"], "oauth2-auth-example")`,
        ]
      }
    
      metric_statements {
        context = "datapoint"
        statements = [
          `set(attributes["cluster"], "oauth2-auth-example")`,
          `set(attributes["k8s.cluster.name"], "oauth2-auth-example")`,
        ]
      }
      log_statements {
        context = "resource"
        statements = [
          `set(attributes["cluster"], "oauth2-auth-example")`,
          `set(attributes["k8s.cluster.name"], "oauth2-auth-example")`,
        ]
      }
    
      log_statements {
        context = "log"
        statements = [
          `delete_key(attributes, "loki.attribute.labels")`,
          `delete_key(attributes, "loki.resource.labels")`,
          `set(resource.attributes["service.name"], attributes["service_name"]) where resource.attributes["service.name"] == nil and attributes["service_name"] != nil`,
          `delete_key(attributes, "service_name") where attributes["service_name"] != nil`,
          `set(resource.attributes["service.namespace"], attributes["service_namespace"] ) where resource.attributes["service.namespace"] == nil and attributes["service_namespace"] != nil`,
          `delete_key(attributes, "service_namespace") where attributes["service_namespace"] != nil`,
          `set(resource.attributes["deployment.environment.name"], attributes["deployment_environment_name"] ) where resource.attributes["deployment.environment.name"] == nil and attributes["deployment_environment_name"] != nil`,
          `delete_key(attributes, "deployment_environment_name") where attributes["deployment_environment_name"] != nil`,
          `set(resource.attributes["deployment.environment"], attributes["deployment_environment"] ) where resource.attributes["deployment.environment"] == nil and attributes["deployment_environment"] != nil`,
          `delete_key(attributes, "deployment_environment") where attributes["deployment_environment"] != nil`,
        ]
      }
    
      trace_statements {
        context = "resource"
        statements = [
          `set(attributes["cluster"], "oauth2-auth-example")`,
          `set(attributes["k8s.cluster.name"], "oauth2-auth-example")`,
        ]
      }
    
      output {
        metrics = [otelcol.processor.batch.otel_endpoint.input]
        logs = [otelcol.processor.batch.otel_endpoint.input]
        traces = [otelcol.processor.batch.otel_endpoint.input]
      }
    }
    
    otelcol.processor.batch "otel_endpoint" {
      timeout = "2s"
      send_batch_size = 8192
      send_batch_max_size = 0
    
      output {
        metrics = [otelcol.exporter.otlp.otel_endpoint.input]
        logs = [otelcol.exporter.otlp.otel_endpoint.input]
        traces = [otelcol.exporter.otlp.otel_endpoint.input]
      }
    }
    otelcol.exporter.otlp "otel_endpoint" {
      client {
        endpoint = "grpc.my.otel.endpoint:443"
        auth = otelcol.auth.oauth2.otel_endpoint.handler
        tls {
          insecure = false
          insecure_skip_verify = false
        }
      }
    
      retry_on_failure {
        enabled = true
        initial_interval = "5s"
        max_interval = "30s"
        max_elapsed_time = "5m"
      }
    }
    
    remote.kubernetes.secret "otel_endpoint" {
      name      = "otel-endpoint-k8smon-k8s-monitoring"
      namespace = "default"
    }
    // Feature: Cluster Events
    declare "cluster_events" {
      argument "logs_destinations" {
        comment = "Must be a list of log destinations where collected logs should be forwarded to"
      }
    
      loki.source.kubernetes_events "cluster_events" {
        job_name   = "integrations/kubernetes/eventhandler"
        log_format = "logfmt"
        forward_to = [loki.process.cluster_events.receiver]
      }
    
      loki.process "cluster_events" {
    
        // add a static source label to the logs so they can be differentiated / restricted if necessary
        stage.static_labels {
          values = {
            "source" = "kubernetes-events",
          }
        }
    
        // extract some of the fields from the log line, these could be used as labels, structured metadata, etc.
        stage.logfmt {
          mapping = {
            "component" = "sourcecomponent", // map the sourcecomponent field to component
            "kind" = "",
            "level" = "type", // most events don't have a level but they do have a "type" i.e. Normal, Warning, Error, etc.
            "name" = "",
            "node" = "sourcehost", // map the sourcehost field to node
          }
        }
        // set these values as labels, they may or may not be used as index labels in Loki as they can be dropped
        // prior to being written to Loki, but this makes them available
        stage.labels {
          values = {
            "component" = "",
            "kind" = "",
            "level" = "",
            "name" = "",
            "node" = "",
          }
        }
    
        // if kind=Node, set the node label by copying the instance label
        stage.match {
          selector = "{kind=\"Node\"}"
    
          stage.labels {
            values = {
              "node" = "name",
            }
          }
        }
    
        // set the level extracted key value as a normalized log level
        stage.match {
          selector = "{level=\"Normal\"}"
    
          stage.static_labels {
            values = {
              level = "Info",
            }
          }
        }
    
        // Only keep the labels that are defined in the `keepLabels` list.
        stage.label_keep {
          values = ["job","level","namespace","node","source"]
        }
        forward_to = argument.logs_destinations.value
      }
    }
    cluster_events "feature" {
      logs_destinations = [
        otelcol.receiver.loki.otel_endpoint.receiver,
      ]
    }
    // Self Reporting
    prometheus.exporter.unix "kubernetes_monitoring_telemetry" {
      set_collectors = ["textfile"]
      textfile {
        directory = "/etc/alloy"
      }
    }
    
    discovery.relabel "kubernetes_monitoring_telemetry" {
      targets = prometheus.exporter.unix.kubernetes_monitoring_telemetry.targets
      rule {
        target_label = "instance"
        action = "replace"
        replacement = "k8smon"
      }
      rule {
        target_label = "job"
        action = "replace"
        replacement = "integrations/kubernetes/kubernetes_monitoring_telemetry"
      }
    }
    
    prometheus.scrape "kubernetes_monitoring_telemetry" {
      job_name   = "integrations/kubernetes/kubernetes_monitoring_telemetry"
      targets    = discovery.relabel.kubernetes_monitoring_telemetry.output
      scrape_interval = "60s"
      clustering {
        enabled = true
      }
      forward_to = [prometheus.relabel.kubernetes_monitoring_telemetry.receiver]
    }
    
    prometheus.relabel "kubernetes_monitoring_telemetry" {
      rule {
        source_labels = ["__name__"]
        regex = "grafana_kubernetes_monitoring_.*"
        action = "keep"
      }
      forward_to = [
        otelcol.receiver.prometheus.otel_endpoint.receiver,
      ]
    }

  self-reporting-metric.prom: |
    
    # HELP grafana_kubernetes_monitoring_build_info A metric to report the version of the Kubernetes Monitoring Helm chart
    # TYPE grafana_kubernetes_monitoring_build_info gauge
    grafana_kubernetes_monitoring_build_info{version="2.0.21", namespace="default"} 1
    # HELP grafana_kubernetes_monitoring_feature_info A metric to report the enabled features of the Kubernetes Monitoring Helm chart
    # TYPE grafana_kubernetes_monitoring_feature_info gauge
    grafana_kubernetes_monitoring_feature_info{feature="annotationAutodiscovery", version="1.0.0"} 1
    grafana_kubernetes_monitoring_feature_info{deployments="kube-state-metrics,node-exporter,windows-exporter", feature="clusterMetrics", sources="kubelet,kubeletResource,cadvisor,kube-state-metrics,node-exporter,windows-exporter", version="1.0.0"} 1
    grafana_kubernetes_monitoring_feature_info{feature="clusterEvents", version="1.0.0"} 1
    grafana_kubernetes_monitoring_feature_info{feature="nodeLogs", version="1.0.0"} 1
    grafana_kubernetes_monitoring_feature_info{feature="podLogs", method="volumes", version="1.0.0"} 1
    grafana_kubernetes_monitoring_feature_info{feature="prometheusOperatorObjects", sources="ServiceMonitors,PodMonitors,Probes", version="1.0.0"} 1
---
# Source: k8s-monitoring/templates/alloy-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: k8smon-alloy-logs
  namespace: default
data:
  config.alloy: |-
    // Destination: otel-endpoint (otlp)
    otelcol.receiver.prometheus "otel_endpoint" {
      output {
        metrics = [otelcol.processor.attributes.otel_endpoint.input]
      }
    }
    otelcol.receiver.loki "otel_endpoint" {
      output {
        logs = [otelcol.processor.attributes.otel_endpoint.input]
      }
    }
    otelcol.auth.oauth2 "otel_endpoint" {
      client_id = convert.nonsensitive(remote.kubernetes.secret.otel_endpoint.data["clientId"])
      client_secret_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
      endpoint_params = {
        client_assertion_type = ["urn:ietf:params:oauth:client-assertion-type:jwt-bearer"],
        grant_type = ["client_credentials"],
      }
      token_url = "https://my.idp/application/o/token/"
    }
    
    otelcol.processor.attributes "otel_endpoint" {
      output {
        metrics = [otelcol.processor.transform.otel_endpoint.input]
        logs = [otelcol.processor.transform.otel_endpoint.input]
        traces = [otelcol.processor.transform.otel_endpoint.input]
      }
    }
    
    otelcol.processor.transform "otel_endpoint" {
      error_mode = "ignore"
      metric_statements {
        context = "resource"
        statements = [
          `set(attributes["cluster"], "oauth2-auth-example")`,
          `set(attributes["k8s.cluster.name"], "oauth2-auth-example")`,
        ]
      }
    
      metric_statements {
        context = "datapoint"
        statements = [
          `set(attributes["cluster"], "oauth2-auth-example")`,
          `set(attributes["k8s.cluster.name"], "oauth2-auth-example")`,
        ]
      }
      log_statements {
        context = "resource"
        statements = [
          `set(attributes["cluster"], "oauth2-auth-example")`,
          `set(attributes["k8s.cluster.name"], "oauth2-auth-example")`,
        ]
      }
    
      log_statements {
        context = "log"
        statements = [
          `delete_key(attributes, "loki.attribute.labels")`,
          `delete_key(attributes, "loki.resource.labels")`,
          `set(resource.attributes["service.name"], attributes["service_name"]) where resource.attributes["service.name"] == nil and attributes["service_name"] != nil`,
          `delete_key(attributes, "service_name") where attributes["service_name"] != nil`,
          `set(resource.attributes["service.namespace"], attributes["service_namespace"] ) where resource.attributes["service.namespace"] == nil and attributes["service_namespace"] != nil`,
          `delete_key(attributes, "service_namespace") where attributes["service_namespace"] != nil`,
          `set(resource.attributes["deployment.environment.name"], attributes["deployment_environment_name"] ) where resource.attributes["deployment.environment.name"] == nil and attributes["deployment_environment_name"] != nil`,
          `delete_key(attributes, "deployment_environment_name") where attributes["deployment_environment_name"] != nil`,
          `set(resource.attributes["deployment.environment"], attributes["deployment_environment"] ) where resource.attributes["deployment.environment"] == nil and attributes["deployment_environment"] != nil`,
          `delete_key(attributes, "deployment_environment") where attributes["deployment_environment"] != nil`,
        ]
      }
    
      trace_statements {
        context = "resource"
        statements = [
          `set(attributes["cluster"], "oauth2-auth-example")`,
          `set(attributes["k8s.cluster.name"], "oauth2-auth-example")`,
        ]
      }
    
      output {
        metrics = [otelcol.processor.batch.otel_endpoint.input]
        logs = [otelcol.processor.batch.otel_endpoint.input]
        traces = [otelcol.processor.batch.otel_endpoint.input]
      }
    }
    
    otelcol.processor.batch "otel_endpoint" {
      timeout = "2s"
      send_batch_size = 8192
      send_batch_max_size = 0
    
      output {
        metrics = [otelcol.exporter.otlp.otel_endpoint.input]
        logs = [otelcol.exporter.otlp.otel_endpoint.input]
        traces = [otelcol.exporter.otlp.otel_endpoint.input]
      }
    }
    otelcol.exporter.otlp "otel_endpoint" {
      client {
        endpoint = "grpc.my.otel.endpoint:443"
        auth = otelcol.auth.oauth2.otel_endpoint.handler
        tls {
          insecure = false
          insecure_skip_verify = false
        }
      }
    
      retry_on_failure {
        enabled = true
        initial_interval = "5s"
        max_interval = "30s"
        max_elapsed_time = "5m"
      }
    }
    
    remote.kubernetes.secret "otel_endpoint" {
      name      = "otel-endpoint-k8smon-k8s-monitoring"
      namespace = "default"
    }
    // Feature: Node Logs
    declare "node_logs" {
      argument "logs_destinations" {
        comment = "Must be a list of log destinations where collected logs should be forwarded to"
      }
    
      loki.relabel "journal" {
    
        // copy all journal labels and make the available to the pipeline stages as labels, there is a label
        // keep defined to filter out unwanted labels, these pipeline labels can be set as structured metadata
        // as well, the following labels are available:
        // - boot_id
        // - cap_effective
        // - cmdline
        // - comm
        // - exe
        // - gid
        // - hostname
        // - machine_id
        // - pid
        // - stream_id
        // - systemd_cgroup
        // - systemd_invocation_id
        // - systemd_slice
        // - systemd_unit
        // - transport
        // - uid
        //
        // More Info: https://www.freedesktop.org/software/systemd/man/systemd.journal-fields.html
        rule {
          action = "labelmap"
          regex = "__journal__(.+)"
        }
    
        rule {
          action = "replace"
          source_labels = ["__journal__systemd_unit"]
          replacement = "$1"
          target_label = "unit"
        }
    
        // the service_name label will be set automatically in loki if not set, and the unit label
        // will not allow service_name to be set automatically.
        rule {
          action = "replace"
          source_labels = ["__journal__systemd_unit"]
          replacement = "$1"
          target_label = "service_name"
        }
    
        forward_to = [] // No forward_to is used in this component, the defined rules are used in the loki.source.journal component
      }
    
      loki.source.journal "worker" {
        path = "/var/log/journal"
        format_as_json = false
        max_age = "8h"
        relabel_rules = loki.relabel.journal.rules
        labels = {
          job = "integrations/kubernetes/journal",
          instance = sys.env("HOSTNAME"),
        }
        forward_to = [loki.process.journal_logs.receiver]
      }
    
      loki.process "journal_logs" {
        stage.static_labels {
          values = {
            // add a static source label to the logs so they can be differentiated / restricted if necessary
            "source" = "journal",
            // default level to unknown
            level = "unknown",
          }
        }
    
        // Attempt to determine the log level, most k8s workers are either in logfmt or klog formats
        // check to see if the log line matches the klog format (https://github.com/kubernetes/klog)
        stage.match {
          // unescaped regex: ([IWED][0-9]{4}\s+[0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]+)
          selector = "{level=\"unknown\"} |~ \"([IWED][0-9]{4}\\\\s+[0-9]{2}:[0-9]{2}:[0-9]{2}\\\\.[0-9]+)\""
    
          // extract log level, klog uses a single letter code for the level followed by the month and day i.e. I0119
          stage.regex {
            expression = "((?P<level>[A-Z])[0-9])"
          }
    
          // if the extracted level is I set INFO
          stage.replace {
            source = "level"
            expression = "(I)"
            replace = "INFO"
          }
    
          // if the extracted level is W set WARN
          stage.replace {
            source = "level"
            expression = "(W)"
            replace = "WARN"
          }
    
          // if the extracted level is E set ERROR
          stage.replace {
            source = "level"
            expression = "(E)"
            replace = "ERROR"
          }
    
          // if the extracted level is I set INFO
          stage.replace {
            source = "level"
            expression = "(D)"
            replace = "DEBUG"
          }
    
          // set the extracted level to be a label
          stage.labels {
            values = {
              level = "",
            }
          }
        }
    
        // if the level is still unknown, do one last attempt at detecting it based on common levels
        stage.match {
          selector = "{level=\"unknown\"}"
    
          // unescaped regex: (?i)(?:"(?:level|loglevel|levelname|lvl|levelText|SeverityText)":\s*"|\s*(?:level|loglevel|levelText|lvl)="?|\s+\[?)(?P<level>(DEBUG?|DBG|INFO?(RMATION)?|WA?RN(ING)?|ERR(OR)?|CRI?T(ICAL)?|FATAL|FTL|NOTICE|TRACE|TRC|PANIC|PNC|ALERT|EMERGENCY))("|\s+|-|\s*\])
          stage.regex {
            expression = "(?i)(?:\"(?:level|loglevel|levelname|lvl|levelText|SeverityText)\":\\s*\"|\\s*(?:level|loglevel|levelText|lvl)=\"?|\\s+\\[?)(?P<level>(DEBUG?|DBG|INFO?(RMATION)?|WA?RN(ING)?|ERR(OR)?|CRI?T(ICAL)?|FATAL|FTL|NOTICE|TRACE|TRC|PANIC|PNC|ALERT|EMERGENCY))(\"|\\s+|-|\\s*\\])"
          }
    
          // set the extracted level to be a label
          stage.labels {
            values = {
              level = "",
            }
          }
        }
    
        // Only keep the labels that are defined in the `keepLabels` list.
        stage.label_keep {
          values = ["instance","job","level","name","unit","service_name","source"]
        }
    
        forward_to = argument.logs_destinations.value
      }
    }
    node_logs "feature" {
      logs_destinations = [
        otelcol.receiver.loki.otel_endpoint.receiver,
      ]
    }
    // Feature: Pod Logs
    declare "pod_logs" {
      argument "logs_destinations" {
        comment = "Must be a list of log destinations where collected logs should be forwarded to"
      }
    
      discovery.relabel "filtered_pods" {
        targets = discovery.kubernetes.pods.targets
        rule {
          source_labels = ["__meta_kubernetes_namespace"]
          action = "replace"
          target_label = "namespace"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_name"]
          action = "replace"
          target_label = "pod"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_container_name"]
          action = "replace"
          target_label = "container"
        }
        rule {
          source_labels = ["__meta_kubernetes_namespace", "__meta_kubernetes_pod_container_name"]
          separator = "/"
          action = "replace"
          replacement = "$1"
          target_label = "job"
        }
    
        // set the container runtime as a label
        rule {
          action = "replace"
          source_labels = ["__meta_kubernetes_pod_container_id"]
          regex = "^(\\S+):\\/\\/.+$"
          replacement = "$1"
          target_label = "tmp_container_runtime"
        }
    
        // make all labels on the pod available to the pipeline as labels,
        // they are omitted before write to loki via stage.label_keep unless explicitly set
        rule {
          action = "labelmap"
          regex = "__meta_kubernetes_pod_label_(.+)"
        }
    
        // make all annotations on the pod available to the pipeline as labels,
        // they are omitted before write to loki via stage.label_keep unless explicitly set
        rule {
          action = "labelmap"
          regex = "__meta_kubernetes_pod_annotation_(.+)"
        }
    
        // explicitly set service_name. if not set, loki will automatically try to populate a default.
        // see https://grafana.com/docs/loki/latest/get-started/labels/#default-labels-for-all-users
        //
        // choose the first value found from the following ordered list:
        // - pod.annotation[resource.opentelemetry.io/service.name]
        // - pod.label[app.kubernetes.io/name]
        // - k8s.pod.name
        // - k8s.container.name
        rule {
          action = "replace"
          source_labels = [
            "__meta_kubernetes_pod_annotation_resource_opentelemetry_io_service_name",
            "__meta_kubernetes_pod_label_app_kubernetes_io_name",
            "__meta_kubernetes_pod_name",
            "__meta_kubernetes_pod_container_name",
          ]
          separator = ";"
          regex = "^(?:;*)?([^;]+).*$"
          replacement = "$1"
          target_label = "service_name"
        }
    
        // set resource attributes
        rule {
          action = "labelmap"
          regex = "__meta_kubernetes_pod_annotation_resource_opentelemetry_io_(.+)"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_logs_job"]
          regex = "(.+)"
          target_label = "job"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_label_app_kubernetes_io_name"]
          regex = "(.+)"
          target_label = "app_kubernetes_io_name"
        }
      }
    
      discovery.kubernetes "pods" {
        role = "pod"
        selectors {
          role = "pod"
          field = "spec.nodeName=" + sys.env("HOSTNAME")
        }
      }
    
      discovery.relabel "filtered_pods_with_paths" {
        targets = discovery.relabel.filtered_pods.output
    
        rule {
          source_labels = ["__meta_kubernetes_pod_uid", "__meta_kubernetes_pod_container_name"]
          separator = "/"
          action = "replace"
          replacement = "/var/log/pods/*$1/*.log"
          target_label = "__path__"
        }
      }
    
      local.file_match "pod_logs" {
        path_targets = discovery.relabel.filtered_pods_with_paths.output
      }
    
      loki.source.file "pod_logs" {
        targets    = local.file_match.pod_logs.targets
        forward_to = [loki.process.pod_logs.receiver]
      }
    
      loki.process "pod_logs" {
        stage.match {
          selector = "{tmp_container_runtime=~\"containerd|cri-o\"}"
          // the cri processing stage extracts the following k/v pairs: log, stream, time, flags
          stage.cri {}
    
          // Set the extract flags and stream values as labels
          stage.labels {
            values = {
              flags  = "",
              stream  = "",
            }
          }
        }
    
        stage.match {
          selector = "{tmp_container_runtime=\"docker\"}"
          // the docker processing stage extracts the following k/v pairs: log, stream, time
          stage.docker {}
    
          // Set the extract stream value as a label
          stage.labels {
            values = {
              stream  = "",
            }
          }
        }
    
        // Drop the filename label, since it's not really useful in the context of Kubernetes, where we already have cluster,
        // namespace, pod, and container labels. Drop any structured metadata. Also drop the temporary
        // container runtime label as it is no longer needed.
        stage.label_drop {
          values = [
            "filename",
            "tmp_container_runtime",
          ]
        }
    
        // Only keep the labels that are defined in the `keepLabels` list.
        stage.label_keep {
          values = ["app_kubernetes_io_name","container","instance","job","level","namespace","pod","service_name","service_namespace","deployment_environment","deployment_environment_name","k8s_pod_name","k8s_namespace_name","k8s_deployment_name","k8s_statefulset_name","k8s_daemonset_name","k8s_cronjob_name","k8s_job_name","k8s_node_name"]
        }
    
        forward_to = argument.logs_destinations.value
      }
    }
    pod_logs "feature" {
      logs_destinations = [
        otelcol.receiver.loki.otel_endpoint.receiver,
      ]
    }
---
# Source: k8s-monitoring/charts/alloy-logs/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: k8smon-alloy-logs
  labels:
    helm.sh/chart: alloy-logs-0.12.5
    app.kubernetes.io/name: alloy-logs
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
rules:
  # Rules which allow discovery.kubernetes to function.
  - apiGroups:
      - ""
      - "discovery.k8s.io"
      - "networking.k8s.io"
    resources:
      - endpoints
      - endpointslices
      - ingresses
      - nodes
      - nodes/proxy
      - nodes/metrics
      - pods
      - services
    verbs:
      - get
      - list
      - watch
  # Rules which allow loki.source.kubernetes and loki.source.podlogs to work.
  - apiGroups:
      - ""
    resources:
      - pods
      - pods/log
      - namespaces
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - "monitoring.grafana.com"
    resources:
      - podlogs
    verbs:
      - get
      - list
      - watch
  # Rules which allow mimir.rules.kubernetes to work.
  - apiGroups: ["monitoring.coreos.com"]
    resources:
      - prometheusrules
    verbs:
      - get
      - list
      - watch
  - nonResourceURLs:
      - /metrics
    verbs:
      - get
  # Rules for prometheus.kubernetes.*
  - apiGroups: ["monitoring.coreos.com"]
    resources:
      - podmonitors
      - servicemonitors
      - probes
    verbs:
      - get
      - list
      - watch
  # Rules which allow eventhandler to work.
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - get
      - list
      - watch
  # needed for remote.kubernetes.*
  - apiGroups: [""]
    resources:
      - "configmaps"
      - "secrets"
    verbs:
      - get
      - list
      - watch
  # needed for otelcol.processor.k8sattributes
  - apiGroups: ["apps"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["extensions"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]
---
# Source: k8s-monitoring/charts/alloy-metrics/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: k8smon-alloy-metrics
  labels:
    helm.sh/chart: alloy-metrics-0.12.5
    app.kubernetes.io/name: alloy-metrics
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
rules:
  # Rules which allow discovery.kubernetes to function.
  - apiGroups:
      - ""
      - "discovery.k8s.io"
      - "networking.k8s.io"
    resources:
      - endpoints
      - endpointslices
      - ingresses
      - nodes
      - nodes/proxy
      - nodes/metrics
      - pods
      - services
    verbs:
      - get
      - list
      - watch
  # Rules which allow loki.source.kubernetes and loki.source.podlogs to work.
  - apiGroups:
      - ""
    resources:
      - pods
      - pods/log
      - namespaces
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - "monitoring.grafana.com"
    resources:
      - podlogs
    verbs:
      - get
      - list
      - watch
  # Rules which allow mimir.rules.kubernetes to work.
  - apiGroups: ["monitoring.coreos.com"]
    resources:
      - prometheusrules
    verbs:
      - get
      - list
      - watch
  - nonResourceURLs:
      - /metrics
    verbs:
      - get
  # Rules for prometheus.kubernetes.*
  - apiGroups: ["monitoring.coreos.com"]
    resources:
      - podmonitors
      - servicemonitors
      - probes
    verbs:
      - get
      - list
      - watch
  # Rules which allow eventhandler to work.
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - get
      - list
      - watch
  # needed for remote.kubernetes.*
  - apiGroups: [""]
    resources:
      - "configmaps"
      - "secrets"
    verbs:
      - get
      - list
      - watch
  # needed for otelcol.processor.k8sattributes
  - apiGroups: ["apps"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["extensions"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]
---
# Source: k8s-monitoring/charts/alloy-singleton/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: k8smon-alloy-singleton
  labels:
    helm.sh/chart: alloy-singleton-0.12.5
    app.kubernetes.io/name: alloy-singleton
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
rules:
  # Rules which allow discovery.kubernetes to function.
  - apiGroups:
      - ""
      - "discovery.k8s.io"
      - "networking.k8s.io"
    resources:
      - endpoints
      - endpointslices
      - ingresses
      - nodes
      - nodes/proxy
      - nodes/metrics
      - pods
      - services
    verbs:
      - get
      - list
      - watch
  # Rules which allow loki.source.kubernetes and loki.source.podlogs to work.
  - apiGroups:
      - ""
    resources:
      - pods
      - pods/log
      - namespaces
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - "monitoring.grafana.com"
    resources:
      - podlogs
    verbs:
      - get
      - list
      - watch
  # Rules which allow mimir.rules.kubernetes to work.
  - apiGroups: ["monitoring.coreos.com"]
    resources:
      - prometheusrules
    verbs:
      - get
      - list
      - watch
  - nonResourceURLs:
      - /metrics
    verbs:
      - get
  # Rules for prometheus.kubernetes.*
  - apiGroups: ["monitoring.coreos.com"]
    resources:
      - podmonitors
      - servicemonitors
      - probes
    verbs:
      - get
      - list
      - watch
  # Rules which allow eventhandler to work.
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - get
      - list
      - watch
  # needed for remote.kubernetes.*
  - apiGroups: [""]
    resources:
      - "configmaps"
      - "secrets"
    verbs:
      - get
      - list
      - watch
  # needed for otelcol.processor.k8sattributes
  - apiGroups: ["apps"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["extensions"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]
---
# Source: k8s-monitoring/charts/clusterMetrics/charts/kube-state-metrics/templates/role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:    
    helm.sh/chart: kube-state-metrics-5.31.0
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: kube-state-metrics
    app.kubernetes.io/name: kube-state-metrics
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "2.15.0"
    release: k8smon
  name: k8smon-kube-state-metrics
rules:

- apiGroups: ["certificates.k8s.io"]
  resources:
  - certificatesigningrequests
  verbs: ["list", "watch"]

- apiGroups: [""]
  resources:
  - configmaps
  verbs: ["list", "watch"]

- apiGroups: ["batch"]
  resources:
  - cronjobs
  verbs: ["list", "watch"]

- apiGroups: ["extensions", "apps"]
  resources:
  - daemonsets
  verbs: ["list", "watch"]

- apiGroups: ["extensions", "apps"]
  resources:
  - deployments
  verbs: ["list", "watch"]

- apiGroups: [""]
  resources:
  - endpoints
  verbs: ["list", "watch"]

- apiGroups: ["autoscaling"]
  resources:
  - horizontalpodautoscalers
  verbs: ["list", "watch"]

- apiGroups: ["extensions", "networking.k8s.io"]
  resources:
  - ingresses
  verbs: ["list", "watch"]

- apiGroups: ["batch"]
  resources:
  - jobs
  verbs: ["list", "watch"]

- apiGroups: ["coordination.k8s.io"]
  resources:
  - leases
  verbs: ["list", "watch"]

- apiGroups: [""]
  resources:
  - limitranges
  verbs: ["list", "watch"]

- apiGroups: ["admissionregistration.k8s.io"]
  resources:
    - mutatingwebhookconfigurations
  verbs: ["list", "watch"]

- apiGroups: [""]
  resources:
  - namespaces
  verbs: ["list", "watch"]

- apiGroups: ["networking.k8s.io"]
  resources:
  - networkpolicies
  verbs: ["list", "watch"]

- apiGroups: [""]
  resources:
  - nodes
  verbs: ["list", "watch"]

- apiGroups: [""]
  resources:
  - persistentvolumeclaims
  verbs: ["list", "watch"]

- apiGroups: [""]
  resources:
  - persistentvolumes
  verbs: ["list", "watch"]

- apiGroups: ["policy"]
  resources:
    - poddisruptionbudgets
  verbs: ["list", "watch"]

- apiGroups: [""]
  resources:
  - pods
  verbs: ["list", "watch"]

- apiGroups: ["extensions", "apps"]
  resources:
  - replicasets
  verbs: ["list", "watch"]

- apiGroups: [""]
  resources:
  - replicationcontrollers
  verbs: ["list", "watch"]

- apiGroups: [""]
  resources:
  - resourcequotas
  verbs: ["list", "watch"]

- apiGroups: [""]
  resources:
  - secrets
  verbs: ["list", "watch"]

- apiGroups: [""]
  resources:
  - services
  verbs: ["list", "watch"]

- apiGroups: ["apps"]
  resources:
  - statefulsets
  verbs: ["list", "watch"]

- apiGroups: ["storage.k8s.io"]
  resources:
    - storageclasses
  verbs: ["list", "watch"]

- apiGroups: ["admissionregistration.k8s.io"]
  resources:
    - validatingwebhookconfigurations
  verbs: ["list", "watch"]

- apiGroups: ["storage.k8s.io"]
  resources:
    - volumeattachments
  verbs: ["list", "watch"]
---
# Source: k8s-monitoring/charts/alloy-logs/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: k8smon-alloy-logs
  labels:
    helm.sh/chart: alloy-logs-0.12.5
    app.kubernetes.io/name: alloy-logs
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: k8smon-alloy-logs
subjects:
  - kind: ServiceAccount
    name: k8smon-alloy-logs
    namespace: default
---
# Source: k8s-monitoring/charts/alloy-metrics/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: k8smon-alloy-metrics
  labels:
    helm.sh/chart: alloy-metrics-0.12.5
    app.kubernetes.io/name: alloy-metrics
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: k8smon-alloy-metrics
subjects:
  - kind: ServiceAccount
    name: k8smon-alloy-metrics
    namespace: default
---
# Source: k8s-monitoring/charts/alloy-singleton/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: k8smon-alloy-singleton
  labels:
    helm.sh/chart: alloy-singleton-0.12.5
    app.kubernetes.io/name: alloy-singleton
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: k8smon-alloy-singleton
subjects:
  - kind: ServiceAccount
    name: k8smon-alloy-singleton
    namespace: default
---
# Source: k8s-monitoring/charts/clusterMetrics/charts/kube-state-metrics/templates/clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:    
    helm.sh/chart: kube-state-metrics-5.31.0
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: kube-state-metrics
    app.kubernetes.io/name: kube-state-metrics
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "2.15.0"
    release: k8smon
  name: k8smon-kube-state-metrics
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: k8smon-kube-state-metrics
subjects:
- kind: ServiceAccount
  name: k8smon-kube-state-metrics
  namespace: default
---
# Source: k8s-monitoring/charts/alloy-logs/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: k8smon-alloy-logs
  namespace: default
  labels:
    helm.sh/chart: alloy-logs-0.12.5
    app.kubernetes.io/name: alloy-logs
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: networking
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: alloy-logs
    app.kubernetes.io/instance: k8smon
  internalTrafficPolicy: Cluster
  ports:
    - name: http-metrics
      port: 12345
      targetPort: 12345
      protocol: "TCP"
---
# Source: k8s-monitoring/charts/alloy-metrics/templates/cluster_service.yaml
apiVersion: v1
kind: Service
metadata:
  name: k8smon-alloy-metrics-cluster
  namespace: default
  labels:
    helm.sh/chart: alloy-metrics-0.12.5
    app.kubernetes.io/name: alloy-metrics
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: networking
spec:
  type: ClusterIP
  clusterIP: 'None'
  publishNotReadyAddresses: true
  selector:
    app.kubernetes.io/name: alloy-metrics
    app.kubernetes.io/instance: k8smon
  ports:
    # Do not include the -metrics suffix in the port name, otherwise metrics
    # can be double-collected with the non-headless Service if it's also
    # enabled.
    #
    # This service should only be used for clustering, and not metric
    # collection.
    - name: http
      port: 12345
      targetPort: 12345
      protocol: "TCP"
---
# Source: k8s-monitoring/charts/alloy-metrics/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: k8smon-alloy-metrics
  namespace: default
  labels:
    helm.sh/chart: alloy-metrics-0.12.5
    app.kubernetes.io/name: alloy-metrics
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: networking
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: alloy-metrics
    app.kubernetes.io/instance: k8smon
  internalTrafficPolicy: Cluster
  ports:
    - name: http-metrics
      port: 12345
      targetPort: 12345
      protocol: "TCP"
---
# Source: k8s-monitoring/charts/alloy-singleton/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: k8smon-alloy-singleton
  namespace: default
  labels:
    helm.sh/chart: alloy-singleton-0.12.5
    app.kubernetes.io/name: alloy-singleton
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: networking
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: alloy-singleton
    app.kubernetes.io/instance: k8smon
  internalTrafficPolicy: Cluster
  ports:
    - name: http-metrics
      port: 12345
      targetPort: 12345
      protocol: "TCP"
---
# Source: k8s-monitoring/charts/clusterMetrics/charts/kube-state-metrics/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: k8smon-kube-state-metrics
  namespace: default
  labels:    
    helm.sh/chart: kube-state-metrics-5.31.0
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: kube-state-metrics
    app.kubernetes.io/name: kube-state-metrics
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "2.15.0"
    release: k8smon
  annotations:
spec:
  type: "ClusterIP"
  ports:
  - name: "http"
    protocol: TCP
    port: 8080
    targetPort: 8080
  
  selector:    
    app.kubernetes.io/name: kube-state-metrics
    app.kubernetes.io/instance: k8smon
---
# Source: k8s-monitoring/charts/clusterMetrics/charts/node-exporter/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: k8smon-node-exporter
  namespace: default
  labels:
    helm.sh/chart: node-exporter-4.45.0
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: node-exporter
    app.kubernetes.io/name: node-exporter
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "1.9.0"
    release: k8smon
  annotations:
    prometheus.io/scrape: "false"
spec:
  type: ClusterIP
  ports:
    - port: 9100
      targetPort: 9100
      protocol: TCP
      name: metrics
  selector:
    app.kubernetes.io/name: node-exporter
    app.kubernetes.io/instance: k8smon
---
# Source: k8s-monitoring/charts/clusterMetrics/charts/windows-exporter/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: k8smon-windows-exporter
  namespace: default
  labels:
    helm.sh/chart: windows-exporter-0.9.1
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: windows-exporter
    app.kubernetes.io/name: windows-exporter
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "0.30.5"
    release: k8smon
spec:
  type: ClusterIP
  ports:
    - port: 9182
      targetPort: metrics
      protocol: TCP
      appProtocol: http
      name: metrics
  selector:
    app.kubernetes.io/name: windows-exporter
    app.kubernetes.io/instance: k8smon
---
# Source: k8s-monitoring/charts/alloy-logs/templates/controllers/daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: k8smon-alloy-logs
  namespace: default
  labels:
    helm.sh/chart: alloy-logs-0.12.5
    app.kubernetes.io/name: alloy-logs
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
spec:
  minReadySeconds: 10
  selector:
    matchLabels:
      app.kubernetes.io/name: alloy-logs
      app.kubernetes.io/instance: k8smon
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: alloy
        k8s.grafana.com/logs.job: integrations/alloy
      labels:
        app.kubernetes.io/name: alloy-logs
        app.kubernetes.io/instance: k8smon
    spec:
      serviceAccountName: k8smon-alloy-logs
      containers:
        - name: alloy
          image: docker.io/grafana/alloy:v1.7.4
          imagePullPolicy: IfNotPresent
          args:
            - run
            - /etc/alloy/config.alloy
            - --storage.path=/tmp/alloy
            - --server.http.listen-addr=0.0.0.0:12345
            - --server.http.ui-path-prefix=/
            - --stability.level=generally-available
          env:
            - name: ALLOY_DEPLOY_MODE
              value: "helm"
            - name: HOSTNAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          ports:
            - containerPort: 12345
              name: http-metrics
          readinessProbe:
            httpGet:
              path: /-/ready
              port: 12345
              scheme: HTTP
            initialDelaySeconds: 10
            timeoutSeconds: 1
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              add:
              - CHOWN
              - DAC_OVERRIDE
              - FOWNER
              - FSETID
              - KILL
              - SETGID
              - SETUID
              - SETPCAP
              - NET_BIND_SERVICE
              - NET_RAW
              - SYS_CHROOT
              - MKNOD
              - AUDIT_WRITE
              - SETFCAP
              drop:
              - ALL
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - name: config
              mountPath: /etc/alloy
            - name: varlog
              mountPath: /var/log
              readOnly: true
            - name: dockercontainers
              mountPath: /var/lib/docker/containers
              readOnly: true
        - name: config-reloader
          image: ghcr.io/jimmidyson/configmap-reload:v0.14.0
          args:
            - --volume-dir=/etc/alloy
            - --webhook-url=http://localhost:12345/-/reload
          volumeMounts:
            - name: config
              mountPath: /etc/alloy
          resources:
            requests:
              cpu: 1m
              memory: 5Mi
      dnsPolicy: ClusterFirst
      nodeSelector:
        kubernetes.io/os: linux
      tolerations:
        - effect: NoSchedule
          operator: Exists
      volumes:
        - name: config
          configMap:
            name: k8smon-alloy-logs
        - name: varlog
          hostPath:
            path: /var/log
        - name: dockercontainers
          hostPath:
            path: /var/lib/docker/containers
---
# Source: k8s-monitoring/charts/clusterMetrics/charts/node-exporter/templates/daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: k8smon-node-exporter
  namespace: default
  labels:
    helm.sh/chart: node-exporter-4.45.0
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: node-exporter
    app.kubernetes.io/name: node-exporter
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "1.9.0"
    release: k8smon
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: node-exporter
      app.kubernetes.io/instance: k8smon
  revisionHistoryLimit: 10
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      annotations:
        cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
        k8s.grafana.com/logs.job: integrations/node_exporter
      labels:
        helm.sh/chart: node-exporter-4.45.0
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/component: metrics
        app.kubernetes.io/part-of: node-exporter
        app.kubernetes.io/name: node-exporter
        app.kubernetes.io/instance: k8smon
        app.kubernetes.io/version: "1.9.0"
        release: k8smon
    spec:
      automountServiceAccountToken: false
      securityContext:
        fsGroup: 65534
        runAsGroup: 65534
        runAsNonRoot: true
        runAsUser: 65534
      serviceAccountName: k8smon-node-exporter
      containers:
        - name: node-exporter
          image: quay.io/prometheus/node-exporter:v1.9.0
          imagePullPolicy: IfNotPresent
          args:
            - --path.procfs=/host/proc
            - --path.sysfs=/host/sys
            - --path.rootfs=/host/root
            - --path.udev.data=/host/root/run/udev/data
            - --web.listen-address=[$(HOST_IP)]:9100
          securityContext:
            readOnlyRootFilesystem: true
          env:
            - name: HOST_IP
              value: 0.0.0.0
          ports:
            - name: metrics
              containerPort: 9100
              protocol: TCP
          livenessProbe:
            failureThreshold: 3
            httpGet:
              httpHeaders:
              path: /
              port: 9100
              scheme: HTTP
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          readinessProbe:
            failureThreshold: 3
            httpGet:
              httpHeaders:
              path: /
              port: 9100
              scheme: HTTP
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          volumeMounts:
            - name: proc
              mountPath: /host/proc
              readOnly:  true
            - name: sys
              mountPath: /host/sys
              readOnly: true
            - name: root
              mountPath: /host/root
              mountPropagation: HostToContainer
              readOnly: true
      hostNetwork: true
      hostPID: true
      hostIPC: false
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: eks.amazonaws.com/compute-type
                operator: NotIn
                values:
                - fargate
      nodeSelector:
        kubernetes.io/os: linux
      tolerations:
        - effect: NoSchedule
          operator: Exists
      volumes:
        - name: proc
          hostPath:
            path: /proc
        - name: sys
          hostPath:
            path: /sys
        - name: root
          hostPath:
            path: /
---
# Source: k8s-monitoring/charts/clusterMetrics/charts/windows-exporter/templates/daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: k8smon-windows-exporter
  namespace: default
  labels:
    helm.sh/chart: windows-exporter-0.9.1
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: windows-exporter
    app.kubernetes.io/name: windows-exporter
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "0.30.5"
    release: k8smon
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: windows-exporter
      app.kubernetes.io/instance: k8smon
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      annotations:
        cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
        k8s.grafana.com/logs.job: integrations/windows_exporter
      labels:
        helm.sh/chart: windows-exporter-0.9.1
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/component: metrics
        app.kubernetes.io/part-of: windows-exporter
        app.kubernetes.io/name: windows-exporter
        app.kubernetes.io/instance: k8smon
        app.kubernetes.io/version: "0.30.5"
        release: k8smon
    spec:
      automountServiceAccountToken: false
      securityContext:
        windowsOptions:
          hostProcess: true
          runAsUserName: NT AUTHORITY\system
      initContainers:
        - name: configure-firewall
          image: ghcr.io/prometheus-community/windows-exporter:0.30.5
          command: [ "powershell" ]
          args: [ "New-NetFirewallRule", "-DisplayName", "'windows-exporter'", "-Direction", "inbound", "-Profile", "Any", "-Action", "Allow", "-LocalPort", "9182", "-Protocol", "TCP" ]
      serviceAccountName: k8smon-windows-exporter
      containers:
        - name: windows-exporter
          image: ghcr.io/prometheus-community/windows-exporter:0.30.5
          imagePullPolicy: IfNotPresent
          args:
            - --config.file=%CONTAINER_SANDBOX_MOUNT_POINT%/config.yml
            - --collector.textfile.directories=%CONTAINER_SANDBOX_MOUNT_POINT%
            - --web.listen-address=:9182
          env:
          ports:
            - name: metrics
              containerPort: 9182
              protocol: TCP
          livenessProbe:
            failureThreshold: 3
            httpGet:
              httpHeaders:
              path: /health
              port: 9182
              scheme: HTTP
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          readinessProbe:
            failureThreshold: 3
            httpGet:
              httpHeaders:
              path: /health
              port: 9182
              scheme: HTTP
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          volumeMounts:
            - name: config
              mountPath: /config.yml
              subPath: config.yml
      hostNetwork: true
      hostPID: true
      nodeSelector:
        kubernetes.io/os: windows
      tolerations:
        - effect: NoSchedule
          operator: Exists
      volumes:
        - name: config
          configMap:
            name: k8smon-windows-exporter
---
# Source: k8s-monitoring/charts/alloy-singleton/templates/controllers/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: k8smon-alloy-singleton
  namespace: default
  labels:
    helm.sh/chart: alloy-singleton-0.12.5
    app.kubernetes.io/name: alloy-singleton
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
spec:
  replicas: 1
  minReadySeconds: 10
  selector:
    matchLabels:
      app.kubernetes.io/name: alloy-singleton
      app.kubernetes.io/instance: k8smon
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: alloy
        k8s.grafana.com/logs.job: integrations/alloy
      labels:
        app.kubernetes.io/name: alloy-singleton
        app.kubernetes.io/instance: k8smon
    spec:
      serviceAccountName: k8smon-alloy-singleton
      containers:
        - name: alloy
          image: docker.io/grafana/alloy:v1.7.4
          imagePullPolicy: IfNotPresent
          args:
            - run
            - /etc/alloy/config.alloy
            - --storage.path=/tmp/alloy
            - --server.http.listen-addr=0.0.0.0:12345
            - --server.http.ui-path-prefix=/
            - --stability.level=generally-available
          env:
            - name: ALLOY_DEPLOY_MODE
              value: "helm"
            - name: HOSTNAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          ports:
            - containerPort: 12345
              name: http-metrics
          readinessProbe:
            httpGet:
              path: /-/ready
              port: 12345
              scheme: HTTP
            initialDelaySeconds: 10
            timeoutSeconds: 1
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              add:
              - CHOWN
              - DAC_OVERRIDE
              - FOWNER
              - FSETID
              - KILL
              - SETGID
              - SETUID
              - SETPCAP
              - NET_BIND_SERVICE
              - NET_RAW
              - SYS_CHROOT
              - MKNOD
              - AUDIT_WRITE
              - SETFCAP
              drop:
              - ALL
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - name: config
              mountPath: /etc/alloy
        - name: config-reloader
          image: ghcr.io/jimmidyson/configmap-reload:v0.14.0
          args:
            - --volume-dir=/etc/alloy
            - --webhook-url=http://localhost:12345/-/reload
          volumeMounts:
            - name: config
              mountPath: /etc/alloy
          resources:
            requests:
              cpu: 1m
              memory: 5Mi
      dnsPolicy: ClusterFirst
      nodeSelector:
        kubernetes.io/os: linux
      volumes:
        - name: config
          configMap:
            name: k8smon-alloy-singleton
---
# Source: k8s-monitoring/charts/clusterMetrics/charts/kube-state-metrics/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: k8smon-kube-state-metrics
  namespace: default
  labels:    
    helm.sh/chart: kube-state-metrics-5.31.0
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: kube-state-metrics
    app.kubernetes.io/name: kube-state-metrics
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "2.15.0"
    release: k8smon
spec:
  selector:
    matchLabels:      
      app.kubernetes.io/name: kube-state-metrics
      app.kubernetes.io/instance: k8smon
  replicas: 1
  strategy:
    type: Recreate
  revisionHistoryLimit: 10
  template:
    metadata:
      labels:        
        helm.sh/chart: kube-state-metrics-5.31.0
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/component: metrics
        app.kubernetes.io/part-of: kube-state-metrics
        app.kubernetes.io/name: kube-state-metrics
        app.kubernetes.io/instance: k8smon
        app.kubernetes.io/version: "2.15.0"
        release: k8smon
      annotations:
      
        k8s.grafana.com/logs.job: integrations/kubernetes/kube-state-metrics
    spec:
      automountServiceAccountToken: true
      hostNetwork: false
      serviceAccountName: k8smon-kube-state-metrics
      securityContext:
        fsGroup: 65534
        runAsGroup: 65534
        runAsNonRoot: true
        runAsUser: 65534
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: kube-state-metrics
        args:
        - --port=8080
        - --resources=certificatesigningrequests,configmaps,cronjobs,daemonsets,deployments,endpoints,horizontalpodautoscalers,ingresses,jobs,leases,limitranges,mutatingwebhookconfigurations,namespaces,networkpolicies,nodes,persistentvolumeclaims,persistentvolumes,poddisruptionbudgets,pods,replicasets,replicationcontrollers,resourcequotas,secrets,services,statefulsets,storageclasses,validatingwebhookconfigurations,volumeattachments
        - --metric-labels-allowlist=nodes=[agentpool,alpha.eksctl.io/cluster-name,alpha.eksctl.io/nodegroup-name,beta.kubernetes.io/instance-type,cloud.google.com/gke-nodepool,cluster-name,ec2.amazonaws.com/Name,ec2.amazonaws.com/aws-autoscaling-groupName,ec2.amazonaws.com/aws-autoscaling-group-name,ec2.amazonaws.com/name,eks.amazonaws.com/nodegroup,k8s.io/cloud-provider-aws,karpenter.sh/nodepool,kubernetes.azure.com/cluster,kubernetes.io/arch,kubernetes.io/hostname,kubernetes.io/os,node.kubernetes.io/instance-type,topology.kubernetes.io/region,topology.kubernetes.io/zone]
        imagePullPolicy: IfNotPresent
        image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0
        ports:
        - containerPort: 8080
          name: "http"
        livenessProbe:
          failureThreshold: 3
          httpGet:
            httpHeaders:
            path: /livez
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        readinessProbe:
          failureThreshold: 3
          httpGet:
            httpHeaders:
            path: /readyz
            port: 8081
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        resources:
          {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
      nodeSelector:
        kubernetes.io/os: linux
---
# Source: k8s-monitoring/charts/alloy-metrics/templates/controllers/statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: k8smon-alloy-metrics
  namespace: default
  labels:
    helm.sh/chart: alloy-metrics-0.12.5
    app.kubernetes.io/name: alloy-metrics
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
spec:
  replicas: 1
  podManagementPolicy: Parallel
  minReadySeconds: 10
  serviceName: k8smon-alloy-metrics
  selector:
    matchLabels:
      app.kubernetes.io/name: alloy-metrics
      app.kubernetes.io/instance: k8smon
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: alloy
        k8s.grafana.com/logs.job: integrations/alloy
      labels:
        app.kubernetes.io/name: alloy-metrics
        app.kubernetes.io/instance: k8smon
    spec:
      serviceAccountName: k8smon-alloy-metrics
      containers:
        - name: alloy
          image: docker.io/grafana/alloy:v1.7.4
          imagePullPolicy: IfNotPresent
          args:
            - run
            - /etc/alloy/config.alloy
            - --storage.path=/tmp/alloy
            - --server.http.listen-addr=0.0.0.0:12345
            - --server.http.ui-path-prefix=/
            - --cluster.enabled=true
            - --cluster.join-addresses=k8smon-alloy-metrics-cluster
            - --cluster.name=alloy-metrics
            - --stability.level=generally-available
          env:
            - name: ALLOY_DEPLOY_MODE
              value: "helm"
            - name: HOSTNAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          ports:
            - containerPort: 12345
              name: http-metrics
          readinessProbe:
            httpGet:
              path: /-/ready
              port: 12345
              scheme: HTTP
            initialDelaySeconds: 10
            timeoutSeconds: 1
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              add:
              - CHOWN
              - DAC_OVERRIDE
              - FOWNER
              - FSETID
              - KILL
              - SETGID
              - SETUID
              - SETPCAP
              - NET_BIND_SERVICE
              - NET_RAW
              - SYS_CHROOT
              - MKNOD
              - AUDIT_WRITE
              - SETFCAP
              drop:
              - ALL
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - name: config
              mountPath: /etc/alloy
        - name: config-reloader
          image: ghcr.io/jimmidyson/configmap-reload:v0.14.0
          args:
            - --volume-dir=/etc/alloy
            - --webhook-url=http://localhost:12345/-/reload
          volumeMounts:
            - name: config
              mountPath: /etc/alloy
          resources:
            requests:
              cpu: 1m
              memory: 5Mi
      dnsPolicy: ClusterFirst
      nodeSelector:
        kubernetes.io/os: linux
      volumes:
        - name: config
          configMap:
            name: k8smon-alloy-metrics