output.yaml

---
# Source: k8s-monitoring/charts/alloy-logs/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
automountServiceAccountToken: true
metadata:
  name: k8smon-alloy-logs
  namespace: default
  labels:
    helm.sh/chart: alloy-logs-0.12.5
    app.kubernetes.io/name: alloy-logs
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
---
# Source: k8s-monitoring/charts/alloy-metrics/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
automountServiceAccountToken: true
metadata:
  name: k8smon-alloy-metrics
  namespace: default
  labels:
    helm.sh/chart: alloy-metrics-0.12.5
    app.kubernetes.io/name: alloy-metrics
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
---
# Source: k8s-monitoring/charts/alloy-profiles/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
automountServiceAccountToken: true
metadata:
  name: k8smon-alloy-profiles
  namespace: default
  labels:
    helm.sh/chart: alloy-profiles-0.12.5
    app.kubernetes.io/name: alloy-profiles
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
---
# Source: k8s-monitoring/charts/alloy-receiver/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
automountServiceAccountToken: true
metadata:
  name: k8smon-alloy-receiver
  namespace: default
  labels:
    helm.sh/chart: alloy-receiver-0.12.5
    app.kubernetes.io/name: alloy-receiver
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
---
# Source: k8s-monitoring/charts/alloy-singleton/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
automountServiceAccountToken: true
metadata:
  name: k8smon-alloy-singleton
  namespace: default
  labels:
    helm.sh/chart: alloy-singleton-0.12.5
    app.kubernetes.io/name: alloy-singleton
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
---
# Source: k8s-monitoring/charts/autoInstrumentation/charts/beyla/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: k8smon-beyla
  namespace: default
  labels:
    helm.sh/chart: beyla-1.7.3
    app.kubernetes.io/name: beyla
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "2.0.3"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: beyla
    app.kubernetes.io/component: rbac
automountServiceAccountToken: true
---
# Source: k8s-monitoring/charts/clusterMetrics/charts/kube-state-metrics/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
automountServiceAccountToken: true
metadata:
  labels:    
    helm.sh/chart: kube-state-metrics-5.31.0
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: kube-state-metrics
    app.kubernetes.io/name: kube-state-metrics
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "2.15.0"
    release: k8smon
  name: k8smon-kube-state-metrics
  namespace: default
---
# Source: k8s-monitoring/charts/clusterMetrics/charts/node-exporter/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: k8smon-node-exporter
  namespace: default
  labels:
    helm.sh/chart: node-exporter-4.45.0
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: node-exporter
    app.kubernetes.io/name: node-exporter
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "1.9.0"
    release: k8smon
automountServiceAccountToken: false
---
# Source: k8s-monitoring/charts/clusterMetrics/charts/windows-exporter/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: k8smon-windows-exporter
  namespace: default
  labels:
    helm.sh/chart: windows-exporter-0.9.1
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: windows-exporter
    app.kubernetes.io/name: windows-exporter
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "0.30.5"
    release: k8smon
---
# Source: k8s-monitoring/charts/clusterMetrics/charts/windows-exporter/templates/config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: k8smon-windows-exporter
  namespace: default
  labels:
    helm.sh/chart: windows-exporter-0.9.1
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: windows-exporter
    app.kubernetes.io/name: windows-exporter
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "0.30.5"
    release: k8smon
data:
  config.yml: |
    collectors:
      enabled: cpu,cs,container,logical_disk,memory,net,os
    collector:
      service:
        services-where: "Name='containerd' or Name='kubelet'"
---
# Source: k8s-monitoring/templates/alloy-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: k8smon-alloy-metrics
  namespace: default
data:
  config.alloy: |-
    // Destination: prometheus (prometheus)
    otelcol.exporter.prometheus "prometheus" {
      add_metric_suffixes = true
      forward_to = [prometheus.remote_write.prometheus.receiver]
    }
    
    prometheus.remote_write "prometheus" {
      endpoint {
        url = "http://prometheus.prometheus.svc:9090/api/v1/write"
        headers = {
        }
        tls_config {
          insecure_skip_verify = false
        }
        send_native_histograms = false
    
        queue_config {
          capacity = 10000
          min_shards = 1
          max_shards = 50
          max_samples_per_send = 2000
          batch_send_deadline = "5s"
          min_backoff = "30ms"
          max_backoff = "5s"
          retry_on_http_429 = true
          sample_age_limit = "0s"
        }
    
        write_relabel_config {
          source_labels = ["cluster"]
          regex = ""
          replacement = "exclude-by-namespace-cluster"
          target_label = "cluster"
        }
        write_relabel_config {
          source_labels = ["k8s.cluster.name"]
          regex = ""
          replacement = "exclude-by-namespace-cluster"
          target_label = "cluster"
        }
      }
    
      wal {
        truncate_frequency = "2h"
        min_keepalive_time = "5m"
        max_keepalive_time = "8h"
      }
    }
    // Feature: Annotation Autodiscovery
    declare "annotation_autodiscovery" {
      argument "metrics_destinations" {
        comment = "Must be a list of metric destinations where collected metrics should be forwarded to"
      }
    
      discovery.kubernetes "pods" {
        role = "pod"
      }
    
      discovery.relabel "annotation_autodiscovery_pods" {
        targets = discovery.kubernetes.pods.targets
        rule {
          source_labels = ["__meta_kubernetes_namespace"]
          regex = "kube-system|kube-public|confidential"
          action = "drop"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_scrape"]
          regex = "true"
          action = "keep"
        }
        // Only keep pods that are running, ready, and not init containers.
        rule {
          source_labels = [
            "__meta_kubernetes_pod_phase",
            "__meta_kubernetes_pod_ready",
            "__meta_kubernetes_pod_container_init",
          ]
          regex = "Running;true;false"
          action = "keep"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_name"]
          target_label = "pod"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_container_name"]
          target_label = "container"
        }
        rule {
          source_labels = ["__meta_kubernetes_namespace"]
          target_label = "namespace"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_job"]
          target_label = "job"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_instance"]
          target_label = "instance"
        }
    
        // Rules to choose the right container
        rule {
          source_labels = ["container"]
          target_label = "__tmp_container"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_container"]
          regex = "(.+)"
          target_label = "__tmp_container"
        }
        rule {
          source_labels = ["container"]
          action = "keepequal"
          target_label = "__tmp_container"
        }
        rule {
          action = "labeldrop"
          regex = "__tmp_container"
        }
    
        // Set metrics path
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_path"]
          regex = "(.+)"
          target_label = "__metrics_path__"
        }
    
        // Set metrics scraping URL parameters
        rule {
          action = "labelmap"
          regex = "__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_param_(.+)"
          replacement = "__param_$1"
        }
    
        // Choose the pod port
        // The discovery generates a target for each declared container port of the pod.
        // If the metricsPortName annotation has value, keep only the target where the port name matches the one of the annotation.
        rule {
          source_labels = ["__meta_kubernetes_pod_container_port_name"]
          target_label = "__tmp_port"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_portName"]
          regex = "(.+)"
          target_label = "__tmp_port"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_container_port_name"]
          action = "keepequal"
          target_label = "__tmp_port"
        }
        rule {
          action = "labeldrop"
          regex = "__tmp_port"
        }
    
        // If the metrics port number annotation has a value, override the target address to use it, regardless whether it is
        // one of the declared ports on that Pod.
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_portNumber", "__meta_kubernetes_pod_ip"]
          regex = "(\\d+);(([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4})"
          replacement = "[$2]:$1" // IPv6
          target_label = "__address__"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_portNumber", "__meta_kubernetes_pod_ip"]
          regex = "(\\d+);((([0-9]+?)(\\.|$)){4})" // IPv4, takes priority over IPv6 when both exists
          replacement = "$2:$1"
          target_label = "__address__"
        }
    
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_scheme"]
          regex = "(.+)"
          target_label = "__scheme__"
        }
    
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_scrapeInterval"]
          regex = "(.+)"
          target_label = "__scrape_interval__"
        }
        rule {
          source_labels = ["__scrape_interval__"]
          regex = ""
          replacement = "60s"
          target_label = "__scrape_interval__"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_scrapeTimeout"]
          regex = "(.+)"
          target_label = "__scrape_timeout__"
        }
        rule {
          source_labels = ["__scrape_timeout__"]
          regex = ""
          replacement = "10s"
          target_label = "__scrape_timeout__"
        }
      }
    
      discovery.kubernetes "services" {
        role = "service"
      }
    
      discovery.relabel "annotation_autodiscovery_services" {
        targets = discovery.kubernetes.services.targets
        rule {
          source_labels = ["__meta_kubernetes_namespace"]
          regex = "kube-system|kube-public|confidential"
          action = "drop"
        }
        rule {
          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_scrape"]
          regex = "true"
          action = "keep"
        }
        rule {
          source_labels = ["__meta_kubernetes_service_name"]
          target_label = "service"
        }
        rule {
          source_labels = ["__meta_kubernetes_namespace"]
          target_label = "namespace"
        }
        rule {
          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_job"]
          target_label = "job"
        }
        rule {
          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_instance"]
          target_label = "instance"
        }
    
        // Set metrics path
        rule {
          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_metrics_path"]
          target_label = "__metrics_path__"
        }
    
        // Set metrics scraping URL parameters
        rule {
          action = "labelmap"
          regex = "__meta_kubernetes_service_annotation_k8s_grafana_com_metrics_param_(.+)"
          replacement = "__param_$1"
        }
    
        // Choose the service port
        rule {
          source_labels = ["__meta_kubernetes_service_port_name"]
          target_label = "__tmp_port"
        }
        rule {
          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_metrics_portName"]
          regex = "(.+)"
          target_label = "__tmp_port"
        }
        rule {
          source_labels = ["__meta_kubernetes_service_port_name"]
          action = "keepequal"
          target_label = "__tmp_port"
        }
    
        rule {
          source_labels = ["__meta_kubernetes_service_port_number"]
          target_label = "__tmp_port"
        }
        rule {
          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_metrics_portNumber"]
          regex = "(.+)"
          target_label = "__tmp_port"
        }
        rule {
          source_labels = ["__meta_kubernetes_service_port_number"]
          action = "keepequal"
          target_label = "__tmp_port"
        }
        rule {
          action = "labeldrop"
          regex = "__tmp_port"
        }
    
        rule {
          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_metrics_scheme"]
          regex = "(.+)"
          target_label = "__scheme__"
        }
    
        rule {
          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_metrics_scrapeInterval"]
          regex = "(.+)"
          target_label = "__scrape_interval__"
        }
        rule {
          source_labels = ["__scrape_interval__"]
          regex = ""
          replacement = "60s"
          target_label = "__scrape_interval__"
        }
        rule {
          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_metrics_scrapeTimeout"]
          regex = "(.+)"
          target_label = "__scrape_timeout__"
        }
        rule {
          source_labels = ["__scrape_timeout__"]
          regex = ""
          replacement = "10s"
          target_label = "__scrape_timeout__"
        }
      }
    
      discovery.relabel "annotation_autodiscovery_http" {
        targets = array.concat(discovery.relabel.annotation_autodiscovery_pods.output, discovery.relabel.annotation_autodiscovery_services.output)
        rule {
          source_labels = ["__scheme__"]
          regex = "https"
          action = "drop"
        }
      }
    
      discovery.relabel "annotation_autodiscovery_https" {
        targets = array.concat(discovery.relabel.annotation_autodiscovery_pods.output, discovery.relabel.annotation_autodiscovery_services.output)
        rule {
          source_labels = ["__scheme__"]
          regex = "https"
          action = "keep"
        }
      }
    
      prometheus.scrape "annotation_autodiscovery_http" {
        targets = discovery.relabel.annotation_autodiscovery_http.output
        honor_labels = true
        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
        clustering {
          enabled = true
        }
    
        forward_to = argument.metrics_destinations.value
      }
    
      prometheus.scrape "annotation_autodiscovery_https" {
        targets = discovery.relabel.annotation_autodiscovery_https.output
        honor_labels = true
        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
        tls_config {
          insecure_skip_verify = true
        }
        clustering {
          enabled = true
        }
    
        forward_to = argument.metrics_destinations.value
      }
    }
    annotation_autodiscovery "feature" {
      metrics_destinations = [
        prometheus.remote_write.prometheus.receiver,
      ]
    }
    // Feature: Auto-Instrumentation
    declare "auto_instrumentation" {
      argument "metrics_destinations" {
        comment = "Must be a list of metric destinations where collected metrics should be forwarded to"
      }
    
      discovery.kubernetes "beyla_pods" {
        role = "pod"
        namespaces {
          own_namespace = true
        }
        selectors {
          role = "pod"
          label = "app.kubernetes.io/name=beyla"
        }
      }
    
      discovery.relabel "beyla_pods" {
        targets = discovery.kubernetes.beyla_pods.targets
        rule {
          source_labels = ["__meta_kubernetes_pod_node_name"]
          action = "replace"
          target_label = "instance"
        }
      }
    
      prometheus.scrape "beyla_applications" {
        targets         = discovery.relabel.beyla_pods.output
        honor_labels    = true
        scrape_interval = "60s"
        clustering {
          enabled = true
        }
        forward_to = argument.metrics_destinations.value
      }
    
      prometheus.scrape "beyla_internal" {
        targets         = discovery.relabel.beyla_pods.output
        metrics_path    = "/internal/metrics"
        job_name        = "integrations/beyla"
        honor_labels    = true
        scrape_interval = "60s"
        clustering {
          enabled = true
        }
        forward_to = argument.metrics_destinations.value
      }
    }
    auto_instrumentation "feature" {
      metrics_destinations = [
        prometheus.remote_write.prometheus.receiver,
      ]
    }
    // Feature: Cluster Metrics
    declare "cluster_metrics" {
      argument "metrics_destinations" {
        comment = "Must be a list of metric destinations where collected metrics should be forwarded to"
      }
      discovery.kubernetes "nodes" {
        role = "node"
      }
    
      // Kubelet
      discovery.relabel "kubelet" {
        targets = discovery.kubernetes.nodes.targets
      }
    
      prometheus.scrape "kubelet" {
        targets  = discovery.relabel.kubelet.output
        job_name = "integrations/kubernetes/kubelet"
        scheme   = "https"
        scrape_interval = "60s"
        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
    
        tls_config {
          ca_file = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
          insecure_skip_verify = true
          server_name = "kubernetes"
        }
    
        clustering {
          enabled = true
        }
    
        forward_to = [prometheus.relabel.kubelet.receiver]
      }
    
      prometheus.relabel "kubelet" {
        max_cache_size = 100000
        rule {
          source_labels = ["__name__"]
          regex = "up|scrape_samples_scraped|go_goroutines|kubelet_certificate_manager_client_expiration_renew_errors|kubelet_certificate_manager_client_ttl_seconds|kubelet_certificate_manager_server_ttl_seconds|kubelet_cgroup_manager_duration_seconds_bucket|kubelet_cgroup_manager_duration_seconds_count|kubelet_node_config_error|kubelet_node_name|kubelet_pleg_relist_duration_seconds_bucket|kubelet_pleg_relist_duration_seconds_count|kubelet_pleg_relist_interval_seconds_bucket|kubelet_pod_start_duration_seconds_bucket|kubelet_pod_start_duration_seconds_count|kubelet_pod_worker_duration_seconds_bucket|kubelet_pod_worker_duration_seconds_count|kubelet_running_container_count|kubelet_running_containers|kubelet_running_pod_count|kubelet_running_pods|kubelet_runtime_operations_errors_total|kubelet_runtime_operations_total|kubelet_server_expiration_renew_errors|kubelet_volume_stats_available_bytes|kubelet_volume_stats_capacity_bytes|kubelet_volume_stats_inodes|kubelet_volume_stats_inodes_free|kubelet_volume_stats_inodes_used|kubelet_volume_stats_used_bytes|kubernetes_build_info|namespace_workload_pod|process_cpu_seconds_total|process_resident_memory_bytes|rest_client_requests_total|storage_operation_duration_seconds_count|storage_operation_errors_total|volume_manager_total_volumes"
          action = "keep"
        }
    
        forward_to = argument.metrics_destinations.value
      }
    
      // Kubelet Resources
      discovery.relabel "kubelet_resources" {
        targets = discovery.kubernetes.nodes.targets
        rule {
          replacement   = "/metrics/resource"
          target_label  = "__metrics_path__"
        }
        // set the node label
        rule {
          source_labels = ["__meta_kubernetes_node_name"]
          target_label  = "node"
        }
    
        // set the app name if specified as metadata labels "app:" or "app.kubernetes.io/name:" or "k8s-app:"
        rule {
          action = "replace"
          source_labels = [
            "__meta_kubernetes_node_label_app_kubernetes_io_name",
            "__meta_kubernetes_node_label_k8s_app",
            "__meta_kubernetes_node_label_app",
          ]
          separator = ";"
          regex = "^(?:;*)?([^;]+).*$"
          replacement = "$1"
          target_label = "app"
        }
    
        // set a source label
        rule {
          action = "replace"
          replacement = "kubernetes"
          target_label = "source"
        }
      }
    
      prometheus.scrape "kubelet_resources" {
        targets  = discovery.relabel.kubelet_resources.output
        job_name = "integrations/kubernetes/resources"
        scheme   = "https"
        scrape_interval = "60s"
        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
    
        tls_config {
          ca_file = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
          insecure_skip_verify = true
          server_name = "kubernetes"
        }
    
        clustering {
          enabled = true
        }
    
        forward_to = [prometheus.relabel.kubelet_resources.receiver]
      }
    
      prometheus.relabel "kubelet_resources" {
        max_cache_size = 100000
        rule {
          source_labels = ["__name__"]
          regex = "up|scrape_samples_scraped|node_cpu_usage_seconds_total|node_memory_working_set_bytes"
          action = "keep"
        }
    
        forward_to = argument.metrics_destinations.value
      }
    
      // cAdvisor
      discovery.relabel "cadvisor" {
        targets = discovery.kubernetes.nodes.targets
        rule {
          replacement   = "/metrics/cadvisor"
          target_label  = "__metrics_path__"
        }
        rule {
          source_labels = ["__meta_kubernetes_node_name"]
          target_label  = "node"
        }
        // set the app name if specified as metadata labels "app:" or "app.kubernetes.io/name:" or "k8s-app:"
        rule {
          action = "replace"
          source_labels = [
            "__meta_kubernetes_node_label_app_kubernetes_io_name",
            "__meta_kubernetes_node_label_k8s_app",
            "__meta_kubernetes_node_label_app",
          ]
          separator = ";"
          regex = "^(?:;*)?([^;]+).*$"
          replacement = "$1"
          target_label = "app"
        }
    
        // set a source label
        rule {
          action = "replace"
          replacement = "kubernetes"
          target_label = "source"
        }
      }
    
      prometheus.scrape "cadvisor" {
        targets = discovery.relabel.cadvisor.output
        job_name = "integrations/kubernetes/cadvisor"
        scheme = "https"
        scrape_interval = "60s"
        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
    
        tls_config {
          ca_file = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
          insecure_skip_verify = true
          server_name = "kubernetes"
        }
    
        clustering {
          enabled = true
        }
    
        forward_to = [prometheus.relabel.cadvisor.receiver]
      }
    
      prometheus.relabel "cadvisor" {
        max_cache_size = 100000
        rule {
          source_labels = ["__name__"]
          regex = "up|scrape_samples_scraped|container_cpu_cfs_periods_total|container_cpu_cfs_throttled_periods_total|container_cpu_usage_seconds_total|container_fs_reads_bytes_total|container_fs_reads_total|container_fs_writes_bytes_total|container_fs_writes_total|container_memory_cache|container_memory_rss|container_memory_swap|container_memory_working_set_bytes|container_network_receive_bytes_total|container_network_receive_packets_dropped_total|container_network_receive_packets_total|container_network_transmit_bytes_total|container_network_transmit_packets_dropped_total|container_network_transmit_packets_total|machine_memory_bytes"
          action = "keep"
        }
        // Drop empty container labels, addressing https://github.com/google/cadvisor/issues/2688
        rule {
          source_labels = ["__name__","container"]
          separator = "@"
          regex = "(container_cpu_.*|container_fs_.*|container_memory_.*)@"
          action = "drop"
        }
        // Drop empty image labels, addressing https://github.com/google/cadvisor/issues/2688
        rule {
          source_labels = ["__name__","image"]
          separator = "@"
          regex = "(container_cpu_.*|container_fs_.*|container_memory_.*|container_network_.*)@"
          action = "drop"
        }
        // Normalizing unimportant labels (not deleting to continue satisfying <label>!="" checks)
        rule {
          source_labels = ["__name__", "boot_id"]
          separator = "@"
          regex = "machine_memory_bytes@.*"
          target_label = "boot_id"
          replacement = "NA"
        }
        rule {
          source_labels = ["__name__", "system_uuid"]
          separator = "@"
          regex = "machine_memory_bytes@.*"
          target_label = "system_uuid"
          replacement = "NA"
        }
        // Filter out non-physical devices/interfaces
        rule {
          source_labels = ["__name__", "device"]
          separator = "@"
          regex = "container_fs_.*@(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dasd.+)"
          target_label = "__keepme"
          replacement = "1"
        }
        rule {
          source_labels = ["__name__", "__keepme"]
          separator = "@"
          regex = "container_fs_.*@"
          action = "drop"
        }
        rule {
          source_labels = ["__name__"]
          regex = "container_fs_.*"
          target_label = "__keepme"
          replacement = ""
        }
        rule {
          source_labels = ["__name__", "interface"]
          separator = "@"
          regex = "container_network_.*@(en[ospx][0-9].*|wlan[0-9].*|eth[0-9].*)"
          target_label = "__keepme"
          replacement = "1"
        }
        rule {
          source_labels = ["__name__", "__keepme"]
          separator = "@"
          regex = "container_network_.*@"
          action = "drop"
        }
        rule {
          source_labels = ["__name__"]
          regex = "container_network_.*"
          target_label = "__keepme"
          replacement = ""
        }
        rule {
          source_labels = ["namespace"]
          regex = "kube-system|kube-public|confidential"
          action = "drop"
        }
        forward_to = argument.metrics_destinations.value
      }
      discovery.kubernetes "kube_state_metrics" {
        role = "endpoints"
    
        selectors {
          role = "endpoints"
          label = "app.kubernetes.io/name=kube-state-metrics,release=k8smon"
        }
        namespaces {
          names = ["default"]
        }
      }
    
      discovery.relabel "kube_state_metrics" {
        targets = discovery.kubernetes.kube_state_metrics.targets
    
        // only keep targets with a matching port name
        rule {
          source_labels = ["__meta_kubernetes_endpoint_port_name"]
          regex = "http"
          action = "keep"
        }
    
        rule {
          action = "replace"
          replacement = "kubernetes"
          target_label = "source"
        }
    
      }
    
      prometheus.scrape "kube_state_metrics" {
        targets = discovery.relabel.kube_state_metrics.output
        job_name = "integrations/kubernetes/kube-state-metrics"
        scrape_interval = "60s"
        scheme = "http"
        bearer_token_file = ""
        tls_config {
          insecure_skip_verify = true
        }
    
        clustering {
          enabled = true
        }
        forward_to = [prometheus.relabel.kube_state_metrics.receiver]
      }
    
      prometheus.relabel "kube_state_metrics" {
        max_cache_size = 100000
        rule {
          source_labels = ["__name__"]
          regex = "up|scrape_samples_scraped|kube_configmap_info|kube_configmap_metadata_resource_version|kube_daemonset.*|kube_deployment_metadata_generation|kube_deployment_spec_replicas|kube_deployment_status_condition|kube_deployment_status_observed_generation|kube_deployment_status_replicas_available|kube_deployment_status_replicas_updated|kube_horizontalpodautoscaler_spec_max_replicas|kube_horizontalpodautoscaler_spec_min_replicas|kube_horizontalpodautoscaler_status_current_replicas|kube_horizontalpodautoscaler_status_desired_replicas|kube_job.*|kube_namespace_status_phase|kube_node.*|kube_persistentvolume_status_phase|kube_persistentvolumeclaim_access_mode|kube_persistentvolumeclaim_info|kube_persistentvolumeclaim_labels|kube_persistentvolumeclaim_resource_requests_storage_bytes|kube_persistentvolumeclaim_status_phase|kube_pod_container_info|kube_pod_container_resource_limits|kube_pod_container_resource_requests|kube_pod_container_status_last_terminated_reason|kube_pod_container_status_restarts_total|kube_pod_container_status_waiting_reason|kube_pod_info|kube_pod_owner|kube_pod_spec_volumes_persistentvolumeclaims_info|kube_pod_start_time|kube_pod_status_phase|kube_pod_status_reason|kube_replicaset.*|kube_resourcequota|kube_secret_metadata_resource_version|kube_statefulset.*"
          action = "keep"
        }
        forward_to = argument.metrics_destinations.value
      }
    
      // Node Exporter
      discovery.kubernetes "node_exporter" {
        role = "pod"
    
        selectors {
          role = "pod"
          label = "app.kubernetes.io/name=node-exporter,release=k8smon"
        }
        namespaces {
          names = ["default"]
        }
      }
    
      discovery.relabel "node_exporter" {
        targets = discovery.kubernetes.node_exporter.targets
    
        // keep only the specified metrics port name, and pods that are Running and ready
        rule {
          source_labels = [
            "__meta_kubernetes_pod_container_port_name",
            "__meta_kubernetes_pod_container_init",
            "__meta_kubernetes_pod_phase",
            "__meta_kubernetes_pod_ready",
          ]
          separator = "@"
          regex = "metrics@false@Running@true"
          action = "keep"
        }
    
        // Set the instance label to the node name
        rule {
          source_labels = ["__meta_kubernetes_pod_node_name"]
          action = "replace"
          target_label = "instance"
        }
    
        // set the namespace label
        rule {
          source_labels = ["__meta_kubernetes_namespace"]
          target_label  = "namespace"
        }
    
        // set the pod label
        rule {
          source_labels = ["__meta_kubernetes_pod_name"]
          target_label  = "pod"
        }
    
        // set the container label
        rule {
          source_labels = ["__meta_kubernetes_pod_container_name"]
          target_label  = "container"
        }
    
        // set a workload label
        rule {
          source_labels = [
            "__meta_kubernetes_pod_controller_kind",
            "__meta_kubernetes_pod_controller_name",
          ]
          separator = "/"
          target_label  = "workload"
        }
        // remove the hash from the ReplicaSet
        rule {
          source_labels = ["workload"]
          regex = "(ReplicaSet/.+)-.+"
          target_label  = "workload"
        }
    
        // set the app name if specified as metadata labels "app:" or "app.kubernetes.io/name:" or "k8s-app:"
        rule {
          action = "replace"
          source_labels = [
            "__meta_kubernetes_pod_label_app_kubernetes_io_name",
            "__meta_kubernetes_pod_label_k8s_app",
            "__meta_kubernetes_pod_label_app",
          ]
          separator = ";"
          regex = "^(?:;*)?([^;]+).*$"
          replacement = "$1"
          target_label = "app"
        }
    
        // set the component if specified as metadata labels "component:" or "app.kubernetes.io/component:" or "k8s-component:"
        rule {
          action = "replace"
          source_labels = [
            "__meta_kubernetes_pod_label_app_kubernetes_io_component",
            "__meta_kubernetes_pod_label_k8s_component",
            "__meta_kubernetes_pod_label_component",
          ]
          regex = "^(?:;*)?([^;]+).*$"
          replacement = "$1"
          target_label = "component"
        }
    
        // set a source label
        rule {
          action = "replace"
          replacement = "kubernetes"
          target_label = "source"
        }
      }
    
      prometheus.scrape "node_exporter" {
        targets = discovery.relabel.node_exporter.output
        job_name = "integrations/node_exporter"
        scrape_interval = "60s"
        scheme = "http"
        bearer_token_file = ""
        tls_config {
          insecure_skip_verify = true
        }
    
        clustering {
          enabled = true
        }
        forward_to = [prometheus.relabel.node_exporter.receiver]
      }
    
      prometheus.relabel "node_exporter" {
        max_cache_size = 100000
        rule {
          source_labels = ["__name__"]
          regex = "up|scrape_samples_scraped|node_cpu.*|node_exporter_build_info|node_filesystem.*|node_memory.*|node_network_receive_bytes_total|node_network_receive_drop_total|node_network_transmit_bytes_total|node_network_transmit_drop_total|process_cpu_seconds_total|process_resident_memory_bytes"
          action = "keep"
        }
        // Drop metrics for certain file systems
        rule {
          source_labels = ["__name__", "fstype"]
          separator = "@"
          regex = "node_filesystem.*@(ramfs|tmpfs)"
          action = "drop"
        }
        forward_to = argument.metrics_destinations.value
      }
    
      discovery.kubernetes "windows_exporter_pods" {
        role = "pod"
        namespaces {
          names = ["default"]
        }
        selectors {
          role = "pod"
          label = "app.kubernetes.io/name=windows-exporter,release=k8smon"
        }
      }
    
      discovery.relabel "windows_exporter" {
        targets = discovery.kubernetes.windows_exporter_pods.targets
        rule {
          source_labels = ["__meta_kubernetes_pod_node_name"]
          action = "replace"
          target_label = "instance"
        }
      }
    
      prometheus.scrape "windows_exporter" {
        job_name   = "integrations/windows-exporter"
        targets  = discovery.relabel.windows_exporter.output
        scrape_interval = "60s"
        clustering {
          enabled = true
        }
        forward_to = [prometheus.relabel.windows_exporter.receiver]
      }
    
      prometheus.relabel "windows_exporter" {
        max_cache_size = 100000
        rule {
          source_labels = ["__name__"]
          regex = "up|scrape_samples_scraped|windows_.*|node_cpu_seconds_total|node_filesystem_size_bytes|node_filesystem_avail_bytes|container_cpu_usage_seconds_total"
          action = "keep"
        }
        forward_to = argument.metrics_destinations.value
      }
    }
    cluster_metrics "feature" {
      metrics_destinations = [
        prometheus.remote_write.prometheus.receiver,
      ]
    }
    // Feature: Prometheus Operator Objects
    declare "prometheus_operator_objects" {
      argument "metrics_destinations" {
        comment = "Must be a list of metric destinations where collected metrics should be forwarded to"
      }
    
      // Prometheus Operator PodMonitor objects
      prometheus.operator.podmonitors "pod_monitors" {
        clustering {
          enabled = true
        }
        scrape {
          default_scrape_interval = "60s"
        }
        rule {
          source_labels = ["__meta_kubernetes_namespace"]
          regex = "kube-system|kube-public|confidential"
          action = "drop"
        }
        forward_to = argument.metrics_destinations.value
      }
    
      // Prometheus Operator Probe objects
      prometheus.operator.probes "probes" {
        clustering {
          enabled = true
        }
        scrape {
          default_scrape_interval = "60s"
        }
        rule {
          source_labels = ["__meta_kubernetes_namespace"]
          regex = "kube-system|kube-public|confidential"
          action = "drop"
        }
        forward_to = argument.metrics_destinations.value
      }
    
      // Prometheus Operator ServiceMonitor objects
      prometheus.operator.servicemonitors "service_monitors" {
        clustering {
          enabled = true
        }
        scrape {
          default_scrape_interval = "60s"
        }
        rule {
          source_labels = ["__meta_kubernetes_namespace"]
          regex = "kube-system|kube-public|confidential"
          action = "drop"
        }
        forward_to = argument.metrics_destinations.value
      }
    }
    prometheus_operator_objects "feature" {
      metrics_destinations = [
        prometheus.remote_write.prometheus.receiver,
      ]
    }
---
# Source: k8s-monitoring/templates/alloy-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: k8smon-alloy-singleton
  namespace: default
data:
  config.alloy: |-
    // Destination: prometheus (prometheus)
    otelcol.exporter.prometheus "prometheus" {
      add_metric_suffixes = true
      forward_to = [prometheus.remote_write.prometheus.receiver]
    }
    
    prometheus.remote_write "prometheus" {
      endpoint {
        url = "http://prometheus.prometheus.svc:9090/api/v1/write"
        headers = {
        }
        tls_config {
          insecure_skip_verify = false
        }
        send_native_histograms = false
    
        queue_config {
          capacity = 10000
          min_shards = 1
          max_shards = 50
          max_samples_per_send = 2000
          batch_send_deadline = "5s"
          min_backoff = "30ms"
          max_backoff = "5s"
          retry_on_http_429 = true
          sample_age_limit = "0s"
        }
    
        write_relabel_config {
          source_labels = ["cluster"]
          regex = ""
          replacement = "exclude-by-namespace-cluster"
          target_label = "cluster"
        }
        write_relabel_config {
          source_labels = ["k8s.cluster.name"]
          regex = ""
          replacement = "exclude-by-namespace-cluster"
          target_label = "cluster"
        }
      }
    
      wal {
        truncate_frequency = "2h"
        min_keepalive_time = "5m"
        max_keepalive_time = "8h"
      }
    }
    // Destination: loki (loki)
    otelcol.exporter.loki "loki" {
      forward_to = [loki.write.loki.receiver]
    }
    
    loki.write "loki" {
      endpoint {
        url = "http://loki.loki.svc:3100/api/push"
        tls_config {
          insecure_skip_verify = false
        }
        min_backoff_period = "500ms"
        max_backoff_period = "5m"
        max_backoff_retries = "10"
      }
      external_labels = {
        cluster = "exclude-by-namespace-cluster",
        "k8s_cluster_name" = "exclude-by-namespace-cluster",
      }
    }
    // Feature: Cluster Events
    declare "cluster_events" {
      argument "logs_destinations" {
        comment = "Must be a list of log destinations where collected logs should be forwarded to"
      }
    
      loki.source.kubernetes_events "cluster_events" {
        job_name   = "integrations/kubernetes/eventhandler"
        log_format = "logfmt"
        forward_to = [loki.process.cluster_events.receiver]
      }
    
      loki.process "cluster_events" {
        stage.drop {
          source = "namespace"
          expression = "kube-system|kube-public|confidential"
          drop_counter_reason = "excluded_namespaces"
        }
    
        // add a static source label to the logs so they can be differentiated / restricted if necessary
        stage.static_labels {
          values = {
            "source" = "kubernetes-events",
          }
        }
    
        // extract some of the fields from the log line, these could be used as labels, structured metadata, etc.
        stage.logfmt {
          mapping = {
            "component" = "sourcecomponent", // map the sourcecomponent field to component
            "kind" = "",
            "level" = "type", // most events don't have a level but they do have a "type" i.e. Normal, Warning, Error, etc.
            "name" = "",
            "node" = "sourcehost", // map the sourcehost field to node
          }
        }
        // set these values as labels, they may or may not be used as index labels in Loki as they can be dropped
        // prior to being written to Loki, but this makes them available
        stage.labels {
          values = {
            "component" = "",
            "kind" = "",
            "level" = "",
            "name" = "",
            "node" = "",
          }
        }
    
        // if kind=Node, set the node label by copying the instance label
        stage.match {
          selector = "{kind=\"Node\"}"
    
          stage.labels {
            values = {
              "node" = "name",
            }
          }
        }
    
        // set the level extracted key value as a normalized log level
        stage.match {
          selector = "{level=\"Normal\"}"
    
          stage.static_labels {
            values = {
              level = "Info",
            }
          }
        }
    
        // Only keep the labels that are defined in the `keepLabels` list.
        stage.label_keep {
          values = ["job","level","namespace","node","source"]
        }
        forward_to = argument.logs_destinations.value
      }
    }
    cluster_events "feature" {
      logs_destinations = [
        loki.write.loki.receiver,
      ]
    }
    // Self Reporting
    prometheus.exporter.unix "kubernetes_monitoring_telemetry" {
      set_collectors = ["textfile"]
      textfile {
        directory = "/etc/alloy"
      }
    }
    
    discovery.relabel "kubernetes_monitoring_telemetry" {
      targets = prometheus.exporter.unix.kubernetes_monitoring_telemetry.targets
      rule {
        target_label = "instance"
        action = "replace"
        replacement = "k8smon"
      }
      rule {
        target_label = "job"
        action = "replace"
        replacement = "integrations/kubernetes/kubernetes_monitoring_telemetry"
      }
    }
    
    prometheus.scrape "kubernetes_monitoring_telemetry" {
      job_name   = "integrations/kubernetes/kubernetes_monitoring_telemetry"
      targets    = discovery.relabel.kubernetes_monitoring_telemetry.output
      scrape_interval = "60s"
      clustering {
        enabled = true
      }
      forward_to = [prometheus.relabel.kubernetes_monitoring_telemetry.receiver]
    }
    
    prometheus.relabel "kubernetes_monitoring_telemetry" {
      rule {
        source_labels = ["__name__"]
        regex = "grafana_kubernetes_monitoring_.*"
        action = "keep"
      }
      forward_to = [
        prometheus.remote_write.prometheus.receiver,
      ]
    }

  self-reporting-metric.prom: |
    
    # HELP grafana_kubernetes_monitoring_build_info A metric to report the version of the Kubernetes Monitoring Helm chart
    # TYPE grafana_kubernetes_monitoring_build_info gauge
    grafana_kubernetes_monitoring_build_info{version="2.0.21", namespace="default"} 1
    # HELP grafana_kubernetes_monitoring_feature_info A metric to report the enabled features of the Kubernetes Monitoring Helm chart
    # TYPE grafana_kubernetes_monitoring_feature_info gauge
    grafana_kubernetes_monitoring_feature_info{feature="annotationAutodiscovery", version="1.0.0"} 1
    grafana_kubernetes_monitoring_feature_info{feature="applicationObservability", protocols="otlpgrpc", version="1.0.0"} 1
    grafana_kubernetes_monitoring_feature_info{feature="autoInstrumentation", version="1.0.0"} 1
    grafana_kubernetes_monitoring_feature_info{deployments="kube-state-metrics,node-exporter,windows-exporter", feature="clusterMetrics", sources="kubelet,kubeletResource,cadvisor,kube-state-metrics,node-exporter,windows-exporter", version="1.0.0"} 1
    grafana_kubernetes_monitoring_feature_info{feature="clusterEvents", version="1.0.0"} 1
    grafana_kubernetes_monitoring_feature_info{feature="podLogs", method="volumes", version="1.0.0"} 1
    grafana_kubernetes_monitoring_feature_info{feature="profiling", method="", version="1.0.0"} 1
    grafana_kubernetes_monitoring_feature_info{feature="prometheusOperatorObjects", sources="ServiceMonitors,PodMonitors,Probes", version="1.0.0"} 1
---
# Source: k8s-monitoring/templates/alloy-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: k8smon-alloy-logs
  namespace: default
data:
  config.alloy: |-
    // Destination: loki (loki)
    otelcol.exporter.loki "loki" {
      forward_to = [loki.write.loki.receiver]
    }
    
    loki.write "loki" {
      endpoint {
        url = "http://loki.loki.svc:3100/api/push"
        tls_config {
          insecure_skip_verify = false
        }
        min_backoff_period = "500ms"
        max_backoff_period = "5m"
        max_backoff_retries = "10"
      }
      external_labels = {
        cluster = "exclude-by-namespace-cluster",
        "k8s_cluster_name" = "exclude-by-namespace-cluster",
      }
    }
    // Feature: Pod Logs
    declare "pod_logs" {
      argument "logs_destinations" {
        comment = "Must be a list of log destinations where collected logs should be forwarded to"
      }
    
      discovery.relabel "filtered_pods" {
        targets = discovery.kubernetes.pods.targets
        rule {
          source_labels = ["__meta_kubernetes_namespace"]
          action = "replace"
          target_label = "namespace"
        }
        rule {
          source_labels = ["namespace"]
          regex = "kube-system|kube-public|confidential"
          action = "drop"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_name"]
          action = "replace"
          target_label = "pod"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_container_name"]
          action = "replace"
          target_label = "container"
        }
        rule {
          source_labels = ["__meta_kubernetes_namespace", "__meta_kubernetes_pod_container_name"]
          separator = "/"
          action = "replace"
          replacement = "$1"
          target_label = "job"
        }
    
        // set the container runtime as a label
        rule {
          action = "replace"
          source_labels = ["__meta_kubernetes_pod_container_id"]
          regex = "^(\\S+):\\/\\/.+$"
          replacement = "$1"
          target_label = "tmp_container_runtime"
        }
    
        // make all labels on the pod available to the pipeline as labels,
        // they are omitted before write to loki via stage.label_keep unless explicitly set
        rule {
          action = "labelmap"
          regex = "__meta_kubernetes_pod_label_(.+)"
        }
    
        // make all annotations on the pod available to the pipeline as labels,
        // they are omitted before write to loki via stage.label_keep unless explicitly set
        rule {
          action = "labelmap"
          regex = "__meta_kubernetes_pod_annotation_(.+)"
        }
    
        // explicitly set service_name. if not set, loki will automatically try to populate a default.
        // see https://grafana.com/docs/loki/latest/get-started/labels/#default-labels-for-all-users
        //
        // choose the first value found from the following ordered list:
        // - pod.annotation[resource.opentelemetry.io/service.name]
        // - pod.label[app.kubernetes.io/name]
        // - k8s.pod.name
        // - k8s.container.name
        rule {
          action = "replace"
          source_labels = [
            "__meta_kubernetes_pod_annotation_resource_opentelemetry_io_service_name",
            "__meta_kubernetes_pod_label_app_kubernetes_io_name",
            "__meta_kubernetes_pod_name",
            "__meta_kubernetes_pod_container_name",
          ]
          separator = ";"
          regex = "^(?:;*)?([^;]+).*$"
          replacement = "$1"
          target_label = "service_name"
        }
    
        // set resource attributes
        rule {
          action = "labelmap"
          regex = "__meta_kubernetes_pod_annotation_resource_opentelemetry_io_(.+)"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_logs_job"]
          regex = "(.+)"
          target_label = "job"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_label_app_kubernetes_io_name"]
          regex = "(.+)"
          target_label = "app_kubernetes_io_name"
        }
      }
    
      discovery.kubernetes "pods" {
        role = "pod"
        selectors {
          role = "pod"
          field = "spec.nodeName=" + sys.env("HOSTNAME")
        }
      }
    
      discovery.relabel "filtered_pods_with_paths" {
        targets = discovery.relabel.filtered_pods.output
    
        rule {
          source_labels = ["__meta_kubernetes_pod_uid", "__meta_kubernetes_pod_container_name"]
          separator = "/"
          action = "replace"
          replacement = "/var/log/pods/*$1/*.log"
          target_label = "__path__"
        }
      }
    
      local.file_match "pod_logs" {
        path_targets = discovery.relabel.filtered_pods_with_paths.output
      }
    
      loki.source.file "pod_logs" {
        targets    = local.file_match.pod_logs.targets
        forward_to = [loki.process.pod_logs.receiver]
      }
    
      loki.process "pod_logs" {
        stage.match {
          selector = "{tmp_container_runtime=~\"containerd|cri-o\"}"
          // the cri processing stage extracts the following k/v pairs: log, stream, time, flags
          stage.cri {}
    
          // Set the extract flags and stream values as labels
          stage.labels {
            values = {
              flags  = "",
              stream  = "",
            }
          }
        }
    
        stage.match {
          selector = "{tmp_container_runtime=\"docker\"}"
          // the docker processing stage extracts the following k/v pairs: log, stream, time
          stage.docker {}
    
          // Set the extract stream value as a label
          stage.labels {
            values = {
              stream  = "",
            }
          }
        }
    
        // Drop the filename label, since it's not really useful in the context of Kubernetes, where we already have cluster,
        // namespace, pod, and container labels. Drop any structured metadata. Also drop the temporary
        // container runtime label as it is no longer needed.
        stage.label_drop {
          values = [
            "filename",
            "tmp_container_runtime",
          ]
        }
    
        // Only keep the labels that are defined in the `keepLabels` list.
        stage.label_keep {
          values = ["app_kubernetes_io_name","container","instance","job","level","namespace","pod","service_name","service_namespace","deployment_environment","deployment_environment_name","k8s_pod_name","k8s_namespace_name","k8s_deployment_name","k8s_statefulset_name","k8s_daemonset_name","k8s_cronjob_name","k8s_job_name","k8s_node_name"]
        }
    
        forward_to = argument.logs_destinations.value
      }
    }
    pod_logs "feature" {
      logs_destinations = [
        loki.write.loki.receiver,
      ]
    }
---
# Source: k8s-monitoring/templates/alloy-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: k8smon-alloy-receiver
  namespace: default
data:
  config.alloy: |-
    // Destination: prometheus (prometheus)
    otelcol.exporter.prometheus "prometheus" {
      add_metric_suffixes = true
      forward_to = [prometheus.remote_write.prometheus.receiver]
    }
    
    prometheus.remote_write "prometheus" {
      endpoint {
        url = "http://prometheus.prometheus.svc:9090/api/v1/write"
        headers = {
        }
        tls_config {
          insecure_skip_verify = false
        }
        send_native_histograms = false
    
        queue_config {
          capacity = 10000
          min_shards = 1
          max_shards = 50
          max_samples_per_send = 2000
          batch_send_deadline = "5s"
          min_backoff = "30ms"
          max_backoff = "5s"
          retry_on_http_429 = true
          sample_age_limit = "0s"
        }
    
        write_relabel_config {
          source_labels = ["cluster"]
          regex = ""
          replacement = "exclude-by-namespace-cluster"
          target_label = "cluster"
        }
        write_relabel_config {
          source_labels = ["k8s.cluster.name"]
          regex = ""
          replacement = "exclude-by-namespace-cluster"
          target_label = "cluster"
        }
      }
    
      wal {
        truncate_frequency = "2h"
        min_keepalive_time = "5m"
        max_keepalive_time = "8h"
      }
    }
    // Destination: loki (loki)
    otelcol.exporter.loki "loki" {
      forward_to = [loki.write.loki.receiver]
    }
    
    loki.write "loki" {
      endpoint {
        url = "http://loki.loki.svc:3100/api/push"
        tls_config {
          insecure_skip_verify = false
        }
        min_backoff_period = "500ms"
        max_backoff_period = "5m"
        max_backoff_retries = "10"
      }
      external_labels = {
        cluster = "exclude-by-namespace-cluster",
        "k8s_cluster_name" = "exclude-by-namespace-cluster",
      }
    }
    // Destination: tempo (otlp)
    
    otelcol.processor.attributes "tempo" {
      output {
        metrics = [otelcol.processor.transform.tempo.input]
        logs = [otelcol.processor.transform.tempo.input]
        traces = [otelcol.processor.transform.tempo.input]
      }
    }
    
    otelcol.processor.transform "tempo" {
      error_mode = "ignore"
      metric_statements {
        context = "resource"
        statements = [
          `set(attributes["cluster"], "exclude-by-namespace-cluster")`,
          `set(attributes["k8s.cluster.name"], "exclude-by-namespace-cluster")`,
        ]
      }
    
      metric_statements {
        context = "datapoint"
        statements = [
          `set(attributes["cluster"], "exclude-by-namespace-cluster")`,
          `set(attributes["k8s.cluster.name"], "exclude-by-namespace-cluster")`,
        ]
      }
      log_statements {
        context = "resource"
        statements = [
          `set(attributes["cluster"], "exclude-by-namespace-cluster")`,
          `set(attributes["k8s.cluster.name"], "exclude-by-namespace-cluster")`,
        ]
      }
    
      log_statements {
        context = "log"
        statements = [
          `delete_key(attributes, "loki.attribute.labels")`,
          `delete_key(attributes, "loki.resource.labels")`,
          `set(resource.attributes["service.name"], attributes["service_name"]) where resource.attributes["service.name"] == nil and attributes["service_name"] != nil`,
          `delete_key(attributes, "service_name") where attributes["service_name"] != nil`,
          `set(resource.attributes["service.namespace"], attributes["service_namespace"] ) where resource.attributes["service.namespace"] == nil and attributes["service_namespace"] != nil`,
          `delete_key(attributes, "service_namespace") where attributes["service_namespace"] != nil`,
          `set(resource.attributes["deployment.environment.name"], attributes["deployment_environment_name"] ) where resource.attributes["deployment.environment.name"] == nil and attributes["deployment_environment_name"] != nil`,
          `delete_key(attributes, "deployment_environment_name") where attributes["deployment_environment_name"] != nil`,
          `set(resource.attributes["deployment.environment"], attributes["deployment_environment"] ) where resource.attributes["deployment.environment"] == nil and attributes["deployment_environment"] != nil`,
          `delete_key(attributes, "deployment_environment") where attributes["deployment_environment"] != nil`,
        ]
      }
    
      trace_statements {
        context = "resource"
        statements = [
          `set(attributes["cluster"], "exclude-by-namespace-cluster")`,
          `set(attributes["k8s.cluster.name"], "exclude-by-namespace-cluster")`,
        ]
      }
    
      output {
        metrics = [otelcol.processor.batch.tempo.input]
        logs = [otelcol.processor.batch.tempo.input]
        traces = [otelcol.processor.batch.tempo.input]
      }
    }
    
    otelcol.processor.batch "tempo" {
      timeout = "2s"
      send_batch_size = 8192
      send_batch_max_size = 0
    
      output {
        metrics = [otelcol.exporter.otlphttp.tempo.input]
        logs = [otelcol.exporter.otlphttp.tempo.input]
        traces = [otelcol.exporter.otlphttp.tempo.input]
      }
    }
    otelcol.exporter.otlphttp "tempo" {
      client {
        endpoint = "http://tempo.tempo.svc:443/otlp"
        tls {
          insecure = false
          insecure_skip_verify = false
        }
      }
    
      retry_on_failure {
        enabled = true
        initial_interval = "5s"
        max_interval = "30s"
        max_elapsed_time = "5m"
      }
    }
    // Feature: Application Observability
    declare "application_observability" {
      argument "metrics_destinations" {
        comment = "Must be a list of metrics destinations where collected metrics should be forwarded to"
      }
    
      argument "logs_destinations" {
        comment = "Must be a list of log destinations where collected logs should be forwarded to"
      }
    
      argument "traces_destinations" {
        comment = "Must be a list of trace destinations where collected trace should be forwarded to"
      }
    
      // OTLP Receiver
      otelcol.receiver.otlp "receiver" {
        grpc {
          endpoint = "0.0.0.0:4317"
        }
        debug_metrics {
          disable_high_cardinality_metrics = true
        }
        output {
          metrics = [otelcol.processor.resourcedetection.default.input]
          logs = [otelcol.processor.resourcedetection.default.input]
          traces = [otelcol.processor.resourcedetection.default.input]
        }
      }
    
      // Resource Detection Processor
      otelcol.processor.resourcedetection "default" {
        detectors = ["env","system"]
    
        system {
          hostname_sources = ["os"]
        }
    
        output {
          metrics = [otelcol.processor.k8sattributes.default.input]
          logs = [otelcol.processor.k8sattributes.default.input]
          traces = [otelcol.processor.k8sattributes.default.input]
        }
      }
    
      // K8s Attributes Processor
      otelcol.processor.k8sattributes "default" {
        extract {
          metadata = ["k8s.namespace.name","k8s.pod.name","k8s.deployment.name","k8s.statefulset.name","k8s.daemonset.name","k8s.cronjob.name","k8s.job.name","k8s.node.name","k8s.pod.uid","k8s.pod.start_time"]
        }
        pod_association {
          source {
            from = "resource_attribute"
            name = "k8s.pod.ip"
          }
        }
        pod_association {
          source {
            from = "resource_attribute"
            name = "k8s.pod.uid"
          }
        }
        pod_association {
          source {
            from = "connection"
          }
        }
    
        output {
          metrics = [otelcol.processor.transform.default.input]
          logs = [otelcol.processor.transform.default.input]
          traces = [otelcol.processor.transform.default.input, otelcol.connector.host_info.default.input]
        }
      }
    
      // Host Info Connector
      otelcol.connector.host_info "default" {
        host_identifiers = [ "k8s.node.name" ]
    
        output {
          metrics = [otelcol.processor.batch.default.input]
        }
      }
    
      // Transform Processor
      otelcol.processor.transform "default" {
        error_mode = "ignore"
        log_statements {
          context = "resource"
          statements = [
            "set(attributes[\"pod\"], attributes[\"k8s.pod.name\"])",
            "set(attributes[\"namespace\"], attributes[\"k8s.namespace.name\"])",
            "set(attributes[\"loki.resource.labels\"], \"cluster, namespace, job, pod\")",
          ]
        }
    
        output {
          metrics = [otelcol.processor.filter.default.input]
          logs = [otelcol.processor.filter.default.input]
          traces = [otelcol.processor.filter.default.input]
        }
      }
    
      // Filter Processor
      otelcol.processor.filter "default" {
        metrics {
          metric = [
            "IsMatch(resource.attributes[\"k8s.namespace.name\"], \"^kube-system|kube-public|confidential$\")",
          ]
        }
        output {
          metrics = [otelcol.processor.batch.default.input]
          logs = [otelcol.processor.batch.default.input]
          traces = [otelcol.processor.batch.default.input]
        }
      }
    
      // Batch Processor
      otelcol.processor.batch "default" {
        send_batch_size = 8192
        send_batch_max_size = 0
        timeout = "2s"
    
        output {
          metrics = argument.metrics_destinations.value
          logs = argument.logs_destinations.value
          traces = argument.traces_destinations.value
        }
      }
    }
    application_observability "feature" {
      metrics_destinations = [
        otelcol.exporter.prometheus.prometheus.input,
      ]
      logs_destinations = [
        otelcol.exporter.loki.loki.input,
      ]
      traces_destinations = [
        otelcol.processor.attributes.tempo.input,
      ]
    }
---
# Source: k8s-monitoring/templates/alloy-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: k8smon-alloy-profiles
  namespace: default
data:
  config.alloy: |-
    // Destination: pyroscope (pyroscope)
    pyroscope.write "pyroscope" {
      endpoint {
        url = "http://pyroscope.pyroscope.svc:4040"
        headers = {
        }
        tls_config {
          insecure_skip_verify = false
        }
        min_backoff_period = "500ms"
        max_backoff_period = "5m"
        max_backoff_retries = "10"
      }
    
      external_labels = {
        cluster = "exclude-by-namespace-cluster",
        k8s_cluster_name = "exclude-by-namespace-cluster",
      }
    }
    // Feature: Profiling
    declare "profiling" {
      argument "profiles_destinations" {
        comment = "Must be a list of profile destinations where collected profiles should be forwarded to"
      }
      // Profiles: eBPF
      discovery.kubernetes "ebpf_pods" {
        selectors {
          role = "pod"
          field = "spec.nodeName=" + sys.env("HOSTNAME")
        }
        role = "pod"
      }
    
      discovery.relabel "ebpf_pods" {
        targets = discovery.kubernetes.ebpf_pods.targets
        rule {
          source_labels = ["__meta_kubernetes_pod_phase"]
          regex = "Succeeded|Failed|Completed"
          action = "drop"
        }
        rule {
          source_labels = ["__meta_kubernetes_namespace"]
          target_label = "namespace"
        }
        rule {
          source_labels = ["namespace"]
          regex = "kube-system|kube-public|confidential"
          action = "drop"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_name"]
          target_label = "pod"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_node_name"]
          target_label = "node"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_container_name"]
          target_label = "container"
        }
        // provide arbitrary service_name label, otherwise it will be set to {__meta_kubernetes_namespace}/{__meta_kubernetes_pod_container_name}
        rule {
          source_labels = ["__meta_kubernetes_namespace", "__meta_kubernetes_pod_container_name"]
          separator = "@"
          regex = "(.*)@(.*)"
          replacement = "ebpf/${1}/${2}"
          target_label = "service_name"
        }
      }
    
      pyroscope.ebpf "ebpf_pods" {
        targets = discovery.relabel.ebpf_pods.output
        demangle = "none"
        forward_to = argument.profiles_destinations.value
      }
      // Profiles: Java
      discovery.kubernetes "java_pods" {
        selectors {
          role = "pod"
          field = "spec.nodeName=" + sys.env("HOSTNAME")
        }
        role = "pod"
      }
    
      discovery.process "java_pods" {
        join = discovery.kubernetes.java_pods.targets
      }
    
      discovery.relabel "java_pods" {
        targets = discovery.process.java_pods.targets
        rule {
          source_labels = ["__meta_kubernetes_pod_phase"]
          regex = "Succeeded|Failed|Completed"
          action = "drop"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_name"]
          regex = "^$"
          action = "drop"
        }
        rule {
          source_labels = ["__meta_process_exe"]
          action = "keep"
          regex = ".*/java$"
        }
        rule {
          source_labels = ["__meta_kubernetes_namespace"]
          target_label = "namespace"
        }
        rule {
          source_labels = ["namespace"]
          regex = "kube-system|kube-public|confidential"
          action = "drop"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_name"]
          target_label = "pod"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_node_name"]
          target_label = "node"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_container_name"]
          target_label = "container"
        }
      }
    
      pyroscope.java "java_pods" {
        targets = discovery.relabel.java_pods.output
        profiling_config {
          interval = "60s"
          alloc = "512k"
          cpu = true
          sample_rate = 100
          lock = "10ms"
        }
        forward_to = argument.profiles_destinations.value
      }
      // Profiles: pprof
      discovery.kubernetes "pprof_pods" {
        selectors {
          role = "pod"
          field = "spec.nodeName=" + sys.env("HOSTNAME")
        }
        role = "pod"
      }
    
      discovery.relabel "pprof_pods" {
        targets = discovery.kubernetes.pprof_pods.targets
        rule {
          action        = "drop"
          source_labels = ["__meta_kubernetes_pod_phase"]
          regex         = "Pending|Succeeded|Failed|Completed"
        }
    
        rule {
          regex  = "__meta_kubernetes_pod_label_(.+)"
          action = "labelmap"
        }
        rule {
          source_labels = ["__meta_kubernetes_namespace"]
          target_label  = "namespace"
        }
        rule {
          source_labels = ["namespace"]
          regex = "kube-system|kube-public|confidential"
          action = "drop"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_name"]
          target_label  = "pod"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_container_name"]
          target_label  = "container"
        }
      }
    
      discovery.relabel "pprof_pods_block_default_name" {
        targets = discovery.relabel.pprof_pods.output
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_block_scrape"]
          regex         = "true"
          action        = "keep"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_block_port_name"]
          regex         = ""
          action        = "keep"
        }
    
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_block_scheme"]
          action        = "replace"
          regex         = "(https?)"
          target_label  = "__scheme__"
          replacement   = "$1"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_block_path"]
          action        = "replace"
          regex         = "(.+)"
          target_label  = "__profile_path__"
          replacement   = "$1"
        }
        rule {
          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_block_port"]
          action        = "replace"
          regex         = "(.+?)(?::\\d+)?;(\\d+)"
          target_label  = "__address__"
          replacement   = "$1:$2"
        }
      }
    
      discovery.relabel "pprof_pods_block_custom_name" {
        targets = discovery.relabel.pprof_pods.output
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_block_scrape"]
          regex         = "true"
          action        = "keep"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_block_port_name"]
          regex         = ""
          action        = "drop"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_container_port_name"]
          target_label  = "__meta_kubernetes_pod_annotation_profiles_grafana_com_block_port_name"
          action        = "keepequal"
        }
    
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_block_scheme"]
          action        = "replace"
          regex         = "(https?)"
          target_label  = "__scheme__"
          replacement   = "$1"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_block_path"]
          action        = "replace"
          regex         = "(.+)"
          target_label  = "__profile_path__"
          replacement   = "$1"
        }
        rule {
          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_block_port"]
          action        = "replace"
          regex         = "(.+?)(?::\\d+)?;(\\d+)"
          target_label  = "__address__"
          replacement   = "$1:$2"
        }
      }
    
      pyroscope.scrape "pyroscope_scrape_block" {
        targets = array.concat(discovery.relabel.pprof_pods_block_default_name.output, discovery.relabel.pprof_pods_block_custom_name.output)
    
        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
        profiling_config {
          profile.block {
            enabled = true
          }
          profile.process_cpu {
            enabled = false
          }
          profile.fgprof {
            enabled = false
          }
          profile.godeltaprof_block {
            enabled = false
          }
          profile.godeltaprof_memory {
            enabled = false
          }
          profile.godeltaprof_mutex {
            enabled = false
          }
          profile.goroutine {
            enabled = false
          }
          profile.memory {
            enabled = false
          }
          profile.mutex {
            enabled = false
          }
        }
    
        forward_to = argument.profiles_destinations.value
      }
      discovery.relabel "pprof_pods_cpu_default_name" {
        targets = discovery.relabel.pprof_pods.output
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_scrape"]
          regex         = "true"
          action        = "keep"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_port_name"]
          regex         = ""
          action        = "keep"
        }
    
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_scheme"]
          action        = "replace"
          regex         = "(https?)"
          target_label  = "__scheme__"
          replacement   = "$1"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_path"]
          action        = "replace"
          regex         = "(.+)"
          target_label  = "__profile_path__"
          replacement   = "$1"
        }
        rule {
          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_port"]
          action        = "replace"
          regex         = "(.+?)(?::\\d+)?;(\\d+)"
          target_label  = "__address__"
          replacement   = "$1:$2"
        }
      }
    
      discovery.relabel "pprof_pods_cpu_custom_name" {
        targets = discovery.relabel.pprof_pods.output
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_scrape"]
          regex         = "true"
          action        = "keep"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_port_name"]
          regex         = ""
          action        = "drop"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_container_port_name"]
          target_label  = "__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_port_name"
          action        = "keepequal"
        }
    
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_scheme"]
          action        = "replace"
          regex         = "(https?)"
          target_label  = "__scheme__"
          replacement   = "$1"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_path"]
          action        = "replace"
          regex         = "(.+)"
          target_label  = "__profile_path__"
          replacement   = "$1"
        }
        rule {
          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_port"]
          action        = "replace"
          regex         = "(.+?)(?::\\d+)?;(\\d+)"
          target_label  = "__address__"
          replacement   = "$1:$2"
        }
      }
    
      pyroscope.scrape "pyroscope_scrape_cpu" {
        targets = array.concat(discovery.relabel.pprof_pods_cpu_default_name.output, discovery.relabel.pprof_pods_cpu_custom_name.output)
    
        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
        profiling_config {
          profile.block {
            enabled = false
          }
          profile.process_cpu {
            enabled = true
          }
          profile.fgprof {
            enabled = false
          }
          profile.godeltaprof_block {
            enabled = false
          }
          profile.godeltaprof_memory {
            enabled = false
          }
          profile.godeltaprof_mutex {
            enabled = false
          }
          profile.goroutine {
            enabled = false
          }
          profile.memory {
            enabled = false
          }
          profile.mutex {
            enabled = false
          }
        }
    
        forward_to = argument.profiles_destinations.value
      }
      discovery.relabel "pprof_pods_fgprof_default_name" {
        targets = discovery.relabel.pprof_pods.output
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_scrape"]
          regex         = "true"
          action        = "keep"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_port_name"]
          regex         = ""
          action        = "keep"
        }
    
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_scheme"]
          action        = "replace"
          regex         = "(https?)"
          target_label  = "__scheme__"
          replacement   = "$1"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_path"]
          action        = "replace"
          regex         = "(.+)"
          target_label  = "__profile_path__"
          replacement   = "$1"
        }
        rule {
          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_port"]
          action        = "replace"
          regex         = "(.+?)(?::\\d+)?;(\\d+)"
          target_label  = "__address__"
          replacement   = "$1:$2"
        }
      }
    
      discovery.relabel "pprof_pods_fgprof_custom_name" {
        targets = discovery.relabel.pprof_pods.output
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_scrape"]
          regex         = "true"
          action        = "keep"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_port_name"]
          regex         = ""
          action        = "drop"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_container_port_name"]
          target_label  = "__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_port_name"
          action        = "keepequal"
        }
    
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_scheme"]
          action        = "replace"
          regex         = "(https?)"
          target_label  = "__scheme__"
          replacement   = "$1"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_path"]
          action        = "replace"
          regex         = "(.+)"
          target_label  = "__profile_path__"
          replacement   = "$1"
        }
        rule {
          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_port"]
          action        = "replace"
          regex         = "(.+?)(?::\\d+)?;(\\d+)"
          target_label  = "__address__"
          replacement   = "$1:$2"
        }
      }
    
      pyroscope.scrape "pyroscope_scrape_fgprof" {
        targets = array.concat(discovery.relabel.pprof_pods_fgprof_default_name.output, discovery.relabel.pprof_pods_fgprof_custom_name.output)
    
        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
        profiling_config {
          profile.block {
            enabled = false
          }
          profile.process_cpu {
            enabled = false
          }
          profile.fgprof {
            enabled = true
          }
          profile.godeltaprof_block {
            enabled = false
          }
          profile.godeltaprof_memory {
            enabled = false
          }
          profile.godeltaprof_mutex {
            enabled = false
          }
          profile.goroutine {
            enabled = false
          }
          profile.memory {
            enabled = false
          }
          profile.mutex {
            enabled = false
          }
        }
    
        forward_to = argument.profiles_destinations.value
      }
      discovery.relabel "pprof_pods_goroutine_default_name" {
        targets = discovery.relabel.pprof_pods.output
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_scrape"]
          regex         = "true"
          action        = "keep"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_port_name"]
          regex         = ""
          action        = "keep"
        }
    
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_scheme"]
          action        = "replace"
          regex         = "(https?)"
          target_label  = "__scheme__"
          replacement   = "$1"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_path"]
          action        = "replace"
          regex         = "(.+)"
          target_label  = "__profile_path__"
          replacement   = "$1"
        }
        rule {
          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_port"]
          action        = "replace"
          regex         = "(.+?)(?::\\d+)?;(\\d+)"
          target_label  = "__address__"
          replacement   = "$1:$2"
        }
      }
    
      discovery.relabel "pprof_pods_goroutine_custom_name" {
        targets = discovery.relabel.pprof_pods.output
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_scrape"]
          regex         = "true"
          action        = "keep"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_port_name"]
          regex         = ""
          action        = "drop"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_container_port_name"]
          target_label  = "__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_port_name"
          action        = "keepequal"
        }
    
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_scheme"]
          action        = "replace"
          regex         = "(https?)"
          target_label  = "__scheme__"
          replacement   = "$1"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_path"]
          action        = "replace"
          regex         = "(.+)"
          target_label  = "__profile_path__"
          replacement   = "$1"
        }
        rule {
          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_port"]
          action        = "replace"
          regex         = "(.+?)(?::\\d+)?;(\\d+)"
          target_label  = "__address__"
          replacement   = "$1:$2"
        }
      }
    
      pyroscope.scrape "pyroscope_scrape_goroutine" {
        targets = array.concat(discovery.relabel.pprof_pods_goroutine_default_name.output, discovery.relabel.pprof_pods_goroutine_custom_name.output)
    
        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
        profiling_config {
          profile.block {
            enabled = false
          }
          profile.process_cpu {
            enabled = false
          }
          profile.fgprof {
            enabled = false
          }
          profile.godeltaprof_block {
            enabled = false
          }
          profile.godeltaprof_memory {
            enabled = false
          }
          profile.godeltaprof_mutex {
            enabled = false
          }
          profile.goroutine {
            enabled = true
          }
          profile.memory {
            enabled = false
          }
          profile.mutex {
            enabled = false
          }
        }
    
        forward_to = argument.profiles_destinations.value
      }
      discovery.relabel "pprof_pods_memory_default_name" {
        targets = discovery.relabel.pprof_pods.output
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_scrape"]
          regex         = "true"
          action        = "keep"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_port_name"]
          regex         = ""
          action        = "keep"
        }
    
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_scheme"]
          action        = "replace"
          regex         = "(https?)"
          target_label  = "__scheme__"
          replacement   = "$1"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_path"]
          action        = "replace"
          regex         = "(.+)"
          target_label  = "__profile_path__"
          replacement   = "$1"
        }
        rule {
          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_port"]
          action        = "replace"
          regex         = "(.+?)(?::\\d+)?;(\\d+)"
          target_label  = "__address__"
          replacement   = "$1:$2"
        }
      }
    
      discovery.relabel "pprof_pods_memory_custom_name" {
        targets = discovery.relabel.pprof_pods.output
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_scrape"]
          regex         = "true"
          action        = "keep"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_port_name"]
          regex         = ""
          action        = "drop"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_container_port_name"]
          target_label  = "__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_port_name"
          action        = "keepequal"
        }
    
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_scheme"]
          action        = "replace"
          regex         = "(https?)"
          target_label  = "__scheme__"
          replacement   = "$1"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_path"]
          action        = "replace"
          regex         = "(.+)"
          target_label  = "__profile_path__"
          replacement   = "$1"
        }
        rule {
          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_port"]
          action        = "replace"
          regex         = "(.+?)(?::\\d+)?;(\\d+)"
          target_label  = "__address__"
          replacement   = "$1:$2"
        }
      }
    
      pyroscope.scrape "pyroscope_scrape_memory" {
        targets = array.concat(discovery.relabel.pprof_pods_memory_default_name.output, discovery.relabel.pprof_pods_memory_custom_name.output)
    
        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
        profiling_config {
          profile.block {
            enabled = false
          }
          profile.process_cpu {
            enabled = false
          }
          profile.fgprof {
            enabled = false
          }
          profile.godeltaprof_block {
            enabled = false
          }
          profile.godeltaprof_memory {
            enabled = false
          }
          profile.godeltaprof_mutex {
            enabled = false
          }
          profile.goroutine {
            enabled = false
          }
          profile.memory {
            enabled = true
          }
          profile.mutex {
            enabled = false
          }
        }
    
        forward_to = argument.profiles_destinations.value
      }
      discovery.relabel "pprof_pods_mutex_default_name" {
        targets = discovery.relabel.pprof_pods.output
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_scrape"]
          regex         = "true"
          action        = "keep"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_port_name"]
          regex         = ""
          action        = "keep"
        }
    
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_scheme"]
          action        = "replace"
          regex         = "(https?)"
          target_label  = "__scheme__"
          replacement   = "$1"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_path"]
          action        = "replace"
          regex         = "(.+)"
          target_label  = "__profile_path__"
          replacement   = "$1"
        }
        rule {
          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_port"]
          action        = "replace"
          regex         = "(.+?)(?::\\d+)?;(\\d+)"
          target_label  = "__address__"
          replacement   = "$1:$2"
        }
      }
    
      discovery.relabel "pprof_pods_mutex_custom_name" {
        targets = discovery.relabel.pprof_pods.output
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_scrape"]
          regex         = "true"
          action        = "keep"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_port_name"]
          regex         = ""
          action        = "drop"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_container_port_name"]
          target_label  = "__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_port_name"
          action        = "keepequal"
        }
    
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_scheme"]
          action        = "replace"
          regex         = "(https?)"
          target_label  = "__scheme__"
          replacement   = "$1"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_path"]
          action        = "replace"
          regex         = "(.+)"
          target_label  = "__profile_path__"
          replacement   = "$1"
        }
        rule {
          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_port"]
          action        = "replace"
          regex         = "(.+?)(?::\\d+)?;(\\d+)"
          target_label  = "__address__"
          replacement   = "$1:$2"
        }
      }
    
      pyroscope.scrape "pyroscope_scrape_mutex" {
        targets = array.concat(discovery.relabel.pprof_pods_mutex_default_name.output, discovery.relabel.pprof_pods_mutex_custom_name.output)
    
        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
        profiling_config {
          profile.block {
            enabled = false
          }
          profile.process_cpu {
            enabled = false
          }
          profile.fgprof {
            enabled = false
          }
          profile.godeltaprof_block {
            enabled = false
          }
          profile.godeltaprof_memory {
            enabled = false
          }
          profile.godeltaprof_mutex {
            enabled = false
          }
          profile.goroutine {
            enabled = false
          }
          profile.memory {
            enabled = false
          }
          profile.mutex {
            enabled = true
          }
        }
    
        forward_to = argument.profiles_destinations.value
      }
    }
    profiling "feature" {
      profiles_destinations = [
        pyroscope.write.pyroscope.receiver,
      ]
    }
---
# Source: k8s-monitoring/templates/beyla-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: k8smon-beyla
  namespace: default
  labels:
    helm.sh/chart: beyla-1.7.3
    app.kubernetes.io/name: beyla
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "2.0.3"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: beyla
    app.kubernetes.io/component: config
data:
  beyla-config.yml: |-
    attributes:
      kubernetes:
        cluster_name: exclude-by-namespace-cluster
        enable: true
    discovery:
      exclude_services:
      - k8s_namespace: kube-system
      - k8s_namespace: kube-public
      - k8s_namespace: confidential
      services:
      - k8s_namespace: .
    filter:
      network:
        k8s_dst_owner_name:
          not_match: '{kube*,*jaeger-agent*,*prometheus*,*promtail*,*grafana-agent*}'
        k8s_src_owner_name:
          not_match: '{kube*,*jaeger-agent*,*prometheus*,*promtail*,*grafana-agent*}'
    internal_metrics:
      prometheus:
        path: /internal/metrics
        port: 9090
    otel_traces_export:
      endpoint: http://k8smon-alloy-receiver.default.svc.cluster.local:4317
    prometheus_export:
      features:
      - application
      - network
      - application_service_graph
      - application_span
      path: /metrics
      port: 9090
---
# Source: k8s-monitoring/charts/alloy-logs/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: k8smon-alloy-logs
  labels:
    helm.sh/chart: alloy-logs-0.12.5
    app.kubernetes.io/name: alloy-logs
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
rules:
  # Rules which allow discovery.kubernetes to function.
  - apiGroups:
      - ""
      - "discovery.k8s.io"
      - "networking.k8s.io"
    resources:
      - endpoints
      - endpointslices
      - ingresses
      - nodes
      - nodes/proxy
      - nodes/metrics
      - pods
      - services
    verbs:
      - get
      - list
      - watch
  # Rules which allow loki.source.kubernetes and loki.source.podlogs to work.
  - apiGroups:
      - ""
    resources:
      - pods
      - pods/log
      - namespaces
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - "monitoring.grafana.com"
    resources:
      - podlogs
    verbs:
      - get
      - list
      - watch
  # Rules which allow mimir.rules.kubernetes to work.
  - apiGroups: ["monitoring.coreos.com"]
    resources:
      - prometheusrules
    verbs:
      - get
      - list
      - watch
  - nonResourceURLs:
      - /metrics
    verbs:
      - get
  # Rules for prometheus.kubernetes.*
  - apiGroups: ["monitoring.coreos.com"]
    resources:
      - podmonitors
      - servicemonitors
      - probes
    verbs:
      - get
      - list
      - watch
  # Rules which allow eventhandler to work.
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - get
      - list
      - watch
  # needed for remote.kubernetes.*
  - apiGroups: [""]
    resources:
      - "configmaps"
      - "secrets"
    verbs:
      - get
      - list
      - watch
  # needed for otelcol.processor.k8sattributes
  - apiGroups: ["apps"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["extensions"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]
---
# Source: k8s-monitoring/charts/alloy-metrics/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: k8smon-alloy-metrics
  labels:
    helm.sh/chart: alloy-metrics-0.12.5
    app.kubernetes.io/name: alloy-metrics
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
rules:
  # Rules which allow discovery.kubernetes to function.
  - apiGroups:
      - ""
      - "discovery.k8s.io"
      - "networking.k8s.io"
    resources:
      - endpoints
      - endpointslices
      - ingresses
      - nodes
      - nodes/proxy
      - nodes/metrics
      - pods
      - services
    verbs:
      - get
      - list
      - watch
  # Rules which allow loki.source.kubernetes and loki.source.podlogs to work.
  - apiGroups:
      - ""
    resources:
      - pods
      - pods/log
      - namespaces
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - "monitoring.grafana.com"
    resources:
      - podlogs
    verbs:
      - get
      - list
      - watch
  # Rules which allow mimir.rules.kubernetes to work.
  - apiGroups: ["monitoring.coreos.com"]
    resources:
      - prometheusrules
    verbs:
      - get
      - list
      - watch
  - nonResourceURLs:
      - /metrics
    verbs:
      - get
  # Rules for prometheus.kubernetes.*
  - apiGroups: ["monitoring.coreos.com"]
    resources:
      - podmonitors
      - servicemonitors
      - probes
    verbs:
      - get
      - list
      - watch
  # Rules which allow eventhandler to work.
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - get
      - list
      - watch
  # needed for remote.kubernetes.*
  - apiGroups: [""]
    resources:
      - "configmaps"
      - "secrets"
    verbs:
      - get
      - list
      - watch
  # needed for otelcol.processor.k8sattributes
  - apiGroups: ["apps"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["extensions"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]
---
# Source: k8s-monitoring/charts/alloy-profiles/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: k8smon-alloy-profiles
  labels:
    helm.sh/chart: alloy-profiles-0.12.5
    app.kubernetes.io/name: alloy-profiles
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
rules:
  # Rules which allow discovery.kubernetes to function.
  - apiGroups:
      - ""
      - "discovery.k8s.io"
      - "networking.k8s.io"
    resources:
      - endpoints
      - endpointslices
      - ingresses
      - nodes
      - nodes/proxy
      - nodes/metrics
      - pods
      - services
    verbs:
      - get
      - list
      - watch
  # Rules which allow loki.source.kubernetes and loki.source.podlogs to work.
  - apiGroups:
      - ""
    resources:
      - pods
      - pods/log
      - namespaces
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - "monitoring.grafana.com"
    resources:
      - podlogs
    verbs:
      - get
      - list
      - watch
  # Rules which allow mimir.rules.kubernetes to work.
  - apiGroups: ["monitoring.coreos.com"]
    resources:
      - prometheusrules
    verbs:
      - get
      - list
      - watch
  - nonResourceURLs:
      - /metrics
    verbs:
      - get
  # Rules for prometheus.kubernetes.*
  - apiGroups: ["monitoring.coreos.com"]
    resources:
      - podmonitors
      - servicemonitors
      - probes
    verbs:
      - get
      - list
      - watch
  # Rules which allow eventhandler to work.
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - get
      - list
      - watch
  # needed for remote.kubernetes.*
  - apiGroups: [""]
    resources:
      - "configmaps"
      - "secrets"
    verbs:
      - get
      - list
      - watch
  # needed for otelcol.processor.k8sattributes
  - apiGroups: ["apps"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["extensions"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]
---
# Source: k8s-monitoring/charts/alloy-receiver/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: k8smon-alloy-receiver
  labels:
    helm.sh/chart: alloy-receiver-0.12.5
    app.kubernetes.io/name: alloy-receiver
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
rules:
  # Rules which allow discovery.kubernetes to function.
  - apiGroups:
      - ""
      - "discovery.k8s.io"
      - "networking.k8s.io"
    resources:
      - endpoints
      - endpointslices
      - ingresses
      - nodes
      - nodes/proxy
      - nodes/metrics
      - pods
      - services
    verbs:
      - get
      - list
      - watch
  # Rules which allow loki.source.kubernetes and loki.source.podlogs to work.
  - apiGroups:
      - ""
    resources:
      - pods
      - pods/log
      - namespaces
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - "monitoring.grafana.com"
    resources:
      - podlogs
    verbs:
      - get
      - list
      - watch
  # Rules which allow mimir.rules.kubernetes to work.
  - apiGroups: ["monitoring.coreos.com"]
    resources:
      - prometheusrules
    verbs:
      - get
      - list
      - watch
  - nonResourceURLs:
      - /metrics
    verbs:
      - get
  # Rules for prometheus.kubernetes.*
  - apiGroups: ["monitoring.coreos.com"]
    resources:
      - podmonitors
      - servicemonitors
      - probes
    verbs:
      - get
      - list
      - watch
  # Rules which allow eventhandler to work.
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - get
      - list
      - watch
  # needed for remote.kubernetes.*
  - apiGroups: [""]
    resources:
      - "configmaps"
      - "secrets"
    verbs:
      - get
      - list
      - watch
  # needed for otelcol.processor.k8sattributes
  - apiGroups: ["apps"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["extensions"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]
---
# Source: k8s-monitoring/charts/alloy-singleton/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: k8smon-alloy-singleton
  labels:
    helm.sh/chart: alloy-singleton-0.12.5
    app.kubernetes.io/name: alloy-singleton
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
rules:
  # Rules which allow discovery.kubernetes to function.
  - apiGroups:
      - ""
      - "discovery.k8s.io"
      - "networking.k8s.io"
    resources:
      - endpoints
      - endpointslices
      - ingresses
      - nodes
      - nodes/proxy
      - nodes/metrics
      - pods
      - services
    verbs:
      - get
      - list
      - watch
  # Rules which allow loki.source.kubernetes and loki.source.podlogs to work.
  - apiGroups:
      - ""
    resources:
      - pods
      - pods/log
      - namespaces
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - "monitoring.grafana.com"
    resources:
      - podlogs
    verbs:
      - get
      - list
      - watch
  # Rules which allow mimir.rules.kubernetes to work.
  - apiGroups: ["monitoring.coreos.com"]
    resources:
      - prometheusrules
    verbs:
      - get
      - list
      - watch
  - nonResourceURLs:
      - /metrics
    verbs:
      - get
  # Rules for prometheus.kubernetes.*
  - apiGroups: ["monitoring.coreos.com"]
    resources:
      - podmonitors
      - servicemonitors
      - probes
    verbs:
      - get
      - list
      - watch
  # Rules which allow eventhandler to work.
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - get
      - list
      - watch
  # needed for remote.kubernetes.*
  - apiGroups: [""]
    resources:
      - "configmaps"
      - "secrets"
    verbs:
      - get
      - list
      - watch
  # needed for otelcol.processor.k8sattributes
  - apiGroups: ["apps"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["extensions"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]
---
# Source: k8s-monitoring/charts/autoInstrumentation/charts/beyla/templates/cluster-role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: k8smon-beyla
  labels:
    helm.sh/chart: beyla-1.7.3
    app.kubernetes.io/name: beyla
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "2.0.3"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: beyla
    app.kubernetes.io/component: rbac
rules:
  - apiGroups: [ "apps" ]
    resources: [ "replicasets" ]
    verbs: [ "list", "watch" ]
  - apiGroups: [ "" ]
    resources: [ "pods", "services", "nodes" ]
    verbs: [ "list", "watch", "get" ]
---
# Source: k8s-monitoring/charts/clusterMetrics/charts/kube-state-metrics/templates/role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:    
    helm.sh/chart: kube-state-metrics-5.31.0
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: kube-state-metrics
    app.kubernetes.io/name: kube-state-metrics
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "2.15.0"
    release: k8smon
  name: k8smon-kube-state-metrics
rules:

- apiGroups: ["certificates.k8s.io"]
  resources:
  - certificatesigningrequests
  verbs: ["list", "watch"]

- apiGroups: [""]
  resources:
  - configmaps
  verbs: ["list", "watch"]

- apiGroups: ["batch"]
  resources:
  - cronjobs
  verbs: ["list", "watch"]

- apiGroups: ["extensions", "apps"]
  resources:
  - daemonsets
  verbs: ["list", "watch"]

- apiGroups: ["extensions", "apps"]
  resources:
  - deployments
  verbs: ["list", "watch"]

- apiGroups: [""]
  resources:
  - endpoints
  verbs: ["list", "watch"]

- apiGroups: ["autoscaling"]
  resources:
  - horizontalpodautoscalers
  verbs: ["list", "watch"]

- apiGroups: ["extensions", "networking.k8s.io"]
  resources:
  - ingresses
  verbs: ["list", "watch"]

- apiGroups: ["batch"]
  resources:
  - jobs
  verbs: ["list", "watch"]

- apiGroups: ["coordination.k8s.io"]
  resources:
  - leases
  verbs: ["list", "watch"]

- apiGroups: [""]
  resources:
  - limitranges
  verbs: ["list", "watch"]

- apiGroups: ["admissionregistration.k8s.io"]
  resources:
    - mutatingwebhookconfigurations
  verbs: ["list", "watch"]

- apiGroups: [""]
  resources:
  - namespaces
  verbs: ["list", "watch"]

- apiGroups: ["networking.k8s.io"]
  resources:
  - networkpolicies
  verbs: ["list", "watch"]

- apiGroups: [""]
  resources:
  - nodes
  verbs: ["list", "watch"]

- apiGroups: [""]
  resources:
  - persistentvolumeclaims
  verbs: ["list", "watch"]

- apiGroups: [""]
  resources:
  - persistentvolumes
  verbs: ["list", "watch"]

- apiGroups: ["policy"]
  resources:
    - poddisruptionbudgets
  verbs: ["list", "watch"]

- apiGroups: [""]
  resources:
  - pods
  verbs: ["list", "watch"]

- apiGroups: ["extensions", "apps"]
  resources:
  - replicasets
  verbs: ["list", "watch"]

- apiGroups: [""]
  resources:
  - replicationcontrollers
  verbs: ["list", "watch"]

- apiGroups: [""]
  resources:
  - resourcequotas
  verbs: ["list", "watch"]

- apiGroups: [""]
  resources:
  - secrets
  verbs: ["list", "watch"]

- apiGroups: [""]
  resources:
  - services
  verbs: ["list", "watch"]

- apiGroups: ["apps"]
  resources:
  - statefulsets
  verbs: ["list", "watch"]

- apiGroups: ["storage.k8s.io"]
  resources:
    - storageclasses
  verbs: ["list", "watch"]

- apiGroups: ["admissionregistration.k8s.io"]
  resources:
    - validatingwebhookconfigurations
  verbs: ["list", "watch"]

- apiGroups: ["storage.k8s.io"]
  resources:
    - volumeattachments
  verbs: ["list", "watch"]
---
# Source: k8s-monitoring/charts/alloy-logs/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: k8smon-alloy-logs
  labels:
    helm.sh/chart: alloy-logs-0.12.5
    app.kubernetes.io/name: alloy-logs
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: k8smon-alloy-logs
subjects:
  - kind: ServiceAccount
    name: k8smon-alloy-logs
    namespace: default
---
# Source: k8s-monitoring/charts/alloy-metrics/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: k8smon-alloy-metrics
  labels:
    helm.sh/chart: alloy-metrics-0.12.5
    app.kubernetes.io/name: alloy-metrics
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: k8smon-alloy-metrics
subjects:
  - kind: ServiceAccount
    name: k8smon-alloy-metrics
    namespace: default
---
# Source: k8s-monitoring/charts/alloy-profiles/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: k8smon-alloy-profiles
  labels:
    helm.sh/chart: alloy-profiles-0.12.5
    app.kubernetes.io/name: alloy-profiles
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: k8smon-alloy-profiles
subjects:
  - kind: ServiceAccount
    name: k8smon-alloy-profiles
    namespace: default
---
# Source: k8s-monitoring/charts/alloy-receiver/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: k8smon-alloy-receiver
  labels:
    helm.sh/chart: alloy-receiver-0.12.5
    app.kubernetes.io/name: alloy-receiver
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: k8smon-alloy-receiver
subjects:
  - kind: ServiceAccount
    name: k8smon-alloy-receiver
    namespace: default
---
# Source: k8s-monitoring/charts/alloy-singleton/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: k8smon-alloy-singleton
  labels:
    helm.sh/chart: alloy-singleton-0.12.5
    app.kubernetes.io/name: alloy-singleton
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: rbac
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: k8smon-alloy-singleton
subjects:
  - kind: ServiceAccount
    name: k8smon-alloy-singleton
    namespace: default
---
# Source: k8s-monitoring/charts/autoInstrumentation/charts/beyla/templates/cluster-role-binding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: k8smon-beyla
  labels:
    helm.sh/chart: beyla-1.7.3
    app.kubernetes.io/name: beyla
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "2.0.3"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: beyla
    app.kubernetes.io/component: rbac
subjects:
  - kind: ServiceAccount
    name: k8smon-beyla
    namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: k8smon-beyla
---
# Source: k8s-monitoring/charts/clusterMetrics/charts/kube-state-metrics/templates/clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:    
    helm.sh/chart: kube-state-metrics-5.31.0
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: kube-state-metrics
    app.kubernetes.io/name: kube-state-metrics
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "2.15.0"
    release: k8smon
  name: k8smon-kube-state-metrics
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: k8smon-kube-state-metrics
subjects:
- kind: ServiceAccount
  name: k8smon-kube-state-metrics
  namespace: default
---
# Source: k8s-monitoring/charts/alloy-logs/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: k8smon-alloy-logs
  namespace: default
  labels:
    helm.sh/chart: alloy-logs-0.12.5
    app.kubernetes.io/name: alloy-logs
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: networking
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: alloy-logs
    app.kubernetes.io/instance: k8smon
  internalTrafficPolicy: Cluster
  ports:
    - name: http-metrics
      port: 12345
      targetPort: 12345
      protocol: "TCP"
---
# Source: k8s-monitoring/charts/alloy-metrics/templates/cluster_service.yaml
apiVersion: v1
kind: Service
metadata:
  name: k8smon-alloy-metrics-cluster
  namespace: default
  labels:
    helm.sh/chart: alloy-metrics-0.12.5
    app.kubernetes.io/name: alloy-metrics
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: networking
spec:
  type: ClusterIP
  clusterIP: 'None'
  publishNotReadyAddresses: true
  selector:
    app.kubernetes.io/name: alloy-metrics
    app.kubernetes.io/instance: k8smon
  ports:
    # Do not include the -metrics suffix in the port name, otherwise metrics
    # can be double-collected with the non-headless Service if it's also
    # enabled.
    #
    # This service should only be used for clustering, and not metric
    # collection.
    - name: http
      port: 12345
      targetPort: 12345
      protocol: "TCP"
---
# Source: k8s-monitoring/charts/alloy-metrics/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: k8smon-alloy-metrics
  namespace: default
  labels:
    helm.sh/chart: alloy-metrics-0.12.5
    app.kubernetes.io/name: alloy-metrics
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: networking
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: alloy-metrics
    app.kubernetes.io/instance: k8smon
  internalTrafficPolicy: Cluster
  ports:
    - name: http-metrics
      port: 12345
      targetPort: 12345
      protocol: "TCP"
---
# Source: k8s-monitoring/charts/alloy-profiles/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: k8smon-alloy-profiles
  namespace: default
  labels:
    helm.sh/chart: alloy-profiles-0.12.5
    app.kubernetes.io/name: alloy-profiles
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: networking
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: alloy-profiles
    app.kubernetes.io/instance: k8smon
  internalTrafficPolicy: Cluster
  ports:
    - name: http-metrics
      port: 12345
      targetPort: 12345
      protocol: "TCP"
---
# Source: k8s-monitoring/charts/alloy-receiver/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: k8smon-alloy-receiver
  namespace: default
  labels:
    helm.sh/chart: alloy-receiver-0.12.5
    app.kubernetes.io/name: alloy-receiver
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: networking
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: alloy-receiver
    app.kubernetes.io/instance: k8smon
  internalTrafficPolicy: Cluster
  ports:
    - name: http-metrics
      port: 12345
      targetPort: 12345
      protocol: "TCP"
    - name: otlp-grpc
      port: 4317
      targetPort: 4317
      protocol: TCP
---
# Source: k8s-monitoring/charts/alloy-singleton/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: k8smon-alloy-singleton
  namespace: default
  labels:
    helm.sh/chart: alloy-singleton-0.12.5
    app.kubernetes.io/name: alloy-singleton
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
    app.kubernetes.io/component: networking
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: alloy-singleton
    app.kubernetes.io/instance: k8smon
  internalTrafficPolicy: Cluster
  ports:
    - name: http-metrics
      port: 12345
      targetPort: 12345
      protocol: "TCP"
---
# Source: k8s-monitoring/charts/clusterMetrics/charts/kube-state-metrics/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: k8smon-kube-state-metrics
  namespace: default
  labels:    
    helm.sh/chart: kube-state-metrics-5.31.0
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: kube-state-metrics
    app.kubernetes.io/name: kube-state-metrics
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "2.15.0"
    release: k8smon
  annotations:
spec:
  type: "ClusterIP"
  ports:
  - name: "http"
    protocol: TCP
    port: 8080
    targetPort: 8080
  
  selector:    
    app.kubernetes.io/name: kube-state-metrics
    app.kubernetes.io/instance: k8smon
---
# Source: k8s-monitoring/charts/clusterMetrics/charts/node-exporter/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: k8smon-node-exporter
  namespace: default
  labels:
    helm.sh/chart: node-exporter-4.45.0
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: node-exporter
    app.kubernetes.io/name: node-exporter
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "1.9.0"
    release: k8smon
  annotations:
    prometheus.io/scrape: "false"
spec:
  type: ClusterIP
  ports:
    - port: 9100
      targetPort: 9100
      protocol: TCP
      name: metrics
  selector:
    app.kubernetes.io/name: node-exporter
    app.kubernetes.io/instance: k8smon
---
# Source: k8s-monitoring/charts/clusterMetrics/charts/windows-exporter/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: k8smon-windows-exporter
  namespace: default
  labels:
    helm.sh/chart: windows-exporter-0.9.1
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: windows-exporter
    app.kubernetes.io/name: windows-exporter
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "0.30.5"
    release: k8smon
spec:
  type: ClusterIP
  ports:
    - port: 9182
      targetPort: metrics
      protocol: TCP
      appProtocol: http
      name: metrics
  selector:
    app.kubernetes.io/name: windows-exporter
    app.kubernetes.io/instance: k8smon
---
# Source: k8s-monitoring/charts/alloy-logs/templates/controllers/daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: k8smon-alloy-logs
  namespace: default
  labels:
    helm.sh/chart: alloy-logs-0.12.5
    app.kubernetes.io/name: alloy-logs
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
spec:
  minReadySeconds: 10
  selector:
    matchLabels:
      app.kubernetes.io/name: alloy-logs
      app.kubernetes.io/instance: k8smon
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: alloy
        k8s.grafana.com/logs.job: integrations/alloy
      labels:
        app.kubernetes.io/name: alloy-logs
        app.kubernetes.io/instance: k8smon
    spec:
      serviceAccountName: k8smon-alloy-logs
      containers:
        - name: alloy
          image: docker.io/grafana/alloy:v1.7.4
          imagePullPolicy: IfNotPresent
          args:
            - run
            - /etc/alloy/config.alloy
            - --storage.path=/tmp/alloy
            - --server.http.listen-addr=0.0.0.0:12345
            - --server.http.ui-path-prefix=/
            - --stability.level=generally-available
          env:
            - name: ALLOY_DEPLOY_MODE
              value: "helm"
            - name: HOSTNAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          ports:
            - containerPort: 12345
              name: http-metrics
          readinessProbe:
            httpGet:
              path: /-/ready
              port: 12345
              scheme: HTTP
            initialDelaySeconds: 10
            timeoutSeconds: 1
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              add:
              - CHOWN
              - DAC_OVERRIDE
              - FOWNER
              - FSETID
              - KILL
              - SETGID
              - SETUID
              - SETPCAP
              - NET_BIND_SERVICE
              - NET_RAW
              - SYS_CHROOT
              - MKNOD
              - AUDIT_WRITE
              - SETFCAP
              drop:
              - ALL
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - name: config
              mountPath: /etc/alloy
            - name: varlog
              mountPath: /var/log
              readOnly: true
            - name: dockercontainers
              mountPath: /var/lib/docker/containers
              readOnly: true
        - name: config-reloader
          image: ghcr.io/jimmidyson/configmap-reload:v0.14.0
          args:
            - --volume-dir=/etc/alloy
            - --webhook-url=http://localhost:12345/-/reload
          volumeMounts:
            - name: config
              mountPath: /etc/alloy
          resources:
            requests:
              cpu: 1m
              memory: 5Mi
      dnsPolicy: ClusterFirst
      nodeSelector:
        kubernetes.io/os: linux
      tolerations:
        - effect: NoSchedule
          operator: Exists
      volumes:
        - name: config
          configMap:
            name: k8smon-alloy-logs
        - name: varlog
          hostPath:
            path: /var/log
        - name: dockercontainers
          hostPath:
            path: /var/lib/docker/containers
---
# Source: k8s-monitoring/charts/alloy-profiles/templates/controllers/daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: k8smon-alloy-profiles
  namespace: default
  labels:
    helm.sh/chart: alloy-profiles-0.12.5
    app.kubernetes.io/name: alloy-profiles
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
spec:
  minReadySeconds: 10
  selector:
    matchLabels:
      app.kubernetes.io/name: alloy-profiles
      app.kubernetes.io/instance: k8smon
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: alloy
        k8s.grafana.com/logs.job: integrations/alloy
      labels:
        app.kubernetes.io/name: alloy-profiles
        app.kubernetes.io/instance: k8smon
    spec:
      serviceAccountName: k8smon-alloy-profiles
      containers:
        - name: alloy
          image: docker.io/grafana/alloy:v1.7.4
          imagePullPolicy: IfNotPresent
          args:
            - run
            - /etc/alloy/config.alloy
            - --storage.path=/tmp/alloy
            - --server.http.listen-addr=0.0.0.0:12345
            - --server.http.ui-path-prefix=/
            - --stability.level=public-preview
          env:
            - name: ALLOY_DEPLOY_MODE
              value: "helm"
            - name: HOSTNAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          ports:
            - containerPort: 12345
              name: http-metrics
          readinessProbe:
            httpGet:
              path: /-/ready
              port: 12345
              scheme: HTTP
            initialDelaySeconds: 10
            timeoutSeconds: 1
          securityContext:
            privileged: true
            runAsGroup: 0
            runAsUser: 0
          volumeMounts:
            - name: config
              mountPath: /etc/alloy
        - name: config-reloader
          image: ghcr.io/jimmidyson/configmap-reload:v0.14.0
          args:
            - --volume-dir=/etc/alloy
            - --webhook-url=http://localhost:12345/-/reload
          volumeMounts:
            - name: config
              mountPath: /etc/alloy
          resources:
            requests:
              cpu: 1m
              memory: 5Mi
      hostPID: true
      dnsPolicy: ClusterFirst
      nodeSelector:
        kubernetes.io/os: linux
      tolerations:
        - effect: NoSchedule
          operator: Exists
      volumes:
        - name: config
          configMap:
            name: k8smon-alloy-profiles
---
# Source: k8s-monitoring/charts/alloy-receiver/templates/controllers/daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: k8smon-alloy-receiver
  namespace: default
  labels:
    helm.sh/chart: alloy-receiver-0.12.5
    app.kubernetes.io/name: alloy-receiver
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
spec:
  minReadySeconds: 10
  selector:
    matchLabels:
      app.kubernetes.io/name: alloy-receiver
      app.kubernetes.io/instance: k8smon
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: alloy
        k8s.grafana.com/logs.job: integrations/alloy
      labels:
        app.kubernetes.io/name: alloy-receiver
        app.kubernetes.io/instance: k8smon
    spec:
      serviceAccountName: k8smon-alloy-receiver
      containers:
        - name: alloy
          image: docker.io/grafana/alloy:v1.7.4
          imagePullPolicy: IfNotPresent
          args:
            - run
            - /etc/alloy/config.alloy
            - --storage.path=/tmp/alloy
            - --server.http.listen-addr=0.0.0.0:12345
            - --server.http.ui-path-prefix=/
            - --stability.level=generally-available
          env:
            - name: ALLOY_DEPLOY_MODE
              value: "helm"
            - name: HOSTNAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          ports:
            - containerPort: 12345
              name: http-metrics
            - containerPort: 4317
              name: otlp-grpc
              protocol: TCP
          readinessProbe:
            httpGet:
              path: /-/ready
              port: 12345
              scheme: HTTP
            initialDelaySeconds: 10
            timeoutSeconds: 1
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              add:
              - CHOWN
              - DAC_OVERRIDE
              - FOWNER
              - FSETID
              - KILL
              - SETGID
              - SETUID
              - SETPCAP
              - NET_BIND_SERVICE
              - NET_RAW
              - SYS_CHROOT
              - MKNOD
              - AUDIT_WRITE
              - SETFCAP
              drop:
              - ALL
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - name: config
              mountPath: /etc/alloy
        - name: config-reloader
          image: ghcr.io/jimmidyson/configmap-reload:v0.14.0
          args:
            - --volume-dir=/etc/alloy
            - --webhook-url=http://localhost:12345/-/reload
          volumeMounts:
            - name: config
              mountPath: /etc/alloy
          resources:
            requests:
              cpu: 1m
              memory: 5Mi
      dnsPolicy: ClusterFirst
      nodeSelector:
        kubernetes.io/os: linux
      volumes:
        - name: config
          configMap:
            name: k8smon-alloy-receiver
---
# Source: k8s-monitoring/charts/autoInstrumentation/charts/beyla/templates/daemon-set.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: k8smon-beyla
  namespace: default
  labels:
    helm.sh/chart: beyla-1.7.3
    app.kubernetes.io/name: beyla
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "2.0.3"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: beyla
    app.kubernetes.io/component: workload
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: beyla
      app.kubernetes.io/instance: k8smon
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      annotations:
        checksum/config: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
        k8s.grafana.com/job: default/beyla
        k8s.grafana.com/logs.job: integrations/beyla
      labels:
        helm.sh/chart: beyla-1.7.3
        app.kubernetes.io/name: beyla
        app.kubernetes.io/instance: k8smon
        app.kubernetes.io/version: "2.0.3"
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/part-of: beyla
        app.kubernetes.io/component: workload
    spec:
      serviceAccountName: k8smon-beyla
      hostPID: true
      containers:
        - name: beyla
          image: docker.io/grafana/beyla:2.0.3
          imagePullPolicy: IfNotPresent
          securityContext:
            privileged: true
          ports:
          - name: metrics
            containerPort: 9090
            protocol: TCP
          env:
            - name: BEYLA_CONFIG_PATH
              value: "/etc/beyla/config/beyla-config.yml"
          volumeMounts:
            - mountPath: /etc/beyla/config
              name: beyla-config
      nodeSelector:
        kubernetes.io/os: linux
      volumes:
        - name: beyla-config
          configMap:
            name: k8smon-beyla
---
# Source: k8s-monitoring/charts/clusterMetrics/charts/node-exporter/templates/daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: k8smon-node-exporter
  namespace: default
  labels:
    helm.sh/chart: node-exporter-4.45.0
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: node-exporter
    app.kubernetes.io/name: node-exporter
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "1.9.0"
    release: k8smon
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: node-exporter
      app.kubernetes.io/instance: k8smon
  revisionHistoryLimit: 10
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      annotations:
        cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
        k8s.grafana.com/logs.job: integrations/node_exporter
      labels:
        helm.sh/chart: node-exporter-4.45.0
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/component: metrics
        app.kubernetes.io/part-of: node-exporter
        app.kubernetes.io/name: node-exporter
        app.kubernetes.io/instance: k8smon
        app.kubernetes.io/version: "1.9.0"
        release: k8smon
    spec:
      automountServiceAccountToken: false
      securityContext:
        fsGroup: 65534
        runAsGroup: 65534
        runAsNonRoot: true
        runAsUser: 65534
      serviceAccountName: k8smon-node-exporter
      containers:
        - name: node-exporter
          image: quay.io/prometheus/node-exporter:v1.9.0
          imagePullPolicy: IfNotPresent
          args:
            - --path.procfs=/host/proc
            - --path.sysfs=/host/sys
            - --path.rootfs=/host/root
            - --path.udev.data=/host/root/run/udev/data
            - --web.listen-address=[$(HOST_IP)]:9100
          securityContext:
            readOnlyRootFilesystem: true
          env:
            - name: HOST_IP
              value: 0.0.0.0
          ports:
            - name: metrics
              containerPort: 9100
              protocol: TCP
          livenessProbe:
            failureThreshold: 3
            httpGet:
              httpHeaders:
              path: /
              port: 9100
              scheme: HTTP
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          readinessProbe:
            failureThreshold: 3
            httpGet:
              httpHeaders:
              path: /
              port: 9100
              scheme: HTTP
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          volumeMounts:
            - name: proc
              mountPath: /host/proc
              readOnly:  true
            - name: sys
              mountPath: /host/sys
              readOnly: true
            - name: root
              mountPath: /host/root
              mountPropagation: HostToContainer
              readOnly: true
      hostNetwork: true
      hostPID: true
      hostIPC: false
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: eks.amazonaws.com/compute-type
                operator: NotIn
                values:
                - fargate
      nodeSelector:
        kubernetes.io/os: linux
      tolerations:
        - effect: NoSchedule
          operator: Exists
      volumes:
        - name: proc
          hostPath:
            path: /proc
        - name: sys
          hostPath:
            path: /sys
        - name: root
          hostPath:
            path: /
---
# Source: k8s-monitoring/charts/clusterMetrics/charts/windows-exporter/templates/daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: k8smon-windows-exporter
  namespace: default
  labels:
    helm.sh/chart: windows-exporter-0.9.1
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: windows-exporter
    app.kubernetes.io/name: windows-exporter
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "0.30.5"
    release: k8smon
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: windows-exporter
      app.kubernetes.io/instance: k8smon
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      annotations:
        cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
        k8s.grafana.com/logs.job: integrations/windows_exporter
      labels:
        helm.sh/chart: windows-exporter-0.9.1
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/component: metrics
        app.kubernetes.io/part-of: windows-exporter
        app.kubernetes.io/name: windows-exporter
        app.kubernetes.io/instance: k8smon
        app.kubernetes.io/version: "0.30.5"
        release: k8smon
    spec:
      automountServiceAccountToken: false
      securityContext:
        windowsOptions:
          hostProcess: true
          runAsUserName: NT AUTHORITY\system
      initContainers:
        - name: configure-firewall
          image: ghcr.io/prometheus-community/windows-exporter:0.30.5
          command: [ "powershell" ]
          args: [ "New-NetFirewallRule", "-DisplayName", "'windows-exporter'", "-Direction", "inbound", "-Profile", "Any", "-Action", "Allow", "-LocalPort", "9182", "-Protocol", "TCP" ]
      serviceAccountName: k8smon-windows-exporter
      containers:
        - name: windows-exporter
          image: ghcr.io/prometheus-community/windows-exporter:0.30.5
          imagePullPolicy: IfNotPresent
          args:
            - --config.file=%CONTAINER_SANDBOX_MOUNT_POINT%/config.yml
            - --collector.textfile.directories=%CONTAINER_SANDBOX_MOUNT_POINT%
            - --web.listen-address=:9182
          env:
          ports:
            - name: metrics
              containerPort: 9182
              protocol: TCP
          livenessProbe:
            failureThreshold: 3
            httpGet:
              httpHeaders:
              path: /health
              port: 9182
              scheme: HTTP
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          readinessProbe:
            failureThreshold: 3
            httpGet:
              httpHeaders:
              path: /health
              port: 9182
              scheme: HTTP
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          volumeMounts:
            - name: config
              mountPath: /config.yml
              subPath: config.yml
      hostNetwork: true
      hostPID: true
      nodeSelector:
        kubernetes.io/os: windows
      tolerations:
        - effect: NoSchedule
          operator: Exists
      volumes:
        - name: config
          configMap:
            name: k8smon-windows-exporter
---
# Source: k8s-monitoring/charts/alloy-singleton/templates/controllers/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: k8smon-alloy-singleton
  namespace: default
  labels:
    helm.sh/chart: alloy-singleton-0.12.5
    app.kubernetes.io/name: alloy-singleton
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
spec:
  replicas: 1
  minReadySeconds: 10
  selector:
    matchLabels:
      app.kubernetes.io/name: alloy-singleton
      app.kubernetes.io/instance: k8smon
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: alloy
        k8s.grafana.com/logs.job: integrations/alloy
      labels:
        app.kubernetes.io/name: alloy-singleton
        app.kubernetes.io/instance: k8smon
    spec:
      serviceAccountName: k8smon-alloy-singleton
      containers:
        - name: alloy
          image: docker.io/grafana/alloy:v1.7.4
          imagePullPolicy: IfNotPresent
          args:
            - run
            - /etc/alloy/config.alloy
            - --storage.path=/tmp/alloy
            - --server.http.listen-addr=0.0.0.0:12345
            - --server.http.ui-path-prefix=/
            - --stability.level=generally-available
          env:
            - name: ALLOY_DEPLOY_MODE
              value: "helm"
            - name: HOSTNAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          ports:
            - containerPort: 12345
              name: http-metrics
          readinessProbe:
            httpGet:
              path: /-/ready
              port: 12345
              scheme: HTTP
            initialDelaySeconds: 10
            timeoutSeconds: 1
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              add:
              - CHOWN
              - DAC_OVERRIDE
              - FOWNER
              - FSETID
              - KILL
              - SETGID
              - SETUID
              - SETPCAP
              - NET_BIND_SERVICE
              - NET_RAW
              - SYS_CHROOT
              - MKNOD
              - AUDIT_WRITE
              - SETFCAP
              drop:
              - ALL
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - name: config
              mountPath: /etc/alloy
        - name: config-reloader
          image: ghcr.io/jimmidyson/configmap-reload:v0.14.0
          args:
            - --volume-dir=/etc/alloy
            - --webhook-url=http://localhost:12345/-/reload
          volumeMounts:
            - name: config
              mountPath: /etc/alloy
          resources:
            requests:
              cpu: 1m
              memory: 5Mi
      dnsPolicy: ClusterFirst
      nodeSelector:
        kubernetes.io/os: linux
      volumes:
        - name: config
          configMap:
            name: k8smon-alloy-singleton
---
# Source: k8s-monitoring/charts/clusterMetrics/charts/kube-state-metrics/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: k8smon-kube-state-metrics
  namespace: default
  labels:    
    helm.sh/chart: kube-state-metrics-5.31.0
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: metrics
    app.kubernetes.io/part-of: kube-state-metrics
    app.kubernetes.io/name: kube-state-metrics
    app.kubernetes.io/instance: k8smon
    app.kubernetes.io/version: "2.15.0"
    release: k8smon
spec:
  selector:
    matchLabels:      
      app.kubernetes.io/name: kube-state-metrics
      app.kubernetes.io/instance: k8smon
  replicas: 1
  strategy:
    type: Recreate
  revisionHistoryLimit: 10
  template:
    metadata:
      labels:        
        helm.sh/chart: kube-state-metrics-5.31.0
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/component: metrics
        app.kubernetes.io/part-of: kube-state-metrics
        app.kubernetes.io/name: kube-state-metrics
        app.kubernetes.io/instance: k8smon
        app.kubernetes.io/version: "2.15.0"
        release: k8smon
      annotations:
      
        k8s.grafana.com/logs.job: integrations/kubernetes/kube-state-metrics
    spec:
      automountServiceAccountToken: true
      hostNetwork: false
      serviceAccountName: k8smon-kube-state-metrics
      securityContext:
        fsGroup: 65534
        runAsGroup: 65534
        runAsNonRoot: true
        runAsUser: 65534
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: kube-state-metrics
        args:
        - --port=8080
        - --resources=certificatesigningrequests,configmaps,cronjobs,daemonsets,deployments,endpoints,horizontalpodautoscalers,ingresses,jobs,leases,limitranges,mutatingwebhookconfigurations,namespaces,networkpolicies,nodes,persistentvolumeclaims,persistentvolumes,poddisruptionbudgets,pods,replicasets,replicationcontrollers,resourcequotas,secrets,services,statefulsets,storageclasses,validatingwebhookconfigurations,volumeattachments
        - --metric-labels-allowlist=nodes=[agentpool,alpha.eksctl.io/cluster-name,alpha.eksctl.io/nodegroup-name,beta.kubernetes.io/instance-type,cloud.google.com/gke-nodepool,cluster-name,ec2.amazonaws.com/Name,ec2.amazonaws.com/aws-autoscaling-groupName,ec2.amazonaws.com/aws-autoscaling-group-name,ec2.amazonaws.com/name,eks.amazonaws.com/nodegroup,k8s.io/cloud-provider-aws,karpenter.sh/nodepool,kubernetes.azure.com/cluster,kubernetes.io/arch,kubernetes.io/hostname,kubernetes.io/os,node.kubernetes.io/instance-type,topology.kubernetes.io/region,topology.kubernetes.io/zone]
        - --namespaces-denylist=kube-system,kube-public,confidential
        imagePullPolicy: IfNotPresent
        image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0
        ports:
        - containerPort: 8080
          name: "http"
        livenessProbe:
          failureThreshold: 3
          httpGet:
            httpHeaders:
            path: /livez
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        readinessProbe:
          failureThreshold: 3
          httpGet:
            httpHeaders:
            path: /readyz
            port: 8081
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        resources:
          {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
      nodeSelector:
        kubernetes.io/os: linux
---
# Source: k8s-monitoring/charts/alloy-metrics/templates/controllers/statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: k8smon-alloy-metrics
  namespace: default
  labels:
    helm.sh/chart: alloy-metrics-0.12.5
    app.kubernetes.io/name: alloy-metrics
    app.kubernetes.io/instance: k8smon
    
    app.kubernetes.io/version: "v1.7.4"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: alloy
spec:
  replicas: 1
  podManagementPolicy: Parallel
  minReadySeconds: 10
  serviceName: k8smon-alloy-metrics
  selector:
    matchLabels:
      app.kubernetes.io/name: alloy-metrics
      app.kubernetes.io/instance: k8smon
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: alloy
        k8s.grafana.com/logs.job: integrations/alloy
      labels:
        app.kubernetes.io/name: alloy-metrics
        app.kubernetes.io/instance: k8smon
    spec:
      serviceAccountName: k8smon-alloy-metrics
      containers:
        - name: alloy
          image: docker.io/grafana/alloy:v1.7.4
          imagePullPolicy: IfNotPresent
          args:
            - run
            - /etc/alloy/config.alloy
            - --storage.path=/tmp/alloy
            - --server.http.listen-addr=0.0.0.0:12345
            - --server.http.ui-path-prefix=/
            - --cluster.enabled=true
            - --cluster.join-addresses=k8smon-alloy-metrics-cluster
            - --cluster.name=alloy-metrics
            - --stability.level=generally-available
          env:
            - name: ALLOY_DEPLOY_MODE
              value: "helm"
            - name: HOSTNAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          ports:
            - containerPort: 12345
              name: http-metrics
          readinessProbe:
            httpGet:
              path: /-/ready
              port: 12345
              scheme: HTTP
            initialDelaySeconds: 10
            timeoutSeconds: 1
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              add:
              - CHOWN
              - DAC_OVERRIDE
              - FOWNER
              - FSETID
              - KILL
              - SETGID
              - SETUID
              - SETPCAP
              - NET_BIND_SERVICE
              - NET_RAW
              - SYS_CHROOT
              - MKNOD
              - AUDIT_WRITE
              - SETFCAP
              drop:
              - ALL
            seccompProfile:
              type: RuntimeDefault
          volumeMounts:
            - name: config
              mountPath: /etc/alloy
        - name: config-reloader
          image: ghcr.io/jimmidyson/configmap-reload:v0.14.0
          args:
            - --volume-dir=/etc/alloy
            - --webhook-url=http://localhost:12345/-/reload
          volumeMounts:
            - name: config
              mountPath: /etc/alloy
          resources:
            requests:
              cpu: 1m
              memory: 5Mi
      dnsPolicy: ClusterFirst
      nodeSelector:
        kubernetes.io/os: linux
      volumes:
        - name: config
          configMap:
            name: k8smon-alloy-metrics