---
# Grafana Alloy — log-shipping agent (docs/10). Serves R-OBS-01. Runs as a DaemonSet, discovers
# pods on each node, and forwards container logs to Loki. DEV-SCOPED: modest per-node resources,
# in-cluster clustering disabled (not needed for log tailing on a 3-node box).
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: alloy
  namespace: monitoring
spec:
  interval: 30m
  chart:
    spec:
      chart: alloy
      version: ">=0.10.0 <1.0.0"   # TODO(WS-OBS): pin at bring-up; Renovate maintains
      sourceRef:
        kind: HelmRepository
        name: grafana
        namespace: monitoring
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  values:
    controller:
      type: daemonset            # one collector per node — tails all pod logs locally
    alloy:
      clustering:
        enabled: false           # log tailing needs no cluster ring on a 3-node dev box
      resources:
        requests:
          cpu: 50m
          memory: 96Mi
        limits:
          memory: 256Mi
      # Alloy pipeline: discover pods -> relabel identity -> ship to the Loki single binary.
      configMap:
        content: |-
          logging {
            level  = "info"
            format = "logfmt"
          }

          discovery.kubernetes "pods" {
            role = "pod"
          }

          // Carry useful identity labels; keep cardinality bounded (no per-request labels).
          discovery.relabel "pod_logs" {
            targets = discovery.kubernetes.pods.targets

            rule {
              source_labels = ["__meta_kubernetes_namespace"]
              target_label  = "namespace"
            }
            rule {
              source_labels = ["__meta_kubernetes_pod_name"]
              target_label  = "pod"
            }
            rule {
              source_labels = ["__meta_kubernetes_pod_container_name"]
              target_label  = "container"
            }
            rule {
              source_labels = ["__meta_kubernetes_pod_node_name"]
              target_label  = "node"
            }
            rule {
              source_labels = ["__meta_kubernetes_pod_label_app_kubernetes_io_name"]
              target_label  = "app"
            }
          }

          loki.source.kubernetes "pods" {
            targets    = discovery.relabel.pod_logs.output
            forward_to = [loki.process.default.receiver]
          }

          loki.process "default" {
            forward_to = [loki.write.default.receiver]
            stage.static_labels {
              values = {
                job = "kubernetes-pods",
              }
            }
          }

          loki.write "default" {
            endpoint {
              // Loki single-binary service (gateway disabled).
              url = "http://loki.monitoring.svc.cluster.local:3100/loki/api/v1/push"
            }
          }