jakman85andClaude Opus 4.8
cc89b4b830
Author-only Phase-2 components (platform suspended; cluster untouched): - platform/longhorn: 3-replica SC + bulk external-mount indirection (R-STATE) - platform/monitoring: kube-prometheus-stack + Loki + Alloy (dev-trimmed) + 8 alert rules (R-OBS) - platform/cilium: parity fix (k8sServiceHost=10.73.0.11 + masquerade) safe to adopt Phase 2 - conformance: partial L2 tests (worker hit session limit; incomplete — see DECISIONS-LOG K2) - bootstrap/gitea: fix rootless-podman perms (host bind-mount -> named volume) Flux installed on the cluster; host Gitea up + repo pushed; GitRepository BLOCKED by host firewalld (VM->10.73.0.1:3000) — needs one operator sudo command (DECISIONS-LOG). Known issue K1: cluster-vars substitution-var case mismatch (fix before un-suspend). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
96 lines
2.8 KiB
YAML
96 lines
2.8 KiB
YAML
---
|
|
# Grafana Alloy — log-shipping agent (docs/10). Serves R-OBS-01. Runs as a DaemonSet, discovers
|
|
# pods on each node, and forwards container logs to Loki. DEV-SCOPED: modest per-node resources,
|
|
# in-cluster clustering disabled (not needed for log tailing on a 3-node box).
|
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: alloy
|
|
namespace: monitoring
|
|
spec:
|
|
interval: 30m
|
|
chart:
|
|
spec:
|
|
chart: alloy
|
|
version: ">=0.10.0 <1.0.0" # TODO(WS-OBS): pin at bring-up; Renovate maintains
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: grafana
|
|
namespace: monitoring
|
|
install:
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
remediation:
|
|
retries: 3
|
|
values:
|
|
controller:
|
|
type: daemonset # one collector per node — tails all pod logs locally
|
|
alloy:
|
|
clustering:
|
|
enabled: false # log tailing needs no cluster ring on a 3-node dev box
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 96Mi
|
|
limits:
|
|
memory: 256Mi
|
|
# Alloy pipeline: discover pods -> relabel identity -> ship to the Loki single binary.
|
|
configMap:
|
|
content: |-
|
|
logging {
|
|
level = "info"
|
|
format = "logfmt"
|
|
}
|
|
|
|
discovery.kubernetes "pods" {
|
|
role = "pod"
|
|
}
|
|
|
|
// Carry useful identity labels; keep cardinality bounded (no per-request labels).
|
|
discovery.relabel "pod_logs" {
|
|
targets = discovery.kubernetes.pods.targets
|
|
|
|
rule {
|
|
source_labels = ["__meta_kubernetes_namespace"]
|
|
target_label = "namespace"
|
|
}
|
|
rule {
|
|
source_labels = ["__meta_kubernetes_pod_name"]
|
|
target_label = "pod"
|
|
}
|
|
rule {
|
|
source_labels = ["__meta_kubernetes_pod_container_name"]
|
|
target_label = "container"
|
|
}
|
|
rule {
|
|
source_labels = ["__meta_kubernetes_pod_node_name"]
|
|
target_label = "node"
|
|
}
|
|
rule {
|
|
source_labels = ["__meta_kubernetes_pod_label_app_kubernetes_io_name"]
|
|
target_label = "app"
|
|
}
|
|
}
|
|
|
|
loki.source.kubernetes "pods" {
|
|
targets = discovery.relabel.pod_logs.output
|
|
forward_to = [loki.process.default.receiver]
|
|
}
|
|
|
|
loki.process "default" {
|
|
forward_to = [loki.write.default.receiver]
|
|
stage.static_labels {
|
|
values = {
|
|
job = "kubernetes-pods",
|
|
}
|
|
}
|
|
}
|
|
|
|
loki.write "default" {
|
|
endpoint {
|
|
// Loki single-binary service (gateway disabled).
|
|
url = "http://loki.monitoring.svc.cluster.local:3100/loki/api/v1/push"
|
|
}
|
|
}
|