k8s-apps/loki/alloy.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: alloy
  namespace: loki
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: alloy
rules:
  - apiGroups: [""]
    resources:
      - pods
      - pods/log
      - nodes
      - namespaces
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: alloy
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: alloy
subjects:
- kind: ServiceAccount
  name: alloy
  namespace: loki
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: alloy-config
  namespace: loki
data:
  config.alloy: |
    discovery.kubernetes "pods" {
      role = "pod"
    }

    discovery.relabel "pods" {
      targets = discovery.kubernetes.pods.targets

      rule {
        target_label = "job"
        replacement  = "kubernetes-pods"
      }

      rule {
        target_label = "source"
        replacement  = "kubernetes"
      }

      rule {
        target_label = "service_name"
        replacement  = "kubernetes-pods"
      }

      rule {
        source_labels = ["__meta_kubernetes_namespace"]
        target_label  = "namespace"
      }

      rule {
        source_labels = ["__meta_kubernetes_pod_name"]
        target_label  = "pod"
      }

      rule {
        source_labels = ["__meta_kubernetes_pod_container_name"]
        target_label  = "container"
      }

      rule {
        source_labels = ["__meta_kubernetes_pod_node_name"]
        target_label  = "node"
      }

      rule {
        source_labels = ["__meta_kubernetes_pod_node_name"]
        target_label  = "host"
      }

      rule {
        source_labels = ["__meta_kubernetes_pod_label_app"]
        target_label  = "app"
      }

      rule {
        source_labels = ["__meta_kubernetes_pod_label_app_kubernetes_io_name"]
        target_label  = "app_kubernetes_io_name"
      }
    }

    loki.relabel "journal" {
      forward_to = [loki.write.default.receiver]

      rule {
        target_label = "job"
        replacement  = "host-journal"
      }

      rule {
        target_label = "role"
        replacement  = "kubernetes-node"
      }

      rule {
        target_label = "host"
        replacement  = sys.env("NODE_NAME")
      }

      rule {
        source_labels = ["__journal__systemd_unit"]
        target_label  = "unit"
      }

      rule {
        source_labels = ["__journal_syslog_identifier"]
        target_label  = "syslog_identifier"
      }

      rule {
        source_labels = ["__journal_priority_keyword"]
        target_label  = "severity"
      }
    }

    loki.source.kubernetes "pods" {
      targets    = discovery.relabel.pods.output
      forward_to = [loki.write.default.receiver]
    }

    loki.source.journal "journal_var" {
      path          = "/var/log/journal"
      max_age       = "1m"
      relabel_rules = loki.relabel.journal.rules
      forward_to    = [loki.relabel.journal.receiver]
    }

    loki.source.journal "journal_run" {
      path          = "/run/log/journal"
      max_age       = "1m"
      relabel_rules = loki.relabel.journal.rules
      forward_to    = [loki.relabel.journal.receiver]
    }

    loki.write "default" {
      endpoint {
        url = "http://loki.loki.svc.k8s.undercloud.local:3100/loki/api/v1/push"
      }
    }
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: alloy
  namespace: loki
spec:
  selector:
    matchLabels:
      app: alloy
  template:
    metadata:
      labels:
        app: alloy
    spec:
      serviceAccountName: alloy
      tolerations:
        - key: "node-role.kubernetes.io/control-plane"
          operator: "Exists"
          effect: "NoSchedule"

      containers:
      - name: alloy
        image: grafana/alloy:latest
        args:
          - run
          - /etc/alloy/config.alloy

        ports:
        - containerPort: 12345
          name: http
        
        env:
        - name: NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName

        volumeMounts:
        - name: config
          mountPath: /etc/alloy

        - name: varlogpods
          mountPath: /var/log/pods
          readOnly: true

        - name: varlogcontainers
          mountPath: /var/log/containers
          readOnly: true

        - name: varlibdockercontainers
          mountPath: /var/lib/docker/containers
          readOnly: true

        - name: varlogjournal
          mountPath: /var/log/journal
          readOnly: true

        - name: runlogjournal
          mountPath: /run/log/journal
          readOnly: true

        - name: etcmachineid
          mountPath: /etc/machine-id
          readOnly: true

        securityContext:
          runAsUser: 0

      volumes:
      - name: config
        configMap:
          name: alloy-config

      - name: varlogpods
        hostPath:
          path: /var/log/pods

      - name: varlogcontainers
        hostPath:
          path: /var/log/containers

      - name: varlibdockercontainers
        hostPath:
          path: /var/lib/docker/containers

      - name: varlogjournal
        hostPath:
          path: /var/log/journal
          type: Directory

      - name: runlogjournal
        hostPath:
          path: /run/log/journal
          type: DirectoryOrCreate

      - name: etcmachineid
        hostPath:
          path: /etc/machine-id
          type: File