From 37db88f2d028f9f4aeba9054454b5be32c833147 Mon Sep 17 00:00:00 2001
From: Michael Thomson <me@michaelthomson.dev>
Date: Fri, 20 Mar 2026 00:20:10 -0400
Subject: [PATCH] alloy push to loki

---
 apps/kube-prometheus-stack/release-alloy.yaml | 129 ++++++++++++++++++
 1 file changed, 129 insertions(+)

diff --git a/apps/kube-prometheus-stack/release-alloy.yaml b/apps/kube-prometheus-stack/release-alloy.yaml
index 9d98bd5..14bab6a 100644
--- a/apps/kube-prometheus-stack/release-alloy.yaml
+++ b/apps/kube-prometheus-stack/release-alloy.yaml
@@ -14,3 +14,132 @@ spec:
   interval: 15m
   releaseName: alloy
   values:
+    alloy:
+      configMap:
+        content: |-
+          // Write your Alloy config here:
+          loki.write "default" {
+            endpoint {
+              url = "http://loki:3100/loki/api/v1/push"
+            }
+          }
+
+          // discovery.kubernetes allows you to find scrape targets from Kubernetes resources.
+          // It watches cluster state and ensures targets are continually synced with what is currently running in your cluster.
+          discovery.kubernetes "pod" {
+            role = "pod"
+            // Restrict to pods on the node to reduce cpu & memory usage
+            selectors {
+              role = "pod"
+              field = "spec.nodeName=" + coalesce(sys.env("HOSTNAME"), constants.hostname)
+            }
+          }
+
+          // discovery.relabel rewrites the label set of the input targets by applying one or more relabeling rules.
+          // If no rules are defined, then the input targets are exported as-is.
+          discovery.relabel "pod_logs" {
+            targets = discovery.kubernetes.pod.targets
+
+            // Label creation - "namespace" field from "__meta_kubernetes_namespace"
+            rule {
+              source_labels = ["__meta_kubernetes_namespace"]
+              action = "replace"
+              target_label = "namespace"
+            }
+
+            // Label creation - "pod" field from "__meta_kubernetes_pod_name"
+            rule {
+              source_labels = ["__meta_kubernetes_pod_name"]
+              action = "replace"
+              target_label = "pod"
+            }
+
+            // Label creation - "container" field from "__meta_kubernetes_pod_container_name"
+            rule {
+              source_labels = ["__meta_kubernetes_pod_container_name"]
+              action = "replace"
+              target_label = "container"
+            }
+
+            // Label creation -  "app" field from "__meta_kubernetes_pod_label_app_kubernetes_io_name"
+            rule {
+              source_labels = ["__meta_kubernetes_pod_label_app_kubernetes_io_name"]
+              action = "replace"
+              target_label = "app"
+            }
+
+            // Label creation -  "job" field from "__meta_kubernetes_namespace" and "__meta_kubernetes_pod_container_name"
+            // Concatenate values __meta_kubernetes_namespace/__meta_kubernetes_pod_container_name
+            rule {
+              source_labels = ["__meta_kubernetes_namespace", "__meta_kubernetes_pod_container_name"]
+              action = "replace"
+              target_label = "job"
+              separator = "/"
+              replacement = "$1"
+            }
+
+            // Label creation - "__path__" field from "__meta_kubernetes_pod_uid" and "__meta_kubernetes_pod_container_name"
+            // Concatenate values __meta_kubernetes_pod_uid/__meta_kubernetes_pod_container_name.log
+            rule {
+              source_labels = ["__meta_kubernetes_pod_uid", "__meta_kubernetes_pod_container_name"]
+              action = "replace"
+              target_label = "__path__"
+              separator = "/"
+              replacement = "/var/log/pods/*$1/*.log"
+            }
+
+            // Label creation -  "container_runtime" field from "__meta_kubernetes_pod_container_id"
+            rule {
+              source_labels = ["__meta_kubernetes_pod_container_id"]
+              action = "replace"
+              target_label = "container_runtime"
+              regex = `^(\S+):\/\/.+$`
+              replacement = "$1"
+            }
+          }
+
+          // loki.source.kubernetes tails logs from Kubernetes containers using the Kubernetes API.
+          loki.source.kubernetes "pod_logs" {
+            targets    = discovery.relabel.pod_logs.output
+            forward_to = [loki.process.pod_logs.receiver]
+          }
+
+          // loki.process receives log entries from other Loki components, applies one or more processing stages,
+          // and forwards the results to the list of receivers in the component's arguments.
+          loki.process "pod_logs" {
+            stage.static_labels {
+                values = {
+                  cluster = "server",
+                }
+            }
+
+            forward_to = [loki.write.default.receiver]
+          }
+
+          // loki.source.kubernetes_events tails events from the Kubernetes API and converts them
+          // into log lines to forward to other Loki components.
+          loki.source.kubernetes_events "cluster_events" {
+            job_name   = "integrations/kubernetes/eventhandler"
+            log_format = "logfmt"
+            forward_to = [
+              loki.process.cluster_events.receiver,
+            ]
+          }
+
+          // loki.process receives log entries from other loki components, applies one or more processing stages,
+          // and forwards the results to the list of receivers in the component's arguments.
+          loki.process "cluster_events" {
+            forward_to = [loki.write.default.receiver]
+
+            stage.static_labels {
+              values = {
+                cluster = "server",
+              }
+            }
+
+            stage.labels {
+              values = {
+                kubernetes_cluster_events = "job",
+              }
+            }
+          }