Add Grafana Loki with Alloy for log collection

3 files changed, 46 insertions, 0 deletions

diff --git a/f3s/loki/Justfile b/f3s/loki/Justfile
index 6162880..395d5d6 100644
--- a/f3s/loki/Justfile
+++ b/f3s/loki/Justfile
@@ -3,10 +3,13 @@ install:
     helm repo update
     kubectl apply -f persistent-volumes.yaml
     helm install loki grafana/loki --namespace monitoring -f values.yaml
+    helm install alloy grafana/alloy --namespace monitoring -f alloy-values.yaml
 
 uninstall:
+    helm uninstall alloy --namespace monitoring
     helm uninstall loki --namespace monitoring
     kubectl delete -f persistent-volumes.yaml
 
 upgrade:
     helm upgrade loki grafana/loki --namespace monitoring -f values.yaml
+    helm upgrade alloy grafana/alloy --namespace monitoring -f alloy-values.yaml
diff --git a/f3s/loki/README.md b/f3s/loki/README.md
index 0ebcd46..ec3a2d5 100644
--- a/f3s/loki/README.md
+++ b/f3s/loki/README.md
@@ -2,6 +2,8 @@
 
 Log aggregation system for your k3s cluster.
 
+Includes Grafana Alloy as a DaemonSet to collect logs from all containers in all namespaces.
+
 ## Prerequisites
 
 Create the data directory on your host:
diff --git a/f3s/loki/alloy-values.yaml b/f3s/loki/alloy-values.yaml
new file mode 100644
index 0000000..09da220
--- /dev/null
+++ b/f3s/loki/alloy-values.yaml
@@ -0,0 +1,41 @@
+alloy:
+  configMap:
+    content: |
+      discovery.kubernetes "pods" {
+        role = "pod"
+      }
+
+      discovery.relabel "pods" {
+        targets = discovery.kubernetes.pods.targets
+
+        rule {
+          source_labels = ["__meta_kubernetes_namespace"]
+          target_label  = "namespace"
+        }
+
+        rule {
+          source_labels = ["__meta_kubernetes_pod_name"]
+          target_label  = "pod"
+        }
+
+        rule {
+          source_labels = ["__meta_kubernetes_pod_container_name"]
+          target_label  = "container"
+        }
+
+        rule {
+          source_labels = ["__meta_kubernetes_pod_label_app"]
+          target_label  = "app"
+        }
+      }
+
+      loki.source.kubernetes "pods" {
+        targets    = discovery.relabel.pods.output
+        forward_to = [loki.write.default.receiver]
+      }
+
+      loki.write "default" {
+        endpoint {
+          url = "http://loki.monitoring.svc.cluster.local:3100/loki/api/v1/push"
+        }
+      }