controller:
  type: daemonset
  tolerations:
    - key: node-role.kubernetes.io/control-plane
      operator: Exists
      effect: NoSchedule

alloy:
  configMap:
    create: true
    content: |
      // ── Обнаружение подов Kubernetes ─────────────────────────────
      discovery.kubernetes "pods" {
        role = "pod"
      }

      // ── Relabeling: namespace, pod, container, app ────────────────
      discovery.relabel "pod_logs" {
        targets = discovery.kubernetes.pods.targets

        rule {
          source_labels = ["__meta_kubernetes_namespace"]
          target_label  = "namespace"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_name"]
          target_label  = "pod"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_container_name"]
          target_label  = "container"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_label_app"]
          target_label  = "app"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_annotation_filter_debug"]
          regex         = "true"
          action        = "drop"
        }
      }

      // ── Чтение файлов логов подов ─────────────────────────────────
      loki.source.kubernetes "pods" {
        targets    = discovery.relabel.pod_logs.output
        forward_to = [loki.process.parse.receiver]
      }

      // ── Парсинг JSON-логов, отброс debug ─────────────────────────
      loki.process "parse" {
        stage.json {
          expressions = {level = "level", msg = "message"}
        }
        stage.labels {
          values = {level = ""}
        }
        stage.drop {
          expression          = ".*level=\"debug\".*"
          drop_counter_reason = "debug_dropped"
        }
        forward_to = [loki.write.local.receiver]
      }

      // ── Сбор journald (kubelet, containerd, sshd) ─────────────────
      discovery.relabel "journal" {
        targets = []
        rule {
          source_labels = ["__journal__systemd_unit"]
          target_label  = "unit"
        }
        rule {
          source_labels = ["__journal__hostname"]
          target_label  = "node"
        }
      }

      loki.source.journal "systemd" {
        path          = "/var/log/journal"
        max_age       = "12h"
        labels        = {job = "systemd-journal"}
        forward_to    = [loki.write.local.receiver]
        relabel_rules = discovery.relabel.journal.rules
      }

      // ── Отправка в Loki ───────────────────────────────────────────
      loki.write "local" {
        endpoint {
          url = "http://loki.{{ logging_namespace }}.svc.cluster.local:3100/loki/api/v1/push"
        }
      }

  mounts:
    varlog: true
    dockercontainers: false

extraVolumes:
  - name: journal
    hostPath:
      path: /var/log/journal

extraVolumeMounts:
  - name: journal
    mountPath: /var/log/journal
    readOnly: true