# Alloy

Grafana Alloy runs as a single-node DaemonSet in `observability-agent`.
It tails only `/var/log/pods`, writes logs to the in-cluster Loki service, and
accepts OTLP/gRPC traces on port `4317` for the in-cluster Tempo service.

The deployment deliberately disables host namespaces, automatic service
account token mounts, CRD creation, the config reloader, public exposure, and
persistent OpenTelemetry queues. The 2 GiB PVC stores only Alloy file
positions and local state. Alloy keeps primary UID/GID `473:473`; supplemental
group `0` permits read-only traversal of k3s' `root:root 0750` Pod log tree
without changing host permissions or running the container as root.