crds:
  create: false

global:
  podSecurityContext:
    runAsNonRoot: true
    runAsUser: 473
    runAsGroup: 473
    fsGroup: 473
    fsGroupChangePolicy: OnRootMismatch
    # k3s keeps /var/log/pods root:root 0750. Retain Alloy's non-root primary
    # identity while granting read-only traversal of that single hostPath.
    supplementalGroups:
      - 0
    seccompProfile:
      type: RuntimeDefault

alloy:
  configMap:
    create: false
    name: alloy-config
    key: config.alloy
  clustering:
    enabled: false
  stabilityLevel: generally-available
  storagePath: /var/lib/alloy
  enableHttpServerPort: true
  listenAddr: 0.0.0.0
  listenPort: 12345
  enableReporting: false
  extraPorts:
    - name: otlp-grpc
      port: 4317
      targetPort: 4317
      protocol: TCP
  mounts:
    varlog: false
    dockercontainers: false
    extra:
      - name: pod-logs
        mountPath: /var/log/pods
        readOnly: true
      - name: alloy-storage
        mountPath: /var/lib/alloy
      - name: tmp
        mountPath: /tmp
      - name: kubernetes-api-access
        mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        readOnly: true
  securityContext:
    runAsNonRoot: true
    runAsUser: 473
    runAsGroup: 473
    allowPrivilegeEscalation: false
    readOnlyRootFilesystem: true
    capabilities:
      drop:
        - ALL
    seccompProfile:
      type: RuntimeDefault
  resources:
    requests:
      cpu: 200m
      memory: 384Mi
    limits:
      cpu: "1"
      memory: 768Mi

image:
  registry: docker.io
  repository: grafana/alloy
  tag: v1.18.0
  digest: sha256:eb21f4c0858edffcdd1b385910ddeef26f692fc2c282f61baa724fc09d274a17
  pullPolicy: IfNotPresent

rbac:
  create: true
  namespaces: []
  rules:
    - apiGroups:
        - ""
      resources:
        - pods
        - namespaces
      verbs:
        - get
        - list
        - watch
  clusterRules:
    - apiGroups:
        - apps
      resources:
        - replicasets
      verbs:
        - get
        - list
        - watch

serviceAccount:
  create: true
  name: alloy
  automountServiceAccountToken: false

configReloader:
  enabled: false

controller:
  type: daemonset
  hostNetwork: false
  hostPID: false
  volumes:
    extra:
      - name: pod-logs
        hostPath:
          path: /var/log/pods
          type: Directory
      - name: alloy-storage
        persistentVolumeClaim:
          claimName: alloy-storage
      - name: tmp
        emptyDir: {}
      - name: kubernetes-api-access
        projected:
          defaultMode: 420
          sources:
            - serviceAccountToken:
                expirationSeconds: 3600
                path: token
            - configMap:
                name: kube-root-ca.crt
                items:
                  - key: ca.crt
                    path: ca.crt
            - downwardAPI:
                items:
                  - path: namespace
                    fieldRef:
                      apiVersion: v1
                      fieldPath: metadata.namespace

networkPolicy:
  enabled: false

service:
  enabled: true
  type: ClusterIP

serviceMonitor:
  enabled: true
  interval: 30s
  additionalLabels:
    observability.hyeonworks.com/instance: home

ingress:
  enabled: false