Observability core
This root composes the internal observability workloads deployed after the namespace, CRD, and Local PV prerequisites:
- kube-prometheus-stack without Grafana or its bundled node-exporter;
- single-binary Loki and Tempo using isolated AIStor buckets;
- Alloy for Pod logs and internal OTLP/gRPC traces;
- a standalone node-exporter;
- the exact core NetworkPolicy matrix, platform rules, scrape targets, verified dashboards, and source-only Alertmanager Slack routing.
It intentionally does not create public ingress, Grafana, OIDC, or credential
Secrets. The Slack routing source references
alertmanager-slack-webhook/url; while that Secret is absent, do not apply the
AlertmanagerConfig, its kube-prometheus-stack reference, its public HTTPS
NetworkPolicy, or alert rules. Namespace, CRD, and Local PV roots remain outside
this aggregate because their protected apply order is different.