This is the Stable version of the documentation. The latest version is experimental and under active development. You can use the version selector in the top-right menu to switch versions for this specific page, or click here to go to the latest version's homepage.

Grafana Alloy (Workload) Installation

Grafana Alloy (Workload) is a Metrics/Logs/Traces Gathering from Opstella-managed Application (OpenTelemetry Enabled Applications)

Prerequisites

Kubernetes Cluster

Grafana Alloy (Workload) will be installed on 🟦 Non-Production Workload and 🟥 Production Workload Kubernetes Cluster

📥Ingress Service provided as Kubernetes Ingress Class (IngressClass)
🛡️TLS Certificate for Grafana Alloy (Workload) provided as Kubernetes Secret
- Grafana Alloy (Workload) will be exposed as HTTPS with Kubernetes Ingress.

Complete Prerequisites

Kubernetes Cluster

Prepare Shell Variables

Ensure you have defined and loaded your Global Shell Variables as described in Shell Variables.

Prepare Shell Variables for Grafana Alloy (Workload)

Ensure you have defined and loaded your Global Shell Variables as described in Shell Variables.
Terminal window
```
source $HOME/opstella-installation/shell-values/tools/observability.vars.sh
```
Grafana Alloy (Workload) is installed on 🟦 Non-Production Workload and 🟥 Production Workload Kubernetes Cluster(s) ONLY ; it is NOT installed on 🟢 Management.
Cluster specific Shell Variables and Kubeconfig File are loaded per Kubernetes Cluster in the steps below.
Set Workload Kubernetes Cluster Information

Ensure K8S_INTERNAL_DOMAIN, K8S_INGRESSCLASS_NAME, K8S_STORAGECLASS_NAME are defined as per the Shell Variables guide, for EACH of 🟦 Non-Production Workload and 🟥 Production Workload Kubernetes Cluster(s).
Set Kubernetes Secret Name for 🛡️ TLS Certificate for Grafana Alloy (Workload)

Kubernetes Ingress for Grafana Alloy (Workload) will associate TLS Certificate with Kubernetes Secret named wildcard-${BASE_DOMAIN}-tls.
```
export K8S_INGRESS_TLS_CERTIFICATE_SECRET_NAME="wildcard-${BASE_DOMAIN}-tls"
```
The Kubernetes Secret MUST exist in Namespace observability-agents of EACH Workload Kubernetes Cluster.
Kubernetes resolves the TLS Secret of an Ingress from the SAME Namespace as that Ingress ; a Secret created on 🟢 Management, or in another Namespace, is NEVER used and NGINX will serve its own Kubernetes Ingress Controller Fake Certificate instead.
It is created in the Installation section, after connecting to each Workload Kubernetes Cluster.

Pre-Installation

Grafana Alloy (Workload) Preparation

Create Helm Values Configuration, create for 🟦 Non-Production Workload Kubernetes Cluster

cat <<EOF > $BASE_WORKING_DIR/helm-values/grafana-alloy-workload-nonprod-full-values.yaml
## Global properties for image pulling override the values defined under 'image.registry' and 'configReloader.image.registry'.
## If you want to override only one image registry, use the specific fields but if you want to override them all, use 'global.image.registry'
global:
  # -- Security context to apply to the Grafana Alloy pod.
  podSecurityContext:
    fsGroup: 473

# Options for the extra controller used for config reloading.
configReloader:
  securityContext:
    runAsUser: 473
    runAsGroup: 473
    runAsNonRoot: true
    privileged: false
    allowPrivilegeEscalation: false
    capabilities:
      drop: ["ALL"]
    seccompProfile:
      type: "RuntimeDefault"

# Options for the extra controller used for config reloading.
alloy:

  ## OPSTELLA_CUSTOMIZE: SecuityContext
  securityContext:
    runAsUser: 473
    runAsGroup: 473
    runAsNonRoot: true
    privileged: false
    allowPrivilegeEscalation: false
    capabilities:
      drop: ["ALL"]
    seccompProfile:
      type: "RuntimeDefault"

  configMap:
    create: true

  ## OPSTELLA_CUSTOMIZE: Enable Alloy Clustering
  clustering:
    # -- Deploy Alloy in a cluster to allow for load distribution.
    enabled: true

  ## OPSTELLA_CUSTOMIZE: Enable Alloy to be OTel gRPC Receiver
  extraPorts:
    - name: otlp-grpc
      port: 4317
      targetPort: 4317
      protocol: "TCP"

EOF

Create Helm Values Configuration, create for 🟥 Production Workload Kubernetes Cluster

cat <<EOF > $BASE_WORKING_DIR/helm-values/grafana-alloy-workload-prod-full-values.yaml
## Global properties for image pulling override the values defined under 'image.registry' and 'configReloader.image.registry'.
## If you want to override only one image registry, use the specific fields but if you want to override them all, use 'global.image.registry'
global:
  # -- Security context to apply to the Grafana Alloy pod.
  podSecurityContext:
    fsGroup: 473

# Options for the extra controller used for config reloading.
configReloader:
  securityContext:
    runAsUser: 473
    runAsGroup: 473
    runAsNonRoot: true
    privileged: false
    allowPrivilegeEscalation: false
    capabilities:
      drop: ["ALL"]
    seccompProfile:
      type: "RuntimeDefault"

# Options for the extra controller used for config reloading.
alloy:

  ## OPSTELLA_CUSTOMIZE: SecuityContext
  securityContext:
    runAsUser: 473
    runAsGroup: 473
    runAsNonRoot: true
    privileged: false
    allowPrivilegeEscalation: false
    capabilities:
      drop: ["ALL"]
    seccompProfile:
      type: "RuntimeDefault"

  configMap:
    create: true

  ## OPSTELLA_CUSTOMIZE: Enable Alloy Clustering
  clustering:
    # -- Deploy Alloy in a cluster to allow for load distribution.
    enabled: true

  ## OPSTELLA_CUSTOMIZE: Enable Alloy to be OTel gRPC Receiver
  extraPorts:
    - name: otlp-grpc
      port: 4317
      targetPort: 4317
      protocol: "TCP"

EOF

Create Kubernetes Manifest Configuration for Grafana Alloy Health Checking for 🟦 Non-Production Workload

Load 🟦 Non-Production Workload Kubernetes Cluster Shell Variables first, so the Ingress is rendered with ITS K8S_INGRESSCLASS_NAME

source $HOME/opstella-installation/shell-values/kubernetes/nonprod_cluster.vars.sh

Set Domain for Grafana Alloy

export GRAFANA_ALLOY_WORKLOAD_DOMAIN="alloy-nonprod.${BASE_DOMAIN}"

cat <<EOF > $BASE_WORKING_DIR/kubernetes-manifests/grafana-alloy-nonprod-healthcheck-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: grafana-alloy-workload-healthcheck
  namespace: observability-agents
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /-/ready
spec:
  ingressClassName: ${K8S_INGRESSCLASS_NAME}
  tls:
    - secretName: ${K8S_INGRESS_TLS_CERTIFICATE_SECRET_NAME}
  rules:
    - host: ${GRAFANA_ALLOY_WORKLOAD_DOMAIN}
      http:
        paths:
          - path: /workload/ready
            pathType: ImplementationSpecific
            backend:
              service:
                name: grafana-alloy-workload
                port:
                  number: 12345
EOF

Create Kubernetes Manifest Configuration for Grafana Alloy Health Checking for 🟥 Production Workload

Load 🟥 Production Workload Kubernetes Cluster Shell Variables first, so the Ingress is rendered with ITS K8S_INGRESSCLASS_NAME

source $HOME/opstella-installation/shell-values/kubernetes/prod_cluster.vars.sh

Set Domain for Grafana Alloy

export GRAFANA_ALLOY_WORKLOAD_DOMAIN="alloy-prod.${BASE_DOMAIN}"

cat <<EOF > $BASE_WORKING_DIR/kubernetes-manifests/grafana-alloy-prod-healthcheck-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: grafana-alloy-workload-healthcheck
  namespace: observability-agents
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /-/ready
spec:
  ingressClassName: ${K8S_INGRESSCLASS_NAME}
  tls:
    - secretName: ${K8S_INGRESS_TLS_CERTIFICATE_SECRET_NAME}
  rules:
    - host: ${GRAFANA_ALLOY_WORKLOAD_DOMAIN}
      http:
        paths:
          - path: /workload/ready
            pathType: ImplementationSpecific
            backend:
              service:
                name: grafana-alloy-workload
                port:
                  number: 12345
EOF

Installation

Connect to 🟦 Non-Production Workload Kubernetes Cluster ; i.e w/ Kubeconfig File

source $HOME/opstella-installation/shell-values/kubernetes/nonprod_cluster.vars.sh
export KUBECONFIG="$HOME/opstella-installation/kubeconfigs/nonprod_cluster.yaml"

Create Kubernetes Secret for 🛡️ TLS Certificate for Grafana Alloy (Workload) in Namespace observability-agents on 🟦 Non-Production Workload

Create one using from .crt and .key file.
Terminal window
```
kubectl create secret tls $K8S_INGRESS_TLS_CERTIFICATE_SECRET_NAME \
  --cert=/path/to/cert/file --key=/path/to/key/file \
  --namespace observability-agents
```
💡 Should return secret/wildcard-${BASE_DOMAIN}-tls created message.

Install Grafana Alloy (Workload) on 🟦 Non-Production Workload

Install a Helm Release with specific Helm Chart Version --version 0.12.3 (App Version: v1.7.2)

helm install grafana-alloy-workload grafana/alloy --version 0.12.3 \
  --namespace observability-agents \
  -f $HOME/opstella-installation/helm-values/grafana-alloy-workload-nonprod-full-values.yaml

Apply Kubernetes Manifest on 🟦 Non-Production Workload

kubectl apply -f $HOME/opstella-installation/kubernetes-manifests/grafana-alloy-nonprod-healthcheck-ingress.yaml

Connect to 🟥 Production Workload Kubernetes Cluster ; i.e w/ Kubeconfig File

source $HOME/opstella-installation/shell-values/kubernetes/prod_cluster.vars.sh
export KUBECONFIG="$HOME/opstella-installation/kubeconfigs/prod_cluster.yaml"

Create Kubernetes Secret for 🛡️ TLS Certificate for Grafana Alloy (Workload) in Namespace observability-agents on 🟥 Production Workload

Create one using from .crt and .key file.
Terminal window
```
kubectl create secret tls $K8S_INGRESS_TLS_CERTIFICATE_SECRET_NAME \
  --cert=/path/to/cert/file --key=/path/to/key/file \
  --namespace observability-agents
```
💡 Should return secret/wildcard-${BASE_DOMAIN}-tls created message.

Install Grafana Alloy (Workload) on 🟥 Production Workload

helm install grafana-alloy-workload grafana/alloy --version 0.12.3 \
  --namespace observability-agents \
  -f $HOME/opstella-installation/helm-values/grafana-alloy-workload-prod-full-values.yaml

Apply Kubernetes Manifest on 🟥 Production Workload

kubectl apply -f $HOME/opstella-installation/kubernetes-manifests/grafana-alloy-prod-healthcheck-ingress.yaml

Post-Installation

Grafana Alloy (Workload) Testing

Get Pods Status

kubectl get pods -n observability-agents

Grafana Alloy should be Running

NAME                                READY   STATUS    RESTARTS  AGE
... (deducted)
grafana-alloy-workload-0            1/1     Running   0         Xd
grafana-alloy-workload-1            1/1     Running   0         Xd
grafana-alloy-workload-2            1/1     Running   0         Xd

Finished?

Use the below navigation to proceed

Previous
Grafana Alloy (Platform) Next
Overview