diff --git a/chart/templates/alloy/_postrenderers.tpl b/chart/templates/alloy/_postrenderers.tpl new file mode 100644 index 0000000000000000000000000000000000000000..1455db0a603694372b191142d345dd0136643246 --- /dev/null +++ b/chart/templates/alloy/_postrenderers.tpl @@ -0,0 +1,11 @@ +{{- define "alloy.istioPostRenderers" }} +- kustomize: + patches: + - patch: | + - op: replace + path: /spec/endpoints/0/scheme + value: https + target: + kind: ServiceMonitor + name: ".*alloy-alloy.*" +{{- end }} \ No newline at end of file diff --git a/chart/templates/alloy/helmrelease.yaml b/chart/templates/alloy/helmrelease.yaml index 8554c74983795539ebe2b037650e2302bcc2d75e..189ecf3d0c9a28bfb1f4815f75bc2ff8148b350e 100644 --- a/chart/templates/alloy/helmrelease.yaml +++ b/chart/templates/alloy/helmrelease.yaml @@ -1,4 +1,5 @@ -{{- $fluxSettingsMonitoring := merge .Values.addons.alloy.flux .Values.flux -}} +{{- $fluxSettingsAlloy := merge .Values.addons.alloy.flux .Values.flux -}} +{{- $isStrictIstio := and (eq (include "istioEnabled" .) "true") (eq (dig "istio" "mtls" "mode" "STRICT" .Values.addons.alloy.values) "STRICT") -}} {{- if .Values.addons.alloy.enabled }} apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease @@ -37,12 +38,15 @@ spec: {{- end }} {{- end }} interval: 5m - - {{- toYaml $fluxSettingsMonitoring | nindent 2 }} - - {{- if .Values.addons.alloy.postRenderers }} + {{- toYaml $fluxSettingsAlloy | nindent 2 }} + {{- if or .Values.addons.alloy.postRenderers (and .Values.monitoring.enabled $isStrictIstio ) }} postRenderers: - {{ toYaml .Values.addons.alloy.postRenderers | nindent 4 }} + {{- if and .Values.monitoring.enabled $isStrictIstio }} + {{- include "alloy.istioPostRenderers" . | nindent 4 }} + {{- end }} + {{- with .Values.addons.alloy.postRenderers }} + {{- toYaml . | nindent 4 }} + {{- end }} {{- end }} valuesFrom: - name: {{ .Release.Name }}-alloy-values @@ -70,6 +74,10 @@ spec: - name: kyverno-policies namespace: {{ .Release.Namespace }} {{- end }} + {{- if .Values.monitoring.enabled }} + - name: monitoring + namespace: {{ .Release.Namespace }} + {{- end }} {{- end }} {{- end }} diff --git a/chart/templates/alloy/values.yaml b/chart/templates/alloy/values.yaml index c903df42751205b58e3705468fbb1f2aef7ac130..a7dc2c9f9c8af8a3c463c808dc1cc21b640fb935 100644 --- a/chart/templates/alloy/values.yaml +++ b/chart/templates/alloy/values.yaml @@ -26,4 +26,18 @@ istio: (dig "istio" "hardened" "enabled" false .Values.addons.alloy.values) }} +k8s-monitoring: + {{- range $service := list "alloy-metrics" "alloy-log" }} # Add/Remove Alloy Micro-Services as Alloy Configurations Change + {{ $service }}: + serviceMonitor: + enabled: {{ $.Values.monitoring.enabled }} + {{- if and (include "istioEnabled" $) (eq (dig "istio" "mtls" "mode" "STRICT" $.Values.addons.alloy.values) "STRICT") }} + tlsConfig: + caFile: /etc/prom-certs/root-cert.pem + certFile: /etc/prom-certs/cert-chain.pem + keyFile: /etc/prom-certs/key.pem + insecureSkipVerify: true # Prometheus does not support Istio security naming, thus skip verifying target pod certificate + {{- end }} + {{- end }} + {{- end }} \ No newline at end of file