Trey t 93fddc3769 feat(observability): ship pod logs to Loki via Grafana Alloy ...

Adds a Grafana Alloy DaemonSet that tails honeydue-namespace pod logs
from /var/log/pods and pushes them to Loki at obs.88oakapps.com,
reusing the existing OBS_INGEST_TOKEN (14-day retention).

- deploy-k3s/manifests/observability/alloy-logs.yaml — DaemonSet + RBAC
  + token Secret + Alloy config. Runs as root (/var/log/pods is 0750
  root:root) but otherwise locked down: all caps dropped, read-only
  root filesystem, seccomp RuntimeDefault, read-only hostPath mount.
- network-policies.yaml — allow-egress-from-alloy-logs (DNS + k8s API
  + obs HTTPS), mirroring the vmagent egress policy.
- 03-deploy.sh — applies alloy-logs with the OBS_INGEST_TOKEN
  substitution and waits for the DaemonSet rollout.

The Loki container, nginx /loki/api/v1/push route, and Grafana Loki
datasource live on the obs server and are not repo-managed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-17 20:04:09 -05:00

..

_config.sh

fix(security): remediate 2026-05-12 audit findings (Stages 2–5)

2026-05-16 22:28:33 -05:00

01-provision-cluster.sh

Add K3s dev deployment setup for single-node VPS

2026-03-30 21:30:39 -05:00

02-setup-secrets.sh

fix(security): remediate 2026-05-12 audit findings (Stages 2–5)

2026-05-16 22:28:33 -05:00

03-deploy.sh

feat(observability): ship pod logs to Loki via Grafana Alloy

2026-05-17 20:04:09 -05:00

04-verify.sh

Add K3s dev deployment setup for single-node VPS

2026-03-30 21:30:39 -05:00

rollback.sh

Add K3s dev deployment setup for single-node VPS

2026-03-30 21:30:39 -05:00