From 5150565254eaab0e9d9c0f20a65bd44e25a04ffc Mon Sep 17 00:00:00 2001
From: Pete Wall <pete.wall@grafana.com>
Date: Wed, 30 Oct 2024 09:11:03 -0500
Subject: [PATCH 1/6] Add image scanner

Signed-off-by: Pete Wall <pete.wall@grafana.com>
---
 .github/workflows/security-scans.yml          |   60 +
 .../examples/features/all-features/README.md  |   63 +
 .../features/all-features/alloy-logs.alloy    |  173 +
 .../features/all-features/alloy-metrics.alloy |  839 ++++
 .../all-features/alloy-profiles.alloy         |  846 ++++
 .../all-features/alloy-receiver.alloy         |  168 +
 .../all-features/alloy-singleton.alloy        |  109 +
 .../features/all-features/output.yaml         | 4418 +++++++++++++++++
 .../features/all-features/values.yaml         |   54 +
 9 files changed, 6730 insertions(+)
 create mode 100644 .github/workflows/security-scans.yml
 create mode 100644 charts/k8s-monitoring/docs/examples/features/all-features/README.md
 create mode 100644 charts/k8s-monitoring/docs/examples/features/all-features/alloy-logs.alloy
 create mode 100644 charts/k8s-monitoring/docs/examples/features/all-features/alloy-metrics.alloy
 create mode 100644 charts/k8s-monitoring/docs/examples/features/all-features/alloy-profiles.alloy
 create mode 100644 charts/k8s-monitoring/docs/examples/features/all-features/alloy-receiver.alloy
 create mode 100644 charts/k8s-monitoring/docs/examples/features/all-features/alloy-singleton.alloy
 create mode 100644 charts/k8s-monitoring/docs/examples/features/all-features/output.yaml
 create mode 100644 charts/k8s-monitoring/docs/examples/features/all-features/values.yaml

diff --git a/.github/workflows/security-scans.yml b/.github/workflows/security-scans.yml
new file mode 100644
index 000000000..24f9daa2d
--- /dev/null
+++ b/.github/workflows/security-scans.yml
@@ -0,0 +1,60 @@
+---
+name: Security Scans
+
+on:
+  push:
+    branches: ["main"]
+    paths:
+      - 'charts/k8s-monitoring/docs/examples/features/all-features/output.yaml'
+  pull_request:
+    paths:
+      - 'charts/k8s-monitoring/docs/examples/features/all-features/output.yaml'
+  workflow_dispatch:
+
+jobs:
+  list-container-images:
+    name: List Container Images
+    runs-on: ubuntu-latest
+    outputs:
+      images: ${{ steps.list_images.outputs.images }}
+    steps:
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.9'
+          check-latest: true
+
+      - name: Install yq
+        run: pip install yq
+
+      - name: List Container Images
+        id: list_images
+        run: |
+          file=charts/k8s-monitoring/docs/examples/features/all-features/output.yaml
+          yq -r -o json '. | select(.kind=="DaemonSet") | .spec.template.spec.containers[].image' "${file}" > images.txt
+          yq -r -o json '. | select(.kind=="Deployment") | .spec.template.spec.containers[].image' "${file}" > images.txt
+          yq -r -o json '. | select(.kind=="Job") | .spec.template.spec.containers[].image' "${file}" > images.txt
+          yq -r -o json '. | select(.kind=="Pod") | .spec.containers[].image' "${file}" > images.txt
+          yq -r -o json '. | select(.kind=="StatefulSet") | .spec.template.spec.containers[].image' "${file}" > images.txt
+          echo "images=$(cat images.txt | sort --unique | jq --raw-input --slurp --compact-output 'split("\n") | map(select(. != ""))')" >> "${GITHUB_OUTPUT}"
+
+  scan-container-images:
+    name: Scan Container Images
+    needs: list-container-images
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        image: ${{ fromJson(needs.list-container-images.outputs.images) }}
+      fail-fast: false
+    steps:
+      - name: Run Trivy
+        uses: aquasecurity/trivy-action
+        with:
+          image-ref: ${{ matrix.image }}
+          format: sarif
+          output: trivy-results.sarif
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: trivy-results.sarif
diff --git a/charts/k8s-monitoring/docs/examples/features/all-features/README.md b/charts/k8s-monitoring/docs/examples/features/all-features/README.md
new file mode 100644
index 000000000..0f956f84b
--- /dev/null
+++ b/charts/k8s-monitoring/docs/examples/features/all-features/README.md
@@ -0,0 +1,63 @@
+<!--
+(NOTE: Do not edit README.md directly. It is a generated file!)
+(      To make changes, please modify values.yaml or description.txt and run `make examples`)
+-->
+# Example: features/all-features/values.yaml
+
+## Values
+
+```yaml
+---
+cluster:
+  name: all-features-cluster
+
+destinations:
+  - name: otlpGateway
+    type: otlp
+    url: https://otlp.example.com:4317/v1/traces
+    auth:
+      type: basic
+      username: "my-username"
+      password: "my-password"
+    metrics: { enabled: true }
+    logs:    { enabled: true }
+    traces:  { enabled: true }
+  - name: pyroscope
+    type: pyroscope
+    url: http://pyroscope.example.com
+
+# Features
+clusterMetrics:
+  enabled: true
+  kepler: { enabled: true }
+clusterEvents: { enabled: true }
+
+podLogs: { enabled: true }
+applicationObservability:
+  enabled: true
+  receivers:
+    grpc:
+      enabled: true
+annotationAutodiscovery: { enabled: true }
+prometheusOperatorObjects: { enabled: true }
+profiling: { enabled: true }
+integrations:
+  alloy:
+    instances:
+      - name: alloy
+
+# Collectors
+alloy-metrics: { enabled: true }
+
+alloy-logs: { enabled: true }
+
+alloy-singleton: { enabled: true }
+alloy-receiver:
+  enabled: true
+  alloy:
+    extraPorts:
+      - name: otlp-grpc
+        port: 4317
+        targetPort: 4317
+        protocol: TCP
+alloy-profiles: { enabled: true }```
diff --git a/charts/k8s-monitoring/docs/examples/features/all-features/alloy-logs.alloy b/charts/k8s-monitoring/docs/examples/features/all-features/alloy-logs.alloy
new file mode 100644
index 000000000..0a02fb28c
--- /dev/null
+++ b/charts/k8s-monitoring/docs/examples/features/all-features/alloy-logs.alloy
@@ -0,0 +1,173 @@
+// Destination: otlpGateway (otlp)
+otelcol.receiver.prometheus "otlpgateway" {
+  output {
+    metrics = [otelcol.processor.transform.otlpgateway.input]
+  }
+}
+otelcol.receiver.loki "otlpgateway" {
+  output {
+    logs = [otelcol.processor.transform.otlpgateway.input]
+  }
+}
+otelcol.auth.basic "otlpgateway" {
+  username = nonsensitive(remote.kubernetes.secret.otlpgateway.data["username"])
+  password = remote.kubernetes.secret.otlpgateway.data["password"]
+}
+
+otelcol.processor.transform "otlpgateway" {
+  error_mode = "ignore"
+  metric_statements {
+    context = "resource"
+    statements = ["set(attributes[\"k8s.cluster.name\"], \"all-features-cluster\") where attributes[\"k8s.cluster.name\"] == nil"]
+  }
+  log_statements {
+    context = "resource"
+    statements = ["set(attributes[\"k8s.cluster.name\"], \"all-features-cluster\") where attributes[\"k8s.cluster.name\"] == nil"]
+  }
+  trace_statements {
+    context = "resource"
+    statements = ["set(attributes[\"k8s.cluster.name\"], \"all-features-cluster\") where attributes[\"k8s.cluster.name\"] == nil"]
+  }
+
+  output {
+    metrics = [otelcol.exporter.otlp.otlpgateway.input]
+    logs = [otelcol.exporter.otlp.otlpgateway.input]
+    traces = [otelcol.exporter.otlp.otlpgateway.input]
+  }
+}
+otelcol.exporter.otlp "otlpgateway" {
+  client {
+    endpoint = "https://otlp.example.com:4317/v1/traces"
+    headers = {
+      "X-Scope-OrgID" = nonsensitive(remote.kubernetes.secret.otlpgateway.data["tenantId"]),
+    }
+    tls {
+      insecure = false
+      insecure_skip_verify = false
+      ca_pem = nonsensitive(remote.kubernetes.secret.otlpgateway.data["ca"])
+      cert_pem = nonsensitive(remote.kubernetes.secret.otlpgateway.data["cert"])
+      key_pem = remote.kubernetes.secret.otlpgateway.data["key"]
+    }
+  }
+}
+
+remote.kubernetes.secret "otlpgateway" {
+  name      = "otlpgateway-ko-k8s-monitoring"
+  namespace = "default"
+}
+
+// Feature: Pod Logs
+declare "pod_logs" {
+  argument "logs_destinations" {
+    comment = "Must be a list of log destinations where collected logs should be forwarded to"
+  }
+  
+  discovery.relabel "filtered_pods" {
+    targets = discovery.kubernetes.pods.targets
+    rule {
+      source_labels = ["__meta_kubernetes_namespace"]
+      action = "replace"
+      target_label = "namespace"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_name"]
+      action = "replace"
+      target_label = "pod"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_container_name"]
+      action = "replace"
+      target_label = "container"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_namespace", "__meta_kubernetes_pod_container_name"]
+      separator = "/"
+      action = "replace"
+      replacement = "$1"
+      target_label = "job"
+    }
+  
+    // set the container runtime as a label
+    rule {
+      action = "replace"
+      source_labels = ["__meta_kubernetes_pod_container_id"]
+      regex = "^(\\S+):\\/\\/.+$"
+      replacement = "$1"
+      target_label = "tmp_container_runtime"
+    }
+  }
+  
+  discovery.kubernetes "pods" {
+    role = "pod"
+    selectors {
+      role = "pod"
+      field = "spec.nodeName=" + env("HOSTNAME")
+    }
+  }
+  
+  discovery.relabel "filtered_pods_with_paths" {
+    targets = discovery.relabel.filtered_pods.output
+  
+    rule {
+      source_labels = ["__meta_kubernetes_pod_uid", "__meta_kubernetes_pod_container_name"]
+      separator = "/"
+      action = "replace"
+      replacement = "/var/log/pods/*$1/*.log"
+      target_label = "__path__"
+    }
+  }
+  
+  local.file_match "pod_logs" {
+    path_targets = discovery.relabel.filtered_pods_with_paths.output
+  }
+  
+  loki.source.file "pod_logs" {
+    targets    = local.file_match.pod_logs.targets
+    forward_to = [loki.process.pod_logs.receiver]
+  }
+  
+  loki.process "pod_logs" {
+    stage.match {
+      selector = "{tmp_container_runtime=~\"containerd|cri-o\"}"
+      // the cri processing stage extracts the following k/v pairs: log, stream, time, flags
+      stage.cri {}
+  
+      // Set the extract flags and stream values as labels
+      stage.labels {
+        values = {
+          flags  = "",
+          stream  = "",
+        }
+      }
+    }
+  
+    stage.match {
+      selector = "{tmp_container_runtime=\"docker\"}"
+      // the docker processing stage extracts the following k/v pairs: log, stream, time
+      stage.docker {}
+  
+      // Set the extract stream value as a label
+      stage.labels {
+        values = {
+          stream  = "",
+        }
+      }
+    }
+  
+    // Drop the filename label, since it's not really useful in the context of Kubernetes, where we already have cluster,
+    // namespace, pod, and container labels. Drop any structured metadata. Also drop the temporary
+    // container runtime label as it is no longer needed.
+    stage.label_drop {
+      values = [
+        "filename",
+        "tmp_container_runtime",
+      ]
+    }
+    forward_to = argument.logs_destinations.value
+  }
+}
+pod_logs "feature" {
+  logs_destinations = [
+    otelcol.receiver.loki.otlpgateway.receiver,
+  ]
+}
diff --git a/charts/k8s-monitoring/docs/examples/features/all-features/alloy-metrics.alloy b/charts/k8s-monitoring/docs/examples/features/all-features/alloy-metrics.alloy
new file mode 100644
index 000000000..fb5558e9d
--- /dev/null
+++ b/charts/k8s-monitoring/docs/examples/features/all-features/alloy-metrics.alloy
@@ -0,0 +1,839 @@
+// Destination: otlpGateway (otlp)
+otelcol.receiver.prometheus "otlpgateway" {
+  output {
+    metrics = [otelcol.processor.transform.otlpgateway.input]
+  }
+}
+otelcol.receiver.loki "otlpgateway" {
+  output {
+    logs = [otelcol.processor.transform.otlpgateway.input]
+  }
+}
+otelcol.auth.basic "otlpgateway" {
+  username = nonsensitive(remote.kubernetes.secret.otlpgateway.data["username"])
+  password = remote.kubernetes.secret.otlpgateway.data["password"]
+}
+
+otelcol.processor.transform "otlpgateway" {
+  error_mode = "ignore"
+  metric_statements {
+    context = "resource"
+    statements = ["set(attributes[\"k8s.cluster.name\"], \"all-features-cluster\") where attributes[\"k8s.cluster.name\"] == nil"]
+  }
+  log_statements {
+    context = "resource"
+    statements = ["set(attributes[\"k8s.cluster.name\"], \"all-features-cluster\") where attributes[\"k8s.cluster.name\"] == nil"]
+  }
+  trace_statements {
+    context = "resource"
+    statements = ["set(attributes[\"k8s.cluster.name\"], \"all-features-cluster\") where attributes[\"k8s.cluster.name\"] == nil"]
+  }
+
+  output {
+    metrics = [otelcol.exporter.otlp.otlpgateway.input]
+    logs = [otelcol.exporter.otlp.otlpgateway.input]
+    traces = [otelcol.exporter.otlp.otlpgateway.input]
+  }
+}
+otelcol.exporter.otlp "otlpgateway" {
+  client {
+    endpoint = "https://otlp.example.com:4317/v1/traces"
+    headers = {
+      "X-Scope-OrgID" = nonsensitive(remote.kubernetes.secret.otlpgateway.data["tenantId"]),
+    }
+    tls {
+      insecure = false
+      insecure_skip_verify = false
+      ca_pem = nonsensitive(remote.kubernetes.secret.otlpgateway.data["ca"])
+      cert_pem = nonsensitive(remote.kubernetes.secret.otlpgateway.data["cert"])
+      key_pem = remote.kubernetes.secret.otlpgateway.data["key"]
+    }
+  }
+}
+
+remote.kubernetes.secret "otlpgateway" {
+  name      = "otlpgateway-ko-k8s-monitoring"
+  namespace = "default"
+}
+
+// Feature: Annotation Autodiscovery
+declare "annotation_autodiscovery" {
+  argument "metrics_destinations" {
+    comment = "Must be a list of metric destinations where collected metrics should be forwarded to"
+  }
+
+  discovery.kubernetes "pods" {
+    role = "pod"
+  }
+
+  discovery.relabel "annotation_autodiscovery_pods" {
+    targets = discovery.kubernetes.pods.targets
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_scrape"]
+      regex = "true"
+      action = "keep"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_job"]
+      action = "replace"
+      target_label = "job"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_instance"]
+      action = "replace"
+      target_label = "instance"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_path"]
+      action = "replace"
+      target_label = "__metrics_path__"
+    }
+
+    // Choose the pod port
+    // The discovery generates a target for each declared container port of the pod.
+    // If the metricsPortName annotation has value, keep only the target where the port name matches the one of the annotation.
+    rule {
+      source_labels = ["__meta_kubernetes_pod_container_port_name"]
+      target_label = "__tmp_port"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_portName"]
+      regex = "(.+)"
+      target_label = "__tmp_port"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_container_port_name"]
+      action = "keepequal"
+      target_label = "__tmp_port"
+    }
+
+    // If the metrics port number annotation has a value, override the target address to use it, regardless whether it is
+    // one of the declared ports on that Pod.
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_portNumber", "__meta_kubernetes_pod_ip"]
+      regex = "(\\d+);(([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4})"
+      replacement = "[$2]:$1" // IPv6
+      target_label = "__address__"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_portNumber", "__meta_kubernetes_pod_ip"]
+      regex = "(\\d+);((([0-9]+?)(\\.|$)){4})" // IPv4, takes priority over IPv6 when both exists
+      replacement = "$2:$1"
+      target_label = "__address__"
+    }
+
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_scheme"]
+      action = "replace"
+      target_label = "__scheme__"
+    }
+
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_scrapeInterval"]
+      action = "replace"
+      target_label = "__scrape_interval__"
+    }
+  }
+
+  discovery.kubernetes "services" {
+    role = "service"
+  }
+
+  discovery.relabel "annotation_autodiscovery_services" {
+    targets = discovery.kubernetes.services.targets
+    rule {
+      source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_scrape"]
+      regex = "true"
+      action = "keep"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_job"]
+      action = "replace"
+      target_label = "job"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_instance"]
+      action = "replace"
+      target_label = "instance"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_metrics_path"]
+      action = "replace"
+      target_label = "__metrics_path__"
+    }
+
+    // Choose the service port
+    rule {
+      source_labels = ["__meta_kubernetes_service_port_name"]
+      target_label = "__tmp_port"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_metrics_portName"]
+      regex = "(.+)"
+      target_label = "__tmp_port"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_service_port_name"]
+      action = "keepequal"
+      target_label = "__tmp_port"
+    }
+
+    rule {
+      source_labels = ["__meta_kubernetes_service_port_number"]
+      target_label = "__tmp_port"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_metrics_portNumber"]
+      regex = "(.+)"
+      target_label = "__tmp_port"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_service_port_number"]
+      action = "keepequal"
+      target_label = "__tmp_port"
+    }
+
+    rule {
+      source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_metrics_scheme"]
+      action = "replace"
+      target_label = "__scheme__"
+    }
+
+    rule {
+      source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_metrics_scrapeInterval"]
+      action = "replace"
+      target_label = "__scrape_interval__"
+    }
+  }
+
+  discovery.relabel "annotation_autodiscovery_http" {
+    targets = concat(discovery.relabel.annotation_autodiscovery_pods.output, discovery.relabel.annotation_autodiscovery_services.output)
+    rule {
+      source_labels = ["__scheme__"]
+      regex = "https"
+      action = "drop"
+    }
+  }
+
+  discovery.relabel "annotation_autodiscovery_https" {
+    targets = concat(discovery.relabel.annotation_autodiscovery_pods.output, discovery.relabel.annotation_autodiscovery_services.output)
+    rule {
+      source_labels = ["__scheme__"]
+      regex = "https"
+      action = "keep"
+    }
+  }
+
+  prometheus.scrape "annotation_autodiscovery_http" {
+    targets = discovery.relabel.annotation_autodiscovery_http.output
+    scrape_interval = "60s"
+    honor_labels = true
+    bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+    clustering {
+      enabled = true
+    }
+
+    forward_to = argument.metrics_destinations.value
+  }
+
+  prometheus.scrape "annotation_autodiscovery_https" {
+    targets = discovery.relabel.annotation_autodiscovery_https.output
+    scrape_interval = "60s"
+    honor_labels = true
+    bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+    tls_config {
+      insecure_skip_verify = true
+    }
+    clustering {
+      enabled = true
+    }
+
+    forward_to = argument.metrics_destinations.value
+  }
+}
+annotation_autodiscovery "feature" {
+  metrics_destinations = [
+    otelcol.receiver.prometheus.otlpgateway.receiver,
+  ]
+}
+
+// Feature: Cluster Metrics
+declare "cluster_metrics" {
+  argument "metrics_destinations" {
+    comment = "Must be a list of metric destinations where collected metrics should be forwarded to"
+  }
+  import.git "kubernetes" {
+    repository = "https://github.com/grafana/alloy-modules.git"
+    revision = "main"
+    path = "modules/kubernetes/core/metrics.alloy"
+    pull_frequency = "15m"
+  }  
+  
+  kubernetes.kubelet "scrape" {
+    clustering = true
+    keep_metrics = "up|container_cpu_usage_seconds_total|kubelet_certificate_manager_client_expiration_renew_errors|kubelet_certificate_manager_client_ttl_seconds|kubelet_certificate_manager_server_ttl_seconds|kubelet_cgroup_manager_duration_seconds_bucket|kubelet_cgroup_manager_duration_seconds_count|kubelet_node_config_error|kubelet_node_name|kubelet_pleg_relist_duration_seconds_bucket|kubelet_pleg_relist_duration_seconds_count|kubelet_pleg_relist_interval_seconds_bucket|kubelet_pod_start_duration_seconds_bucket|kubelet_pod_start_duration_seconds_count|kubelet_pod_worker_duration_seconds_bucket|kubelet_pod_worker_duration_seconds_count|kubelet_running_container_count|kubelet_running_containers|kubelet_running_pod_count|kubelet_running_pods|kubelet_runtime_operations_errors_total|kubelet_runtime_operations_total|kubelet_server_expiration_renew_errors|kubelet_volume_stats_available_bytes|kubelet_volume_stats_capacity_bytes|kubelet_volume_stats_inodes|kubelet_volume_stats_inodes_used|kubernetes_build_info|namespace_workload_pod|rest_client_requests_total|storage_operation_duration_seconds_count|storage_operation_errors_total|volume_manager_total_volumes"
+    scrape_interval = "60s"
+    max_cache_size = 100000
+    forward_to = argument.metrics_destinations.value
+  }  
+  
+  kubernetes.resources "scrape" {
+    clustering = true
+    job_label = "integrations/kubernetes/resources"
+    keep_metrics = "up|node_cpu_usage_seconds_total|node_memory_working_set_bytes"
+    scrape_interval = "60s"
+    max_cache_size = 100000
+    forward_to = argument.metrics_destinations.value
+  }  
+  
+  kubernetes.cadvisor "scrape" {
+    clustering = true
+    keep_metrics = "up|container_cpu_cfs_periods_total|container_cpu_cfs_throttled_periods_total|container_cpu_usage_seconds_total|container_fs_reads_bytes_total|container_fs_reads_total|container_fs_writes_bytes_total|container_fs_writes_total|container_memory_cache|container_memory_rss|container_memory_swap|container_memory_working_set_bytes|container_network_receive_bytes_total|container_network_receive_packets_dropped_total|container_network_receive_packets_total|container_network_transmit_bytes_total|container_network_transmit_packets_dropped_total|container_network_transmit_packets_total|machine_memory_bytes"
+    scrape_interval = "60s"
+    max_cache_size = 100000
+    forward_to = [prometheus.relabel.cadvisor.receiver]
+  }
+  
+  prometheus.relabel "cadvisor" {
+    max_cache_size = 100000
+    // Drop empty container labels, addressing https://github.com/google/cadvisor/issues/2688
+    rule {
+      source_labels = ["__name__","container"]
+      separator = "@"
+      regex = "(container_cpu_.*|container_fs_.*|container_memory_.*)@"
+      action = "drop"
+    }
+    // Drop empty image labels, addressing https://github.com/google/cadvisor/issues/2688
+    rule {
+      source_labels = ["__name__","image"]
+      separator = "@"
+      regex = "(container_cpu_.*|container_fs_.*|container_memory_.*|container_network_.*)@"
+      action = "drop"
+    }
+    // Normalizing unimportant labels (not deleting to continue satisfying <label>!="" checks)
+    rule {
+      source_labels = ["__name__", "boot_id"]
+      separator = "@"
+      regex = "machine_memory_bytes@.*"
+      target_label = "boot_id"
+      replacement = "NA"
+    }
+    rule {
+      source_labels = ["__name__", "system_uuid"]
+      separator = "@"
+      regex = "machine_memory_bytes@.*"
+      target_label = "system_uuid"
+      replacement = "NA"
+    }
+    // Filter out non-physical devices/interfaces
+    rule {
+      source_labels = ["__name__", "device"]
+      separator = "@"
+      regex = "container_fs_.*@(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dasd.+)"
+      target_label = "__keepme"
+      replacement = "1"
+    }
+    rule {
+      source_labels = ["__name__", "__keepme"]
+      separator = "@"
+      regex = "container_fs_.*@"
+      action = "drop"
+    }
+    rule {
+      source_labels = ["__name__"]
+      regex = "container_fs_.*"
+      target_label = "__keepme"
+      replacement = ""
+    }
+    rule {
+      source_labels = ["__name__", "interface"]
+      separator = "@"
+      regex = "container_network_.*@(en[ospx][0-9].*|wlan[0-9].*|eth[0-9].*)"
+      target_label = "__keepme"
+      replacement = "1"
+    }
+    rule {
+      source_labels = ["__name__", "__keepme"]
+      separator = "@"
+      regex = "container_network_.*@"
+      action = "drop"
+    }
+    rule {
+      source_labels = ["__name__"]
+      regex = "container_network_.*"
+      target_label = "__keepme"
+      replacement = ""
+    }
+    forward_to = argument.metrics_destinations.value
+  }          
+  
+  import.git "kube_state_metrics" {
+    repository = "https://github.com/grafana/alloy-modules.git"
+    revision = "main"
+    path = "modules/kubernetes/kube-state-metrics/metrics.alloy"
+    pull_frequency = "15m"
+  }
+  
+  kube_state_metrics.kubernetes "targets" {
+    label_selectors = [
+      "app.kubernetes.io/name=kube-state-metrics",
+      "release=ko",
+    ]
+  }
+  
+  kube_state_metrics.scrape "metrics" {
+    targets = kube_state_metrics.kubernetes.targets.output
+    clustering = true
+    keep_metrics = "up|kube_daemonset.*|kube_deployment_metadata_generation|kube_deployment_spec_replicas|kube_deployment_status_observed_generation|kube_deployment_status_replicas_available|kube_deployment_status_replicas_updated|kube_horizontalpodautoscaler_spec_max_replicas|kube_horizontalpodautoscaler_spec_min_replicas|kube_horizontalpodautoscaler_status_current_replicas|kube_horizontalpodautoscaler_status_desired_replicas|kube_job.*|kube_namespace_status_phase|kube_node.*|kube_persistentvolumeclaim_resource_requests_storage_bytes|kube_pod_container_info|kube_pod_container_resource_limits|kube_pod_container_resource_requests|kube_pod_container_status_last_terminated_reason|kube_pod_container_status_restarts_total|kube_pod_container_status_waiting_reason|kube_pod_info|kube_pod_owner|kube_pod_start_time|kube_pod_status_phase|kube_pod_status_reason|kube_replicaset.*|kube_resourcequota|kube_statefulset.*"
+    scrape_interval = "60s"
+    max_cache_size = 100000
+    forward_to = argument.metrics_destinations.value
+  }  
+  
+  import.git "node_exporter" {
+    repository = "https://github.com/grafana/alloy-modules.git"
+    revision = "main"
+    path = "modules/system/node-exporter/metrics.alloy"
+    pull_frequency = "15m"
+  }
+  
+  node_exporter.kubernetes "targets" {
+    label_selectors = [
+      "app.kubernetes.io/name=node-exporter",
+      "release=ko",
+    ]
+  }
+  
+  discovery.relabel "node_exporter" {
+    targets = node_exporter.kubernetes.targets.output
+    rule {
+      source_labels = ["__meta_kubernetes_pod_node_name"]
+      action = "replace"
+      target_label = "instance"
+    }
+  }
+  
+  node_exporter.scrape "metrics" {
+    targets = discovery.relabel.node_exporter.output
+    job_label = "integrations/node_exporter"
+    clustering = true
+    keep_metrics = "up|node_cpu.*|node_exporter_build_info|node_filesystem.*|node_memory.*|node_network_receive_bytes_total|node_network_receive_drop_total|node_network_transmit_bytes_total|node_network_transmit_drop_total|process_cpu_seconds_total|process_resident_memory_bytes"
+    scrape_interval = "60s"
+    max_cache_size = 100000
+    forward_to = argument.metrics_destinations.value
+  }  
+  
+  import.git "windows_exporter" {
+    repository = "https://github.com/grafana/alloy-modules.git"
+    revision = "main"
+    path = "modules/system/node-exporter/metrics.alloy"
+    pull_frequency = "15m"
+  }
+  
+  windows_exporter.kubernetes "targets" {
+    label_selectors = [
+      "app.kubernetes.io/name=windows-exporter",
+      "release=ko",
+    ]
+  }
+  
+  discovery.relabel "windows_exporter" {
+    targets = windows_exporter.kubernetes.targets.output
+    rule {
+      source_labels = ["__meta_kubernetes_pod_node_name"]
+      action = "replace"
+      target_label = "instance"
+    }
+  }
+  
+  windows_exporter.scrape "metrics" {
+    targets = discovery.relabel.windows_exporter.output
+    clustering = true
+    keep_metrics = "up|windows_.*|node_cpu_seconds_total|node_filesystem_size_bytes|node_filesystem_avail_bytes|container_cpu_usage_seconds_total"
+    scrape_interval = "60s"
+    max_cache_size = 100000
+    forward_to = argument.metrics_destinations.value
+  }  
+  
+  discovery.kubernetes "kepler" {
+    role = "pod"
+    namespaces {
+      own_namespace = true
+    }
+    selectors {
+      role = "pod"
+      label = "app.kubernetes.io/name=kepler"
+    }
+  }
+  
+  discovery.relabel "kepler" {
+    targets = discovery.kubernetes.kepler.targets
+    rule {
+      source_labels = ["__meta_kubernetes_pod_node_name"]
+      action = "replace"
+      target_label = "instance"
+    }
+  }
+  
+  prometheus.scrape "kepler" {
+    targets      = discovery.relabel.kepler.output
+    job_name     = "integrations/kepler"
+    honor_labels = true
+    scrape_interval = "60s"
+    clustering {
+      enabled = true
+    }
+    forward_to = [prometheus.relabel.kepler.receiver]
+  }
+  
+  prometheus.relabel "kepler" {
+    max_cache_size = 100000
+    rule {
+      source_labels = ["__name__"]
+      regex = "up|kepler_.*"
+      action = "keep"
+    }
+    forward_to = argument.metrics_destinations.value
+  }
+}
+cluster_metrics "feature" {
+  metrics_destinations = [
+    otelcol.receiver.prometheus.otlpgateway.receiver,
+  ]
+}
+
+// Feature: Prometheus Operator Objects
+declare "prometheus_operator_objects" {
+  argument "metrics_destinations" {
+    comment = "Must be a list of metric destinations where collected metrics should be forwarded to"
+  }
+  
+  // Prometheus Operator podMonitor objects
+  prometheus.operator.podmonitors "pod_monitors" {
+    clustering {
+      enabled = true
+    }
+    scrape {
+      default_scrape_interval = "60s"
+    }
+    forward_to = argument.metrics_destinations.value
+  }
+  
+  // Prometheus Operator podMonitor objects
+  prometheus.operator.probes "pod_monitors" {
+    clustering {
+      enabled = true
+    }
+    scrape {
+      default_scrape_interval = "60s"
+    }
+    forward_to = argument.metrics_destinations.value
+  }
+  
+  // Prometheus Operator ServiceMonitor objects
+  prometheus.operator.servicemonitors "service_monitors" {
+    clustering {
+      enabled = true
+    }
+    scrape {
+      default_scrape_interval = "60s"
+    }
+    forward_to = argument.metrics_destinations.value
+  }
+}
+prometheus_operator_objects "feature" {
+  metrics_destinations = [
+    otelcol.receiver.prometheus.otlpgateway.receiver,
+  ]
+}
+
+declare "alloy_integration" {
+  argument "metrics_destinations" {
+    comment = "Must be a list of metric destinations where collected metrics should be forwarded to"
+  }
+
+  declare "alloy_integration_discovery" {
+    argument "namespaces" {
+      comment = "The namespaces to look for targets in (default: [] is all namespaces)"
+      optional = true
+    }
+
+    argument "field_selectors" {
+      comment = "The field selectors to use to find matching targets (default: [])"
+      optional = true
+    }
+
+    argument "label_selectors" {
+      comment = "The label selectors to use to find matching targets (default: [\"app.kubernetes.io/name=alloy\"])"
+      optional = true
+    }
+
+    argument "port_name" {
+      comment = "The of the port to scrape metrics from (default: http-metrics)"
+      optional = true
+    }
+
+    // Alloy service discovery for all of the pods
+    discovery.kubernetes "alloy_pods" {
+      role = "pod"
+
+      selectors {
+        role = "pod"
+        field = join(coalesce(argument.field_selectors.value, []), ",")
+        label = join(coalesce(argument.label_selectors.value, ["app.kubernetes.io/name=alloy"]), ",")
+      }
+
+      namespaces {
+        names = coalesce(argument.namespaces.value, [])
+      }
+    }
+
+    // alloy relabelings (pre-scrape)
+    discovery.relabel "alloy_pods" {
+      targets = discovery.kubernetes.alloy_pods.targets
+
+      // keep only the specified metrics port name, and pods that are Running and ready
+      rule {
+        source_labels = [
+          "__meta_kubernetes_pod_container_port_name",
+          "__meta_kubernetes_pod_phase",
+          "__meta_kubernetes_pod_ready",
+          "__meta_kubernetes_pod_container_init",
+        ]
+        separator = "@"
+        regex = coalesce(argument.port_name.value, "metrics") + "@Running@true@false"
+        action = "keep"
+      }
+
+      rule {
+        source_labels = ["__meta_kubernetes_namespace"]
+        target_label  = "namespace"
+      }
+
+      rule {
+        source_labels = ["__meta_kubernetes_pod_name"]
+        target_label  = "pod"
+      }
+
+      rule {
+        source_labels = ["__meta_kubernetes_pod_container_name"]
+        target_label  = "container"
+      }
+
+      rule {
+        source_labels = [
+          "__meta_kubernetes_pod_controller_kind",
+          "__meta_kubernetes_pod_controller_name",
+        ]
+        separator = "/"
+        target_label  = "workload"
+      }
+      // remove the hash from the ReplicaSet
+      rule {
+        source_labels = ["workload"]
+        regex = "(ReplicaSet/.+)-.+"
+        target_label  = "workload"
+      }
+
+      // set the app name if specified as metadata labels "app:" or "app.kubernetes.io/name:" or "k8s-app:"
+      rule {
+        action = "replace"
+        source_labels = [
+          "__meta_kubernetes_pod_label_app_kubernetes_io_name",
+          "__meta_kubernetes_pod_label_k8s_app",
+          "__meta_kubernetes_pod_label_app",
+        ]
+        separator = ";"
+        regex = "^(?:;*)?([^;]+).*$"
+        replacement = "$1"
+        target_label = "app"
+      }
+
+      // set the component if specified as metadata labels "component:" or "app.kubernetes.io/component:" or "k8s-component:"
+      rule {
+        action = "replace"
+        source_labels = [
+          "__meta_kubernetes_pod_label_app_kubernetes_io_component",
+          "__meta_kubernetes_pod_label_k8s_component",
+          "__meta_kubernetes_pod_label_component",
+        ]
+        regex = "^(?:;*)?([^;]+).*$"
+        replacement = "$1"
+        target_label = "component"
+      }
+
+      // set a source label
+      rule {
+        action = "replace"
+        replacement = "kubernetes"
+        target_label = "source"
+      }
+    }
+
+    export "output" {
+      value = discovery.relabel.alloy_pods.output
+    }
+  }
+
+  declare "alloy_integration_scrape" {
+    argument "targets" {
+      comment = "Must be a list() of targets"
+    }
+
+    argument "forward_to" {
+      comment = "Must be a list(MetricsReceiver) where collected logs should be forwarded to"
+    }
+
+    argument "job_label" {
+      comment = "The job label to add for all alloy metric (default: integrations/alloy)"
+      optional = true
+    }
+
+    argument "keep_metrics" {
+      comment = "A regular expression of metrics to keep (default: see below)"
+      optional = true
+    }
+
+    argument "drop_metrics" {
+      comment = "A regular expression of metrics to drop (default: see below)"
+      optional = true
+    }
+
+    argument "scrape_interval" {
+      comment = "How often to scrape metrics from the targets (default: 60s)"
+      optional = true
+    }
+
+    argument "scrape_timeout" {
+      comment = "How long before a scrape times out (default: 10s)"
+      optional = true
+    }
+
+    argument "max_cache_size" {
+      comment = "The maximum number of elements to hold in the relabeling cache (default: 100000).  This should be at least 2x-5x your largest scrape target or samples appended rate."
+      optional = true
+    }
+
+    argument "clustering" {
+      comment = "Whether or not clustering should be enabled (default: false)"
+      optional = true
+    }
+
+    prometheus.scrape "alloy" {
+      job_name = coalesce(argument.job_label.value, "integrations/alloy")
+      forward_to = [prometheus.relabel.alloy.receiver]
+      targets = argument.targets.value
+      scrape_interval = coalesce(argument.scrape_interval.value, "60s")
+      scrape_timeout = coalesce(argument.scrape_timeout.value, "10s")
+
+      clustering {
+        enabled = coalesce(argument.clustering.value, false)
+      }
+    }
+
+    // alloy metric relabelings (post-scrape)
+    prometheus.relabel "alloy" {
+      forward_to = argument.forward_to.value
+      max_cache_size = coalesce(argument.max_cache_size.value, 100000)
+
+      // drop metrics that match the drop_metrics regex
+      rule {
+        source_labels = ["__name__"]
+        regex = coalesce(argument.drop_metrics.value, "(^(go|process)_.+$)")
+        action = "drop"
+      }
+
+      // keep only metrics that match the keep_metrics regex
+      rule {
+        source_labels = ["__name__"]
+        regex = coalesce(argument.keep_metrics.value, ".*")
+        action = "keep"
+      }
+
+      // remove the component_id label from any metric that starts with log_bytes or log_lines, these are custom metrics that are generated
+      // as part of the log annotation modules in this repo
+      rule {
+        action = "replace"
+        source_labels = ["__name__"]
+        regex = "^log_(bytes|lines).+"
+        replacement = ""
+        target_label = "component_id"
+      }
+
+      // set the namespace label to that of the exported_namespace
+      rule {
+        action = "replace"
+        source_labels = ["__name__", "exported_namespace"]
+        separator = "@"
+        regex = "^log_(bytes|lines).+@(.+)"
+        replacement = "$2"
+        target_label = "namespace"
+      }
+
+      // set the pod label to that of the exported_pod
+      rule {
+        action = "replace"
+        source_labels = ["__name__", "exported_pod"]
+        separator = "@"
+        regex = "^log_(bytes|lines).+@(.+)"
+        replacement = "$2"
+        target_label = "pod"
+      }
+
+      // set the container label to that of the exported_container
+      rule {
+        action = "replace"
+        source_labels = ["__name__", "exported_container"]
+        separator = "@"
+        regex = "^log_(bytes|lines).+@(.+)"
+        replacement = "$2"
+        target_label = "container"
+      }
+
+      // set the job label to that of the exported_job
+      rule {
+        action = "replace"
+        source_labels = ["__name__", "exported_job"]
+        separator = "@"
+        regex = "^log_(bytes|lines).+@(.+)"
+        replacement = "$2"
+        target_label = "job"
+      }
+
+      // set the instance label to that of the exported_instance
+      rule {
+        action = "replace"
+        source_labels = ["__name__", "exported_instance"]
+        separator = "@"
+        regex = "^log_(bytes|lines).+@(.+)"
+        replacement = "$2"
+        target_label = "instance"
+      }
+
+      rule {
+        action = "labeldrop"
+        regex = "exported_(namespace|pod|container|job|instance)"
+      }
+    }
+  }
+  
+  
+  alloy_integration_discovery "alloy" {
+    port_name       = "http-metrics"
+    label_selectors = ["app.kubernetes.io/name=alloy"]
+  }
+  
+  alloy_integration_scrape  "alloy" {
+    targets = alloy_integration_discovery.alloy.output
+    clustering = true
+    keep_metrics = "up|alloy_build_info"
+    scrape_interval = "60s"
+    max_cache_size = 100000
+    forward_to = argument.metrics_destinations.value
+  }
+}
+alloy_integration "integration" {
+  metrics_destinations = [
+    otelcol.receiver.prometheus.otlpgateway.receiver,
+  ]
+}
diff --git a/charts/k8s-monitoring/docs/examples/features/all-features/alloy-profiles.alloy b/charts/k8s-monitoring/docs/examples/features/all-features/alloy-profiles.alloy
new file mode 100644
index 000000000..a88036248
--- /dev/null
+++ b/charts/k8s-monitoring/docs/examples/features/all-features/alloy-profiles.alloy
@@ -0,0 +1,846 @@
+// Destination: pyroscope (pyroscope)
+pyroscope.write "pyroscope" {
+  endpoint {
+    url = "http://pyroscope.example.com"
+    headers = {
+    }
+    tls_config {
+      insecure_skip_verify = false
+    }
+  }
+
+  external_labels = {
+    cluster = "all-features-cluster",
+  }
+}
+
+// Feature: Profiling
+declare "profiling" {
+  argument "profiles_destinations" {
+    comment = "Must be a list of profile destinations where collected profiles should be forwarded to"
+  }  
+  // Profiles: eBPF
+  discovery.kubernetes "ebpf_pods" {
+    selectors {
+      role = "pod"
+      field = "spec.nodeName=" + env("HOSTNAME")
+    }
+    role = "pod"
+  }
+  
+  discovery.relabel "ebpf_pods" {
+    targets = discovery.kubernetes.ebpf_pods.targets
+    rule {
+      source_labels = ["__meta_kubernetes_pod_phase"]
+      regex = "Succeeded|Failed|Completed"
+      action = "drop"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_namespace"]
+      target_label = "namespace"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_name"]
+      target_label = "pod"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_node_name"]
+      target_label = "node"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_container_name"]
+      target_label = "container"
+    }
+    // provide arbitrary service_name label, otherwise it will be set to {__meta_kubernetes_namespace}/{__meta_kubernetes_pod_container_name}
+    rule {
+      source_labels = ["__meta_kubernetes_namespace", "__meta_kubernetes_pod_container_name"]
+      separator = "@"
+      regex = "(.*)@(.*)"
+      replacement = "ebpf/${1}/${2}"
+      target_label = "service_name"
+    }
+  }
+  
+  pyroscope.ebpf "ebpf_pods" {
+    targets = discovery.relabel.ebpf_pods.output
+    demangle = "none"
+    forward_to = argument.profiles_destinations.value
+  }  
+  // Profiles: Java
+  discovery.kubernetes "java_pods" {
+    selectors {
+      role = "pod"
+      field = "spec.nodeName=" + env("HOSTNAME")
+    }
+    role = "pod"
+  }
+  
+  discovery.process "java_pods" {
+    join = discovery.kubernetes.java_pods.targets
+  }
+  
+  discovery.relabel "java_pods" {
+    targets = discovery.process.java_pods.targets
+    rule {
+      source_labels = ["__meta_kubernetes_pod_phase"]
+      regex = "Succeeded|Failed|Completed"
+      action = "drop"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_name"]
+      regex = "^$"
+      action = "drop"
+    }
+    rule {
+      source_labels = ["__meta_process_exe"]
+      action = "keep"
+      regex = ".*/java$"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_namespace"]
+      target_label = "namespace"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_name"]
+      target_label = "pod"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_node_name"]
+      target_label = "node"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_container_name"]
+      target_label = "container"
+    }
+  }
+  
+  pyroscope.java "java_pods" {
+    targets = discovery.relabel.java_pods.output
+    profiling_config {
+      interval = "60s"
+      alloc = "512k"
+      cpu = true
+      sample_rate = 100
+      lock = "10ms"
+    }
+    forward_to = argument.profiles_destinations.value
+  }  
+  // Profiles: pprof
+  discovery.kubernetes "pprof_pods" {
+    selectors {
+      role = "pod"
+      field = "spec.nodeName=" + env("HOSTNAME")
+    }
+    role = "pod"
+  }
+  
+  discovery.relabel "pprof_pods" {
+    targets = discovery.kubernetes.pprof_pods.targets
+    rule {
+      action        = "drop"
+      source_labels = ["__meta_kubernetes_pod_phase"]
+      regex         = "Pending|Succeeded|Failed|Completed"
+    }
+  
+    rule {
+      regex  = "__meta_kubernetes_pod_label_(.+)"
+      action = "labelmap"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_namespace"]
+      target_label  = "namespace"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_name"]
+      target_label  = "pod"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_container_name"]
+      target_label  = "container"
+    }
+  }
+  
+  discovery.relabel "pprof_pods_block_default_name" {
+    targets = discovery.relabel.pprof_pods.output
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_block_scrape"]
+      regex         = "true"
+      action        = "keep"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_block_port_name"]
+      regex         = ""
+      action        = "keep"
+    }
+  
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_block_scheme"]
+      action        = "replace"
+      regex         = "(https?)"
+      target_label  = "__scheme__"
+      replacement   = "$1"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_block_path"]
+      action        = "replace"
+      regex         = "(.+)"
+      target_label  = "__profile_path__"
+      replacement   = "$1"
+    }
+    rule {
+      source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_block_port"]
+      action        = "replace"
+      regex         = "(.+?)(?::\\d+)?;(\\d+)"
+      target_label  = "__address__"
+      replacement   = "$1:$2"
+    }
+  }
+  
+  discovery.relabel "pprof_pods_block_custom_name" {
+    targets = discovery.relabel.pprof_pods.output
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_block_scrape"]
+      regex         = "true"
+      action        = "keep"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_block_port_name"]
+      regex         = ""
+      action        = "drop"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_container_port_name"]
+      target_label  = "__meta_kubernetes_pod_annotation_profiles_grafana_com_block_port_name"
+      action        = "keepequal"
+    }
+  
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_block_scheme"]
+      action        = "replace"
+      regex         = "(https?)"
+      target_label  = "__scheme__"
+      replacement   = "$1"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_block_path"]
+      action        = "replace"
+      regex         = "(.+)"
+      target_label  = "__profile_path__"
+      replacement   = "$1"
+    }
+    rule {
+      source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_block_port"]
+      action        = "replace"
+      regex         = "(.+?)(?::\\d+)?;(\\d+)"
+      target_label  = "__address__"
+      replacement   = "$1:$2"
+    }
+  }
+  
+  pyroscope.scrape "pyroscope_scrape_block" {
+    targets = concat(discovery.relabel.pprof_pods_block_default_name.output, discovery.relabel.pprof_pods_block_custom_name.output)
+  
+    bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+    profiling_config {
+      profile.block {
+        enabled = true
+      }
+      profile.process_cpu {
+        enabled = false
+      }
+      profile.fgprof {
+        enabled = false
+      }
+      profile.godeltaprof_block {
+        enabled = false
+      }
+      profile.godeltaprof_memory {
+        enabled = false
+      }
+      profile.godeltaprof_mutex {
+        enabled = false
+      }
+      profile.goroutine {
+        enabled = false
+      }
+      profile.memory {
+        enabled = false
+      }
+      profile.mutex {
+        enabled = false
+      }
+    }
+  
+    forward_to = argument.profiles_destinations.value
+  }
+  discovery.relabel "pprof_pods_cpu_default_name" {
+    targets = discovery.relabel.pprof_pods.output
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_scrape"]
+      regex         = "true"
+      action        = "keep"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_port_name"]
+      regex         = ""
+      action        = "keep"
+    }
+  
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_scheme"]
+      action        = "replace"
+      regex         = "(https?)"
+      target_label  = "__scheme__"
+      replacement   = "$1"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_path"]
+      action        = "replace"
+      regex         = "(.+)"
+      target_label  = "__profile_path__"
+      replacement   = "$1"
+    }
+    rule {
+      source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_port"]
+      action        = "replace"
+      regex         = "(.+?)(?::\\d+)?;(\\d+)"
+      target_label  = "__address__"
+      replacement   = "$1:$2"
+    }
+  }
+  
+  discovery.relabel "pprof_pods_cpu_custom_name" {
+    targets = discovery.relabel.pprof_pods.output
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_scrape"]
+      regex         = "true"
+      action        = "keep"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_port_name"]
+      regex         = ""
+      action        = "drop"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_container_port_name"]
+      target_label  = "__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_port_name"
+      action        = "keepequal"
+    }
+  
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_scheme"]
+      action        = "replace"
+      regex         = "(https?)"
+      target_label  = "__scheme__"
+      replacement   = "$1"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_path"]
+      action        = "replace"
+      regex         = "(.+)"
+      target_label  = "__profile_path__"
+      replacement   = "$1"
+    }
+    rule {
+      source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_port"]
+      action        = "replace"
+      regex         = "(.+?)(?::\\d+)?;(\\d+)"
+      target_label  = "__address__"
+      replacement   = "$1:$2"
+    }
+  }
+  
+  pyroscope.scrape "pyroscope_scrape_cpu" {
+    targets = concat(discovery.relabel.pprof_pods_cpu_default_name.output, discovery.relabel.pprof_pods_cpu_custom_name.output)
+  
+    bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+    profiling_config {
+      profile.block {
+        enabled = false
+      }
+      profile.process_cpu {
+        enabled = true
+      }
+      profile.fgprof {
+        enabled = false
+      }
+      profile.godeltaprof_block {
+        enabled = false
+      }
+      profile.godeltaprof_memory {
+        enabled = false
+      }
+      profile.godeltaprof_mutex {
+        enabled = false
+      }
+      profile.goroutine {
+        enabled = false
+      }
+      profile.memory {
+        enabled = false
+      }
+      profile.mutex {
+        enabled = false
+      }
+    }
+  
+    forward_to = argument.profiles_destinations.value
+  }
+  discovery.relabel "pprof_pods_fgprof_default_name" {
+    targets = discovery.relabel.pprof_pods.output
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_scrape"]
+      regex         = "true"
+      action        = "keep"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_port_name"]
+      regex         = ""
+      action        = "keep"
+    }
+  
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_scheme"]
+      action        = "replace"
+      regex         = "(https?)"
+      target_label  = "__scheme__"
+      replacement   = "$1"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_path"]
+      action        = "replace"
+      regex         = "(.+)"
+      target_label  = "__profile_path__"
+      replacement   = "$1"
+    }
+    rule {
+      source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_port"]
+      action        = "replace"
+      regex         = "(.+?)(?::\\d+)?;(\\d+)"
+      target_label  = "__address__"
+      replacement   = "$1:$2"
+    }
+  }
+  
+  discovery.relabel "pprof_pods_fgprof_custom_name" {
+    targets = discovery.relabel.pprof_pods.output
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_scrape"]
+      regex         = "true"
+      action        = "keep"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_port_name"]
+      regex         = ""
+      action        = "drop"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_container_port_name"]
+      target_label  = "__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_port_name"
+      action        = "keepequal"
+    }
+  
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_scheme"]
+      action        = "replace"
+      regex         = "(https?)"
+      target_label  = "__scheme__"
+      replacement   = "$1"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_path"]
+      action        = "replace"
+      regex         = "(.+)"
+      target_label  = "__profile_path__"
+      replacement   = "$1"
+    }
+    rule {
+      source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_port"]
+      action        = "replace"
+      regex         = "(.+?)(?::\\d+)?;(\\d+)"
+      target_label  = "__address__"
+      replacement   = "$1:$2"
+    }
+  }
+  
+  pyroscope.scrape "pyroscope_scrape_fgprof" {
+    targets = concat(discovery.relabel.pprof_pods_fgprof_default_name.output, discovery.relabel.pprof_pods_fgprof_custom_name.output)
+  
+    bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+    profiling_config {
+      profile.block {
+        enabled = false
+      }
+      profile.process_cpu {
+        enabled = false
+      }
+      profile.fgprof {
+        enabled = true
+      }
+      profile.godeltaprof_block {
+        enabled = false
+      }
+      profile.godeltaprof_memory {
+        enabled = false
+      }
+      profile.godeltaprof_mutex {
+        enabled = false
+      }
+      profile.goroutine {
+        enabled = false
+      }
+      profile.memory {
+        enabled = false
+      }
+      profile.mutex {
+        enabled = false
+      }
+    }
+  
+    forward_to = argument.profiles_destinations.value
+  }
+  discovery.relabel "pprof_pods_goroutine_default_name" {
+    targets = discovery.relabel.pprof_pods.output
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_scrape"]
+      regex         = "true"
+      action        = "keep"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_port_name"]
+      regex         = ""
+      action        = "keep"
+    }
+  
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_scheme"]
+      action        = "replace"
+      regex         = "(https?)"
+      target_label  = "__scheme__"
+      replacement   = "$1"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_path"]
+      action        = "replace"
+      regex         = "(.+)"
+      target_label  = "__profile_path__"
+      replacement   = "$1"
+    }
+    rule {
+      source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_port"]
+      action        = "replace"
+      regex         = "(.+?)(?::\\d+)?;(\\d+)"
+      target_label  = "__address__"
+      replacement   = "$1:$2"
+    }
+  }
+  
+  discovery.relabel "pprof_pods_goroutine_custom_name" {
+    targets = discovery.relabel.pprof_pods.output
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_scrape"]
+      regex         = "true"
+      action        = "keep"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_port_name"]
+      regex         = ""
+      action        = "drop"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_container_port_name"]
+      target_label  = "__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_port_name"
+      action        = "keepequal"
+    }
+  
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_scheme"]
+      action        = "replace"
+      regex         = "(https?)"
+      target_label  = "__scheme__"
+      replacement   = "$1"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_path"]
+      action        = "replace"
+      regex         = "(.+)"
+      target_label  = "__profile_path__"
+      replacement   = "$1"
+    }
+    rule {
+      source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_port"]
+      action        = "replace"
+      regex         = "(.+?)(?::\\d+)?;(\\d+)"
+      target_label  = "__address__"
+      replacement   = "$1:$2"
+    }
+  }
+  
+  pyroscope.scrape "pyroscope_scrape_goroutine" {
+    targets = concat(discovery.relabel.pprof_pods_goroutine_default_name.output, discovery.relabel.pprof_pods_goroutine_custom_name.output)
+  
+    bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+    profiling_config {
+      profile.block {
+        enabled = false
+      }
+      profile.process_cpu {
+        enabled = false
+      }
+      profile.fgprof {
+        enabled = false
+      }
+      profile.godeltaprof_block {
+        enabled = false
+      }
+      profile.godeltaprof_memory {
+        enabled = false
+      }
+      profile.godeltaprof_mutex {
+        enabled = false
+      }
+      profile.goroutine {
+        enabled = true
+      }
+      profile.memory {
+        enabled = false
+      }
+      profile.mutex {
+        enabled = false
+      }
+    }
+  
+    forward_to = argument.profiles_destinations.value
+  }
+  discovery.relabel "pprof_pods_memory_default_name" {
+    targets = discovery.relabel.pprof_pods.output
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_scrape"]
+      regex         = "true"
+      action        = "keep"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_port_name"]
+      regex         = ""
+      action        = "keep"
+    }
+  
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_scheme"]
+      action        = "replace"
+      regex         = "(https?)"
+      target_label  = "__scheme__"
+      replacement   = "$1"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_path"]
+      action        = "replace"
+      regex         = "(.+)"
+      target_label  = "__profile_path__"
+      replacement   = "$1"
+    }
+    rule {
+      source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_port"]
+      action        = "replace"
+      regex         = "(.+?)(?::\\d+)?;(\\d+)"
+      target_label  = "__address__"
+      replacement   = "$1:$2"
+    }
+  }
+  
+  discovery.relabel "pprof_pods_memory_custom_name" {
+    targets = discovery.relabel.pprof_pods.output
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_scrape"]
+      regex         = "true"
+      action        = "keep"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_port_name"]
+      regex         = ""
+      action        = "drop"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_container_port_name"]
+      target_label  = "__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_port_name"
+      action        = "keepequal"
+    }
+  
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_scheme"]
+      action        = "replace"
+      regex         = "(https?)"
+      target_label  = "__scheme__"
+      replacement   = "$1"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_path"]
+      action        = "replace"
+      regex         = "(.+)"
+      target_label  = "__profile_path__"
+      replacement   = "$1"
+    }
+    rule {
+      source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_port"]
+      action        = "replace"
+      regex         = "(.+?)(?::\\d+)?;(\\d+)"
+      target_label  = "__address__"
+      replacement   = "$1:$2"
+    }
+  }
+  
+  pyroscope.scrape "pyroscope_scrape_memory" {
+    targets = concat(discovery.relabel.pprof_pods_memory_default_name.output, discovery.relabel.pprof_pods_memory_custom_name.output)
+  
+    bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+    profiling_config {
+      profile.block {
+        enabled = false
+      }
+      profile.process_cpu {
+        enabled = false
+      }
+      profile.fgprof {
+        enabled = false
+      }
+      profile.godeltaprof_block {
+        enabled = false
+      }
+      profile.godeltaprof_memory {
+        enabled = false
+      }
+      profile.godeltaprof_mutex {
+        enabled = false
+      }
+      profile.goroutine {
+        enabled = false
+      }
+      profile.memory {
+        enabled = true
+      }
+      profile.mutex {
+        enabled = false
+      }
+    }
+  
+    forward_to = argument.profiles_destinations.value
+  }
+  discovery.relabel "pprof_pods_mutex_default_name" {
+    targets = discovery.relabel.pprof_pods.output
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_scrape"]
+      regex         = "true"
+      action        = "keep"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_port_name"]
+      regex         = ""
+      action        = "keep"
+    }
+  
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_scheme"]
+      action        = "replace"
+      regex         = "(https?)"
+      target_label  = "__scheme__"
+      replacement   = "$1"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_path"]
+      action        = "replace"
+      regex         = "(.+)"
+      target_label  = "__profile_path__"
+      replacement   = "$1"
+    }
+    rule {
+      source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_port"]
+      action        = "replace"
+      regex         = "(.+?)(?::\\d+)?;(\\d+)"
+      target_label  = "__address__"
+      replacement   = "$1:$2"
+    }
+  }
+  
+  discovery.relabel "pprof_pods_mutex_custom_name" {
+    targets = discovery.relabel.pprof_pods.output
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_scrape"]
+      regex         = "true"
+      action        = "keep"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_port_name"]
+      regex         = ""
+      action        = "drop"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_container_port_name"]
+      target_label  = "__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_port_name"
+      action        = "keepequal"
+    }
+  
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_scheme"]
+      action        = "replace"
+      regex         = "(https?)"
+      target_label  = "__scheme__"
+      replacement   = "$1"
+    }
+    rule {
+      source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_path"]
+      action        = "replace"
+      regex         = "(.+)"
+      target_label  = "__profile_path__"
+      replacement   = "$1"
+    }
+    rule {
+      source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_port"]
+      action        = "replace"
+      regex         = "(.+?)(?::\\d+)?;(\\d+)"
+      target_label  = "__address__"
+      replacement   = "$1:$2"
+    }
+  }
+  
+  pyroscope.scrape "pyroscope_scrape_mutex" {
+    targets = concat(discovery.relabel.pprof_pods_mutex_default_name.output, discovery.relabel.pprof_pods_mutex_custom_name.output)
+  
+    bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+    profiling_config {
+      profile.block {
+        enabled = false
+      }
+      profile.process_cpu {
+        enabled = false
+      }
+      profile.fgprof {
+        enabled = false
+      }
+      profile.godeltaprof_block {
+        enabled = false
+      }
+      profile.godeltaprof_memory {
+        enabled = false
+      }
+      profile.godeltaprof_mutex {
+        enabled = false
+      }
+      profile.goroutine {
+        enabled = false
+      }
+      profile.memory {
+        enabled = false
+      }
+      profile.mutex {
+        enabled = true
+      }
+    }
+  
+    forward_to = argument.profiles_destinations.value
+  }
+}
+profiling "feature" {
+  profiles_destinations = [
+    pyroscope.write.pyroscope.receiver,
+  ]
+}
diff --git a/charts/k8s-monitoring/docs/examples/features/all-features/alloy-receiver.alloy b/charts/k8s-monitoring/docs/examples/features/all-features/alloy-receiver.alloy
new file mode 100644
index 000000000..44d9f2fa6
--- /dev/null
+++ b/charts/k8s-monitoring/docs/examples/features/all-features/alloy-receiver.alloy
@@ -0,0 +1,168 @@
+// Destination: otlpGateway (otlp)
+otelcol.receiver.prometheus "otlpgateway" {
+  output {
+    metrics = [otelcol.processor.transform.otlpgateway.input]
+  }
+}
+otelcol.receiver.loki "otlpgateway" {
+  output {
+    logs = [otelcol.processor.transform.otlpgateway.input]
+  }
+}
+otelcol.auth.basic "otlpgateway" {
+  username = nonsensitive(remote.kubernetes.secret.otlpgateway.data["username"])
+  password = remote.kubernetes.secret.otlpgateway.data["password"]
+}
+
+otelcol.processor.transform "otlpgateway" {
+  error_mode = "ignore"
+  metric_statements {
+    context = "resource"
+    statements = ["set(attributes[\"k8s.cluster.name\"], \"all-features-cluster\") where attributes[\"k8s.cluster.name\"] == nil"]
+  }
+  log_statements {
+    context = "resource"
+    statements = ["set(attributes[\"k8s.cluster.name\"], \"all-features-cluster\") where attributes[\"k8s.cluster.name\"] == nil"]
+  }
+  trace_statements {
+    context = "resource"
+    statements = ["set(attributes[\"k8s.cluster.name\"], \"all-features-cluster\") where attributes[\"k8s.cluster.name\"] == nil"]
+  }
+
+  output {
+    metrics = [otelcol.exporter.otlp.otlpgateway.input]
+    logs = [otelcol.exporter.otlp.otlpgateway.input]
+    traces = [otelcol.exporter.otlp.otlpgateway.input]
+  }
+}
+otelcol.exporter.otlp "otlpgateway" {
+  client {
+    endpoint = "https://otlp.example.com:4317/v1/traces"
+    headers = {
+      "X-Scope-OrgID" = nonsensitive(remote.kubernetes.secret.otlpgateway.data["tenantId"]),
+    }
+    tls {
+      insecure = false
+      insecure_skip_verify = false
+      ca_pem = nonsensitive(remote.kubernetes.secret.otlpgateway.data["ca"])
+      cert_pem = nonsensitive(remote.kubernetes.secret.otlpgateway.data["cert"])
+      key_pem = remote.kubernetes.secret.otlpgateway.data["key"]
+    }
+  }
+}
+
+remote.kubernetes.secret "otlpgateway" {
+  name      = "otlpgateway-ko-k8s-monitoring"
+  namespace = "default"
+}
+
+// Feature: Application Observability
+declare "application_observability" {
+  argument "metrics_destinations" {
+    comment = "Must be a list of metrics destinations where collected metrics should be forwarded to"
+  }
+
+  argument "logs_destinations" {
+    comment = "Must be a list of log destinations where collected logs should be forwarded to"
+  }
+
+  argument "traces_destinations" {
+    comment = "Must be a list of trace destinations where collected trace should be forwarded to"
+  }
+
+  // Receivers --> Resource Detection Processor  
+  otelcol.receiver.otlp "receiver" {
+    grpc {
+      endpoint = "0.0.0.0:4317"
+    }
+    debug_metrics {
+      disable_high_cardinality_metrics = true
+    }
+    output {
+      metrics = [otelcol.processor.resourcedetection.default.input]
+      logs = [otelcol.processor.resourcedetection.default.input]
+      traces = [otelcol.processor.resourcedetection.default.input]
+    }
+  }  
+
+  // Resource Detection Processor --> K8s Attribute Processor  
+  otelcol.processor.resourcedetection "default" {
+    detectors = ["env", "system"]
+    system {
+      hostname_sources = ["os"]
+    }
+  
+    output {
+      metrics = [otelcol.processor.k8sattributes.default.input]
+      logs = [otelcol.processor.k8sattributes.default.input]
+      traces = [otelcol.processor.k8sattributes.default.input]
+    }
+  }
+
+  // K8s Attribute Processor --> Transform Processor
+  // Resource Detection Processor Traces --> Host Info Connector  
+  otelcol.processor.k8sattributes "default" {
+    extract {
+      metadata = ["k8s.namespace.name","k8s.pod.name","k8s.deployment.name","k8s.statefulset.name","k8s.daemonset.name","k8s.cronjob.name","k8s.job.name","k8s.node.name","k8s.pod.uid","k8s.pod.start_time"]
+    }
+    pod_association {
+      source {
+        from = "connection"
+      }
+    }
+  
+    output {
+      metrics = [otelcol.processor.transform.default.input]
+      logs = [otelcol.processor.transform.default.input]
+      traces = [otelcol.processor.transform.default.input, otelcol.connector.host_info.default.input]
+    }
+  }
+  // Host Info Connector --> Batch Processor  
+  otelcol.connector.host_info "default" {
+    host_identifiers = [ "k8s.node.name" ]
+  
+    output {
+      metrics = [otelcol.processor.batch.default.input]
+    }
+  }
+
+
+  // Transform Processor --> Batch Processor  
+  otelcol.processor.transform "default" {
+    error_mode = "ignore"
+    log_statements {
+      context = "resource"
+      statements = [
+        "set(attributes[\"pod\"], attributes[\"k8s.pod.name\"])",
+        "set(attributes[\"namespace\"], attributes[\"k8s.namespace.name\"])",
+        "set(attributes[\"loki.resource.labels\"], \"cluster, namespace, job, pod\")",
+      ]
+    }
+  
+    output {
+      metrics = [otelcol.processor.batch.default.input]
+      logs = [otelcol.processor.batch.default.input]
+      traces = [otelcol.processor.batch.default.input]
+    }
+  }
+
+  // Batch Processor --> Destinations  
+  otelcol.processor.batch "default" {
+    output {
+      metrics = argument.metrics_destinations.value
+      logs = argument.logs_destinations.value
+      traces = argument.traces_destinations.value
+    }
+  }
+}
+application_observability "feature" {
+  metrics_destinations = [
+    otelcol.processor.transform.otlpgateway.input,
+  ]
+  logs_destinations = [
+    otelcol.processor.transform.otlpgateway.input,
+  ]
+  traces_destinations = [
+    otelcol.processor.transform.otlpgateway.input,
+  ]
+}
diff --git a/charts/k8s-monitoring/docs/examples/features/all-features/alloy-singleton.alloy b/charts/k8s-monitoring/docs/examples/features/all-features/alloy-singleton.alloy
new file mode 100644
index 000000000..f956c83d5
--- /dev/null
+++ b/charts/k8s-monitoring/docs/examples/features/all-features/alloy-singleton.alloy
@@ -0,0 +1,109 @@
+// Destination: otlpGateway (otlp)
+otelcol.receiver.prometheus "otlpgateway" {
+  output {
+    metrics = [otelcol.processor.transform.otlpgateway.input]
+  }
+}
+otelcol.receiver.loki "otlpgateway" {
+  output {
+    logs = [otelcol.processor.transform.otlpgateway.input]
+  }
+}
+otelcol.auth.basic "otlpgateway" {
+  username = nonsensitive(remote.kubernetes.secret.otlpgateway.data["username"])
+  password = remote.kubernetes.secret.otlpgateway.data["password"]
+}
+
+otelcol.processor.transform "otlpgateway" {
+  error_mode = "ignore"
+  metric_statements {
+    context = "resource"
+    statements = ["set(attributes[\"k8s.cluster.name\"], \"all-features-cluster\") where attributes[\"k8s.cluster.name\"] == nil"]
+  }
+  log_statements {
+    context = "resource"
+    statements = ["set(attributes[\"k8s.cluster.name\"], \"all-features-cluster\") where attributes[\"k8s.cluster.name\"] == nil"]
+  }
+  trace_statements {
+    context = "resource"
+    statements = ["set(attributes[\"k8s.cluster.name\"], \"all-features-cluster\") where attributes[\"k8s.cluster.name\"] == nil"]
+  }
+
+  output {
+    metrics = [otelcol.exporter.otlp.otlpgateway.input]
+    logs = [otelcol.exporter.otlp.otlpgateway.input]
+    traces = [otelcol.exporter.otlp.otlpgateway.input]
+  }
+}
+otelcol.exporter.otlp "otlpgateway" {
+  client {
+    endpoint = "https://otlp.example.com:4317/v1/traces"
+    headers = {
+      "X-Scope-OrgID" = nonsensitive(remote.kubernetes.secret.otlpgateway.data["tenantId"]),
+    }
+    tls {
+      insecure = false
+      insecure_skip_verify = false
+      ca_pem = nonsensitive(remote.kubernetes.secret.otlpgateway.data["ca"])
+      cert_pem = nonsensitive(remote.kubernetes.secret.otlpgateway.data["cert"])
+      key_pem = remote.kubernetes.secret.otlpgateway.data["key"]
+    }
+  }
+}
+
+remote.kubernetes.secret "otlpgateway" {
+  name      = "otlpgateway-ko-k8s-monitoring"
+  namespace = "default"
+}
+
+// Feature: Cluster Events
+declare "cluster_events" {
+  argument "logs_destinations" {
+    comment = "Must be a list of log destinations where collected logs should be forwarded to"
+  }
+
+  loki.source.kubernetes_events "cluster_events" {
+    job_name   = "integrations/kubernetes/eventhandler"
+    log_format = "logfmt"
+    forward_to = argument.logs_destinations.value
+  }
+}
+cluster_events "feature" {
+  logs_destinations = [
+    otelcol.receiver.loki.otlpgateway.receiver,
+  ]
+}
+
+// Self Reporting
+prometheus.exporter.unix "kubernetes_monitoring_telemetry" {
+  set_collectors = ["textfile"]
+  textfile {
+    directory = "/etc/alloy"
+  }
+}
+
+discovery.relabel "kubernetes_monitoring_telemetry" {
+  targets = prometheus.exporter.unix.kubernetes_monitoring_telemetry.targets
+  rule {
+    target_label = "instance"
+    action = "replace"
+    replacement = "ko"
+  }
+  rule {
+    target_label = "job"
+    action = "replace"
+    replacement = "integrations/kubernetes/kubernetes_monitoring_telemetry"
+  }
+}
+
+prometheus.scrape "kubernetes_monitoring_telemetry" {
+  job_name   = "integrations/kubernetes/kubernetes_monitoring_telemetry"
+  targets    = discovery.relabel.kubernetes_monitoring_telemetry.output
+  scrape_interval = "1h"
+  clustering {
+    enabled = true
+  }
+  forward_to = [
+    otelcol.receiver.prometheus.otlpgateway.receiver,
+  ]
+}
diff --git a/charts/k8s-monitoring/docs/examples/features/all-features/output.yaml b/charts/k8s-monitoring/docs/examples/features/all-features/output.yaml
new file mode 100644
index 000000000..901f3575e
--- /dev/null
+++ b/charts/k8s-monitoring/docs/examples/features/all-features/output.yaml
@@ -0,0 +1,4418 @@
+---
+# Source: k8s-monitoring/charts/alloy-logs/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ko-alloy-logs
+  namespace: default
+  labels:
+    helm.sh/chart: alloy-logs-0.9.1
+    app.kubernetes.io/name: alloy-logs
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+    app.kubernetes.io/component: rbac
+---
+# Source: k8s-monitoring/charts/alloy-metrics/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ko-alloy-metrics
+  namespace: default
+  labels:
+    helm.sh/chart: alloy-metrics-0.9.1
+    app.kubernetes.io/name: alloy-metrics
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+    app.kubernetes.io/component: rbac
+---
+# Source: k8s-monitoring/charts/alloy-profiles/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ko-alloy-profiles
+  namespace: default
+  labels:
+    helm.sh/chart: alloy-profiles-0.9.1
+    app.kubernetes.io/name: alloy-profiles
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+    app.kubernetes.io/component: rbac
+---
+# Source: k8s-monitoring/charts/alloy-receiver/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ko-alloy-receiver
+  namespace: default
+  labels:
+    helm.sh/chart: alloy-receiver-0.9.1
+    app.kubernetes.io/name: alloy-receiver
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+    app.kubernetes.io/component: rbac
+---
+# Source: k8s-monitoring/charts/alloy-singleton/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ko-alloy-singleton
+  namespace: default
+  labels:
+    helm.sh/chart: alloy-singleton-0.9.1
+    app.kubernetes.io/name: alloy-singleton
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+    app.kubernetes.io/component: rbac
+---
+# Source: k8s-monitoring/charts/clusterMetrics/charts/kepler/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ko-kepler
+  namespace: default
+  labels:
+    helm.sh/chart: kepler-0.5.9
+    app.kubernetes.io/name: kepler
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/version: "release-0.7.11"
+    app.kubernetes.io/managed-by: Helm
+---
+# Source: k8s-monitoring/charts/clusterMetrics/charts/kube-state-metrics/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+automountServiceAccountToken: true
+metadata:
+  labels:    
+    helm.sh/chart: kube-state-metrics-5.25.1
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: metrics
+    app.kubernetes.io/part-of: kube-state-metrics
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/instance: ko
+    app.kubernetes.io/version: "2.13.0"
+    release: ko
+  name: ko-kube-state-metrics
+  namespace: default
+---
+# Source: k8s-monitoring/charts/clusterMetrics/charts/node-exporter/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ko-node-exporter
+  namespace: default
+  labels:
+    helm.sh/chart: node-exporter-4.39.0
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: metrics
+    app.kubernetes.io/part-of: node-exporter
+    app.kubernetes.io/name: node-exporter
+    app.kubernetes.io/instance: ko
+    app.kubernetes.io/version: "1.8.2"
+    release: ko
+automountServiceAccountToken: false
+---
+# Source: k8s-monitoring/charts/clusterMetrics/charts/windows-exporter/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ko-windows-exporter
+  namespace: default
+  labels:
+    helm.sh/chart: windows-exporter-0.5.1
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: metrics
+    app.kubernetes.io/part-of: windows-exporter
+    app.kubernetes.io/name: windows-exporter
+    app.kubernetes.io/instance: ko
+    app.kubernetes.io/version: "0.27.1"
+    release: ko
+---
+# Source: k8s-monitoring/templates/destination_secret.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "otlpgateway-ko-k8s-monitoring"
+  namespace: "default"
+type: Opaque
+data:
+  username: "bXktdXNlcm5hbWU="
+  password: "bXktcGFzc3dvcmQ="
+---
+# Source: k8s-monitoring/charts/clusterMetrics/charts/windows-exporter/templates/config.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ko-windows-exporter
+  namespace: default
+  labels:
+    helm.sh/chart: windows-exporter-0.5.1
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: metrics
+    app.kubernetes.io/part-of: windows-exporter
+    app.kubernetes.io/name: windows-exporter
+    app.kubernetes.io/instance: ko
+    app.kubernetes.io/version: "0.27.1"
+    release: ko
+data:
+  config.yml: |
+    collectors:
+      enabled: cpu,cs,container,logical_disk,memory,net,os
+    collector:
+      service:
+        services-where: "Name='containerd' or Name='kubelet'"
+---
+# Source: k8s-monitoring/templates/alloy-config.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ko-alloy-metrics
+  namespace: default
+data:
+  config.alloy: |-
+    // Destination: otlpGateway (otlp)
+    otelcol.receiver.prometheus "otlpgateway" {
+      output {
+        metrics = [otelcol.processor.transform.otlpgateway.input]
+      }
+    }
+    otelcol.receiver.loki "otlpgateway" {
+      output {
+        logs = [otelcol.processor.transform.otlpgateway.input]
+      }
+    }
+    otelcol.auth.basic "otlpgateway" {
+      username = nonsensitive(remote.kubernetes.secret.otlpgateway.data["username"])
+      password = remote.kubernetes.secret.otlpgateway.data["password"]
+    }
+    
+    otelcol.processor.transform "otlpgateway" {
+      error_mode = "ignore"
+      metric_statements {
+        context = "resource"
+        statements = ["set(attributes[\"k8s.cluster.name\"], \"all-features-cluster\") where attributes[\"k8s.cluster.name\"] == nil"]
+      }
+      log_statements {
+        context = "resource"
+        statements = ["set(attributes[\"k8s.cluster.name\"], \"all-features-cluster\") where attributes[\"k8s.cluster.name\"] == nil"]
+      }
+      trace_statements {
+        context = "resource"
+        statements = ["set(attributes[\"k8s.cluster.name\"], \"all-features-cluster\") where attributes[\"k8s.cluster.name\"] == nil"]
+      }
+    
+      output {
+        metrics = [otelcol.exporter.otlp.otlpgateway.input]
+        logs = [otelcol.exporter.otlp.otlpgateway.input]
+        traces = [otelcol.exporter.otlp.otlpgateway.input]
+      }
+    }
+    otelcol.exporter.otlp "otlpgateway" {
+      client {
+        endpoint = "https://otlp.example.com:4317/v1/traces"
+        headers = {
+          "X-Scope-OrgID" = nonsensitive(remote.kubernetes.secret.otlpgateway.data["tenantId"]),
+        }
+        tls {
+          insecure = false
+          insecure_skip_verify = false
+          ca_pem = nonsensitive(remote.kubernetes.secret.otlpgateway.data["ca"])
+          cert_pem = nonsensitive(remote.kubernetes.secret.otlpgateway.data["cert"])
+          key_pem = remote.kubernetes.secret.otlpgateway.data["key"]
+        }
+      }
+    }
+    
+    remote.kubernetes.secret "otlpgateway" {
+      name      = "otlpgateway-ko-k8s-monitoring"
+      namespace = "default"
+    }
+    
+    // Feature: Annotation Autodiscovery
+    declare "annotation_autodiscovery" {
+      argument "metrics_destinations" {
+        comment = "Must be a list of metric destinations where collected metrics should be forwarded to"
+      }
+    
+      discovery.kubernetes "pods" {
+        role = "pod"
+      }
+    
+      discovery.relabel "annotation_autodiscovery_pods" {
+        targets = discovery.kubernetes.pods.targets
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_scrape"]
+          regex = "true"
+          action = "keep"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_job"]
+          action = "replace"
+          target_label = "job"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_instance"]
+          action = "replace"
+          target_label = "instance"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_path"]
+          action = "replace"
+          target_label = "__metrics_path__"
+        }
+    
+        // Choose the pod port
+        // The discovery generates a target for each declared container port of the pod.
+        // If the metricsPortName annotation has value, keep only the target where the port name matches the one of the annotation.
+        rule {
+          source_labels = ["__meta_kubernetes_pod_container_port_name"]
+          target_label = "__tmp_port"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_portName"]
+          regex = "(.+)"
+          target_label = "__tmp_port"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_container_port_name"]
+          action = "keepequal"
+          target_label = "__tmp_port"
+        }
+    
+        // If the metrics port number annotation has a value, override the target address to use it, regardless whether it is
+        // one of the declared ports on that Pod.
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_portNumber", "__meta_kubernetes_pod_ip"]
+          regex = "(\\d+);(([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4})"
+          replacement = "[$2]:$1" // IPv6
+          target_label = "__address__"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_portNumber", "__meta_kubernetes_pod_ip"]
+          regex = "(\\d+);((([0-9]+?)(\\.|$)){4})" // IPv4, takes priority over IPv6 when both exists
+          replacement = "$2:$1"
+          target_label = "__address__"
+        }
+    
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_scheme"]
+          action = "replace"
+          target_label = "__scheme__"
+        }
+    
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_k8s_grafana_com_metrics_scrapeInterval"]
+          action = "replace"
+          target_label = "__scrape_interval__"
+        }
+      }
+    
+      discovery.kubernetes "services" {
+        role = "service"
+      }
+    
+      discovery.relabel "annotation_autodiscovery_services" {
+        targets = discovery.kubernetes.services.targets
+        rule {
+          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_scrape"]
+          regex = "true"
+          action = "keep"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_job"]
+          action = "replace"
+          target_label = "job"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_instance"]
+          action = "replace"
+          target_label = "instance"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_metrics_path"]
+          action = "replace"
+          target_label = "__metrics_path__"
+        }
+    
+        // Choose the service port
+        rule {
+          source_labels = ["__meta_kubernetes_service_port_name"]
+          target_label = "__tmp_port"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_metrics_portName"]
+          regex = "(.+)"
+          target_label = "__tmp_port"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_service_port_name"]
+          action = "keepequal"
+          target_label = "__tmp_port"
+        }
+    
+        rule {
+          source_labels = ["__meta_kubernetes_service_port_number"]
+          target_label = "__tmp_port"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_metrics_portNumber"]
+          regex = "(.+)"
+          target_label = "__tmp_port"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_service_port_number"]
+          action = "keepequal"
+          target_label = "__tmp_port"
+        }
+    
+        rule {
+          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_metrics_scheme"]
+          action = "replace"
+          target_label = "__scheme__"
+        }
+    
+        rule {
+          source_labels = ["__meta_kubernetes_service_annotation_k8s_grafana_com_metrics_scrapeInterval"]
+          action = "replace"
+          target_label = "__scrape_interval__"
+        }
+      }
+    
+      discovery.relabel "annotation_autodiscovery_http" {
+        targets = concat(discovery.relabel.annotation_autodiscovery_pods.output, discovery.relabel.annotation_autodiscovery_services.output)
+        rule {
+          source_labels = ["__scheme__"]
+          regex = "https"
+          action = "drop"
+        }
+      }
+    
+      discovery.relabel "annotation_autodiscovery_https" {
+        targets = concat(discovery.relabel.annotation_autodiscovery_pods.output, discovery.relabel.annotation_autodiscovery_services.output)
+        rule {
+          source_labels = ["__scheme__"]
+          regex = "https"
+          action = "keep"
+        }
+      }
+    
+      prometheus.scrape "annotation_autodiscovery_http" {
+        targets = discovery.relabel.annotation_autodiscovery_http.output
+        scrape_interval = "60s"
+        honor_labels = true
+        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+        clustering {
+          enabled = true
+        }
+    
+        forward_to = argument.metrics_destinations.value
+      }
+    
+      prometheus.scrape "annotation_autodiscovery_https" {
+        targets = discovery.relabel.annotation_autodiscovery_https.output
+        scrape_interval = "60s"
+        honor_labels = true
+        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+        tls_config {
+          insecure_skip_verify = true
+        }
+        clustering {
+          enabled = true
+        }
+    
+        forward_to = argument.metrics_destinations.value
+      }
+    }
+    annotation_autodiscovery "feature" {
+      metrics_destinations = [
+        otelcol.receiver.prometheus.otlpgateway.receiver,
+      ]
+    }
+    
+    // Feature: Cluster Metrics
+    declare "cluster_metrics" {
+      argument "metrics_destinations" {
+        comment = "Must be a list of metric destinations where collected metrics should be forwarded to"
+      }
+      import.git "kubernetes" {
+        repository = "https://github.com/grafana/alloy-modules.git"
+        revision = "main"
+        path = "modules/kubernetes/core/metrics.alloy"
+        pull_frequency = "15m"
+      }  
+      
+      kubernetes.kubelet "scrape" {
+        clustering = true
+        keep_metrics = "up|container_cpu_usage_seconds_total|kubelet_certificate_manager_client_expiration_renew_errors|kubelet_certificate_manager_client_ttl_seconds|kubelet_certificate_manager_server_ttl_seconds|kubelet_cgroup_manager_duration_seconds_bucket|kubelet_cgroup_manager_duration_seconds_count|kubelet_node_config_error|kubelet_node_name|kubelet_pleg_relist_duration_seconds_bucket|kubelet_pleg_relist_duration_seconds_count|kubelet_pleg_relist_interval_seconds_bucket|kubelet_pod_start_duration_seconds_bucket|kubelet_pod_start_duration_seconds_count|kubelet_pod_worker_duration_seconds_bucket|kubelet_pod_worker_duration_seconds_count|kubelet_running_container_count|kubelet_running_containers|kubelet_running_pod_count|kubelet_running_pods|kubelet_runtime_operations_errors_total|kubelet_runtime_operations_total|kubelet_server_expiration_renew_errors|kubelet_volume_stats_available_bytes|kubelet_volume_stats_capacity_bytes|kubelet_volume_stats_inodes|kubelet_volume_stats_inodes_used|kubernetes_build_info|namespace_workload_pod|rest_client_requests_total|storage_operation_duration_seconds_count|storage_operation_errors_total|volume_manager_total_volumes"
+        scrape_interval = "60s"
+        max_cache_size = 100000
+        forward_to = argument.metrics_destinations.value
+      }  
+      
+      kubernetes.resources "scrape" {
+        clustering = true
+        job_label = "integrations/kubernetes/resources"
+        keep_metrics = "up|node_cpu_usage_seconds_total|node_memory_working_set_bytes"
+        scrape_interval = "60s"
+        max_cache_size = 100000
+        forward_to = argument.metrics_destinations.value
+      }  
+      
+      kubernetes.cadvisor "scrape" {
+        clustering = true
+        keep_metrics = "up|container_cpu_cfs_periods_total|container_cpu_cfs_throttled_periods_total|container_cpu_usage_seconds_total|container_fs_reads_bytes_total|container_fs_reads_total|container_fs_writes_bytes_total|container_fs_writes_total|container_memory_cache|container_memory_rss|container_memory_swap|container_memory_working_set_bytes|container_network_receive_bytes_total|container_network_receive_packets_dropped_total|container_network_receive_packets_total|container_network_transmit_bytes_total|container_network_transmit_packets_dropped_total|container_network_transmit_packets_total|machine_memory_bytes"
+        scrape_interval = "60s"
+        max_cache_size = 100000
+        forward_to = [prometheus.relabel.cadvisor.receiver]
+      }
+      
+      prometheus.relabel "cadvisor" {
+        max_cache_size = 100000
+        // Drop empty container labels, addressing https://github.com/google/cadvisor/issues/2688
+        rule {
+          source_labels = ["__name__","container"]
+          separator = "@"
+          regex = "(container_cpu_.*|container_fs_.*|container_memory_.*)@"
+          action = "drop"
+        }
+        // Drop empty image labels, addressing https://github.com/google/cadvisor/issues/2688
+        rule {
+          source_labels = ["__name__","image"]
+          separator = "@"
+          regex = "(container_cpu_.*|container_fs_.*|container_memory_.*|container_network_.*)@"
+          action = "drop"
+        }
+        // Normalizing unimportant labels (not deleting to continue satisfying <label>!="" checks)
+        rule {
+          source_labels = ["__name__", "boot_id"]
+          separator = "@"
+          regex = "machine_memory_bytes@.*"
+          target_label = "boot_id"
+          replacement = "NA"
+        }
+        rule {
+          source_labels = ["__name__", "system_uuid"]
+          separator = "@"
+          regex = "machine_memory_bytes@.*"
+          target_label = "system_uuid"
+          replacement = "NA"
+        }
+        // Filter out non-physical devices/interfaces
+        rule {
+          source_labels = ["__name__", "device"]
+          separator = "@"
+          regex = "container_fs_.*@(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dasd.+)"
+          target_label = "__keepme"
+          replacement = "1"
+        }
+        rule {
+          source_labels = ["__name__", "__keepme"]
+          separator = "@"
+          regex = "container_fs_.*@"
+          action = "drop"
+        }
+        rule {
+          source_labels = ["__name__"]
+          regex = "container_fs_.*"
+          target_label = "__keepme"
+          replacement = ""
+        }
+        rule {
+          source_labels = ["__name__", "interface"]
+          separator = "@"
+          regex = "container_network_.*@(en[ospx][0-9].*|wlan[0-9].*|eth[0-9].*)"
+          target_label = "__keepme"
+          replacement = "1"
+        }
+        rule {
+          source_labels = ["__name__", "__keepme"]
+          separator = "@"
+          regex = "container_network_.*@"
+          action = "drop"
+        }
+        rule {
+          source_labels = ["__name__"]
+          regex = "container_network_.*"
+          target_label = "__keepme"
+          replacement = ""
+        }
+        forward_to = argument.metrics_destinations.value
+      }          
+      
+      import.git "kube_state_metrics" {
+        repository = "https://github.com/grafana/alloy-modules.git"
+        revision = "main"
+        path = "modules/kubernetes/kube-state-metrics/metrics.alloy"
+        pull_frequency = "15m"
+      }
+      
+      kube_state_metrics.kubernetes "targets" {
+        label_selectors = [
+          "app.kubernetes.io/name=kube-state-metrics",
+          "release=ko",
+        ]
+      }
+      
+      kube_state_metrics.scrape "metrics" {
+        targets = kube_state_metrics.kubernetes.targets.output
+        clustering = true
+        keep_metrics = "up|kube_daemonset.*|kube_deployment_metadata_generation|kube_deployment_spec_replicas|kube_deployment_status_observed_generation|kube_deployment_status_replicas_available|kube_deployment_status_replicas_updated|kube_horizontalpodautoscaler_spec_max_replicas|kube_horizontalpodautoscaler_spec_min_replicas|kube_horizontalpodautoscaler_status_current_replicas|kube_horizontalpodautoscaler_status_desired_replicas|kube_job.*|kube_namespace_status_phase|kube_node.*|kube_persistentvolumeclaim_resource_requests_storage_bytes|kube_pod_container_info|kube_pod_container_resource_limits|kube_pod_container_resource_requests|kube_pod_container_status_last_terminated_reason|kube_pod_container_status_restarts_total|kube_pod_container_status_waiting_reason|kube_pod_info|kube_pod_owner|kube_pod_start_time|kube_pod_status_phase|kube_pod_status_reason|kube_replicaset.*|kube_resourcequota|kube_statefulset.*"
+        scrape_interval = "60s"
+        max_cache_size = 100000
+        forward_to = argument.metrics_destinations.value
+      }  
+      
+      import.git "node_exporter" {
+        repository = "https://github.com/grafana/alloy-modules.git"
+        revision = "main"
+        path = "modules/system/node-exporter/metrics.alloy"
+        pull_frequency = "15m"
+      }
+      
+      node_exporter.kubernetes "targets" {
+        label_selectors = [
+          "app.kubernetes.io/name=node-exporter",
+          "release=ko",
+        ]
+      }
+      
+      discovery.relabel "node_exporter" {
+        targets = node_exporter.kubernetes.targets.output
+        rule {
+          source_labels = ["__meta_kubernetes_pod_node_name"]
+          action = "replace"
+          target_label = "instance"
+        }
+      }
+      
+      node_exporter.scrape "metrics" {
+        targets = discovery.relabel.node_exporter.output
+        job_label = "integrations/node_exporter"
+        clustering = true
+        keep_metrics = "up|node_cpu.*|node_exporter_build_info|node_filesystem.*|node_memory.*|node_network_receive_bytes_total|node_network_receive_drop_total|node_network_transmit_bytes_total|node_network_transmit_drop_total|process_cpu_seconds_total|process_resident_memory_bytes"
+        scrape_interval = "60s"
+        max_cache_size = 100000
+        forward_to = argument.metrics_destinations.value
+      }  
+      
+      import.git "windows_exporter" {
+        repository = "https://github.com/grafana/alloy-modules.git"
+        revision = "main"
+        path = "modules/system/node-exporter/metrics.alloy"
+        pull_frequency = "15m"
+      }
+      
+      windows_exporter.kubernetes "targets" {
+        label_selectors = [
+          "app.kubernetes.io/name=windows-exporter",
+          "release=ko",
+        ]
+      }
+      
+      discovery.relabel "windows_exporter" {
+        targets = windows_exporter.kubernetes.targets.output
+        rule {
+          source_labels = ["__meta_kubernetes_pod_node_name"]
+          action = "replace"
+          target_label = "instance"
+        }
+      }
+      
+      windows_exporter.scrape "metrics" {
+        targets = discovery.relabel.windows_exporter.output
+        clustering = true
+        keep_metrics = "up|windows_.*|node_cpu_seconds_total|node_filesystem_size_bytes|node_filesystem_avail_bytes|container_cpu_usage_seconds_total"
+        scrape_interval = "60s"
+        max_cache_size = 100000
+        forward_to = argument.metrics_destinations.value
+      }  
+      
+      discovery.kubernetes "kepler" {
+        role = "pod"
+        namespaces {
+          own_namespace = true
+        }
+        selectors {
+          role = "pod"
+          label = "app.kubernetes.io/name=kepler"
+        }
+      }
+      
+      discovery.relabel "kepler" {
+        targets = discovery.kubernetes.kepler.targets
+        rule {
+          source_labels = ["__meta_kubernetes_pod_node_name"]
+          action = "replace"
+          target_label = "instance"
+        }
+      }
+      
+      prometheus.scrape "kepler" {
+        targets      = discovery.relabel.kepler.output
+        job_name     = "integrations/kepler"
+        honor_labels = true
+        scrape_interval = "60s"
+        clustering {
+          enabled = true
+        }
+        forward_to = [prometheus.relabel.kepler.receiver]
+      }
+      
+      prometheus.relabel "kepler" {
+        max_cache_size = 100000
+        rule {
+          source_labels = ["__name__"]
+          regex = "up|kepler_.*"
+          action = "keep"
+        }
+        forward_to = argument.metrics_destinations.value
+      }
+    }
+    cluster_metrics "feature" {
+      metrics_destinations = [
+        otelcol.receiver.prometheus.otlpgateway.receiver,
+      ]
+    }
+    
+    // Feature: Prometheus Operator Objects
+    declare "prometheus_operator_objects" {
+      argument "metrics_destinations" {
+        comment = "Must be a list of metric destinations where collected metrics should be forwarded to"
+      }
+      
+      // Prometheus Operator podMonitor objects
+      prometheus.operator.podmonitors "pod_monitors" {
+        clustering {
+          enabled = true
+        }
+        scrape {
+          default_scrape_interval = "60s"
+        }
+        forward_to = argument.metrics_destinations.value
+      }
+      
+      // Prometheus Operator podMonitor objects
+      prometheus.operator.probes "pod_monitors" {
+        clustering {
+          enabled = true
+        }
+        scrape {
+          default_scrape_interval = "60s"
+        }
+        forward_to = argument.metrics_destinations.value
+      }
+      
+      // Prometheus Operator ServiceMonitor objects
+      prometheus.operator.servicemonitors "service_monitors" {
+        clustering {
+          enabled = true
+        }
+        scrape {
+          default_scrape_interval = "60s"
+        }
+        forward_to = argument.metrics_destinations.value
+      }
+    }
+    prometheus_operator_objects "feature" {
+      metrics_destinations = [
+        otelcol.receiver.prometheus.otlpgateway.receiver,
+      ]
+    }
+    
+    declare "alloy_integration" {
+      argument "metrics_destinations" {
+        comment = "Must be a list of metric destinations where collected metrics should be forwarded to"
+      }
+    
+      declare "alloy_integration_discovery" {
+        argument "namespaces" {
+          comment = "The namespaces to look for targets in (default: [] is all namespaces)"
+          optional = true
+        }
+    
+        argument "field_selectors" {
+          comment = "The field selectors to use to find matching targets (default: [])"
+          optional = true
+        }
+    
+        argument "label_selectors" {
+          comment = "The label selectors to use to find matching targets (default: [\"app.kubernetes.io/name=alloy\"])"
+          optional = true
+        }
+    
+        argument "port_name" {
+          comment = "The of the port to scrape metrics from (default: http-metrics)"
+          optional = true
+        }
+    
+        // Alloy service discovery for all of the pods
+        discovery.kubernetes "alloy_pods" {
+          role = "pod"
+    
+          selectors {
+            role = "pod"
+            field = join(coalesce(argument.field_selectors.value, []), ",")
+            label = join(coalesce(argument.label_selectors.value, ["app.kubernetes.io/name=alloy"]), ",")
+          }
+    
+          namespaces {
+            names = coalesce(argument.namespaces.value, [])
+          }
+        }
+    
+        // alloy relabelings (pre-scrape)
+        discovery.relabel "alloy_pods" {
+          targets = discovery.kubernetes.alloy_pods.targets
+    
+          // keep only the specified metrics port name, and pods that are Running and ready
+          rule {
+            source_labels = [
+              "__meta_kubernetes_pod_container_port_name",
+              "__meta_kubernetes_pod_phase",
+              "__meta_kubernetes_pod_ready",
+              "__meta_kubernetes_pod_container_init",
+            ]
+            separator = "@"
+            regex = coalesce(argument.port_name.value, "metrics") + "@Running@true@false"
+            action = "keep"
+          }
+    
+          rule {
+            source_labels = ["__meta_kubernetes_namespace"]
+            target_label  = "namespace"
+          }
+    
+          rule {
+            source_labels = ["__meta_kubernetes_pod_name"]
+            target_label  = "pod"
+          }
+    
+          rule {
+            source_labels = ["__meta_kubernetes_pod_container_name"]
+            target_label  = "container"
+          }
+    
+          rule {
+            source_labels = [
+              "__meta_kubernetes_pod_controller_kind",
+              "__meta_kubernetes_pod_controller_name",
+            ]
+            separator = "/"
+            target_label  = "workload"
+          }
+          // remove the hash from the ReplicaSet
+          rule {
+            source_labels = ["workload"]
+            regex = "(ReplicaSet/.+)-.+"
+            target_label  = "workload"
+          }
+    
+          // set the app name if specified as metadata labels "app:" or "app.kubernetes.io/name:" or "k8s-app:"
+          rule {
+            action = "replace"
+            source_labels = [
+              "__meta_kubernetes_pod_label_app_kubernetes_io_name",
+              "__meta_kubernetes_pod_label_k8s_app",
+              "__meta_kubernetes_pod_label_app",
+            ]
+            separator = ";"
+            regex = "^(?:;*)?([^;]+).*$"
+            replacement = "$1"
+            target_label = "app"
+          }
+    
+          // set the component if specified as metadata labels "component:" or "app.kubernetes.io/component:" or "k8s-component:"
+          rule {
+            action = "replace"
+            source_labels = [
+              "__meta_kubernetes_pod_label_app_kubernetes_io_component",
+              "__meta_kubernetes_pod_label_k8s_component",
+              "__meta_kubernetes_pod_label_component",
+            ]
+            regex = "^(?:;*)?([^;]+).*$"
+            replacement = "$1"
+            target_label = "component"
+          }
+    
+          // set a source label
+          rule {
+            action = "replace"
+            replacement = "kubernetes"
+            target_label = "source"
+          }
+        }
+    
+        export "output" {
+          value = discovery.relabel.alloy_pods.output
+        }
+      }
+    
+      declare "alloy_integration_scrape" {
+        argument "targets" {
+          comment = "Must be a list() of targets"
+        }
+    
+        argument "forward_to" {
+          comment = "Must be a list(MetricsReceiver) where collected logs should be forwarded to"
+        }
+    
+        argument "job_label" {
+          comment = "The job label to add for all alloy metric (default: integrations/alloy)"
+          optional = true
+        }
+    
+        argument "keep_metrics" {
+          comment = "A regular expression of metrics to keep (default: see below)"
+          optional = true
+        }
+    
+        argument "drop_metrics" {
+          comment = "A regular expression of metrics to drop (default: see below)"
+          optional = true
+        }
+    
+        argument "scrape_interval" {
+          comment = "How often to scrape metrics from the targets (default: 60s)"
+          optional = true
+        }
+    
+        argument "scrape_timeout" {
+          comment = "How long before a scrape times out (default: 10s)"
+          optional = true
+        }
+    
+        argument "max_cache_size" {
+          comment = "The maximum number of elements to hold in the relabeling cache (default: 100000).  This should be at least 2x-5x your largest scrape target or samples appended rate."
+          optional = true
+        }
+    
+        argument "clustering" {
+          comment = "Whether or not clustering should be enabled (default: false)"
+          optional = true
+        }
+    
+        prometheus.scrape "alloy" {
+          job_name = coalesce(argument.job_label.value, "integrations/alloy")
+          forward_to = [prometheus.relabel.alloy.receiver]
+          targets = argument.targets.value
+          scrape_interval = coalesce(argument.scrape_interval.value, "60s")
+          scrape_timeout = coalesce(argument.scrape_timeout.value, "10s")
+    
+          clustering {
+            enabled = coalesce(argument.clustering.value, false)
+          }
+        }
+    
+        // alloy metric relabelings (post-scrape)
+        prometheus.relabel "alloy" {
+          forward_to = argument.forward_to.value
+          max_cache_size = coalesce(argument.max_cache_size.value, 100000)
+    
+          // drop metrics that match the drop_metrics regex
+          rule {
+            source_labels = ["__name__"]
+            regex = coalesce(argument.drop_metrics.value, "(^(go|process)_.+$)")
+            action = "drop"
+          }
+    
+          // keep only metrics that match the keep_metrics regex
+          rule {
+            source_labels = ["__name__"]
+            regex = coalesce(argument.keep_metrics.value, ".*")
+            action = "keep"
+          }
+    
+          // remove the component_id label from any metric that starts with log_bytes or log_lines, these are custom metrics that are generated
+          // as part of the log annotation modules in this repo
+          rule {
+            action = "replace"
+            source_labels = ["__name__"]
+            regex = "^log_(bytes|lines).+"
+            replacement = ""
+            target_label = "component_id"
+          }
+    
+          // set the namespace label to that of the exported_namespace
+          rule {
+            action = "replace"
+            source_labels = ["__name__", "exported_namespace"]
+            separator = "@"
+            regex = "^log_(bytes|lines).+@(.+)"
+            replacement = "$2"
+            target_label = "namespace"
+          }
+    
+          // set the pod label to that of the exported_pod
+          rule {
+            action = "replace"
+            source_labels = ["__name__", "exported_pod"]
+            separator = "@"
+            regex = "^log_(bytes|lines).+@(.+)"
+            replacement = "$2"
+            target_label = "pod"
+          }
+    
+          // set the container label to that of the exported_container
+          rule {
+            action = "replace"
+            source_labels = ["__name__", "exported_container"]
+            separator = "@"
+            regex = "^log_(bytes|lines).+@(.+)"
+            replacement = "$2"
+            target_label = "container"
+          }
+    
+          // set the job label to that of the exported_job
+          rule {
+            action = "replace"
+            source_labels = ["__name__", "exported_job"]
+            separator = "@"
+            regex = "^log_(bytes|lines).+@(.+)"
+            replacement = "$2"
+            target_label = "job"
+          }
+    
+          // set the instance label to that of the exported_instance
+          rule {
+            action = "replace"
+            source_labels = ["__name__", "exported_instance"]
+            separator = "@"
+            regex = "^log_(bytes|lines).+@(.+)"
+            replacement = "$2"
+            target_label = "instance"
+          }
+    
+          rule {
+            action = "labeldrop"
+            regex = "exported_(namespace|pod|container|job|instance)"
+          }
+        }
+      }
+      
+      
+      alloy_integration_discovery "alloy" {
+        port_name       = "http-metrics"
+        label_selectors = ["app.kubernetes.io/name=alloy"]
+      }
+      
+      alloy_integration_scrape  "alloy" {
+        targets = alloy_integration_discovery.alloy.output
+        clustering = true
+        keep_metrics = "up|alloy_build_info"
+        scrape_interval = "60s"
+        max_cache_size = 100000
+        forward_to = argument.metrics_destinations.value
+      }
+    }
+    alloy_integration "integration" {
+      metrics_destinations = [
+        otelcol.receiver.prometheus.otlpgateway.receiver,
+      ]
+    }
+---
+# Source: k8s-monitoring/templates/alloy-config.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ko-alloy-singleton
+  namespace: default
+data:
+  config.alloy: |-
+    // Destination: otlpGateway (otlp)
+    otelcol.receiver.prometheus "otlpgateway" {
+      output {
+        metrics = [otelcol.processor.transform.otlpgateway.input]
+      }
+    }
+    otelcol.receiver.loki "otlpgateway" {
+      output {
+        logs = [otelcol.processor.transform.otlpgateway.input]
+      }
+    }
+    otelcol.auth.basic "otlpgateway" {
+      username = nonsensitive(remote.kubernetes.secret.otlpgateway.data["username"])
+      password = remote.kubernetes.secret.otlpgateway.data["password"]
+    }
+    
+    otelcol.processor.transform "otlpgateway" {
+      error_mode = "ignore"
+      metric_statements {
+        context = "resource"
+        statements = ["set(attributes[\"k8s.cluster.name\"], \"all-features-cluster\") where attributes[\"k8s.cluster.name\"] == nil"]
+      }
+      log_statements {
+        context = "resource"
+        statements = ["set(attributes[\"k8s.cluster.name\"], \"all-features-cluster\") where attributes[\"k8s.cluster.name\"] == nil"]
+      }
+      trace_statements {
+        context = "resource"
+        statements = ["set(attributes[\"k8s.cluster.name\"], \"all-features-cluster\") where attributes[\"k8s.cluster.name\"] == nil"]
+      }
+    
+      output {
+        metrics = [otelcol.exporter.otlp.otlpgateway.input]
+        logs = [otelcol.exporter.otlp.otlpgateway.input]
+        traces = [otelcol.exporter.otlp.otlpgateway.input]
+      }
+    }
+    otelcol.exporter.otlp "otlpgateway" {
+      client {
+        endpoint = "https://otlp.example.com:4317/v1/traces"
+        headers = {
+          "X-Scope-OrgID" = nonsensitive(remote.kubernetes.secret.otlpgateway.data["tenantId"]),
+        }
+        tls {
+          insecure = false
+          insecure_skip_verify = false
+          ca_pem = nonsensitive(remote.kubernetes.secret.otlpgateway.data["ca"])
+          cert_pem = nonsensitive(remote.kubernetes.secret.otlpgateway.data["cert"])
+          key_pem = remote.kubernetes.secret.otlpgateway.data["key"]
+        }
+      }
+    }
+    
+    remote.kubernetes.secret "otlpgateway" {
+      name      = "otlpgateway-ko-k8s-monitoring"
+      namespace = "default"
+    }
+    
+    // Feature: Cluster Events
+    declare "cluster_events" {
+      argument "logs_destinations" {
+        comment = "Must be a list of log destinations where collected logs should be forwarded to"
+      }
+    
+      loki.source.kubernetes_events "cluster_events" {
+        job_name   = "integrations/kubernetes/eventhandler"
+        log_format = "logfmt"
+        forward_to = argument.logs_destinations.value
+      }
+    }
+    cluster_events "feature" {
+      logs_destinations = [
+        otelcol.receiver.loki.otlpgateway.receiver,
+      ]
+    }
+    
+    // Self Reporting
+    prometheus.exporter.unix "kubernetes_monitoring_telemetry" {
+      set_collectors = ["textfile"]
+      textfile {
+        directory = "/etc/alloy"
+      }
+    }
+    
+    discovery.relabel "kubernetes_monitoring_telemetry" {
+      targets = prometheus.exporter.unix.kubernetes_monitoring_telemetry.targets
+      rule {
+        target_label = "instance"
+        action = "replace"
+        replacement = "ko"
+      }
+      rule {
+        target_label = "job"
+        action = "replace"
+        replacement = "integrations/kubernetes/kubernetes_monitoring_telemetry"
+      }
+    }
+    
+    prometheus.scrape "kubernetes_monitoring_telemetry" {
+      job_name   = "integrations/kubernetes/kubernetes_monitoring_telemetry"
+      targets    = discovery.relabel.kubernetes_monitoring_telemetry.output
+      scrape_interval = "1h"
+      clustering {
+        enabled = true
+      }
+      forward_to = [
+        otelcol.receiver.prometheus.otlpgateway.receiver,
+      ]
+    }
+    
+    
+    
+    
+  self-reporting-metric.prom: |
+    # HELP grafana_kubernetes_monitoring_build_info A metric to report the version of the Kubernetes Monitoring Helm chart
+    # TYPE grafana_kubernetes_monitoring_build_info gauge
+    grafana_kubernetes_monitoring_build_info{version="2.0.0-alpha.1", namespace="default", platform=""} 1
+    # HELP grafana_kubernetes_monitoring_feature_info A metric to report the enabled features of the Kubernetes Monitoring Helm chart
+    # TYPE grafana_kubernetes_monitoring_feature_info gauge
+    grafana_kubernetes_monitoring_feature_info{feature="annotationAutodiscovery", version="1.0.0"} 1
+    grafana_kubernetes_monitoring_feature_info{feature="applicationObservability", protocols="otlpgrpc", version="1.0.0"} 1
+    grafana_kubernetes_monitoring_feature_info{deployments="kube-state-metrics,node-exporter,windows-exporter,kepler", feature="clusterMetrics", sources="kubelet,kubeletResource,cadvisor,kube-state-metrics,node-exporter,windows-exporter,kepler", version="1.0.0"} 1
+    grafana_kubernetes_monitoring_feature_info{feature="clusterEvents", version="1.0.0"} 1
+    grafana_kubernetes_monitoring_feature_info{feature="podLogs", method="volumes", version="1.0.0"} 1
+    grafana_kubernetes_monitoring_feature_info{feature="profiling", method="", version="1.0.0"} 1
+    grafana_kubernetes_monitoring_feature_info{feature="prometheusOperatorObjects", version="1.0.0"} 1
+    grafana_kubernetes_monitoring_feature_info{feature="integrations", version="1.0.0"} 1
+---
+# Source: k8s-monitoring/templates/alloy-config.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ko-alloy-logs
+  namespace: default
+data:
+  config.alloy: |-
+    // Destination: otlpGateway (otlp)
+    otelcol.receiver.prometheus "otlpgateway" {
+      output {
+        metrics = [otelcol.processor.transform.otlpgateway.input]
+      }
+    }
+    otelcol.receiver.loki "otlpgateway" {
+      output {
+        logs = [otelcol.processor.transform.otlpgateway.input]
+      }
+    }
+    otelcol.auth.basic "otlpgateway" {
+      username = nonsensitive(remote.kubernetes.secret.otlpgateway.data["username"])
+      password = remote.kubernetes.secret.otlpgateway.data["password"]
+    }
+    
+    otelcol.processor.transform "otlpgateway" {
+      error_mode = "ignore"
+      metric_statements {
+        context = "resource"
+        statements = ["set(attributes[\"k8s.cluster.name\"], \"all-features-cluster\") where attributes[\"k8s.cluster.name\"] == nil"]
+      }
+      log_statements {
+        context = "resource"
+        statements = ["set(attributes[\"k8s.cluster.name\"], \"all-features-cluster\") where attributes[\"k8s.cluster.name\"] == nil"]
+      }
+      trace_statements {
+        context = "resource"
+        statements = ["set(attributes[\"k8s.cluster.name\"], \"all-features-cluster\") where attributes[\"k8s.cluster.name\"] == nil"]
+      }
+    
+      output {
+        metrics = [otelcol.exporter.otlp.otlpgateway.input]
+        logs = [otelcol.exporter.otlp.otlpgateway.input]
+        traces = [otelcol.exporter.otlp.otlpgateway.input]
+      }
+    }
+    otelcol.exporter.otlp "otlpgateway" {
+      client {
+        endpoint = "https://otlp.example.com:4317/v1/traces"
+        headers = {
+          "X-Scope-OrgID" = nonsensitive(remote.kubernetes.secret.otlpgateway.data["tenantId"]),
+        }
+        tls {
+          insecure = false
+          insecure_skip_verify = false
+          ca_pem = nonsensitive(remote.kubernetes.secret.otlpgateway.data["ca"])
+          cert_pem = nonsensitive(remote.kubernetes.secret.otlpgateway.data["cert"])
+          key_pem = remote.kubernetes.secret.otlpgateway.data["key"]
+        }
+      }
+    }
+    
+    remote.kubernetes.secret "otlpgateway" {
+      name      = "otlpgateway-ko-k8s-monitoring"
+      namespace = "default"
+    }
+    
+    // Feature: Pod Logs
+    declare "pod_logs" {
+      argument "logs_destinations" {
+        comment = "Must be a list of log destinations where collected logs should be forwarded to"
+      }
+      
+      discovery.relabel "filtered_pods" {
+        targets = discovery.kubernetes.pods.targets
+        rule {
+          source_labels = ["__meta_kubernetes_namespace"]
+          action = "replace"
+          target_label = "namespace"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_name"]
+          action = "replace"
+          target_label = "pod"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_container_name"]
+          action = "replace"
+          target_label = "container"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_namespace", "__meta_kubernetes_pod_container_name"]
+          separator = "/"
+          action = "replace"
+          replacement = "$1"
+          target_label = "job"
+        }
+      
+        // set the container runtime as a label
+        rule {
+          action = "replace"
+          source_labels = ["__meta_kubernetes_pod_container_id"]
+          regex = "^(\\S+):\\/\\/.+$"
+          replacement = "$1"
+          target_label = "tmp_container_runtime"
+        }
+      }
+      
+      discovery.kubernetes "pods" {
+        role = "pod"
+        selectors {
+          role = "pod"
+          field = "spec.nodeName=" + env("HOSTNAME")
+        }
+      }
+      
+      discovery.relabel "filtered_pods_with_paths" {
+        targets = discovery.relabel.filtered_pods.output
+      
+        rule {
+          source_labels = ["__meta_kubernetes_pod_uid", "__meta_kubernetes_pod_container_name"]
+          separator = "/"
+          action = "replace"
+          replacement = "/var/log/pods/*$1/*.log"
+          target_label = "__path__"
+        }
+      }
+      
+      local.file_match "pod_logs" {
+        path_targets = discovery.relabel.filtered_pods_with_paths.output
+      }
+      
+      loki.source.file "pod_logs" {
+        targets    = local.file_match.pod_logs.targets
+        forward_to = [loki.process.pod_logs.receiver]
+      }
+      
+      loki.process "pod_logs" {
+        stage.match {
+          selector = "{tmp_container_runtime=~\"containerd|cri-o\"}"
+          // the cri processing stage extracts the following k/v pairs: log, stream, time, flags
+          stage.cri {}
+      
+          // Set the extract flags and stream values as labels
+          stage.labels {
+            values = {
+              flags  = "",
+              stream  = "",
+            }
+          }
+        }
+      
+        stage.match {
+          selector = "{tmp_container_runtime=\"docker\"}"
+          // the docker processing stage extracts the following k/v pairs: log, stream, time
+          stage.docker {}
+      
+          // Set the extract stream value as a label
+          stage.labels {
+            values = {
+              stream  = "",
+            }
+          }
+        }
+      
+        // Drop the filename label, since it's not really useful in the context of Kubernetes, where we already have cluster,
+        // namespace, pod, and container labels. Drop any structured metadata. Also drop the temporary
+        // container runtime label as it is no longer needed.
+        stage.label_drop {
+          values = [
+            "filename",
+            "tmp_container_runtime",
+          ]
+        }
+        forward_to = argument.logs_destinations.value
+      }
+    }
+    pod_logs "feature" {
+      logs_destinations = [
+        otelcol.receiver.loki.otlpgateway.receiver,
+      ]
+    }
+---
+# Source: k8s-monitoring/templates/alloy-config.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ko-alloy-receiver
+  namespace: default
+data:
+  config.alloy: |-
+    // Destination: otlpGateway (otlp)
+    otelcol.receiver.prometheus "otlpgateway" {
+      output {
+        metrics = [otelcol.processor.transform.otlpgateway.input]
+      }
+    }
+    otelcol.receiver.loki "otlpgateway" {
+      output {
+        logs = [otelcol.processor.transform.otlpgateway.input]
+      }
+    }
+    otelcol.auth.basic "otlpgateway" {
+      username = nonsensitive(remote.kubernetes.secret.otlpgateway.data["username"])
+      password = remote.kubernetes.secret.otlpgateway.data["password"]
+    }
+    
+    otelcol.processor.transform "otlpgateway" {
+      error_mode = "ignore"
+      metric_statements {
+        context = "resource"
+        statements = ["set(attributes[\"k8s.cluster.name\"], \"all-features-cluster\") where attributes[\"k8s.cluster.name\"] == nil"]
+      }
+      log_statements {
+        context = "resource"
+        statements = ["set(attributes[\"k8s.cluster.name\"], \"all-features-cluster\") where attributes[\"k8s.cluster.name\"] == nil"]
+      }
+      trace_statements {
+        context = "resource"
+        statements = ["set(attributes[\"k8s.cluster.name\"], \"all-features-cluster\") where attributes[\"k8s.cluster.name\"] == nil"]
+      }
+    
+      output {
+        metrics = [otelcol.exporter.otlp.otlpgateway.input]
+        logs = [otelcol.exporter.otlp.otlpgateway.input]
+        traces = [otelcol.exporter.otlp.otlpgateway.input]
+      }
+    }
+    otelcol.exporter.otlp "otlpgateway" {
+      client {
+        endpoint = "https://otlp.example.com:4317/v1/traces"
+        headers = {
+          "X-Scope-OrgID" = nonsensitive(remote.kubernetes.secret.otlpgateway.data["tenantId"]),
+        }
+        tls {
+          insecure = false
+          insecure_skip_verify = false
+          ca_pem = nonsensitive(remote.kubernetes.secret.otlpgateway.data["ca"])
+          cert_pem = nonsensitive(remote.kubernetes.secret.otlpgateway.data["cert"])
+          key_pem = remote.kubernetes.secret.otlpgateway.data["key"]
+        }
+      }
+    }
+    
+    remote.kubernetes.secret "otlpgateway" {
+      name      = "otlpgateway-ko-k8s-monitoring"
+      namespace = "default"
+    }
+    
+    // Feature: Application Observability
+    declare "application_observability" {
+      argument "metrics_destinations" {
+        comment = "Must be a list of metrics destinations where collected metrics should be forwarded to"
+      }
+    
+      argument "logs_destinations" {
+        comment = "Must be a list of log destinations where collected logs should be forwarded to"
+      }
+    
+      argument "traces_destinations" {
+        comment = "Must be a list of trace destinations where collected trace should be forwarded to"
+      }
+    
+      // Receivers --> Resource Detection Processor  
+      otelcol.receiver.otlp "receiver" {
+        grpc {
+          endpoint = "0.0.0.0:4317"
+        }
+        debug_metrics {
+          disable_high_cardinality_metrics = true
+        }
+        output {
+          metrics = [otelcol.processor.resourcedetection.default.input]
+          logs = [otelcol.processor.resourcedetection.default.input]
+          traces = [otelcol.processor.resourcedetection.default.input]
+        }
+      }  
+    
+      // Resource Detection Processor --> K8s Attribute Processor  
+      otelcol.processor.resourcedetection "default" {
+        detectors = ["env", "system"]
+        system {
+          hostname_sources = ["os"]
+        }
+      
+        output {
+          metrics = [otelcol.processor.k8sattributes.default.input]
+          logs = [otelcol.processor.k8sattributes.default.input]
+          traces = [otelcol.processor.k8sattributes.default.input]
+        }
+      }
+    
+      // K8s Attribute Processor --> Transform Processor
+      // Resource Detection Processor Traces --> Host Info Connector  
+      otelcol.processor.k8sattributes "default" {
+        extract {
+          metadata = ["k8s.namespace.name","k8s.pod.name","k8s.deployment.name","k8s.statefulset.name","k8s.daemonset.name","k8s.cronjob.name","k8s.job.name","k8s.node.name","k8s.pod.uid","k8s.pod.start_time"]
+        }
+        pod_association {
+          source {
+            from = "connection"
+          }
+        }
+      
+        output {
+          metrics = [otelcol.processor.transform.default.input]
+          logs = [otelcol.processor.transform.default.input]
+          traces = [otelcol.processor.transform.default.input, otelcol.connector.host_info.default.input]
+        }
+      }
+      // Host Info Connector --> Batch Processor  
+      otelcol.connector.host_info "default" {
+        host_identifiers = [ "k8s.node.name" ]
+      
+        output {
+          metrics = [otelcol.processor.batch.default.input]
+        }
+      }
+    
+    
+      // Transform Processor --> Batch Processor  
+      otelcol.processor.transform "default" {
+        error_mode = "ignore"
+        log_statements {
+          context = "resource"
+          statements = [
+            "set(attributes[\"pod\"], attributes[\"k8s.pod.name\"])",
+            "set(attributes[\"namespace\"], attributes[\"k8s.namespace.name\"])",
+            "set(attributes[\"loki.resource.labels\"], \"cluster, namespace, job, pod\")",
+          ]
+        }
+      
+        output {
+          metrics = [otelcol.processor.batch.default.input]
+          logs = [otelcol.processor.batch.default.input]
+          traces = [otelcol.processor.batch.default.input]
+        }
+      }
+    
+      // Batch Processor --> Destinations  
+      otelcol.processor.batch "default" {
+        output {
+          metrics = argument.metrics_destinations.value
+          logs = argument.logs_destinations.value
+          traces = argument.traces_destinations.value
+        }
+      }
+    }
+    application_observability "feature" {
+      metrics_destinations = [
+        otelcol.processor.transform.otlpgateway.input,
+      ]
+      logs_destinations = [
+        otelcol.processor.transform.otlpgateway.input,
+      ]
+      traces_destinations = [
+        otelcol.processor.transform.otlpgateway.input,
+      ]
+    }
+---
+# Source: k8s-monitoring/templates/alloy-config.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ko-alloy-profiles
+  namespace: default
+data:
+  config.alloy: |-
+    // Destination: pyroscope (pyroscope)
+    pyroscope.write "pyroscope" {
+      endpoint {
+        url = "http://pyroscope.example.com"
+        headers = {
+        }
+        tls_config {
+          insecure_skip_verify = false
+        }
+      }
+    
+      external_labels = {
+        cluster = "all-features-cluster",
+      }
+    }
+    
+    // Feature: Profiling
+    declare "profiling" {
+      argument "profiles_destinations" {
+        comment = "Must be a list of profile destinations where collected profiles should be forwarded to"
+      }  
+      // Profiles: eBPF
+      discovery.kubernetes "ebpf_pods" {
+        selectors {
+          role = "pod"
+          field = "spec.nodeName=" + env("HOSTNAME")
+        }
+        role = "pod"
+      }
+      
+      discovery.relabel "ebpf_pods" {
+        targets = discovery.kubernetes.ebpf_pods.targets
+        rule {
+          source_labels = ["__meta_kubernetes_pod_phase"]
+          regex = "Succeeded|Failed|Completed"
+          action = "drop"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_namespace"]
+          target_label = "namespace"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_name"]
+          target_label = "pod"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_node_name"]
+          target_label = "node"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_container_name"]
+          target_label = "container"
+        }
+        // provide arbitrary service_name label, otherwise it will be set to {__meta_kubernetes_namespace}/{__meta_kubernetes_pod_container_name}
+        rule {
+          source_labels = ["__meta_kubernetes_namespace", "__meta_kubernetes_pod_container_name"]
+          separator = "@"
+          regex = "(.*)@(.*)"
+          replacement = "ebpf/${1}/${2}"
+          target_label = "service_name"
+        }
+      }
+      
+      pyroscope.ebpf "ebpf_pods" {
+        targets = discovery.relabel.ebpf_pods.output
+        demangle = "none"
+        forward_to = argument.profiles_destinations.value
+      }  
+      // Profiles: Java
+      discovery.kubernetes "java_pods" {
+        selectors {
+          role = "pod"
+          field = "spec.nodeName=" + env("HOSTNAME")
+        }
+        role = "pod"
+      }
+      
+      discovery.process "java_pods" {
+        join = discovery.kubernetes.java_pods.targets
+      }
+      
+      discovery.relabel "java_pods" {
+        targets = discovery.process.java_pods.targets
+        rule {
+          source_labels = ["__meta_kubernetes_pod_phase"]
+          regex = "Succeeded|Failed|Completed"
+          action = "drop"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_name"]
+          regex = "^$"
+          action = "drop"
+        }
+        rule {
+          source_labels = ["__meta_process_exe"]
+          action = "keep"
+          regex = ".*/java$"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_namespace"]
+          target_label = "namespace"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_name"]
+          target_label = "pod"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_node_name"]
+          target_label = "node"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_container_name"]
+          target_label = "container"
+        }
+      }
+      
+      pyroscope.java "java_pods" {
+        targets = discovery.relabel.java_pods.output
+        profiling_config {
+          interval = "60s"
+          alloc = "512k"
+          cpu = true
+          sample_rate = 100
+          lock = "10ms"
+        }
+        forward_to = argument.profiles_destinations.value
+      }  
+      // Profiles: pprof
+      discovery.kubernetes "pprof_pods" {
+        selectors {
+          role = "pod"
+          field = "spec.nodeName=" + env("HOSTNAME")
+        }
+        role = "pod"
+      }
+      
+      discovery.relabel "pprof_pods" {
+        targets = discovery.kubernetes.pprof_pods.targets
+        rule {
+          action        = "drop"
+          source_labels = ["__meta_kubernetes_pod_phase"]
+          regex         = "Pending|Succeeded|Failed|Completed"
+        }
+      
+        rule {
+          regex  = "__meta_kubernetes_pod_label_(.+)"
+          action = "labelmap"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_namespace"]
+          target_label  = "namespace"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_name"]
+          target_label  = "pod"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_container_name"]
+          target_label  = "container"
+        }
+      }
+      
+      discovery.relabel "pprof_pods_block_default_name" {
+        targets = discovery.relabel.pprof_pods.output
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_block_scrape"]
+          regex         = "true"
+          action        = "keep"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_block_port_name"]
+          regex         = ""
+          action        = "keep"
+        }
+      
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_block_scheme"]
+          action        = "replace"
+          regex         = "(https?)"
+          target_label  = "__scheme__"
+          replacement   = "$1"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_block_path"]
+          action        = "replace"
+          regex         = "(.+)"
+          target_label  = "__profile_path__"
+          replacement   = "$1"
+        }
+        rule {
+          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_block_port"]
+          action        = "replace"
+          regex         = "(.+?)(?::\\d+)?;(\\d+)"
+          target_label  = "__address__"
+          replacement   = "$1:$2"
+        }
+      }
+      
+      discovery.relabel "pprof_pods_block_custom_name" {
+        targets = discovery.relabel.pprof_pods.output
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_block_scrape"]
+          regex         = "true"
+          action        = "keep"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_block_port_name"]
+          regex         = ""
+          action        = "drop"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_container_port_name"]
+          target_label  = "__meta_kubernetes_pod_annotation_profiles_grafana_com_block_port_name"
+          action        = "keepequal"
+        }
+      
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_block_scheme"]
+          action        = "replace"
+          regex         = "(https?)"
+          target_label  = "__scheme__"
+          replacement   = "$1"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_block_path"]
+          action        = "replace"
+          regex         = "(.+)"
+          target_label  = "__profile_path__"
+          replacement   = "$1"
+        }
+        rule {
+          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_block_port"]
+          action        = "replace"
+          regex         = "(.+?)(?::\\d+)?;(\\d+)"
+          target_label  = "__address__"
+          replacement   = "$1:$2"
+        }
+      }
+      
+      pyroscope.scrape "pyroscope_scrape_block" {
+        targets = concat(discovery.relabel.pprof_pods_block_default_name.output, discovery.relabel.pprof_pods_block_custom_name.output)
+      
+        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+        profiling_config {
+          profile.block {
+            enabled = true
+          }
+          profile.process_cpu {
+            enabled = false
+          }
+          profile.fgprof {
+            enabled = false
+          }
+          profile.godeltaprof_block {
+            enabled = false
+          }
+          profile.godeltaprof_memory {
+            enabled = false
+          }
+          profile.godeltaprof_mutex {
+            enabled = false
+          }
+          profile.goroutine {
+            enabled = false
+          }
+          profile.memory {
+            enabled = false
+          }
+          profile.mutex {
+            enabled = false
+          }
+        }
+      
+        forward_to = argument.profiles_destinations.value
+      }
+      discovery.relabel "pprof_pods_cpu_default_name" {
+        targets = discovery.relabel.pprof_pods.output
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_scrape"]
+          regex         = "true"
+          action        = "keep"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_port_name"]
+          regex         = ""
+          action        = "keep"
+        }
+      
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_scheme"]
+          action        = "replace"
+          regex         = "(https?)"
+          target_label  = "__scheme__"
+          replacement   = "$1"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_path"]
+          action        = "replace"
+          regex         = "(.+)"
+          target_label  = "__profile_path__"
+          replacement   = "$1"
+        }
+        rule {
+          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_port"]
+          action        = "replace"
+          regex         = "(.+?)(?::\\d+)?;(\\d+)"
+          target_label  = "__address__"
+          replacement   = "$1:$2"
+        }
+      }
+      
+      discovery.relabel "pprof_pods_cpu_custom_name" {
+        targets = discovery.relabel.pprof_pods.output
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_scrape"]
+          regex         = "true"
+          action        = "keep"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_port_name"]
+          regex         = ""
+          action        = "drop"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_container_port_name"]
+          target_label  = "__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_port_name"
+          action        = "keepequal"
+        }
+      
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_scheme"]
+          action        = "replace"
+          regex         = "(https?)"
+          target_label  = "__scheme__"
+          replacement   = "$1"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_path"]
+          action        = "replace"
+          regex         = "(.+)"
+          target_label  = "__profile_path__"
+          replacement   = "$1"
+        }
+        rule {
+          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_cpu_port"]
+          action        = "replace"
+          regex         = "(.+?)(?::\\d+)?;(\\d+)"
+          target_label  = "__address__"
+          replacement   = "$1:$2"
+        }
+      }
+      
+      pyroscope.scrape "pyroscope_scrape_cpu" {
+        targets = concat(discovery.relabel.pprof_pods_cpu_default_name.output, discovery.relabel.pprof_pods_cpu_custom_name.output)
+      
+        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+        profiling_config {
+          profile.block {
+            enabled = false
+          }
+          profile.process_cpu {
+            enabled = true
+          }
+          profile.fgprof {
+            enabled = false
+          }
+          profile.godeltaprof_block {
+            enabled = false
+          }
+          profile.godeltaprof_memory {
+            enabled = false
+          }
+          profile.godeltaprof_mutex {
+            enabled = false
+          }
+          profile.goroutine {
+            enabled = false
+          }
+          profile.memory {
+            enabled = false
+          }
+          profile.mutex {
+            enabled = false
+          }
+        }
+      
+        forward_to = argument.profiles_destinations.value
+      }
+      discovery.relabel "pprof_pods_fgprof_default_name" {
+        targets = discovery.relabel.pprof_pods.output
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_scrape"]
+          regex         = "true"
+          action        = "keep"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_port_name"]
+          regex         = ""
+          action        = "keep"
+        }
+      
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_scheme"]
+          action        = "replace"
+          regex         = "(https?)"
+          target_label  = "__scheme__"
+          replacement   = "$1"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_path"]
+          action        = "replace"
+          regex         = "(.+)"
+          target_label  = "__profile_path__"
+          replacement   = "$1"
+        }
+        rule {
+          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_port"]
+          action        = "replace"
+          regex         = "(.+?)(?::\\d+)?;(\\d+)"
+          target_label  = "__address__"
+          replacement   = "$1:$2"
+        }
+      }
+      
+      discovery.relabel "pprof_pods_fgprof_custom_name" {
+        targets = discovery.relabel.pprof_pods.output
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_scrape"]
+          regex         = "true"
+          action        = "keep"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_port_name"]
+          regex         = ""
+          action        = "drop"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_container_port_name"]
+          target_label  = "__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_port_name"
+          action        = "keepequal"
+        }
+      
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_scheme"]
+          action        = "replace"
+          regex         = "(https?)"
+          target_label  = "__scheme__"
+          replacement   = "$1"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_path"]
+          action        = "replace"
+          regex         = "(.+)"
+          target_label  = "__profile_path__"
+          replacement   = "$1"
+        }
+        rule {
+          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_fgprof_port"]
+          action        = "replace"
+          regex         = "(.+?)(?::\\d+)?;(\\d+)"
+          target_label  = "__address__"
+          replacement   = "$1:$2"
+        }
+      }
+      
+      pyroscope.scrape "pyroscope_scrape_fgprof" {
+        targets = concat(discovery.relabel.pprof_pods_fgprof_default_name.output, discovery.relabel.pprof_pods_fgprof_custom_name.output)
+      
+        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+        profiling_config {
+          profile.block {
+            enabled = false
+          }
+          profile.process_cpu {
+            enabled = false
+          }
+          profile.fgprof {
+            enabled = true
+          }
+          profile.godeltaprof_block {
+            enabled = false
+          }
+          profile.godeltaprof_memory {
+            enabled = false
+          }
+          profile.godeltaprof_mutex {
+            enabled = false
+          }
+          profile.goroutine {
+            enabled = false
+          }
+          profile.memory {
+            enabled = false
+          }
+          profile.mutex {
+            enabled = false
+          }
+        }
+      
+        forward_to = argument.profiles_destinations.value
+      }
+      discovery.relabel "pprof_pods_goroutine_default_name" {
+        targets = discovery.relabel.pprof_pods.output
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_scrape"]
+          regex         = "true"
+          action        = "keep"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_port_name"]
+          regex         = ""
+          action        = "keep"
+        }
+      
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_scheme"]
+          action        = "replace"
+          regex         = "(https?)"
+          target_label  = "__scheme__"
+          replacement   = "$1"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_path"]
+          action        = "replace"
+          regex         = "(.+)"
+          target_label  = "__profile_path__"
+          replacement   = "$1"
+        }
+        rule {
+          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_port"]
+          action        = "replace"
+          regex         = "(.+?)(?::\\d+)?;(\\d+)"
+          target_label  = "__address__"
+          replacement   = "$1:$2"
+        }
+      }
+      
+      discovery.relabel "pprof_pods_goroutine_custom_name" {
+        targets = discovery.relabel.pprof_pods.output
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_scrape"]
+          regex         = "true"
+          action        = "keep"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_port_name"]
+          regex         = ""
+          action        = "drop"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_container_port_name"]
+          target_label  = "__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_port_name"
+          action        = "keepequal"
+        }
+      
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_scheme"]
+          action        = "replace"
+          regex         = "(https?)"
+          target_label  = "__scheme__"
+          replacement   = "$1"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_path"]
+          action        = "replace"
+          regex         = "(.+)"
+          target_label  = "__profile_path__"
+          replacement   = "$1"
+        }
+        rule {
+          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_goroutine_port"]
+          action        = "replace"
+          regex         = "(.+?)(?::\\d+)?;(\\d+)"
+          target_label  = "__address__"
+          replacement   = "$1:$2"
+        }
+      }
+      
+      pyroscope.scrape "pyroscope_scrape_goroutine" {
+        targets = concat(discovery.relabel.pprof_pods_goroutine_default_name.output, discovery.relabel.pprof_pods_goroutine_custom_name.output)
+      
+        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+        profiling_config {
+          profile.block {
+            enabled = false
+          }
+          profile.process_cpu {
+            enabled = false
+          }
+          profile.fgprof {
+            enabled = false
+          }
+          profile.godeltaprof_block {
+            enabled = false
+          }
+          profile.godeltaprof_memory {
+            enabled = false
+          }
+          profile.godeltaprof_mutex {
+            enabled = false
+          }
+          profile.goroutine {
+            enabled = true
+          }
+          profile.memory {
+            enabled = false
+          }
+          profile.mutex {
+            enabled = false
+          }
+        }
+      
+        forward_to = argument.profiles_destinations.value
+      }
+      discovery.relabel "pprof_pods_memory_default_name" {
+        targets = discovery.relabel.pprof_pods.output
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_scrape"]
+          regex         = "true"
+          action        = "keep"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_port_name"]
+          regex         = ""
+          action        = "keep"
+        }
+      
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_scheme"]
+          action        = "replace"
+          regex         = "(https?)"
+          target_label  = "__scheme__"
+          replacement   = "$1"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_path"]
+          action        = "replace"
+          regex         = "(.+)"
+          target_label  = "__profile_path__"
+          replacement   = "$1"
+        }
+        rule {
+          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_port"]
+          action        = "replace"
+          regex         = "(.+?)(?::\\d+)?;(\\d+)"
+          target_label  = "__address__"
+          replacement   = "$1:$2"
+        }
+      }
+      
+      discovery.relabel "pprof_pods_memory_custom_name" {
+        targets = discovery.relabel.pprof_pods.output
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_scrape"]
+          regex         = "true"
+          action        = "keep"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_port_name"]
+          regex         = ""
+          action        = "drop"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_container_port_name"]
+          target_label  = "__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_port_name"
+          action        = "keepequal"
+        }
+      
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_scheme"]
+          action        = "replace"
+          regex         = "(https?)"
+          target_label  = "__scheme__"
+          replacement   = "$1"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_path"]
+          action        = "replace"
+          regex         = "(.+)"
+          target_label  = "__profile_path__"
+          replacement   = "$1"
+        }
+        rule {
+          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_memory_port"]
+          action        = "replace"
+          regex         = "(.+?)(?::\\d+)?;(\\d+)"
+          target_label  = "__address__"
+          replacement   = "$1:$2"
+        }
+      }
+      
+      pyroscope.scrape "pyroscope_scrape_memory" {
+        targets = concat(discovery.relabel.pprof_pods_memory_default_name.output, discovery.relabel.pprof_pods_memory_custom_name.output)
+      
+        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+        profiling_config {
+          profile.block {
+            enabled = false
+          }
+          profile.process_cpu {
+            enabled = false
+          }
+          profile.fgprof {
+            enabled = false
+          }
+          profile.godeltaprof_block {
+            enabled = false
+          }
+          profile.godeltaprof_memory {
+            enabled = false
+          }
+          profile.godeltaprof_mutex {
+            enabled = false
+          }
+          profile.goroutine {
+            enabled = false
+          }
+          profile.memory {
+            enabled = true
+          }
+          profile.mutex {
+            enabled = false
+          }
+        }
+      
+        forward_to = argument.profiles_destinations.value
+      }
+      discovery.relabel "pprof_pods_mutex_default_name" {
+        targets = discovery.relabel.pprof_pods.output
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_scrape"]
+          regex         = "true"
+          action        = "keep"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_port_name"]
+          regex         = ""
+          action        = "keep"
+        }
+      
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_scheme"]
+          action        = "replace"
+          regex         = "(https?)"
+          target_label  = "__scheme__"
+          replacement   = "$1"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_path"]
+          action        = "replace"
+          regex         = "(.+)"
+          target_label  = "__profile_path__"
+          replacement   = "$1"
+        }
+        rule {
+          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_port"]
+          action        = "replace"
+          regex         = "(.+?)(?::\\d+)?;(\\d+)"
+          target_label  = "__address__"
+          replacement   = "$1:$2"
+        }
+      }
+      
+      discovery.relabel "pprof_pods_mutex_custom_name" {
+        targets = discovery.relabel.pprof_pods.output
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_scrape"]
+          regex         = "true"
+          action        = "keep"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_port_name"]
+          regex         = ""
+          action        = "drop"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_container_port_name"]
+          target_label  = "__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_port_name"
+          action        = "keepequal"
+        }
+      
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_scheme"]
+          action        = "replace"
+          regex         = "(https?)"
+          target_label  = "__scheme__"
+          replacement   = "$1"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_path"]
+          action        = "replace"
+          regex         = "(.+)"
+          target_label  = "__profile_path__"
+          replacement   = "$1"
+        }
+        rule {
+          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_profiles_grafana_com_mutex_port"]
+          action        = "replace"
+          regex         = "(.+?)(?::\\d+)?;(\\d+)"
+          target_label  = "__address__"
+          replacement   = "$1:$2"
+        }
+      }
+      
+      pyroscope.scrape "pyroscope_scrape_mutex" {
+        targets = concat(discovery.relabel.pprof_pods_mutex_default_name.output, discovery.relabel.pprof_pods_mutex_custom_name.output)
+      
+        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+        profiling_config {
+          profile.block {
+            enabled = false
+          }
+          profile.process_cpu {
+            enabled = false
+          }
+          profile.fgprof {
+            enabled = false
+          }
+          profile.godeltaprof_block {
+            enabled = false
+          }
+          profile.godeltaprof_memory {
+            enabled = false
+          }
+          profile.godeltaprof_mutex {
+            enabled = false
+          }
+          profile.goroutine {
+            enabled = false
+          }
+          profile.memory {
+            enabled = false
+          }
+          profile.mutex {
+            enabled = true
+          }
+        }
+      
+        forward_to = argument.profiles_destinations.value
+      }
+    }
+    profiling "feature" {
+      profiles_destinations = [
+        pyroscope.write.pyroscope.receiver,
+      ]
+    }
+---
+# Source: k8s-monitoring/charts/alloy-logs/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: ko-alloy-logs
+  labels:
+    helm.sh/chart: alloy-logs-0.9.1
+    app.kubernetes.io/name: alloy-logs
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+    app.kubernetes.io/component: rbac
+rules:
+  # Rules which allow discovery.kubernetes to function.
+  - apiGroups:
+      - ""
+      - "discovery.k8s.io"
+      - "networking.k8s.io"
+    resources:
+      - endpoints
+      - endpointslices
+      - ingresses
+      - nodes
+      - nodes/proxy
+      - nodes/metrics
+      - pods
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  # Rules which allow loki.source.kubernetes and loki.source.podlogs to work.
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - pods/log
+      - namespaces
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - "monitoring.grafana.com"
+    resources:
+      - podlogs
+    verbs:
+      - get
+      - list
+      - watch
+  # Rules which allow mimir.rules.kubernetes to work.
+  - apiGroups: ["monitoring.coreos.com"]
+    resources:
+      - prometheusrules
+    verbs:
+      - get
+      - list
+      - watch
+  - nonResourceURLs:
+      - /metrics
+    verbs:
+      - get
+  # Rules for prometheus.kubernetes.*
+  - apiGroups: ["monitoring.coreos.com"]
+    resources:
+      - podmonitors
+      - servicemonitors
+      - probes
+    verbs:
+      - get
+      - list
+      - watch
+  # Rules which allow eventhandler to work.
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - get
+      - list
+      - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
+  # needed for otelcol.processor.k8sattributes
+  - apiGroups: ["apps"]
+    resources: ["replicasets"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["extensions"]
+    resources: ["replicasets"]
+    verbs: ["get", "list", "watch"]
+---
+# Source: k8s-monitoring/charts/alloy-metrics/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: ko-alloy-metrics
+  labels:
+    helm.sh/chart: alloy-metrics-0.9.1
+    app.kubernetes.io/name: alloy-metrics
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+    app.kubernetes.io/component: rbac
+rules:
+  # Rules which allow discovery.kubernetes to function.
+  - apiGroups:
+      - ""
+      - "discovery.k8s.io"
+      - "networking.k8s.io"
+    resources:
+      - endpoints
+      - endpointslices
+      - ingresses
+      - nodes
+      - nodes/proxy
+      - nodes/metrics
+      - pods
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  # Rules which allow loki.source.kubernetes and loki.source.podlogs to work.
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - pods/log
+      - namespaces
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - "monitoring.grafana.com"
+    resources:
+      - podlogs
+    verbs:
+      - get
+      - list
+      - watch
+  # Rules which allow mimir.rules.kubernetes to work.
+  - apiGroups: ["monitoring.coreos.com"]
+    resources:
+      - prometheusrules
+    verbs:
+      - get
+      - list
+      - watch
+  - nonResourceURLs:
+      - /metrics
+    verbs:
+      - get
+  # Rules for prometheus.kubernetes.*
+  - apiGroups: ["monitoring.coreos.com"]
+    resources:
+      - podmonitors
+      - servicemonitors
+      - probes
+    verbs:
+      - get
+      - list
+      - watch
+  # Rules which allow eventhandler to work.
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - get
+      - list
+      - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
+  # needed for otelcol.processor.k8sattributes
+  - apiGroups: ["apps"]
+    resources: ["replicasets"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["extensions"]
+    resources: ["replicasets"]
+    verbs: ["get", "list", "watch"]
+---
+# Source: k8s-monitoring/charts/alloy-profiles/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: ko-alloy-profiles
+  labels:
+    helm.sh/chart: alloy-profiles-0.9.1
+    app.kubernetes.io/name: alloy-profiles
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+    app.kubernetes.io/component: rbac
+rules:
+  # Rules which allow discovery.kubernetes to function.
+  - apiGroups:
+      - ""
+      - "discovery.k8s.io"
+      - "networking.k8s.io"
+    resources:
+      - endpoints
+      - endpointslices
+      - ingresses
+      - nodes
+      - nodes/proxy
+      - nodes/metrics
+      - pods
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  # Rules which allow loki.source.kubernetes and loki.source.podlogs to work.
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - pods/log
+      - namespaces
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - "monitoring.grafana.com"
+    resources:
+      - podlogs
+    verbs:
+      - get
+      - list
+      - watch
+  # Rules which allow mimir.rules.kubernetes to work.
+  - apiGroups: ["monitoring.coreos.com"]
+    resources:
+      - prometheusrules
+    verbs:
+      - get
+      - list
+      - watch
+  - nonResourceURLs:
+      - /metrics
+    verbs:
+      - get
+  # Rules for prometheus.kubernetes.*
+  - apiGroups: ["monitoring.coreos.com"]
+    resources:
+      - podmonitors
+      - servicemonitors
+      - probes
+    verbs:
+      - get
+      - list
+      - watch
+  # Rules which allow eventhandler to work.
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - get
+      - list
+      - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
+  # needed for otelcol.processor.k8sattributes
+  - apiGroups: ["apps"]
+    resources: ["replicasets"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["extensions"]
+    resources: ["replicasets"]
+    verbs: ["get", "list", "watch"]
+---
+# Source: k8s-monitoring/charts/alloy-receiver/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: ko-alloy-receiver
+  labels:
+    helm.sh/chart: alloy-receiver-0.9.1
+    app.kubernetes.io/name: alloy-receiver
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+    app.kubernetes.io/component: rbac
+rules:
+  # Rules which allow discovery.kubernetes to function.
+  - apiGroups:
+      - ""
+      - "discovery.k8s.io"
+      - "networking.k8s.io"
+    resources:
+      - endpoints
+      - endpointslices
+      - ingresses
+      - nodes
+      - nodes/proxy
+      - nodes/metrics
+      - pods
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  # Rules which allow loki.source.kubernetes and loki.source.podlogs to work.
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - pods/log
+      - namespaces
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - "monitoring.grafana.com"
+    resources:
+      - podlogs
+    verbs:
+      - get
+      - list
+      - watch
+  # Rules which allow mimir.rules.kubernetes to work.
+  - apiGroups: ["monitoring.coreos.com"]
+    resources:
+      - prometheusrules
+    verbs:
+      - get
+      - list
+      - watch
+  - nonResourceURLs:
+      - /metrics
+    verbs:
+      - get
+  # Rules for prometheus.kubernetes.*
+  - apiGroups: ["monitoring.coreos.com"]
+    resources:
+      - podmonitors
+      - servicemonitors
+      - probes
+    verbs:
+      - get
+      - list
+      - watch
+  # Rules which allow eventhandler to work.
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - get
+      - list
+      - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
+  # needed for otelcol.processor.k8sattributes
+  - apiGroups: ["apps"]
+    resources: ["replicasets"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["extensions"]
+    resources: ["replicasets"]
+    verbs: ["get", "list", "watch"]
+---
+# Source: k8s-monitoring/charts/alloy-singleton/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: ko-alloy-singleton
+  labels:
+    helm.sh/chart: alloy-singleton-0.9.1
+    app.kubernetes.io/name: alloy-singleton
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+    app.kubernetes.io/component: rbac
+rules:
+  # Rules which allow discovery.kubernetes to function.
+  - apiGroups:
+      - ""
+      - "discovery.k8s.io"
+      - "networking.k8s.io"
+    resources:
+      - endpoints
+      - endpointslices
+      - ingresses
+      - nodes
+      - nodes/proxy
+      - nodes/metrics
+      - pods
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  # Rules which allow loki.source.kubernetes and loki.source.podlogs to work.
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - pods/log
+      - namespaces
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - "monitoring.grafana.com"
+    resources:
+      - podlogs
+    verbs:
+      - get
+      - list
+      - watch
+  # Rules which allow mimir.rules.kubernetes to work.
+  - apiGroups: ["monitoring.coreos.com"]
+    resources:
+      - prometheusrules
+    verbs:
+      - get
+      - list
+      - watch
+  - nonResourceURLs:
+      - /metrics
+    verbs:
+      - get
+  # Rules for prometheus.kubernetes.*
+  - apiGroups: ["monitoring.coreos.com"]
+    resources:
+      - podmonitors
+      - servicemonitors
+      - probes
+    verbs:
+      - get
+      - list
+      - watch
+  # Rules which allow eventhandler to work.
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - get
+      - list
+      - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
+  # needed for otelcol.processor.k8sattributes
+  - apiGroups: ["apps"]
+    resources: ["replicasets"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["extensions"]
+    resources: ["replicasets"]
+    verbs: ["get", "list", "watch"]
+---
+# Source: k8s-monitoring/charts/clusterMetrics/charts/kepler/templates/rolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kepler-clusterrole
+rules:
+  - apiGroups: [""]
+    resources:
+      - nodes/metrics # access /metrics/resource
+      - nodes/proxy
+      - nodes/stats
+      - pods
+    verbs:
+      - get
+      - watch
+      - list
+---
+# Source: k8s-monitoring/charts/clusterMetrics/charts/kube-state-metrics/templates/role.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:    
+    helm.sh/chart: kube-state-metrics-5.25.1
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: metrics
+    app.kubernetes.io/part-of: kube-state-metrics
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/instance: ko
+    app.kubernetes.io/version: "2.13.0"
+    release: ko
+  name: ko-kube-state-metrics
+rules:
+
+- apiGroups: ["certificates.k8s.io"]
+  resources:
+  - certificatesigningrequests
+  verbs: ["list", "watch"]
+
+- apiGroups: [""]
+  resources:
+  - configmaps
+  verbs: ["list", "watch"]
+
+- apiGroups: ["batch"]
+  resources:
+  - cronjobs
+  verbs: ["list", "watch"]
+
+- apiGroups: ["extensions", "apps"]
+  resources:
+  - daemonsets
+  verbs: ["list", "watch"]
+
+- apiGroups: ["extensions", "apps"]
+  resources:
+  - deployments
+  verbs: ["list", "watch"]
+
+- apiGroups: [""]
+  resources:
+  - endpoints
+  verbs: ["list", "watch"]
+
+- apiGroups: ["autoscaling"]
+  resources:
+  - horizontalpodautoscalers
+  verbs: ["list", "watch"]
+
+- apiGroups: ["extensions", "networking.k8s.io"]
+  resources:
+  - ingresses
+  verbs: ["list", "watch"]
+
+- apiGroups: ["batch"]
+  resources:
+  - jobs
+  verbs: ["list", "watch"]
+
+- apiGroups: ["coordination.k8s.io"]
+  resources:
+  - leases
+  verbs: ["list", "watch"]
+
+- apiGroups: [""]
+  resources:
+  - limitranges
+  verbs: ["list", "watch"]
+
+- apiGroups: ["admissionregistration.k8s.io"]
+  resources:
+    - mutatingwebhookconfigurations
+  verbs: ["list", "watch"]
+
+- apiGroups: [""]
+  resources:
+  - namespaces
+  verbs: ["list", "watch"]
+
+- apiGroups: ["networking.k8s.io"]
+  resources:
+  - networkpolicies
+  verbs: ["list", "watch"]
+
+- apiGroups: [""]
+  resources:
+  - nodes
+  verbs: ["list", "watch"]
+
+- apiGroups: [""]
+  resources:
+  - persistentvolumeclaims
+  verbs: ["list", "watch"]
+
+- apiGroups: [""]
+  resources:
+  - persistentvolumes
+  verbs: ["list", "watch"]
+
+- apiGroups: ["policy"]
+  resources:
+    - poddisruptionbudgets
+  verbs: ["list", "watch"]
+
+- apiGroups: [""]
+  resources:
+  - pods
+  verbs: ["list", "watch"]
+
+- apiGroups: ["extensions", "apps"]
+  resources:
+  - replicasets
+  verbs: ["list", "watch"]
+
+- apiGroups: [""]
+  resources:
+  - replicationcontrollers
+  verbs: ["list", "watch"]
+
+- apiGroups: [""]
+  resources:
+  - resourcequotas
+  verbs: ["list", "watch"]
+
+- apiGroups: [""]
+  resources:
+  - secrets
+  verbs: ["list", "watch"]
+
+- apiGroups: [""]
+  resources:
+  - services
+  verbs: ["list", "watch"]
+
+- apiGroups: ["apps"]
+  resources:
+  - statefulsets
+  verbs: ["list", "watch"]
+
+- apiGroups: ["storage.k8s.io"]
+  resources:
+    - storageclasses
+  verbs: ["list", "watch"]
+
+- apiGroups: ["admissionregistration.k8s.io"]
+  resources:
+    - validatingwebhookconfigurations
+  verbs: ["list", "watch"]
+
+- apiGroups: ["storage.k8s.io"]
+  resources:
+    - volumeattachments
+  verbs: ["list", "watch"]
+---
+# Source: k8s-monitoring/charts/alloy-logs/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: ko-alloy-logs
+  labels:
+    helm.sh/chart: alloy-logs-0.9.1
+    app.kubernetes.io/name: alloy-logs
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+    app.kubernetes.io/component: rbac
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: ko-alloy-logs
+subjects:
+  - kind: ServiceAccount
+    name: ko-alloy-logs
+    namespace: default
+---
+# Source: k8s-monitoring/charts/alloy-metrics/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: ko-alloy-metrics
+  labels:
+    helm.sh/chart: alloy-metrics-0.9.1
+    app.kubernetes.io/name: alloy-metrics
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+    app.kubernetes.io/component: rbac
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: ko-alloy-metrics
+subjects:
+  - kind: ServiceAccount
+    name: ko-alloy-metrics
+    namespace: default
+---
+# Source: k8s-monitoring/charts/alloy-profiles/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: ko-alloy-profiles
+  labels:
+    helm.sh/chart: alloy-profiles-0.9.1
+    app.kubernetes.io/name: alloy-profiles
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+    app.kubernetes.io/component: rbac
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: ko-alloy-profiles
+subjects:
+  - kind: ServiceAccount
+    name: ko-alloy-profiles
+    namespace: default
+---
+# Source: k8s-monitoring/charts/alloy-receiver/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: ko-alloy-receiver
+  labels:
+    helm.sh/chart: alloy-receiver-0.9.1
+    app.kubernetes.io/name: alloy-receiver
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+    app.kubernetes.io/component: rbac
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: ko-alloy-receiver
+subjects:
+  - kind: ServiceAccount
+    name: ko-alloy-receiver
+    namespace: default
+---
+# Source: k8s-monitoring/charts/alloy-singleton/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: ko-alloy-singleton
+  labels:
+    helm.sh/chart: alloy-singleton-0.9.1
+    app.kubernetes.io/name: alloy-singleton
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+    app.kubernetes.io/component: rbac
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: ko-alloy-singleton
+subjects:
+  - kind: ServiceAccount
+    name: ko-alloy-singleton
+    namespace: default
+---
+# Source: k8s-monitoring/charts/clusterMetrics/charts/kepler/templates/rolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kepler-clusterrole-binding
+roleRef:
+  kind: ClusterRole
+  name: kepler-clusterrole
+  apiGroup: "rbac.authorization.k8s.io"
+subjects:
+  - kind: ServiceAccount
+    name: ko-kepler
+    namespace: default
+---
+# Source: k8s-monitoring/charts/clusterMetrics/charts/kube-state-metrics/templates/clusterrolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:    
+    helm.sh/chart: kube-state-metrics-5.25.1
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: metrics
+    app.kubernetes.io/part-of: kube-state-metrics
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/instance: ko
+    app.kubernetes.io/version: "2.13.0"
+    release: ko
+  name: ko-kube-state-metrics
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: ko-kube-state-metrics
+subjects:
+- kind: ServiceAccount
+  name: ko-kube-state-metrics
+  namespace: default
+---
+# Source: k8s-monitoring/charts/alloy-logs/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: ko-alloy-logs
+  labels:
+    helm.sh/chart: alloy-logs-0.9.1
+    app.kubernetes.io/name: alloy-logs
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+    app.kubernetes.io/component: networking
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: alloy-logs
+    app.kubernetes.io/instance: ko
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http-metrics
+      port: 12345
+      targetPort: 12345
+      protocol: "TCP"
+---
+# Source: k8s-monitoring/charts/alloy-metrics/templates/cluster_service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: ko-alloy-metrics-cluster
+  labels:
+    helm.sh/chart: alloy-metrics-0.9.1
+    app.kubernetes.io/name: alloy-metrics
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+    app.kubernetes.io/component: networking
+spec:
+  type: ClusterIP
+  clusterIP: 'None'
+  publishNotReadyAddresses: true
+  selector:
+    app.kubernetes.io/name: alloy-metrics
+    app.kubernetes.io/instance: ko
+  ports:
+    # Do not include the -metrics suffix in the port name, otherwise metrics
+    # can be double-collected with the non-headless Service if it's also
+    # enabled.
+    #
+    # This service should only be used for clustering, and not metric
+    # collection.
+    - name: http
+      port: 12345
+      targetPort: 12345
+      protocol: "TCP"
+---
+# Source: k8s-monitoring/charts/alloy-metrics/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: ko-alloy-metrics
+  labels:
+    helm.sh/chart: alloy-metrics-0.9.1
+    app.kubernetes.io/name: alloy-metrics
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+    app.kubernetes.io/component: networking
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: alloy-metrics
+    app.kubernetes.io/instance: ko
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http-metrics
+      port: 12345
+      targetPort: 12345
+      protocol: "TCP"
+---
+# Source: k8s-monitoring/charts/alloy-profiles/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: ko-alloy-profiles
+  labels:
+    helm.sh/chart: alloy-profiles-0.9.1
+    app.kubernetes.io/name: alloy-profiles
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+    app.kubernetes.io/component: networking
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: alloy-profiles
+    app.kubernetes.io/instance: ko
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http-metrics
+      port: 12345
+      targetPort: 12345
+      protocol: "TCP"
+---
+# Source: k8s-monitoring/charts/alloy-receiver/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: ko-alloy-receiver
+  labels:
+    helm.sh/chart: alloy-receiver-0.9.1
+    app.kubernetes.io/name: alloy-receiver
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+    app.kubernetes.io/component: networking
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: alloy-receiver
+    app.kubernetes.io/instance: ko
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http-metrics
+      port: 12345
+      targetPort: 12345
+      protocol: "TCP"
+    - name: otlp-grpc
+      port: 4317
+      targetPort: 4317
+      protocol: TCP
+---
+# Source: k8s-monitoring/charts/alloy-singleton/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: ko-alloy-singleton
+  labels:
+    helm.sh/chart: alloy-singleton-0.9.1
+    app.kubernetes.io/name: alloy-singleton
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+    app.kubernetes.io/component: networking
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: alloy-singleton
+    app.kubernetes.io/instance: ko
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http-metrics
+      port: 12345
+      targetPort: 12345
+      protocol: "TCP"
+---
+# Source: k8s-monitoring/charts/clusterMetrics/charts/kepler/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: kepler
+  namespace: default
+  labels:
+    helm.sh/chart: kepler-0.5.9
+    app.kubernetes.io/name: kepler
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/version: "release-0.7.11"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 9102
+      targetPort: http
+      protocol: TCP
+  selector:
+    app.kubernetes.io/name: kepler
+    app.kubernetes.io/component: exporter
+---
+# Source: k8s-monitoring/charts/clusterMetrics/charts/kube-state-metrics/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: ko-kube-state-metrics
+  namespace: default
+  labels:    
+    helm.sh/chart: kube-state-metrics-5.25.1
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: metrics
+    app.kubernetes.io/part-of: kube-state-metrics
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/instance: ko
+    app.kubernetes.io/version: "2.13.0"
+    release: ko
+  annotations:
+spec:
+  type: "ClusterIP"
+  ports:
+  - name: "http"
+    protocol: TCP
+    port: 8080
+    targetPort: 8080
+  
+  selector:    
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/instance: ko
+---
+# Source: k8s-monitoring/charts/clusterMetrics/charts/node-exporter/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: ko-node-exporter
+  namespace: default
+  labels:
+    helm.sh/chart: node-exporter-4.39.0
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: metrics
+    app.kubernetes.io/part-of: node-exporter
+    app.kubernetes.io/name: node-exporter
+    app.kubernetes.io/instance: ko
+    app.kubernetes.io/version: "1.8.2"
+    release: ko
+  annotations:
+    prometheus.io/scrape: "true"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 9100
+      targetPort: 9100
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/name: node-exporter
+    app.kubernetes.io/instance: ko
+---
+# Source: k8s-monitoring/charts/clusterMetrics/charts/windows-exporter/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: ko-windows-exporter
+  namespace: default
+  labels:
+    helm.sh/chart: windows-exporter-0.5.1
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: metrics
+    app.kubernetes.io/part-of: windows-exporter
+    app.kubernetes.io/name: windows-exporter
+    app.kubernetes.io/instance: ko
+    app.kubernetes.io/version: "0.27.1"
+    release: ko
+  annotations:
+    prometheus.io/scrape: "true"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 9182
+      targetPort: metrics
+      protocol: TCP
+      appProtocol: http
+      name: metrics
+  selector:
+    app.kubernetes.io/name: windows-exporter
+    app.kubernetes.io/instance: ko
+---
+# Source: k8s-monitoring/charts/alloy-logs/templates/controllers/daemonset.yaml
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: ko-alloy-logs
+  labels:
+    helm.sh/chart: alloy-logs-0.9.1
+    app.kubernetes.io/name: alloy-logs
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+spec:
+  minReadySeconds: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: alloy-logs
+      app.kubernetes.io/instance: ko
+  template:
+    metadata:
+      annotations:
+        kubectl.kubernetes.io/default-container: alloy
+      labels:
+        app.kubernetes.io/name: alloy-logs
+        app.kubernetes.io/instance: ko
+    spec:
+      serviceAccountName: ko-alloy-logs
+      containers:
+        - name: alloy
+          image: docker.io/grafana/alloy:v1.4.2
+          imagePullPolicy: IfNotPresent
+          args:
+            - run
+            - /etc/alloy/config.alloy
+            - --storage.path=/tmp/alloy
+            - --server.http.listen-addr=0.0.0.0:12345
+            - --server.http.ui-path-prefix=/
+            - --stability.level=generally-available
+          env:
+            - name: ALLOY_DEPLOY_MODE
+              value: "helm"
+            - name: HOSTNAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+          ports:
+            - containerPort: 12345
+              name: http-metrics
+          readinessProbe:
+            httpGet:
+              path: /-/ready
+              port: 12345
+              scheme: HTTP
+            initialDelaySeconds: 10
+            timeoutSeconds: 1
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              add:
+              - CHOWN
+              - DAC_OVERRIDE
+              - FOWNER
+              - FSETID
+              - KILL
+              - SETGID
+              - SETUID
+              - SETPCAP
+              - NET_BIND_SERVICE
+              - NET_RAW
+              - SYS_CHROOT
+              - MKNOD
+              - AUDIT_WRITE
+              - SETFCAP
+              drop:
+              - ALL
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - name: config
+              mountPath: /etc/alloy
+            - name: varlog
+              mountPath: /var/log
+              readOnly: true
+            - name: dockercontainers
+              mountPath: /var/lib/docker/containers
+              readOnly: true
+        - name: config-reloader
+          image: ghcr.io/jimmidyson/configmap-reload:v0.12.0
+          args:
+            - --volume-dir=/etc/alloy
+            - --webhook-url=http://localhost:12345/-/reload
+          volumeMounts:
+            - name: config
+              mountPath: /etc/alloy
+          resources:
+            requests:
+              cpu: 1m
+              memory: 5Mi
+      dnsPolicy: ClusterFirst
+      nodeSelector:
+        kubernetes.io/os: linux
+      volumes:
+        - name: config
+          configMap:
+            name: ko-alloy-logs
+        - name: varlog
+          hostPath:
+            path: /var/log
+        - name: dockercontainers
+          hostPath:
+            path: /var/lib/docker/containers
+---
+# Source: k8s-monitoring/charts/alloy-profiles/templates/controllers/daemonset.yaml
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: ko-alloy-profiles
+  labels:
+    helm.sh/chart: alloy-profiles-0.9.1
+    app.kubernetes.io/name: alloy-profiles
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+spec:
+  minReadySeconds: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: alloy-profiles
+      app.kubernetes.io/instance: ko
+  template:
+    metadata:
+      annotations:
+        kubectl.kubernetes.io/default-container: alloy
+      labels:
+        app.kubernetes.io/name: alloy-profiles
+        app.kubernetes.io/instance: ko
+    spec:
+      serviceAccountName: ko-alloy-profiles
+      containers:
+        - name: alloy
+          image: docker.io/grafana/alloy:v1.4.2
+          imagePullPolicy: IfNotPresent
+          args:
+            - run
+            - /etc/alloy/config.alloy
+            - --storage.path=/tmp/alloy
+            - --server.http.listen-addr=0.0.0.0:12345
+            - --server.http.ui-path-prefix=/
+            - --stability.level=public-preview
+          env:
+            - name: ALLOY_DEPLOY_MODE
+              value: "helm"
+            - name: HOSTNAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+          ports:
+            - containerPort: 12345
+              name: http-metrics
+          readinessProbe:
+            httpGet:
+              path: /-/ready
+              port: 12345
+              scheme: HTTP
+            initialDelaySeconds: 10
+            timeoutSeconds: 1
+          securityContext:
+            privileged: true
+            runAsGroup: 0
+            runAsUser: 0
+          volumeMounts:
+            - name: config
+              mountPath: /etc/alloy
+        - name: config-reloader
+          image: ghcr.io/jimmidyson/configmap-reload:v0.12.0
+          args:
+            - --volume-dir=/etc/alloy
+            - --webhook-url=http://localhost:12345/-/reload
+          volumeMounts:
+            - name: config
+              mountPath: /etc/alloy
+          resources:
+            requests:
+              cpu: 1m
+              memory: 5Mi
+      hostPID: true
+      dnsPolicy: ClusterFirst
+      nodeSelector:
+        kubernetes.io/os: linux
+      tolerations:
+        - effect: NoSchedule
+          operator: Exists
+      volumes:
+        - name: config
+          configMap:
+            name: ko-alloy-profiles
+---
+# Source: k8s-monitoring/charts/alloy-receiver/templates/controllers/daemonset.yaml
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: ko-alloy-receiver
+  labels:
+    helm.sh/chart: alloy-receiver-0.9.1
+    app.kubernetes.io/name: alloy-receiver
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+spec:
+  minReadySeconds: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: alloy-receiver
+      app.kubernetes.io/instance: ko
+  template:
+    metadata:
+      annotations:
+        kubectl.kubernetes.io/default-container: alloy
+      labels:
+        app.kubernetes.io/name: alloy-receiver
+        app.kubernetes.io/instance: ko
+    spec:
+      serviceAccountName: ko-alloy-receiver
+      containers:
+        - name: alloy
+          image: docker.io/grafana/alloy:v1.4.2
+          imagePullPolicy: IfNotPresent
+          args:
+            - run
+            - /etc/alloy/config.alloy
+            - --storage.path=/tmp/alloy
+            - --server.http.listen-addr=0.0.0.0:12345
+            - --server.http.ui-path-prefix=/
+            - --stability.level=generally-available
+          env:
+            - name: ALLOY_DEPLOY_MODE
+              value: "helm"
+            - name: HOSTNAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+          ports:
+            - containerPort: 12345
+              name: http-metrics
+            - containerPort: 4317
+              name: otlp-grpc
+              protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /-/ready
+              port: 12345
+              scheme: HTTP
+            initialDelaySeconds: 10
+            timeoutSeconds: 1
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              add:
+              - CHOWN
+              - DAC_OVERRIDE
+              - FOWNER
+              - FSETID
+              - KILL
+              - SETGID
+              - SETUID
+              - SETPCAP
+              - NET_BIND_SERVICE
+              - NET_RAW
+              - SYS_CHROOT
+              - MKNOD
+              - AUDIT_WRITE
+              - SETFCAP
+              drop:
+              - ALL
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - name: config
+              mountPath: /etc/alloy
+        - name: config-reloader
+          image: ghcr.io/jimmidyson/configmap-reload:v0.12.0
+          args:
+            - --volume-dir=/etc/alloy
+            - --webhook-url=http://localhost:12345/-/reload
+          volumeMounts:
+            - name: config
+              mountPath: /etc/alloy
+          resources:
+            requests:
+              cpu: 1m
+              memory: 5Mi
+      dnsPolicy: ClusterFirst
+      nodeSelector:
+        kubernetes.io/os: linux
+      volumes:
+        - name: config
+          configMap:
+            name: ko-alloy-receiver
+---
+# Source: k8s-monitoring/charts/clusterMetrics/charts/kepler/templates/daemonset.yaml
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: kepler
+  namespace: default
+  labels:
+    helm.sh/chart: kepler-0.5.9
+    app.kubernetes.io/name: kepler
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/version: "release-0.7.11"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: kepler
+      app.kubernetes.io/component: exporter
+  template:
+    metadata:
+      annotations:
+        k8s.grafana.com/logs.job: integrations/kepler
+      labels:
+        app.kubernetes.io/name: kepler
+        app.kubernetes.io/component: exporter
+    spec:
+      hostNetwork: true
+      serviceAccountName: ko-kepler
+      containers:
+      - name: kepler-exporter
+        image: "quay.io/sustainable_computing_io/kepler:release-0.7.11"
+        imagePullPolicy: Always
+        securityContext:
+            privileged: true
+        args:
+          - -v=$(KEPLER_LOG_LEVEL)
+        env:
+          - name: NODE_IP
+            valueFrom:
+              fieldRef:
+                fieldPath: status.hostIP
+          - name: NODE_NAME
+            valueFrom:
+              fieldRef:
+                fieldPath: spec.nodeName
+          - name: METRIC_PATH
+            value: "/metrics"
+          - name: BIND_ADDRESS
+            value: "0.0.0.0:9102"
+          - name: "CGROUP_METRICS"
+            value: "*"
+          - name: "CPU_ARCH_OVERRIDE"
+            value: ""
+          - name: "ENABLE_EBPF_CGROUPID"
+            value: "true"
+          - name: "ENABLE_GPU"
+            value: "true"
+          - name: "ENABLE_PROCESS_METRICS"
+            value: "false"
+          - name: "ENABLE_QAT"
+            value: "false"
+          - name: "EXPOSE_CGROUP_METRICS"
+            value: "false"
+          - name: "EXPOSE_ESTIMATED_IDLE_POWER_METRICS"
+            value: "true"
+          - name: "EXPOSE_HW_COUNTER_METRICS"
+            value: "true"
+          - name: "EXPOSE_IRQ_COUNTER_METRICS"
+            value: "true"
+          - name: "KEPLER_LOG_LEVEL"
+            value: "1"
+        ports:
+        - containerPort: 9102
+          hostPort: 9102
+          name: http
+        livenessProbe:
+          failureThreshold: 5
+          httpGet:
+            path: /healthz
+            port: 9102
+            scheme: HTTP
+          initialDelaySeconds: 10
+          periodSeconds: 60
+          successThreshold: 1
+          timeoutSeconds: 10
+        volumeMounts:
+          - name: lib-modules
+            mountPath: /lib/modules
+          - name: tracing
+            mountPath: /sys
+          - name: proc
+            mountPath: /proc
+      volumes:
+        - name: lib-modules
+          hostPath:
+            path: /lib/modules
+            type: DirectoryOrCreate
+        - name: tracing
+          hostPath:
+            path: /sys
+            type: Directory
+        - name: proc
+          hostPath:
+            path: /proc
+            type: Directory
+      nodeSelector:
+        kubernetes.io/os: linux
+      tolerations:
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/control-plane
+---
+# Source: k8s-monitoring/charts/clusterMetrics/charts/node-exporter/templates/daemonset.yaml
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: ko-node-exporter
+  namespace: default
+  labels:
+    helm.sh/chart: node-exporter-4.39.0
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: metrics
+    app.kubernetes.io/part-of: node-exporter
+    app.kubernetes.io/name: node-exporter
+    app.kubernetes.io/instance: ko
+    app.kubernetes.io/version: "1.8.2"
+    release: ko
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: node-exporter
+      app.kubernetes.io/instance: ko
+  revisionHistoryLimit: 10
+  updateStrategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
+        k8s.grafana.com/logs.job: integrations/node_exporter
+      labels:
+        helm.sh/chart: node-exporter-4.39.0
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/component: metrics
+        app.kubernetes.io/part-of: node-exporter
+        app.kubernetes.io/name: node-exporter
+        app.kubernetes.io/instance: ko
+        app.kubernetes.io/version: "1.8.2"
+        release: ko
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65534
+        runAsNonRoot: true
+        runAsUser: 65534
+      serviceAccountName: ko-node-exporter
+      containers:
+        - name: node-exporter
+          image: quay.io/prometheus/node-exporter:v1.8.2
+          imagePullPolicy: IfNotPresent
+          args:
+            - --path.procfs=/host/proc
+            - --path.sysfs=/host/sys
+            - --path.rootfs=/host/root
+            - --path.udev.data=/host/root/run/udev/data
+            - --web.listen-address=[$(HOST_IP)]:9100
+          securityContext:
+            readOnlyRootFilesystem: true
+          env:
+            - name: HOST_IP
+              value: 0.0.0.0
+          ports:
+            - name: metrics
+              containerPort: 9100
+              protocol: TCP
+          livenessProbe:
+            failureThreshold: 3
+            httpGet:
+              httpHeaders:
+              path: /
+              port: 9100
+              scheme: HTTP
+            initialDelaySeconds: 0
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 1
+          readinessProbe:
+            failureThreshold: 3
+            httpGet:
+              httpHeaders:
+              path: /
+              port: 9100
+              scheme: HTTP
+            initialDelaySeconds: 0
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 1
+          volumeMounts:
+            - name: proc
+              mountPath: /host/proc
+              readOnly:  true
+            - name: sys
+              mountPath: /host/sys
+              readOnly: true
+            - name: root
+              mountPath: /host/root
+              mountPropagation: HostToContainer
+              readOnly: true
+      hostNetwork: true
+      hostPID: true
+      hostIPC: false
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: eks.amazonaws.com/compute-type
+                operator: NotIn
+                values:
+                - fargate
+      nodeSelector:
+        kubernetes.io/os: linux
+      tolerations:
+        - effect: NoSchedule
+          operator: Exists
+      volumes:
+        - name: proc
+          hostPath:
+            path: /proc
+        - name: sys
+          hostPath:
+            path: /sys
+        - name: root
+          hostPath:
+            path: /
+---
+# Source: k8s-monitoring/charts/clusterMetrics/charts/windows-exporter/templates/daemonset.yaml
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: ko-windows-exporter
+  namespace: default
+  labels:
+    helm.sh/chart: windows-exporter-0.5.1
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: metrics
+    app.kubernetes.io/part-of: windows-exporter
+    app.kubernetes.io/name: windows-exporter
+    app.kubernetes.io/instance: ko
+    app.kubernetes.io/version: "0.27.1"
+    release: ko
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: windows-exporter
+      app.kubernetes.io/instance: ko
+  updateStrategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
+        k8s.grafana.com/logs.job: integrations/windows_exporter
+      labels:
+        helm.sh/chart: windows-exporter-0.5.1
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/component: metrics
+        app.kubernetes.io/part-of: windows-exporter
+        app.kubernetes.io/name: windows-exporter
+        app.kubernetes.io/instance: ko
+        app.kubernetes.io/version: "0.27.1"
+        release: ko
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        windowsOptions:
+          hostProcess: true
+          runAsUserName: NT AUTHORITY\system
+      initContainers:
+        - name: configure-firewall
+          image: ghcr.io/prometheus-community/windows-exporter:0.27.1
+          command: [ "powershell" ]
+          args: [ "New-NetFirewallRule", "-DisplayName", "'windows-exporter'", "-Direction", "inbound", "-Profile", "Any", "-Action", "Allow", "-LocalPort", "9182", "-Protocol", "TCP" ]
+      serviceAccountName: ko-windows-exporter
+      containers:
+        - name: windows-exporter
+          image: ghcr.io/prometheus-community/windows-exporter:0.27.1
+          imagePullPolicy: IfNotPresent
+          args:
+            - --config.file=%CONTAINER_SANDBOX_MOUNT_POINT%/config.yml
+            - --collector.textfile.directories=%CONTAINER_SANDBOX_MOUNT_POINT%
+            - --web.listen-address=:9182
+          env:
+          ports:
+            - name: metrics
+              containerPort: 9182
+              protocol: TCP
+          livenessProbe:
+            failureThreshold: 3
+            httpGet:
+              httpHeaders:
+              path: /health
+              port: 9182
+              scheme: HTTP
+            initialDelaySeconds: 0
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 1
+          readinessProbe:
+            failureThreshold: 3
+            httpGet:
+              httpHeaders:
+              path: /health
+              port: 9182
+              scheme: HTTP
+            initialDelaySeconds: 0
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 1
+          volumeMounts:
+            - name: config
+              mountPath: /config.yml
+              subPath: config.yml
+      hostNetwork: true
+      hostPID: true
+      nodeSelector:
+        kubernetes.io/os: windows
+      tolerations:
+        - effect: NoSchedule
+          operator: Exists
+      volumes:
+        - name: config
+          configMap:
+            name: ko-windows-exporter
+---
+# Source: k8s-monitoring/charts/alloy-singleton/templates/controllers/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ko-alloy-singleton
+  labels:
+    helm.sh/chart: alloy-singleton-0.9.1
+    app.kubernetes.io/name: alloy-singleton
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+spec:
+  replicas: 1
+  minReadySeconds: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: alloy-singleton
+      app.kubernetes.io/instance: ko
+  template:
+    metadata:
+      annotations:
+        kubectl.kubernetes.io/default-container: alloy
+        k8s.grafana.com/logs.job: integrations/alloy
+      labels:
+        app.kubernetes.io/name: alloy-singleton
+        app.kubernetes.io/instance: ko
+    spec:
+      serviceAccountName: ko-alloy-singleton
+      containers:
+        - name: alloy
+          image: docker.io/grafana/alloy:v1.4.2
+          imagePullPolicy: IfNotPresent
+          args:
+            - run
+            - /etc/alloy/config.alloy
+            - --storage.path=/tmp/alloy
+            - --server.http.listen-addr=0.0.0.0:12345
+            - --server.http.ui-path-prefix=/
+            - --stability.level=generally-available
+          env:
+            - name: ALLOY_DEPLOY_MODE
+              value: "helm"
+            - name: HOSTNAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+          ports:
+            - containerPort: 12345
+              name: http-metrics
+          readinessProbe:
+            httpGet:
+              path: /-/ready
+              port: 12345
+              scheme: HTTP
+            initialDelaySeconds: 10
+            timeoutSeconds: 1
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              add:
+              - CHOWN
+              - DAC_OVERRIDE
+              - FOWNER
+              - FSETID
+              - KILL
+              - SETGID
+              - SETUID
+              - SETPCAP
+              - NET_BIND_SERVICE
+              - NET_RAW
+              - SYS_CHROOT
+              - MKNOD
+              - AUDIT_WRITE
+              - SETFCAP
+              drop:
+              - ALL
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - name: config
+              mountPath: /etc/alloy
+        - name: config-reloader
+          image: ghcr.io/jimmidyson/configmap-reload:v0.12.0
+          args:
+            - --volume-dir=/etc/alloy
+            - --webhook-url=http://localhost:12345/-/reload
+          volumeMounts:
+            - name: config
+              mountPath: /etc/alloy
+          resources:
+            requests:
+              cpu: 1m
+              memory: 5Mi
+      dnsPolicy: ClusterFirst
+      nodeSelector:
+        kubernetes.io/os: linux
+      volumes:
+        - name: config
+          configMap:
+            name: ko-alloy-singleton
+---
+# Source: k8s-monitoring/charts/clusterMetrics/charts/kube-state-metrics/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ko-kube-state-metrics
+  namespace: default
+  labels:    
+    helm.sh/chart: kube-state-metrics-5.25.1
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/component: metrics
+    app.kubernetes.io/part-of: kube-state-metrics
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/instance: ko
+    app.kubernetes.io/version: "2.13.0"
+    release: ko
+spec:
+  selector:
+    matchLabels:      
+      app.kubernetes.io/name: kube-state-metrics
+      app.kubernetes.io/instance: ko
+  replicas: 1
+  strategy:
+    type: Recreate
+  revisionHistoryLimit: 10
+  template:
+    metadata:
+      labels:        
+        helm.sh/chart: kube-state-metrics-5.25.1
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/component: metrics
+        app.kubernetes.io/part-of: kube-state-metrics
+        app.kubernetes.io/name: kube-state-metrics
+        app.kubernetes.io/instance: ko
+        app.kubernetes.io/version: "2.13.0"
+        release: ko
+    spec:
+      automountServiceAccountToken: true
+      hostNetwork: false
+      serviceAccountName: ko-kube-state-metrics
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65534
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - name: kube-state-metrics
+        args:
+        - --port=8080
+        - --resources=certificatesigningrequests,configmaps,cronjobs,daemonsets,deployments,endpoints,horizontalpodautoscalers,ingresses,jobs,leases,limitranges,mutatingwebhookconfigurations,namespaces,networkpolicies,nodes,persistentvolumeclaims,persistentvolumes,poddisruptionbudgets,pods,replicasets,replicationcontrollers,resourcequotas,secrets,services,statefulsets,storageclasses,validatingwebhookconfigurations,volumeattachments
+        - --metric-labels-allowlist=nodes=[agentpool,alpha.eksctl.io/cluster-name,alpha.eksctl.io/nodegroup-name,beta.kubernetes.io/instance-type,cloud.google.com/gke-nodepool,cluster_name,ec2_amazonaws_com_Name,ec2_amazonaws_com_aws_autoscaling_groupName,ec2_amazonaws_com_aws_autoscaling_group_name,ec2_amazonaws_com_name,eks_amazonaws_com_nodegroup,k8s_io_cloud_provider_aws,karpenter.sh/nodepool,kubernetes.azure.com/cluster,kubernetes.io/arch,kubernetes.io/hostname,kubernetes.io/os,node.kubernetes.io/instance-type,topology.kubernetes.io/region,topology.kubernetes.io/zone]
+        imagePullPolicy: IfNotPresent
+        image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.13.0
+        ports:
+        - containerPort: 8080
+          name: "http"
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            httpHeaders:
+            path: /livez
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 5
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            httpHeaders:
+            path: /readyz
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 5
+        resources:
+          {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+      nodeSelector:
+        kubernetes.io/os: linux
+---
+# Source: k8s-monitoring/charts/alloy-metrics/templates/controllers/statefulset.yaml
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: ko-alloy-metrics
+  labels:
+    helm.sh/chart: alloy-metrics-0.9.1
+    app.kubernetes.io/name: alloy-metrics
+    app.kubernetes.io/instance: ko
+    
+    app.kubernetes.io/version: "v1.4.2"
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: alloy
+spec:
+  replicas: 1
+  podManagementPolicy: Parallel
+  minReadySeconds: 10
+  serviceName: ko-alloy-metrics
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: alloy-metrics
+      app.kubernetes.io/instance: ko
+  template:
+    metadata:
+      annotations:
+        kubectl.kubernetes.io/default-container: alloy
+        k8s.grafana.com/logs.job: integrations/alloy
+      labels:
+        app.kubernetes.io/name: alloy-metrics
+        app.kubernetes.io/instance: ko
+    spec:
+      serviceAccountName: ko-alloy-metrics
+      containers:
+        - name: alloy
+          image: docker.io/grafana/alloy:v1.4.2
+          imagePullPolicy: IfNotPresent
+          args:
+            - run
+            - /etc/alloy/config.alloy
+            - --storage.path=/tmp/alloy
+            - --server.http.listen-addr=0.0.0.0:12345
+            - --server.http.ui-path-prefix=/
+            - --cluster.enabled=true
+            - --cluster.join-addresses=ko-alloy-metrics-cluster
+            - --cluster.name="alloy-metrics"
+            - --stability.level=generally-available
+          env:
+            - name: ALLOY_DEPLOY_MODE
+              value: "helm"
+            - name: HOSTNAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+          ports:
+            - containerPort: 12345
+              name: http-metrics
+          readinessProbe:
+            httpGet:
+              path: /-/ready
+              port: 12345
+              scheme: HTTP
+            initialDelaySeconds: 10
+            timeoutSeconds: 1
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              add:
+              - CHOWN
+              - DAC_OVERRIDE
+              - FOWNER
+              - FSETID
+              - KILL
+              - SETGID
+              - SETUID
+              - SETPCAP
+              - NET_BIND_SERVICE
+              - NET_RAW
+              - SYS_CHROOT
+              - MKNOD
+              - AUDIT_WRITE
+              - SETFCAP
+              drop:
+              - ALL
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - name: config
+              mountPath: /etc/alloy
+        - name: config-reloader
+          image: ghcr.io/jimmidyson/configmap-reload:v0.12.0
+          args:
+            - --volume-dir=/etc/alloy
+            - --webhook-url=http://localhost:12345/-/reload
+          volumeMounts:
+            - name: config
+              mountPath: /etc/alloy
+          resources:
+            requests:
+              cpu: 1m
+              memory: 5Mi
+      dnsPolicy: ClusterFirst
+      nodeSelector:
+        kubernetes.io/os: linux
+      volumes:
+        - name: config
+          configMap:
+            name: ko-alloy-metrics
diff --git a/charts/k8s-monitoring/docs/examples/features/all-features/values.yaml b/charts/k8s-monitoring/docs/examples/features/all-features/values.yaml
new file mode 100644
index 000000000..87a242d6f
--- /dev/null
+++ b/charts/k8s-monitoring/docs/examples/features/all-features/values.yaml
@@ -0,0 +1,54 @@
+---
+cluster:
+  name: all-features-cluster
+
+destinations:
+  - name: otlpGateway
+    type: otlp
+    url: https://otlp.example.com:4317/v1/traces
+    auth:
+      type: basic
+      username: "my-username"
+      password: "my-password"
+    metrics: { enabled: true }
+    logs:    { enabled: true }
+    traces:  { enabled: true }
+  - name: pyroscope
+    type: pyroscope
+    url: http://pyroscope.example.com
+
+# Features
+clusterMetrics:
+  enabled: true
+  kepler: { enabled: true }
+clusterEvents: { enabled: true }
+
+podLogs: { enabled: true }
+applicationObservability:
+  enabled: true
+  receivers:
+    grpc:
+      enabled: true
+annotationAutodiscovery: { enabled: true }
+prometheusOperatorObjects: { enabled: true }
+profiling: { enabled: true }
+integrations:
+  alloy:
+    instances:
+      - name: alloy
+
+# Collectors
+alloy-metrics: { enabled: true }
+
+alloy-logs: { enabled: true }
+
+alloy-singleton: { enabled: true }
+alloy-receiver:
+  enabled: true
+  alloy:
+    extraPorts:
+      - name: otlp-grpc
+        port: 4317
+        targetPort: 4317
+        protocol: TCP
+alloy-profiles: { enabled: true }
\ No newline at end of file

From 97d017839f72a099d4b9c3e90df48b8054cff198 Mon Sep 17 00:00:00 2001
From: Pete Wall <pete.wall@grafana.com>
Date: Wed, 30 Oct 2024 09:14:31 -0500
Subject: [PATCH 2/6] Set scanner version

Signed-off-by: Pete Wall <pete.wall@grafana.com>
---
 .github/workflows/security-scans.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/security-scans.yml b/.github/workflows/security-scans.yml
index 24f9daa2d..ea96cfe1a 100644
--- a/.github/workflows/security-scans.yml
+++ b/.github/workflows/security-scans.yml
@@ -36,7 +36,7 @@ jobs:
           yq -r -o json '. | select(.kind=="Job") | .spec.template.spec.containers[].image' "${file}" > images.txt
           yq -r -o json '. | select(.kind=="Pod") | .spec.containers[].image' "${file}" > images.txt
           yq -r -o json '. | select(.kind=="StatefulSet") | .spec.template.spec.containers[].image' "${file}" > images.txt
-          echo "images=$(cat images.txt | sort --unique | jq --raw-input --slurp --compact-output 'split("\n") | map(select(. != ""))')" >> "${GITHUB_OUTPUT}"
+          echo "images=$(sort --unique < images.txt | jq --raw-input --slurp --compact-output 'split("\n") | map(select(. != ""))')" >> "${GITHUB_OUTPUT}"
 
   scan-container-images:
     name: Scan Container Images
@@ -48,7 +48,7 @@ jobs:
       fail-fast: false
     steps:
       - name: Run Trivy
-        uses: aquasecurity/trivy-action
+        uses: aquasecurity/trivy-action@v0.28
         with:
           image-ref: ${{ matrix.image }}
           format: sarif

From e294aa666f589f7dd14ebdf026fa74b548bcc0b1 Mon Sep 17 00:00:00 2001
From: Pete Wall <pete.wall@grafana.com>
Date: Wed, 30 Oct 2024 09:21:25 -0500
Subject: [PATCH 3/6] Use the install yq action to do the right one

Signed-off-by: Pete Wall <pete.wall@grafana.com>
---
 .github/workflows/security-scans.yml | 8 +-------
 .github/workflows/test-v1.yml        | 8 +-------
 2 files changed, 2 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/security-scans.yml b/.github/workflows/security-scans.yml
index ea96cfe1a..4665f05d0 100644
--- a/.github/workflows/security-scans.yml
+++ b/.github/workflows/security-scans.yml
@@ -18,14 +18,8 @@ jobs:
     outputs:
       images: ${{ steps.list_images.outputs.images }}
     steps:
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: '3.9'
-          check-latest: true
-
       - name: Install yq
-        run: pip install yq
+        uses: dcarbone/install-yq-action@v1.1.1
 
       - name: List Container Images
         id: list_images
diff --git a/.github/workflows/test-v1.yml b/.github/workflows/test-v1.yml
index 7ac6c4016..2934d3564 100644
--- a/.github/workflows/test-v1.yml
+++ b/.github/workflows/test-v1.yml
@@ -80,17 +80,11 @@ jobs:
       - name: Install Helm
         uses: azure/setup-helm@v4
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: '3.9'
-          check-latest: true
-
       - name: Set up chart-testing
         uses: helm/chart-testing-action@v2
 
       - name: Install yq
-        run: pip install yq
+        uses: dcarbone/install-yq-action@v1.1.1
 
       - name: Install ShellSpec
         run: |

From 634f86437347a878397873cb704cef54d19bd2e1 Mon Sep 17 00:00:00 2001
From: Pete Wall <pete.wall@grafana.com>
Date: Wed, 30 Oct 2024 09:22:30 -0500
Subject: [PATCH 4/6] Need to checkout

Signed-off-by: Pete Wall <pete.wall@grafana.com>
---
 .github/workflows/security-scans.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/security-scans.yml b/.github/workflows/security-scans.yml
index 4665f05d0..871d299e5 100644
--- a/.github/workflows/security-scans.yml
+++ b/.github/workflows/security-scans.yml
@@ -18,6 +18,9 @@ jobs:
     outputs:
       images: ${{ steps.list_images.outputs.images }}
     steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
       - name: Install yq
         uses: dcarbone/install-yq-action@v1.1.1
 

From 9041cbe2e7fc73b2c1c452f62c924af4800d73e1 Mon Sep 17 00:00:00 2001
From: Pete Wall <pete.wall@grafana.com>
Date: Wed, 30 Oct 2024 09:24:18 -0500
Subject: [PATCH 5/6] More image scanning fixes

Signed-off-by: Pete Wall <pete.wall@grafana.com>
---
 .github/workflows/security-scans.yml | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/security-scans.yml b/.github/workflows/security-scans.yml
index 871d299e5..d017c0253 100644
--- a/.github/workflows/security-scans.yml
+++ b/.github/workflows/security-scans.yml
@@ -28,11 +28,12 @@ jobs:
         id: list_images
         run: |
           file=charts/k8s-monitoring/docs/examples/features/all-features/output.yaml
-          yq -r -o json '. | select(.kind=="DaemonSet") | .spec.template.spec.containers[].image' "${file}" > images.txt
-          yq -r -o json '. | select(.kind=="Deployment") | .spec.template.spec.containers[].image' "${file}" > images.txt
-          yq -r -o json '. | select(.kind=="Job") | .spec.template.spec.containers[].image' "${file}" > images.txt
-          yq -r -o json '. | select(.kind=="Pod") | .spec.containers[].image' "${file}" > images.txt
-          yq -r -o json '. | select(.kind=="StatefulSet") | .spec.template.spec.containers[].image' "${file}" > images.txt
+          touch images.txt
+          yq -r -o json '. | select(.kind=="DaemonSet") | .spec.template.spec.containers[].image' "${file}" >> images.txt
+          yq -r -o json '. | select(.kind=="Deployment") | .spec.template.spec.containers[].image' "${file}" >> images.txt
+          yq -r -o json '. | select(.kind=="Job") | .spec.template.spec.containers[].image' "${file}" >> images.txt
+          yq -r -o json '. | select(.kind=="Pod") | .spec.containers[].image' "${file}" >> images.txt
+          yq -r -o json '. | select(.kind=="StatefulSet") | .spec.template.spec.containers[].image' "${file}" >> images.txt
           echo "images=$(sort --unique < images.txt | jq --raw-input --slurp --compact-output 'split("\n") | map(select(. != ""))')" >> "${GITHUB_OUTPUT}"
 
   scan-container-images:
@@ -45,7 +46,7 @@ jobs:
       fail-fast: false
     steps:
       - name: Run Trivy
-        uses: aquasecurity/trivy-action@v0.28
+        uses: aquasecurity/trivy-action@0.28.0
         with:
           image-ref: ${{ matrix.image }}
           format: sarif

From c291fdc1ea99c2db3f7222d3abb75edb672f8c2f Mon Sep 17 00:00:00 2001
From: Pete Wall <pete.wall@grafana.com>
Date: Wed, 30 Oct 2024 09:30:45 -0500
Subject: [PATCH 6/6] Set GH token for setup

Signed-off-by: Pete Wall <pete.wall@grafana.com>
---
 .github/workflows/security-scans.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/security-scans.yml b/.github/workflows/security-scans.yml
index d017c0253..28a53f7d1 100644
--- a/.github/workflows/security-scans.yml
+++ b/.github/workflows/security-scans.yml
@@ -48,6 +48,7 @@ jobs:
       - name: Run Trivy
         uses: aquasecurity/trivy-action@0.28.0
         with:
+          token-setup-trivy: ${{ secrets.GITHUB_TOKEN }}
           image-ref: ${{ matrix.image }}
           format: sarif
           output: trivy-results.sarif