# promtail-values-simple.yaml
# Simplified configuration for Promtail

# Loki client configuration
config:
  clients:
    - url: http://loki:3100/loki/api/v1/push

  server:
    http_listen_port: 3101

  positions:
    filename: /tmp/positions.yaml

  scrape_configs:
    # Monitor only default and microservices namespaces
    - job_name: kubernetes-pods
      kubernetes_sd_configs:
        - role: pod
      pipeline_stages:
        - cri: {}
      relabel_configs:
        - source_labels:
            - __meta_kubernetes _pod_name
          regex: (.+)
          target_label: __tmp_container_name

        - source_labels:
            - __meta_kubernetes_namespace
          target_label: namespace

        - source_labels:
            - __meta_kubernetes_pod_name
          target_label: pod

        - source_labels:
            - __meta_kubernetes_pod_container_name
          target_label: container

        - source_labels:
            - __meta_kubernetes_pod_node_name
          target_label: node_name

        - source_labels:
            - __meta_kubernetes_pod_label_app
          target_label: app

        - source_labels:
            - __meta_kubernetes_pod_label_app_kubernetes_io_name
          target_label: service

        # Skip POD containers
        - source_labels:
            - __meta_kubernetes_pod_container_name
          regex: POD
          action: drop

        # Build log path
        - replacement: /var/log/pods/*$1/*.log
          separator: /
          source_labels:
            - __meta_kubernetes_pod_uid
            - __meta_kubernetes_pod_container_name
          target_label: __path__

# Resources
resources:
  limits:
    cpu: 200m
    memory: 256Mi
  requests:
    cpu: 100m
    memory: 128Mi

# Tolerations to run on all nodes
tolerations:
  - effect: NoSchedule
    key: node-role.kubernetes.io/control-plane
    operator: Exists
  - effect: NoSchedule
    key: node-role.kubernetes.io/master
    operator: Exists

# Service account
serviceAccount:
  create: true

# RBAC
rbac:
  create: true
  pspEnabled: false

# Security context
securityContext:
  readOnlyRootFilesystem: true
  capabilities:
    drop:
      - ALL
  allowPrivilegeEscalation: false

# Pod security context
podSecurityContext:
  runAsUser: 0
  runAsGroup: 0
  fsGroup: 0