Observability Options

Options for: prometheus, grafana, loki, tempo, otel-collector.

All options are under lab.clusters.<name>.components.

grafana.adminCredentialsSecret

Existing secret with admin-user and admin-password keys

Type: null or string

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.chart

Grafana Helm chart derivation (default: cataCharts.grafana)

Type: package

Default: <derivation helm-chart-https-grafana.github.io-helm-charts-grafana-10.5.15>

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.datasources.loki.url

Loki URL. Auto-configured from components.loki.ref when null and Loki is enabled.

Type: null or string

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.datasources.prometheus.url

Prometheus URL. Auto-configured from components.prometheus.ref when null and Prometheus is enabled.

Type: null or string

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.datasources.tempo.url

Tempo URL. Auto-configured from components.tempo.ref when null and Tempo is enabled.

Type: null or string

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.domain

Domain for Grafana external access

Type: string

Default: "grafana.local"

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.enable

Whether to enable Grafana.

Type: boolean

Default: false

Example: true

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.gateway.enable

Enable HTTPRoute for external access via Gateway API

Type: boolean

Default: true

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.gateway.gatewayNamespace

Namespace of the Gateway resource

Type: null or string

Default: "kube-system"

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.gateway.gatewayRef

Name of the Gateway resource to attach to

Type: string

Default: "default-gateway"

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.namespace

Namespace for Grafana

Type: string

Default: "grafana"

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.oidc.allowSignUp

Allow OIDC users to be created on first login

Type: boolean

Default: true

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.oidc.autoLogin

Automatically redirect to OIDC provider (skip login page)

Type: boolean

Default: false

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.oidc.clientId

OAuth2 client ID

Type: string

Default: "grafana"

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.oidc.clientSecretRef

Reference to Secret containing OIDC client secret

Type: null or (submodule)

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.oidc.clientSecretRef.key

Key within the secret

Type: string

Default: "client-secret"

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.oidc.clientSecretRef.name

Secret containing OIDC client secret

Type: string

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.oidc.enable

Whether to enable OIDC authentication via Kanidm.

Type: boolean

Default: false

Example: true

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.oidc.issuerUrl

OIDC issuer URL (e.g., from Kanidm ref)

Type: string

Default: ""

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.oidc.name

Display name for OIDC provider on login page

Type: string

Default: "Kanidm"

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.oidc.roleAttributePath

JMESPath expression for mapping OIDC claims to Grafana roles

Type: string

Default:

"contains(groups[*], 'grafana-admins') && 'Admin' || contains(groups[*], 'grafana-editors') && 'Editor' || 'Viewer'"

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.oidc.scopes

OIDC scopes to request

Type: list of string

Default:

[
  "openid"
  "email"
  "profile"
  "groups"
]

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.oidc.tlsCaBundleConfigMap

ConfigMap containing CA bundle for OIDC provider (from trust-manager)

Type: null or (submodule)

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.oidc.tlsCaBundleConfigMap.key

Key within the ConfigMap

Type: string

Default: "ca.crt"

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.oidc.tlsCaBundleConfigMap.name

ConfigMap containing CA bundle

Type: string

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.oidc.tlsCaCertSecretRef

Reference to Secret containing CA certificate for OIDC provider

Type: null or (submodule)

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.oidc.tlsCaCertSecretRef.key

Key within the secret

Type: string

Default: "ca.crt"

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.oidc.tlsCaCertSecretRef.name

Secret containing CA certificate

Type: string

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.oidc.tlsSkipVerify

Skip TLS certificate verification for OIDC provider

Type: boolean

Default: false

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.persistence.enable

Enable persistent storage for Grafana

Type: boolean

Default: true

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.persistence.size

PVC size for Grafana data

Type: string

Default: "10Gi"

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.persistence.storageClass

Storage class for PVC

Type: null or string

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.phase

Deployment phase this component belongs to

Type: string

Default: "infrastructure"

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.plugins

Grafana plugins to install (e.g., grafana-tempoexplore-app)

Type: list of string

Default: [ ]

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.ref

Computed references for Grafana

Type: attribute set

Default: { }

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.replicas

Number of Grafana replicas

Type: positive integer, meaning >0

Default: 1

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.sidecar.dashboards.enable

Enable sidecar for auto-loading dashboards from ConfigMaps

Type: boolean

Default: true

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.sidecar.dashboards.searchNamespace

Namespace(s) to search for dashboard ConfigMaps. null = own namespace, ‘ALL’ = all namespaces.

Type: null or string

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.tls.issuerRef

cert-manager issuer reference for Grafana TLS certificate

Type: null or (submodule)

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.tls.issuerRef.kind

Issuer kind

Type: string

Default: "ClusterIssuer"

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.tls.issuerRef.name

Issuer or ClusterIssuer name

Type: string

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.tls.secretName

Name of the TLS Secret created by cert-manager

Type: string

Default: "grafana-tls"

Declared in: modules/lab/cluster/components/observability/grafana.nix

grafana.version

Grafana Helm chart version

Type: string

Default: "8.5.2"

Declared in: modules/lab/cluster/components/observability/grafana.nix

loki.chart

Loki Helm chart derivation (default: cataCharts.loki)

Type: package

Default: <derivation helm-chart-https-grafana.github.io-helm-charts-loki-6.30.1>

Declared in: modules/lab/cluster/components/observability/loki.nix

loki.deploymentMode

Loki deployment topology

Type: one of "SingleBinary", "SimpleScalable", "Distributed"

Default: "SingleBinary"

Declared in: modules/lab/cluster/components/observability/loki.nix

loki.enable

Whether to enable Loki log aggregation.

Type: boolean

Default: false

Example: true

Declared in: modules/lab/cluster/components/observability/loki.nix

loki.namespace

Namespace for Loki

Type: string

Default: "loki"

Declared in: modules/lab/cluster/components/observability/loki.nix

loki.phase

Deployment phase this component belongs to

Type: string

Default: "infrastructure"

Declared in: modules/lab/cluster/components/observability/loki.nix

loki.ref

Computed references for Loki

Type: attribute set

Default: { }

Declared in: modules/lab/cluster/components/observability/loki.nix

loki.replicas

Replicas (SingleBinary mode) or read/write replicas (SimpleScalable)

Type: positive integer, meaning >0

Default: 1

Declared in: modules/lab/cluster/components/observability/loki.nix

loki.retention

Log retention period (default 31 days)

Type: string

Default: "744h"

Declared in: modules/lab/cluster/components/observability/loki.nix

loki.storage.persistence.size

PVC size for local storage (filesystem mode)

Type: string

Default: "50Gi"

Declared in: modules/lab/cluster/components/observability/loki.nix

loki.storage.persistence.storageClass

Storage class for PVCs

Type: null or string

Declared in: modules/lab/cluster/components/observability/loki.nix

loki.storage.s3.bucket

S3 bucket name

Type: string

Default: "loki-chunks"

Declared in: modules/lab/cluster/components/observability/loki.nix

loki.storage.s3.endpoint

S3 endpoint URL (for S3-compatible storage). Use config.components.seaweedfs.ref.s3Endpoint for SeaweedFS.

Type: null or string

Declared in: modules/lab/cluster/components/observability/loki.nix

loki.storage.s3.region

S3 region

Type: string

Default: "us-east-1"

Declared in: modules/lab/cluster/components/observability/loki.nix

loki.storage.s3.secretName

Secret with S3 credentials (access-key-id, secret-access-key keys)

Type: null or string

Declared in: modules/lab/cluster/components/observability/loki.nix

loki.storage.type

Storage backend type

Type: one of "filesystem", "s3"

Default: "filesystem"

Declared in: modules/lab/cluster/components/observability/loki.nix

loki.version

Loki Helm chart version

Type: string

Default: "6.16.0"

Declared in: modules/lab/cluster/components/observability/loki.nix

otel-collector.agent.enable

Whether to enable OTEL agent (DaemonSet for log collection).

Type: boolean

Default: false

Example: true

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.agent.excludeNamespaces

Namespaces to exclude from log collection (otel namespace auto-excluded)

Type: list of string

Default: [ ]

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.agent.gateway.endpoint

Gateway OTLP endpoint (defaults to local gateway if not set)

Type: null or string

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.agent.namespaces

Namespaces to collect logs from (empty = all namespaces)

Type: list of string

Default: [ ]

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.agent.resources.limits.cpu

This option has no description.

Type: string

Default: "200m"

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.agent.resources.limits.memory

This option has no description.

Type: string

Default: "256Mi"

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.agent.resources.requests.cpu

This option has no description.

Type: string

Default: "50m"

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.agent.resources.requests.memory

This option has no description.

Type: string

Default: "128Mi"

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.chart

OpenTelemetry Collector Helm chart derivation

Type: package

Default:

<derivation helm-chart-https-open-telemetry.github.io-opentelemetry-helm-charts-opentelemetry-collector-0.156.0>

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.enable

Whether to enable OpenTelemetry Collector.

Type: boolean

Default: false

Example: true

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.exporters.loki.enable

This option has no description.

Type: boolean

Default: false

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.exporters.loki.endpoint

This option has no description.

Type: string

Default: ""

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.exporters.otlp.endpoint

OTLP gRPC endpoint for traces/metrics/logs (e.g., host:4317)

Type: null or string

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.exporters.otlphttp.endpoint

OTLP HTTP endpoint for traces/metrics/logs (e.g., http://host:4318)

Type: null or string

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.exporters.prometheus.enable

This option has no description.

Type: boolean

Default: false

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.exporters.prometheus.endpoint

This option has no description.

Type: string

Default: ""

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.gateway.enable

Whether to enable OTEL gateway (Deployment for receiving/forwarding).

Type: boolean

Default: false

Example: true

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.gateway.external.domain

Domain for external access

Type: null or string

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.gateway.external.enable

Whether to enable Expose gateway externally.

Type: boolean

Default: false

Example: true

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.gateway.external.tls.issuerRef

cert-manager issuer for the external gateway TLS certificate

Type: null or (submodule)

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.gateway.external.tls.issuerRef.kind

This option has no description.

Type: string

Default: "ClusterIssuer"

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.gateway.external.tls.issuerRef.name

This option has no description.

Type: string

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.gateway.external.tls.secretName

This option has no description.

Type: string

Default: "otel-gateway-tls"

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.gateway.replicas

Number of gateway replicas

Type: positive integer, meaning >0

Default: 1

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.gateway.resources.limits.cpu

This option has no description.

Type: string

Default: "500m"

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.gateway.resources.limits.memory

This option has no description.

Type: string

Default: "512Mi"

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.gateway.resources.requests.cpu

This option has no description.

Type: string

Default: "100m"

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.gateway.resources.requests.memory

This option has no description.

Type: string

Default: "256Mi"

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.namespace

Namespace for OpenTelemetry Collector

Type: string

Default: "otel"

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.phase

Deployment phase this component belongs to

Type: string

Default: "infrastructure"

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.ports.otlpGrpc

This option has no description.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default: 4317

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.ports.otlpHttp

This option has no description.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default: 4318

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.ports.prometheus

This option has no description.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default: 8889

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.ref

Computed references for the OpenTelemetry Collector

Type: attribute set

Default: { }

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.tls.caBundleConfigMap

ConfigMap containing the CA bundle for TLS verification on gateway exporters. When null, exporters use tls.insecure=true.

Type: null or string

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.tls.caBundleKey

Key within the CA bundle ConfigMap

Type: string

Default: "ca.crt"

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

otel-collector.version

OpenTelemetry Collector Helm chart version

Type: string

Default: "0.96.0"

Declared in: modules/lab/cluster/components/observability/otel-collector.nix

prometheus.alertmanager.enable

Enable Alertmanager

Type: boolean

Default: true

Declared in: modules/lab/cluster/components/observability/prometheus.nix

prometheus.chart

kube-prometheus-stack Helm chart derivation (default: cataCharts.prometheus)

Type: package

Default:

<derivation helm-chart-https-prometheus-community.github.io-helm-charts-kube-prometheus-stack-72.5.0>

Declared in: modules/lab/cluster/components/observability/prometheus.nix

prometheus.defaultRules

Override default alert rule groups (e.g., { kubeEtcd = false; } to disable etcd rules)

Type: attribute set of boolean

Default: { }

Declared in: modules/lab/cluster/components/observability/prometheus.nix

prometheus.enable

Whether to enable Prometheus (kube-prometheus-stack).

Type: boolean

Default: false

Example: true

Declared in: modules/lab/cluster/components/observability/prometheus.nix

prometheus.externalLabels

External labels added to all metrics (e.g., cluster name for multi-cluster)

Type: attribute set of string

Default: { }

Declared in: modules/lab/cluster/components/observability/prometheus.nix

prometheus.gateway.domain

Domain for external remote-write ingestion

Type: string

Default: ""

Declared in: modules/lab/cluster/components/observability/prometheus.nix

prometheus.gateway.enable

Expose Prometheus remote-write endpoint externally via Gateway API

Type: boolean

Default: false

Declared in: modules/lab/cluster/components/observability/prometheus.nix

prometheus.gateway.gatewayNamespace

This option has no description.

Type: null or string

Default: "kube-system"

Declared in: modules/lab/cluster/components/observability/prometheus.nix

prometheus.gateway.gatewayRef

This option has no description.

Type: string

Default: "default-gateway"

Declared in: modules/lab/cluster/components/observability/prometheus.nix

prometheus.grafana.enable

Enable the bundled Grafana (disable when using components.grafana)

Type: boolean

Default: false

Declared in: modules/lab/cluster/components/observability/prometheus.nix

prometheus.grafana.forceDeployDashboards

Deploy Kubernetes dashboard ConfigMaps even when bundled Grafana is disabled

Type: boolean

Default: false

Declared in: modules/lab/cluster/components/observability/prometheus.nix

prometheus.kubeStateMetrics.enable

Enable kube-state-metrics

Type: boolean

Default: true

Declared in: modules/lab/cluster/components/observability/prometheus.nix

prometheus.namespace

Namespace for Prometheus

Type: string

Default: "prometheus"

Declared in: modules/lab/cluster/components/observability/prometheus.nix

prometheus.nodeExporter.enable

Enable Node Exporter for host metrics

Type: boolean

Default: true

Declared in: modules/lab/cluster/components/observability/prometheus.nix

prometheus.phase

Deployment phase this component belongs to

Type: string

Default: "infrastructure"

Declared in: modules/lab/cluster/components/observability/prometheus.nix

prometheus.ref

Computed references for Prometheus

Type: attribute set

Default: { }

Declared in: modules/lab/cluster/components/observability/prometheus.nix

prometheus.remoteWrite

Remote write endpoints for forwarding metrics

Type: list of (attribute set)

Default: [ ]

Declared in: modules/lab/cluster/components/observability/prometheus.nix

prometheus.replicas

Number of Prometheus replicas

Type: positive integer, meaning >0

Default: 1

Declared in: modules/lab/cluster/components/observability/prometheus.nix

prometheus.retention

Metrics retention period

Type: string

Default: "15d"

Declared in: modules/lab/cluster/components/observability/prometheus.nix

prometheus.serviceMonitorSelector

Label selector for ServiceMonitors (empty = all)

Type: attribute set of string

Default: { }

Declared in: modules/lab/cluster/components/observability/prometheus.nix

prometheus.storage.size

PVC size for Prometheus TSDB

Type: string

Default: "50Gi"

Declared in: modules/lab/cluster/components/observability/prometheus.nix

prometheus.storage.storageClass

Storage class for PVC

Type: null or string

Declared in: modules/lab/cluster/components/observability/prometheus.nix

prometheus.version

kube-prometheus-stack Helm chart version

Type: string

Default: "65.1.0"

Declared in: modules/lab/cluster/components/observability/prometheus.nix

tempo.chart

Tempo Helm chart derivation (default: cataCharts.tempo)

Type: package

Default: <derivation helm-chart-https-grafana.github.io-helm-charts-tempo-1.21.0>

Declared in: modules/lab/cluster/components/observability/tempo.nix

tempo.deploymentMode

Tempo deployment topology

Type: one of "monolithic", "distributed"

Default: "monolithic"

Declared in: modules/lab/cluster/components/observability/tempo.nix

tempo.enable

Whether to enable Tempo distributed tracing.

Type: boolean

Default: false

Example: true

Declared in: modules/lab/cluster/components/observability/tempo.nix

tempo.namespace

Namespace for Tempo

Type: string

Default: "tempo"

Declared in: modules/lab/cluster/components/observability/tempo.nix

tempo.phase

Deployment phase this component belongs to

Type: string

Default: "infrastructure"

Declared in: modules/lab/cluster/components/observability/tempo.nix

tempo.receivers.otlp.grpc

Enable OTLP gRPC receiver

Type: boolean

Default: true

Declared in: modules/lab/cluster/components/observability/tempo.nix

tempo.receivers.otlp.http

Enable OTLP HTTP receiver

Type: boolean

Default: true

Declared in: modules/lab/cluster/components/observability/tempo.nix

tempo.ref

Computed references for Tempo

Type: attribute set

Default: { }

Declared in: modules/lab/cluster/components/observability/tempo.nix

tempo.retention

Trace retention period (default 7 days)

Type: string

Default: "168h"

Declared in: modules/lab/cluster/components/observability/tempo.nix

tempo.storage.persistence.size

PVC size for trace storage (filesystem mode)

Type: string

Default: "20Gi"

Declared in: modules/lab/cluster/components/observability/tempo.nix

tempo.storage.persistence.storageClass

Storage class for PVCs

Type: null or string

Declared in: modules/lab/cluster/components/observability/tempo.nix

tempo.storage.s3.bucket

S3 bucket name

Type: string

Default: "tempo-traces"

Declared in: modules/lab/cluster/components/observability/tempo.nix

tempo.storage.s3.endpoint

S3 endpoint URL (for S3-compatible storage). Use config.components.seaweedfs.ref.s3Endpoint for SeaweedFS.

Type: null or string

Declared in: modules/lab/cluster/components/observability/tempo.nix

tempo.storage.s3.region

S3 region

Type: string

Default: "us-east-1"

Declared in: modules/lab/cluster/components/observability/tempo.nix

tempo.storage.s3.secretName

Secret with S3 credentials

Type: null or string

Declared in: modules/lab/cluster/components/observability/tempo.nix

tempo.storage.type

Trace storage backend

Type: one of "filesystem", "s3"

Default: "filesystem"

Declared in: modules/lab/cluster/components/observability/tempo.nix

tempo.version

Tempo Helm chart version

Type: string

Default: "1.10.3"

Declared in: modules/lab/cluster/components/observability/tempo.nix