Support Alloys Cloudwatch exporter

[brodul]

Hey,

I have come across a blog post and realized that
YACE is bundled in alloy .

I wonder how hard would would it would be to:

• Edit the helm to support a Service Account with the IRSA role annotation
• Changes to rule templates to make it happen

[petewall]

To use this, you'd put the prometheus.exporter.cloudwatch component inside the alloy-singleton.extraConfig section. It belongs there because it should only be run on a single alloy instance, not inside a clustered instance. Then you would pair that with an prometheus.scrape component to actually gather the metrics from cloudwatch.

To add more roles to the Alloy service account, you can create another Role and RoleBinding in the extraObjects section.

Here's a rough example:

cluster:
  name: cloudwatch-example-cluster

destinations:
  - name: my-metrics-destination
    type: prometheus
    url: http://prometheus-server.prometheus.svc:9090/api/v1/write

alloy-singleton:
  enabled: true
  extraConfig: |-
    prometheus.exporter.cloudwatch "default" {
    ...
    }
    
    prometheus.scrape "cloudwatch" {
      targets = prometheus.exporter.cloudwatch.default.targets
      job_name = "cloudwatch"
      forward_to = prometheus.remote_write.my_metrics_destination.receiver
    }

extraObjects:
- apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: alloy-singleton-irsa-role
  rules: ...
- apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: alloy-singleton-irsa-role-binding
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: alloy-singleton-irsa-role
  subjects:
    - kind: ServiceAccount
      name: "{{ include \"alloy.fullname\" (index $.Subcharts \"alloy-singleton\") }}"
      namespace: "{{ .Release.Namespace }}"