[jtslear]

What changed

Makes the collector emit the labels common Kubernetes dashboards select on (for example dotdc/grafana-dashboards-kubernetes):

• cAdvisor node label. container_* and machine_* series now say which node they came from.

• kube-state-metrics node label. The pod target's node label is the node kube-state-metrics itself runs on, which pushed the real node into exported_node, and that was then dropped. It is now restored on kube_* series, mirroring the existing exported_pod/exported_namespace handling.

• instance on node_* series. instance is still dropped on everything else, but node-exporter dashboards tell nodes apart by it, so it is kept for node_*.

• global.telemetry.metrics.externalLabels adds labels (for example cluster) to every series written. Empty by default, so no change unless set.

• alloy.kubeletVolumeStats scrapes kubelet_volume_stats_* (PVC capacity and usage) from each kubelet's /metrics. Enabled by default, clustered like the cAdvisor scrape, and alloy.kubeletVolumeStats.enabled: false turns it off.

• alloy.kubeletTLS makes TLS verification for the cAdvisor and kubelet scrapes configurable (insecure_skip_verify, ca_file). Defaults keep the existing insecure_skip_verify: true. Kubelets usually serve a self-signed certificate (including on EKS unless serverTLSBootstrap is enabled and the CSRs are approved), so verification is opt-in.

README, CHANGELOG and compiled/resources.yaml are regenerated.

Why

Importing the dotdc dashboards into our dogfood Grafana left the cluster dropdown empty, Nodes CPU/RAM Total at 0, CPU and memory by pod empty, and every Storage panel empty. All of it traced back to labels or series the collector did not produce. Dogfood currently works around this by patching a full copy of the Alloy config into its own repo (coder/dogfood#780). With this change dogfood only needs to set externalLabels.cluster and the patch can be dropped.

Reviewer notes

• Behavior change for existing users: new node label on cAdvisor series, a different node on kube_* series, instance retained on node_* series, and a new kubelet scrape. Series identity changes for those metrics, so queries that aggregate across them are unaffected but anything matching exact label sets is worth a look.
• instance on node_* is the node-exporter pod ip:port, so it changes when a node-exporter pod restarts.
• The rendered config passes alloy validate with defaults, with externalLabels set, and with TLS verification enabled.

🤖 Generated with Claude Code

[dannykopping]

Wow, that was quick