From 60ca8f35238e12cd815cf79f6dade8562c05424e Mon Sep 17 00:00:00 2001
From: daniel-gines <dangines@gmail.com>
Date: Mon, 4 May 2026 06:09:47 -0300
Subject: [PATCH] fix(workload-alloy): correct metric_pods relabel for
 annotation scrape
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Same regex bug shipped fixed in the hub Alloy via upstream PR #148:
the previous rule used only the prometheus.io/port annotation as
source label with regex "(.+)" and replacement "${1}:$0", causing
both backrefs to resolve to the captured port value. The result was
__address__="<port>:<port>" (e.g. "9090:9090") instead of the
expected "<pod_ip>:<port>". Any pod relying on annotation-based
scrape on a workload cluster never had its /metrics endpoint reached.

Replaced with the canonical Prometheus pattern: combine __address__
(pod IP from discovery) with the annotation port, matching
"([^:]+)(?::\d+)?;(\d+)" and replacing with "$1:$2". Also added a
companion rule honoring prometheus.io/path when present.

Workload Alloy does not run an OTLP receiver — only the hub does —
so Bug 2 from the original issue does not apply here. Single-edit
fix, ~15 lines.

Validation:
- helm template grafana/alloy --version 1.6.2 -f values/workload/alloy.yaml
  renders cleanly.
- alloy fmt + alloy run on the rendered config exit 0 (only the
  expected sys.env() errors fire when run offline without the
  LOKI_PUSH_URL / MIMIR_PUSH_URL / CLUSTER_NAME env vars set).

Lower urgency than the hub fix because there are no workload clusters
in production at the time of writing; merging keeps the workload
alloy ready for the first cluster that gets provisioned.

Closes Estabilis/estabilis-platform-tools#210
---
 values/workload/alloy.yaml | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/values/workload/alloy.yaml b/values/workload/alloy.yaml
index 3cf99ff..1426faf 100644
--- a/values/workload/alloy.yaml
+++ b/values/workload/alloy.yaml
@@ -249,11 +249,24 @@ alloy:
           action        = "keep"
         }
 
+        // Build __address__ as <pod_ip>:<annotation_port>. The previous
+        // form ("${1}:$0" with only the port annotation as source label)
+        // resolved to "<port>:<port>" because both backrefs pointed at
+        // the same captured value, leaving the address unreachable.
+        // Same fix shipped for the hub Alloy in upstream PR #148.
         rule {
-          source_labels = ["__meta_kubernetes_pod_annotation_prometheus_io_port"]
+          source_labels = ["__address__", "__meta_kubernetes_pod_annotation_prometheus_io_port"]
+          regex         = "([^:]+)(?::\\d+)?;(\\d+)"
+          replacement   = "$1:$2"
           target_label  = "__address__"
+          action        = "replace"
+        }
+
+        // Honor prometheus.io/path annotation when present.
+        rule {
+          source_labels = ["__meta_kubernetes_pod_annotation_prometheus_io_path"]
           regex         = "(.+)"
-          replacement   = "${1}:$0"
+          target_label  = "__metrics_path__"
           action        = "replace"
         }
       }