mimir on Grafana Labs

mimir.alerts.kubernetes

Mon, 13 Apr 2026 07:37:47 +0000

`mimir.alerts.kubernetes`

EXPERIMENTAL: This is an experimental component. Experimental components are subject to frequent breaking changes, and may be removed with no equivalent replacement. To enable and use an experimental component, you must set the stability.level flag to experimental.

mimir.alerts.kubernetes discovers AlertmanagerConfig Kubernetes resources and loads them into a Mimir instance.

You can specify multiple mimir.alerts.kubernetes components by giving them different labels.
You can use Kubernetes label selectors to limit the Namespace and AlertmanagerConfig resources considered during reconciliation.
Compatible with the Alertmanager APIs of Grafana Mimir, Grafana Cloud, and Grafana Enterprise Metrics.
Compatible with the AlertmanagerConfig CRD from the prometheus-operator.
This component accesses the Kubernetes REST API from within a Pod.

Note
This component requires Role-based access control (RBAC) to be set up in Kubernetes in order for Alloy to access it via the Kubernetes REST API.

mimir.alerts.kubernetes doesn’t support clustering.

Usage

mimir.alerts.kubernetes "<LABEL>" {
  address       = "<MIMIR_URL>"
  global_config = "..."
}

Arguments

You can use the following arguments with mimir.alerts.kubernetes:

Name	Type	Description	Default	Required
`address`	`string`	URL of the Mimir Alertmanager.		yes
`global_config`	`secret`	Alertmanager configuration to be merged with AlertmanagerConfig CRDs.		yes
`bearer_token_file`	`string`	File containing a bearer token to authenticate with.		no
`bearer_token`	`secret`	Bearer token to authenticate with.		no
`enable_http2`	`bool`	Whether HTTP2 is supported for requests.	`true`	no
`follow_redirects`	`bool`	Whether redirects returned by the server should be followed.	`true`	no
`http_headers`	`map(list(secret))`	Custom HTTP headers to be sent along with each request. The map key is the header name.		no
`no_proxy`	`string`	Comma-separated list of IP addresses, CIDR notations, and domain names to exclude from proxying.		no
`proxy_connect_header`	`map(list(secret))`	Specifies headers to send to proxies during CONNECT requests.		no
`proxy_from_environment`	`bool`	Use the proxy URL indicated by environment variables.	`false`	no
`proxy_url`	`string`	HTTP proxy to send requests through.		no
`sync_interval`	`duration`	Amount of time between reconciliations with Mimir.	`"5m"`	no
`template_files`	`map(string)`	A map of Alertmanager template files.	`{}`	no

At most, one of the following can be provided:

[authorization][authorization] block
[basic_auth][basic_auth] block
bearer_token_fileargument
bearer_token argument
[oauth2][oauth2] block

no_proxy can contain IPs, CIDR notations, and domain names. IP and domain names can contain port numbers. proxy_url must be configured if no_proxy is configured.

proxy_from_environment uses the environment variables HTTP_PROXY, HTTPS_PROXY, and NO_PROXY (or the lowercase versions thereof). Requests use the proxy from the environment variable matching their scheme, unless excluded by NO_PROXY. proxy_url and no_proxy must not be configured if proxy_from_environment is configured.

proxy_connect_header should only be configured if proxy_url or proxy_from_environment are configured.

Blocks

The following blocks are supported inside the definition of mimir.alerts.kubernetes:

Block	Description	Required
`authorization`	Configure generic authorization to the endpoint.	no
`basic_auth`	Configure `basic_auth` for authenticating to the endpoint.	no
`oauth2`	Configure OAuth 2.0 for authenticating to the endpoint.	no
`oauth2` > `tls_config`	Configure TLS settings for connecting to the endpoint.	no
`alertmanagerconfig_namespace_selector`	Label selector for `Namespace` resources.	no
`alertmanagerconfig_namespace_selector` > `match_expression`	Label match expression for `Namespace` resources.	no
`alertmanagerconfig_selector`	Label selector for `AlertmanagerConfig` resources.	no
`alertmanagerconfig_selector` > `match_expression`	Label match expression for `AlertmanagerConfig` resources.	no
`alertmanagerconfig_matcher`	Strategy to match alerts to `AlertmanagerConfig` resources.	no
`tls_config`	Configure TLS settings for connecting to the endpoint.	no

`authorization`

Name	Type	Description	Required
`credentials_file`	`string`	File containing the secret value.	no
`credentials`	`secret`	Secret value.	no
`type`	`string`	Authorization type, for example, “Bearer”.	no

credential and credentials_file are mutually exclusive, and only one can be provided inside an authorization block.

Warning
Using credentials_file causes the file to be read on every outgoing request. Use the local.file component with the credentials attribute instead to avoid unnecessary reads.

`basic_auth`

Name	Type	Description	Required
`password_file`	`string`	File containing the basic auth password.	no
`password`	`secret`	Basic auth password.	no
`username`	`string`	Basic auth username.	no

password and password_file are mutually exclusive, and only one can be provided inside a basic_auth block.

Warning
Using password_file causes the file to be read on every outgoing request. Use the local.file component with the password attribute instead to avoid unnecessary reads.

`alertmanagerconfig_selector` and `alertmanagerconfig_namespace_selector`

The alertmanagerconfig_selector and alertmanagerconfig_namespace_selector blocks describe a Kubernetes label selector for AlertmanagerConfig CRDs or namespace discovery.

The following arguments are supported:

Name	Type	Description	Default	Required
`match_labels`	`map(string)`	Label keys and values used to discover resources.	`{}`	yes

When the match_labels argument is empty, all resources are matched.

`match_expression`

The match_expression block describes a Kubernetes label match expression for AlertmanagerConfig CRDs or namespace discovery.

The following arguments are supported:

Name	Type	Description	Required
`key`	`string`	The label name to match against.	yes
`operator`	`string`	The operator to use when matching.	yes
`values`	`list(string)`	The values used when matching.	no

The operator argument should be one of the following strings:

"In"
"NotIn"
"Exists"
"DoesNotExist"

The values argument must not be provided when operator is set to "Exists" or "DoesNotExist".

`alertmanagerconfig_matcher`

The alertmanagerconfig_matcher block describes the strategy used by AlertmanagerConfig objects to match alerts in the routes and inhibition rules.

Depending on how this block is configured, the final Alertmanager config will have different matchers in its route section.

The following arguments are supported:

Name	Type	Description	Default	Required
`strategy`	`string`	Strategy for adding matchers to AlertmanagerConfig CRDs.	`"OnNamespace"`	no
`alertmanager_namespace`	`string`	Namespace to use when `alertmanagerconfig_matcher_strategy` is set to `"OnNamespaceExceptForAlertmanagerNamespace"`.		only when `strategy` is `"OnNamespaceExceptForAlertmanagerNamespace"`

The strategy argument should be one of the following strings:

"OnNamespace": Each AlertmanagerConfig object only matches alerts that have the namespace label set to the same namespace as the AlertmanagerConfig object.
"OnNamespaceExceptForAlertmanagerNamespace": The same as "OnNamespace", except for AlertmanagerConfigs in the namespace given by alertmanager_namespace, which apply to all alerts.
"None": Every AlertmanagerConfig object applies to all alerts

strategy is similar to the AlertmanagerConfigMatcherStrategy in Prometheus Operator, but it is configured in Alloy instead of in an Alertmanager CRD. Alloy doesn’t require an Alertmanager CRD.

`oauth2`

Name	Type	Description	Default	Required
`client_id`	`string`	OAuth2 client ID.		no
`client_secret_file`	`string`	File containing the OAuth2 client secret.		no
`client_secret`	`secret`	OAuth2 client secret.		no
`endpoint_params`	`map(string)`	Optional parameters to append to the token URL.		no
`no_proxy`	`string`	Comma-separated list of IP addresses, CIDR notations, and domain names to exclude from proxying.		no
`proxy_connect_header`	`map(list(secret))`	Specifies headers to send to proxies during CONNECT requests.		no
`proxy_from_environment`	`bool`	Use the proxy URL indicated by environment variables.	`false`	no
`proxy_url`	`string`	HTTP proxy to send requests through.		no
`scopes`	`list(string)`	List of scopes to authenticate with.		no
`token_url`	`string`	URL to fetch the token from.		no

client_secret and client_secret_file are mutually exclusive, and only one can be provided inside an oauth2 block.

Warning
Using client_secret_file causes the file to be read on every outgoing request. Use the local.file component with the client_secret attribute instead to avoid unnecessary reads.

The oauth2 block may also contain a separate tls_config sub-block.

no_proxy can contain IPs, CIDR notations, and domain names. IP and domain names can contain port numbers. proxy_url must be configured if no_proxy is configured.

proxy_connect_header should only be configured if proxy_url or proxy_from_environment are configured.

`tls_config`

Name	Type	Description	Required
`ca_pem`	`string`	CA PEM-encoded text to validate the server with.	no
`ca_file`	`string`	CA certificate to validate the server with.	no
`cert_pem`	`string`	Certificate PEM-encoded text for client authentication.	no
`cert_file`	`string`	Certificate file for client authentication.	no
`insecure_skip_verify`	`bool`	Disables validation of the server certificate.	no
`key_file`	`string`	Key file for client authentication.	no
`key_pem`	`secret`	Key PEM-encoded text for client authentication.	no
`min_version`	`string`	Minimum acceptable TLS version.	no
`server_name`	`string`	ServerName extension to indicate the name of the server.	no

The following pairs of arguments are mutually exclusive and can’t both be set simultaneously:

ca_pem and ca_file
cert_pem and cert_file
key_pem and key_file

When configuring client authentication, both the client certificate (using cert_pem or cert_file) and the client key (using key_pem or key_file) must be provided.

When min_version isn’t provided, the minimum acceptable TLS version is inherited from Go’s default minimum version, TLS 1.2. If min_version is provided, it must be set to one of the following strings:

"TLS10" (TLS 1.0)
"TLS11" (TLS 1.1)
"TLS12" (TLS 1.2)
"TLS13" (TLS 1.3)

Exported fields

mimir.alerts.kubernetes doesn’t export any fields.

Component health

mimir.alerts.kubernetes is reported as unhealthy if given an invalid configuration or an error occurs during reconciliation.

Debug information

mimir.alerts.kubernetes doesn’t expose debug information.

Debug metrics

Metric Name	Type	Description
`mimir_alerts_mimir_client_request_duration_seconds`	`histogram`	Duration of requests to the Mimir API.
`mimir_alerts_config_updates_total`	`counter`	Number of times the configuration has been updated.
`mimir_alerts_events_failed_total`	`counter`	Number of events that failed to be processed, partitioned by event type.
`mimir_alerts_events_retried_total`	`counter`	Number of events that were retried, partitioned by event type.
`mimir_alerts_events_total`	`counter`	Number of events processed, partitioned by event type.

Example

This example creates a mimir.alerts.kubernetes component which only loads namespace and AlertmanagerConfig resources if they contain an alloy label set to yes.

remote.kubernetes.configmap "default" {
  namespace = "default"
  name      = "alertmgr-global"
}

mimir.alerts.kubernetes "default" {
  address       = "http://mimir-nginx.mimir-test.svc:80"
  global_config = remote.kubernetes.configmap.default.data["glbl"]

  template_files = {
    `default_template` = 
`{{ define "__alertmanager" }}AlertManager{{ end }}
{{ define "__alertmanagerURL" }}{{ .ExternalURL }}/#/alerts?receiver={{ .Receiver | urlquery }}{{ end }}`,
  }

  alertmanagerconfig_selector {
      match_labels = {
          alloy = "yes",
      }
  }

  alertmanagerconfig_namespace_selector {
      match_labels = {
          alloy = "yes",
      }
  }
}

The following example is an RBAC configuration for Kubernetes. It authorizes Alloy to query the Kubernetes REST API:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: alloy
  namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: alloy
rules:
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["monitoring.coreos.com"]
  resources: ["alertmanagerconfigs"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: alloy
subjects:
- kind: ServiceAccount
  name: alloy
  namespace: default
roleRef:
  kind: ClusterRole
  name: alloy
  apiGroup: rbac.authorization.k8s.io

The following is an example of a complete Kubernetes configuration:

apiVersion: v1
kind: Namespace
metadata:
  name: testing
  labels:
    alloy: "yes"
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: grafana-alloy
  namespace: testing
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: grafana-alloy
rules:
- apiGroups: [""]
  resources: ["namespaces", "configmaps"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["monitoring.coreos.com"]
  resources: ["alertmanagerconfigs"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: grafana-alloy
subjects:
- kind: ServiceAccount
  name: grafana-alloy
  namespace: testing
roleRef:
  kind: ClusterRole
  name: grafana-alloy
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: Service
metadata:
  name: grafana-alloy
spec:
  type: NodePort
  selector:
    app: grafana-alloy
  ports:
      # By default and for convenience, the `targetPort` is set to the same value as the `port` field.
    - port: 8080
---
apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: testing
  name: grafana-alloy
spec:
  replicas: 1
  selector:
    matchLabels:
      app: grafana-alloy
  template:
    metadata:
      labels:
        app: grafana-alloy
    spec:
      serviceAccount: grafana-alloy
      containers:
      - name: alloy
        image: grafana/alloy:latest
        imagePullPolicy: Never
        args:
        - run
        - /etc/config/config.alloy
        - --stability.level=experimental
        ports:
        - containerPort: 8080
        volumeMounts:
        - name: config-volume
          mountPath: /etc/config
      volumes:
        - name: config-volume
          configMap:
            name: alloy-config
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: alloy-config
  namespace: testing
data:
  config.alloy: |
      remote.kubernetes.configmap "default" {
        namespace = "testing"
        name = "alertmgr-global"
      }

      mimir.alerts.kubernetes "default" {
        address = "http://mimir-nginx.mimir-test.svc:80"
        global_config = remote.kubernetes.configmap.default.data["glbl"]
        template_files = {
          `default_template` = 
      `{{ define "__alertmanager" }}AlertManager{{ end }}
      {{ define "__alertmanagerURL" }}{{ .ExternalURL }}/#/alerts?receiver={{ .Receiver | urlquery }}{{ end }}`,
        }
        alertmanagerconfig_namespace_selector {
            match_labels = {
                alloy = "yes",
            }
        }
        alertmanagerconfig_selector {
            match_labels = {
                alloy = "yes",
            }
        }
      }
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: alertmgr-global
  namespace: testing
data:
  glbl: |
    global:
      resolve_timeout: 5m
      http_config:
        follow_redirects: true
        enable_http2: true
      smtp_hello: localhost
      smtp_require_tls: true
    route:
      receiver: "null"
    receivers:
    - name: "null"
    - name: "alloy-namespace/global-config/myreceiver"
    templates:
    - 'default_template'
---
apiVersion: monitoring.coreos.com/v1alpha1
kind: AlertmanagerConfig
metadata:
  name: alertmgr-config1
  namespace: testing
  labels:
    alloy: "yes"
spec:
  route:
    receiver: "null"
    routes:
    - receiver: myamc
      continue: true
  receivers:
  - name: "null"
  - name: myamc
    webhookConfigs:
    - url: http://test.url
      httpConfig:
        followRedirects: true
---
apiVersion: monitoring.coreos.com/v1alpha1
kind: AlertmanagerConfig
metadata:
  name: alertmgr-config2
  namespace: testing
  labels:
    alloy: "yes"
spec:
  route:
    receiver: "null"
    routes:
    - receiver: 'database-pager'
      groupWait: 10s
      matchers:
      - name: service
        value: webapp
  receivers:
  - name: "null"
  - name: "database-pager"

The Kubernetes configuration above creates the Alertmanager configuration below and sends it to Mimir:

template_files:
    default_template: |-
        {{ define "__alertmanager" }}AlertManager{{ end }}
        {{ define "__alertmanagerURL" }}{{ .ExternalURL }}/#/alerts?receiver={{ .Receiver | urlquery }}{{ end }}
alertmanager_config: |
    global:
      resolve_timeout: 5m
      http_config:
        follow_redirects: true
        enable_http2: true
      smtp_hello: localhost
      smtp_require_tls: true
    route:
      receiver: "null"
      continue: false
      routes:
      - receiver: testing/alertmgr-config1/null
        matchers:
        - namespace="testing"
        continue: true
        routes:
        - receiver: testing/alertmgr-config1/myamc
          continue: true
      - receiver: testing/alertmgr-config2/null
        matchers:
        - namespace="testing"
        continue: true
        routes:
        - receiver: testing/alertmgr-config2/database-pager
          matchers:
          - service="webapp"
          continue: false
          group_wait: 10s
    receivers:
    - name: "null"
    - name: alloy-namespace/global-config/myreceiver
    - name: testing/alertmgr-config1/null
    - name: testing/alertmgr-config1/myamc
      webhook_configs:
      - send_resolved: false
        http_config:
          follow_redirects: true
          enable_http2: true
        url: <secret>
        url_file: ""
        max_alerts: 0
        timeout: 0s
    - name: testing/alertmgr-config2/null
    - name: testing/alertmgr-config2/database-pager
    templates:
    - default_template

You can add the alertmanagerconfig_matcher block to your Alloy configuration to remove the namespace matchers:

alertmanagerconfig_matcher {
  strategy = "None"
}

This results in the following final configuration:

template_files:
    default_template: |-
        {{ define "__alertmanager" }}AlertManager{{ end }}
        {{ define "__alertmanagerURL" }}{{ .ExternalURL }}/#/alerts?receiver={{ .Receiver | urlquery }}{{ end }}
alertmanager_config: |
    global:
      resolve_timeout: 5m
      http_config:
        follow_redirects: true
        enable_http2: true
      smtp_hello: localhost
      smtp_require_tls: true
    route:
      receiver: "null"
      continue: false
      routes:
      - receiver: testing/alertmgr-config1/null
        continue: true
        routes:
        - receiver: testing/alertmgr-config1/myamc
          continue: true
      - receiver: testing/alertmgr-config2/null
        continue: true
        routes:
        - receiver: testing/alertmgr-config2/database-pager
          matchers:
          - service="webapp"
          continue: false
          group_wait: 10s
    receivers:
    - name: "null"
    - name: alloy-namespace/global-config/myreceiver
    - name: testing/alertmgr-config1/null
    - name: testing/alertmgr-config1/myamc
      webhook_configs:
      - send_resolved: false
        http_config:
          follow_redirects: true
          enable_http2: true
        url: <secret>
        url_file: ""
        max_alerts: 0
        timeout: 0s
    - name: testing/alertmgr-config2/null
    - name: testing/alertmgr-config2/database-pager
    templates:
    - default_template

mimir.rules.kubernetes

Mon, 13 Apr 2026 07:37:47 +0000

`mimir.rules.kubernetes`

mimir.rules.kubernetes discovers PrometheusRule Kubernetes resources and loads them into a Mimir instance.

It can also federate rules from different source tenants into a target Mimir tenant by interpreting the monitoring.grafana.com/source_tenants annotation on PrometheusRule resources.

You can specify multiple mimir.rules.kubernetes components by giving them different labels.
Kubernetes label selectors let you limit the Namespace and PrometheusRule resources the component considers during reconciliation.
Compatible with the Ruler APIs of Grafana Mimir, Grafana Cloud, and Grafana Enterprise Metrics.
Compatible with the PrometheusRule CRD from the prometheus-operator.
This component accesses the Kubernetes REST API from within a Pod.

Note
You must configure Role-based access control (RBAC) in Kubernetes so Alloy can access the Kubernetes REST API.

Note
Alloy version 1.1 and higher supports clustered mode in this component. When you use this component as part of a cluster of Alloy instances, only a single instance from the cluster updates rules using the Mimir API.

Usage

mimir.rules.kubernetes "<LABEL>" {
  address = "<MIMIR_RULER_URL>"
}

Arguments

You can use the following arguments with mimir.rules.kubernetes:

Name	Type	Description	Default	Required
`address`	`string`	URL of the Mimir ruler.		yes
`bearer_token_file`	`string`	File containing a bearer token to authenticate with.		no
`bearer_token`	`secret`	Bearer token to authenticate with.		no
`enable_http2`	`bool`	Whether to enable HTTP2 for requests.	`true`	no
`external_labels`	`map(string)`	Labels to add to each rule.	`{}`	no
`follow_redirects`	`bool`	Whether to follow redirects returned by the server.	`true`	no
`http_headers`	`map(list(secret))`	Custom HTTP headers to send with each request. The map key is the header name.		no
`mimir_namespace_prefix`	`string`	Prefix used to differentiate multiple Alloy deployments.	`"alloy"`	no
`no_proxy`	`string`	Comma-separated list of IP addresses, CIDR notations, and domain names to exclude from proxying.		no
`prometheus_http_prefix`	`string`	Path prefix for the Mimir Prometheus endpoint.	`"/prometheus"`	no
`proxy_connect_header`	`map(list(secret))`	Specifies headers to send to proxies during CONNECT requests.		no
`proxy_from_environment`	`bool`	Use the proxy URL indicated by environment variables.	`false`	no
`proxy_url`	`string`	HTTP proxy to send requests through.		no
`sync_interval`	`duration`	Amount of time between reconciliations with Mimir.	`"5m"`	no
`tenant_id`	`string`	Mimir tenant ID. Required when you enable Mimir multi-tenancy.		no
`use_legacy_routes`	`bool`	Whether to use deprecated ruler API endpoints.	`false`	no

You can provide at most one of the following:

[authorization][authorization] block
[basic_auth][basic_auth] block
bearer_token_file argument
bearer_token argument
[oauth2][oauth2] block

no_proxy can contain IPs, CIDR notations, and domain names. IP and domain names can contain port numbers. proxy_url must be configured if no_proxy is configured.

proxy_connect_header should only be configured if proxy_url or proxy_from_environment are configured.

If you don’t provide tenant_id, the component assumes the Mimir instance at address runs in single-tenant mode. The component doesn’t send an X-Scope-OrgID header.

Note
The mimir-distributed Helm chart enables multi-tenancy by default.

When you enable multi-tenancy, requests to the Mimir Ruler API must include an X-Scope-OrgID tenant header. The mimir.rules.kubernetes component sends this header only when you configure the tenant_id argument.

If you don’t set tenant_id, the Mimir API returns the error: 401 Unauthorized: no org id.

To resolve this, set the tenant_id argument in the component configuration.

The sync_interval argument determines how often the component accesses the Mimir ruler API to reload the current state of rules. The Kubernetes API delivers updates as events using the informer pattern.

Use the mimir_namespace_prefix argument to separate the rules that multiple Alloy deployments manage across your infrastructure. Set it to a unique value for each deployment.

If you set use_legacy_routes to true, mimir.rules.kubernetes contacts Mimir on a /api/v1/rules endpoint.

If you set prometheus_http_prefix to /mimir, mimir.rules.kubernetes contacts Mimir on a /mimir/config/v1/rules endpoint. This is useful if you configure Mimir to use a different prefix for its Prometheus endpoints than the default one.

The component ignores prometheus_http_prefix if you set use_legacy_routes to true.

external_labels overrides label values if labels with the same names already exist inside the rule.

Blocks

You can use the following blocks with mimir.rules.kubernetes:

Block	Description	Required
`authorization`	Configure generic authorization to the endpoint.	no
`basic_auth`	Configure `basic_auth` for authenticating to the endpoint.	no
`oauth2`	Configure OAuth 2.0 for authenticating to the endpoint.	no
`oauth2` > `tls_config`	Configure TLS settings for connecting to the endpoint.	no
`alertmanagerconfig_namespace_selector`	Label selector for `Namespace` resources.	no
`alertmanagerconfig_namespace_selector` > `match_expression`	Label match expression for `Namespace` resources.	no
`alertmanagerconfig_selector`	Label selector for `AlertmanagerConfig` resources.	no
`alertmanagerconfig_selector` > `match_expression`	Label match expression for `AlertmanagerConfig` resources.	no
`alertmanagerconfig_matcher`	Strategy to match alerts to `AlertmanagerConfig` resources.	no
`tls_config`	Configure TLS settings for connecting to the endpoint.	no

`authorization`

Name	Type	Description	Required
`credentials_file`	`string`	File containing the secret value.	no
`credentials`	`secret`	Secret value.	no
`type`	`string`	Authorization type, for example, “Bearer”.	no

credential and credentials_file are mutually exclusive, and only one can be provided inside an authorization block.

Warning
Using credentials_file causes the file to be read on every outgoing request. Use the local.file component with the credentials attribute instead to avoid unnecessary reads.

`basic_auth`

Name	Type	Description	Required
`password_file`	`string`	File containing the basic auth password.	no
`password`	`secret`	Basic auth password.	no
`username`	`string`	Basic auth username.	no

password and password_file are mutually exclusive, and only one can be provided inside a basic_auth block.

Warning
Using password_file causes the file to be read on every outgoing request. Use the local.file component with the password attribute instead to avoid unnecessary reads.

`extra_query_matchers`

The extra_query_matchers block has no attributes. It contains zero or more [matcher][] blocks. These blocks let you add extra label matchers to all queries that the mimir.rules.kubernetes component discovers. The algorithm of adding the label matchers to queries is the same as the one provided by the promtool promql label-matchers set command.

`matcher`

The matcher block describes a label matcher that the component adds to each query in PrometheusRule CRDs.

You can use the following arguments:

Name	Type	Description	Required
`match_type`	`string`	The type of match. One of `=`, `!=`, `=~` and `!~`.	yes
`name`	`string`	Name of the label to match.	yes
`value`	`string`	Value of the label to match.	no
`value_from_label`	`string`	Value of the Kubernetes `PrometheusRule` label to match.	no

Use only one of value or value_from_label.

`rule_selector` and `rule_namespace_selector`

The rule_selector and rule_namespace_selector blocks describe a Kubernetes label selector for rule or namespace discovery.

You can use the following arguments:

Name	Type	Description	Default	Required
`match_labels`	`map(string)`	Label keys and values used to discover resources.	`{}`	yes

When the match_labels argument is empty, the component matches all resources.

`match_expression`

The match_expression block describes a Kubernetes label match expression for rule or namespace discovery.

You can use the following arguments:

Name	Type	Description	Required
`key`	`string`	The label name to match against.	yes
`operator`	`string`	The operator to use when matching.	yes
`values`	`list(string)`	The values used when matching.	no

The operator argument should be one of the following strings:

"In"
"NotIn"
"Exists"
"DoesNotExist"

Don’t provide the values argument when you set operator to "Exists" or "DoesNotExist".

`oauth2`

Name	Type	Description	Default	Required
`client_id`	`string`	OAuth2 client ID.		no
`client_secret_file`	`string`	File containing the OAuth2 client secret.		no
`client_secret`	`secret`	OAuth2 client secret.		no
`endpoint_params`	`map(string)`	Optional parameters to append to the token URL.		no
`no_proxy`	`string`	Comma-separated list of IP addresses, CIDR notations, and domain names to exclude from proxying.		no
`proxy_connect_header`	`map(list(secret))`	Specifies headers to send to proxies during CONNECT requests.		no
`proxy_from_environment`	`bool`	Use the proxy URL indicated by environment variables.	`false`	no
`proxy_url`	`string`	HTTP proxy to send requests through.		no
`scopes`	`list(string)`	List of scopes to authenticate with.		no
`token_url`	`string`	URL to fetch the token from.		no

client_secret and client_secret_file are mutually exclusive, and only one can be provided inside an oauth2 block.

Warning
Using client_secret_file causes the file to be read on every outgoing request. Use the local.file component with the client_secret attribute instead to avoid unnecessary reads.

The oauth2 block may also contain a separate tls_config sub-block.

no_proxy can contain IPs, CIDR notations, and domain names. IP and domain names can contain port numbers. proxy_url must be configured if no_proxy is configured.

proxy_connect_header should only be configured if proxy_url or proxy_from_environment are configured.

`tls_config`

Name	Type	Description	Required
`ca_pem`	`string`	CA PEM-encoded text to validate the server with.	no
`ca_file`	`string`	CA certificate to validate the server with.	no
`cert_pem`	`string`	Certificate PEM-encoded text for client authentication.	no
`cert_file`	`string`	Certificate file for client authentication.	no
`insecure_skip_verify`	`bool`	Disables validation of the server certificate.	no
`key_file`	`string`	Key file for client authentication.	no
`key_pem`	`secret`	Key PEM-encoded text for client authentication.	no
`min_version`	`string`	Minimum acceptable TLS version.	no
`server_name`	`string`	ServerName extension to indicate the name of the server.	no

The following pairs of arguments are mutually exclusive and can’t both be set simultaneously:

ca_pem and ca_file
cert_pem and cert_file
key_pem and key_file

When configuring client authentication, both the client certificate (using cert_pem or cert_file) and the client key (using key_pem or key_file) must be provided.

"TLS10" (TLS 1.0)
"TLS11" (TLS 1.1)
"TLS12" (TLS 1.2)
"TLS13" (TLS 1.3)

Exported fields

mimir.rules.kubernetes doesn’t export any fields.

Component health

mimir.rules.kubernetes reports as unhealthy when given an invalid configuration or when an error occurs during reconciliation.

Debug information

mimir.rules.kubernetes exposes resource-level debug information.

The component exposes the following per discovered PrometheusRule resource:

The Kubernetes namespace.
The resource name.
The resource UID.
The number of rule groups.

The component exposes the following per discovered Mimir rule namespace resource:

The namespace name.
The number of rule groups.

The component only exposes resources it manages, regardless of how many actually exist.

Debug metrics

Metric Name	Type	Description
`mimir_rules_mimir_client_request_duration_seconds`	`histogram`	Duration of requests to the Mimir API.
`mimir_rules_config_updates_total`	`counter`	Number of configuration updates.
`mimir_rules_events_failed_total`	`counter`	Number of events that failed processing, partitioned by event type.
`mimir_rules_events_retried_total`	`counter`	Number of retried events, partitioned by event type.
`mimir_rules_events_total`	`counter`	Number of events processed, partitioned by event type.

Examples

This example creates a mimir.rules.kubernetes component that loads discovered rules to a local Mimir instance under the team-a tenant. The component only includes namespaces and rules with the alloy label set to yes.

mimir.rules.kubernetes "local" {
    address = "mimir:8080"
    tenant_id = "team-a"

    rule_namespace_selector {
        match_labels = {
            alloy = "yes",
        }
    }

    rule_selector {
        match_labels = {
            alloy = "yes",
        }
    }
}

This example creates a mimir.rules.kubernetes component that loads discovered rules to Grafana Cloud. It also adds a "label1" label to each rule. If that label already exists, the component overwrites it with "value1".

mimir.rules.kubernetes "default" {
    address = "<GRAFANA_CLOUD_METRICS_URL>"
    basic_auth {
        username = "<GRAFANA_CLOUD_USER>"
        password = "<GRAFANA_CLOUD_API_KEY>"
        // Alternatively, load the password from a file:
        // password_file = "<GRAFANA_CLOUD_API_KEY_PATH>"
    }
    external_labels = {"label1" = "value1"}
}

This example adds label matcher {cluster=~"prod-.*"} to all the queries discovered by mimir.rules.kubernetes.

mimir.rules.kubernetes "default" {
    address = "<GRAFANA_CLOUD_METRICS_URL>"
    extra_query_matchers {
        matcher {
            name = "cluster"
            match_type = "=~"
            value = "prod-.*"
        }
    }
}

If the component finds a query in the form of up != 1 in PrometheusRule CRDs, it modifies the query to up{cluster=~"prod-.*"} != 1 before sending it to Mimir.

This example shows a PrometheusRule with a label set to application.kubernetes.io/name=my-app.

apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  labels:
    application.kubernetes.io/name: my-app

The following configuration extracts the value from the PrometheusRules CR label application.kubernetes.io/name and adds a label matcher with the value {app=~"extracted_value"} to all the queries discovered by the mimir.rules.kubernetes component.

mimir.rules.kubernetes "default" {
    address = "<GRAFANA_CLOUD_METRICS_URL>"
    extra_query_matchers {
        matcher {
            name = "app"
            match_type = "="
            value_from_label = "application.kubernetes.io/name"
        }
    }
}

If the component finds a query in the form of up != 1 in PrometheusRule CRDs, it modifies the query to up{app="my-app"} != 1 before sending it to Mimir.

This example demonstrates tenant federation. The component treats rules defined in the PrometheusRule CR as originating from source-tenant-alpha and source-tenant-beta. The mimir.rules.kubernetes component syncs these rules to the target-tenant-main in the configured Mimir instance.

// config.alloy
mimir.rules.kubernetes "federated_rules" {
    address   = "mimir-ruler.example.com:8080"
    tenant_id = "target-tenant-main" // Target tenant in Mimir

    rule_selector {
        match_labels = {
            "federation-group" = "group1"
        }
    }
}

# prometheus-rule-federated.yaml
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: federated-app-rules
  namespace: my-apps
  labels:
    federation-group: "group1"
  annotations:
    monitoring.grafana.com/source_tenants: "source-tenant-alpha,source-tenant-beta"
spec:
  groups:
  - name: my.app.rules
    rules:
    - alert: HighErrorRateFederated
      expr: job:request_latency_seconds:mean5m{job="my-federated-app"} > 0.5
      for: 10m
      labels:
        severity: critical
      annotations:
        summary: High request error rate for my-federated-app

The following example is an RBAC configuration for Kubernetes. It authorizes Alloy to query the Kubernetes REST API:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: alloy
  namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: alloy
rules:
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["monitoring.coreos.com"]
  resources: ["prometheusrules"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: alloy
subjects:
- kind: ServiceAccount
  name: alloy
  namespace: default
roleRef:
  kind: ClusterRole
  name: alloy
  apiGroup: rbac.authorization.k8s.io

mimir on Grafana Labs

mimir.alerts.kubernetes

mimir.alerts.kubernetes

Usage

Arguments

Blocks

authorization

basic_auth

alertmanagerconfig_selector and alertmanagerconfig_namespace_selector

match_expression

alertmanagerconfig_matcher

oauth2

tls_config

Exported fields

Component health

Debug information

Debug metrics

Example

mimir.rules.kubernetes

mimir.rules.kubernetes

Usage

Arguments

Blocks

authorization

basic_auth

extra_query_matchers

matcher

rule_selector and rule_namespace_selector

match_expression

oauth2

tls_config

Exported fields

Component health

Debug information

Debug metrics

Examples

`mimir.alerts.kubernetes`

`authorization`

`basic_auth`

`alertmanagerconfig_selector` and `alertmanagerconfig_namespace_selector`

`match_expression`

`alertmanagerconfig_matcher`

`oauth2`

`tls_config`

`mimir.rules.kubernetes`

`authorization`

`basic_auth`

`extra_query_matchers`

`matcher`

`rule_selector` and `rule_namespace_selector`

`match_expression`

`oauth2`

`tls_config`