// guides
Configurations that were run before they were published
Each guide solves one specific problem with a complete config you can copy, explains the settings that actually matter, and shows how to prove it works. Verified with otelcol validate, kyverno test or kubeconform -strict — tool versions are listed at the top of every page.
OpenTelemetry Collector
6Send logs to Grafana Loki with the OpenTelemetry Collector (native OTLP)
Tail log files with the file_log receiver and ship them to Loki 3's native OTLP endpoint. Tested config, labels vs structured metadata, and LogQL checks.
verified against otelcol-contrib 0.161.0, Loki 3.7.7
Production-ready OpenTelemetry Collector config
A tested OpenTelemetry Collector config that survives outages and memory spikes: memory_limiter, batch, retries, persistent queue, health_check.
verified against otelcol-contrib 0.161.0
Redact PII in the OpenTelemetry Collector with OTTL
A tested transform processor config that masks emails and card numbers and deletes Authorization and cookie attributes from traces and logs.
verified against otelcol-contrib 0.161.0
Reduce OpenTelemetry costs in the Collector
Tested filter and transform processor config that drops health-check spans, DEBUG logs and unused runtime metrics, and trims high-cardinality attributes.
verified against otelcol-contrib 0.161.0
Span metrics and service graph with OpenTelemetry Collector connectors
Generate RED metrics and a service graph from traces with the span_metrics and service_graph connectors. Tested config, metric names, pitfalls.
verified against otelcol-contrib 0.161.0, Prometheus 3.14.0
OpenTelemetry Collector tail sampling: a working config
Keep every error and slow trace plus a small baseline with tail_sampling. Tested config, how to verify it, and why scaling out needs load balancing.
verified against otelcol-contrib 0.161.0
Kyverno & policy
4Rolling out Kyverno from Audit to Enforce safely
Move Kyverno ValidatingPolicies from Audit to Warn to Deny without breaking deploys, with PolicyReport queries and a tested PolicyException.
verified against Kyverno CLI 1.19.1
Kyverno: disallow the :latest image tag
A tested Kyverno ValidatingPolicy that blocks :latest and untagged images, including init containers and registry ports, with kyverno test.
verified against Kyverno CLI 1.19.1
Kyverno: require CPU and memory requests and limits
A tested Kyverno ValidatingPolicy requiring CPU/memory requests and a memory limit on every container, with messages that name the container.
verified against Kyverno CLI 1.19.1
Migrate a namespace to Pod Security Admission `restricted`
Move a live Kubernetes namespace to Pod Security Admission restricted safely: dry runs, warn and audit first, a compliant Deployment, then enforce.
verified against kubeconform -strict (Kubernetes 1.35 and 1.37 schemas)
Looking for a specific alert?
There is a runbook for each of 165 Prometheus alerts — what it means, what it breaks and the commands to diagnose it.
Browse the alert runbooks