fix(alloy): scrape cadvisor from the kubelet port instead of the API server proxy

Alloy Helm 차트의 ClusterRole에는 nodes/metrics는 있지만 nodes/proxy가 없어(실측 2026-10-08)
/api/v1/nodes/<n>/proxy/metrics/cadvisor 경로가 거부되고 container_* 지표가 비었다. kubelet
10250을 직접 스크랩한다(자체 서명 인증서라 insecure_skip_verify). up도 남겨 스크랩 성공 여부를
볼 수 있게 하고, container_* 는 demo·ingress-nginx·argocd 네임스페이스만 유지한다.

apps/alloy.yaml

@@ -103,30 +103,30 @@ spec:
                 clustering { enabled = true }
               }
 
-              // ---- cadvisor through the API server proxy (container CPU/memory of namespace demo) ----
+              // ---- cadvisor straight from each kubelet (container CPU/memory of namespace demo) ----
+              // nodes/metrics is in the chart ClusterRole, nodes/proxy is not (checked 2026-10-08), so the kubelet
+              // port is scraped directly; the kubeadm kubelet serving certificate is self-signed, hence insecure_skip_verify.
               discovery.kubernetes "nodes" { role = "node" }
               discovery.relabel "cadvisor" {
                 targets = discovery.kubernetes.nodes.targets
                 rule {
-                  target_label = "__address__"
-                  replacement = "kubernetes.default.svc:443"
-                }
-                rule {
-                  source_labels = ["__meta_kubernetes_node_name"]
-                  regex = "(.+)"
                   target_label = "__metrics_path__"
-                  replacement = "/api/v1/nodes/$1/proxy/metrics/cadvisor"
+                  replacement  = "/metrics/cadvisor"
                 }
                 rule {
                   source_labels = ["__meta_kubernetes_node_name"]
                   target_label  = "node"
                 }
+                rule {
+                  target_label = "job"
+                  replacement  = "cadvisor"
+                }
               }
               prometheus.scrape "cadvisor" {
                 targets           = discovery.relabel.cadvisor.output
                 scheme            = "https"
                 bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
-                tls_config { ca_file = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt" }
+                tls_config { insecure_skip_verify = true }
                 scrape_interval   = "30s"
                 forward_to        = [prometheus.relabel.cadvisor_keep.receiver]
                 clustering { enabled = true }
@@ -135,12 +135,12 @@ spec:
                 forward_to = [prometheus.remote_write.mimir.receiver]
                 rule {
                   source_labels = ["__name__"]
-                  regex = "container_(cpu_usage_seconds_total|memory_working_set_bytes|oom_events_total|network_receive_bytes_total|network_transmit_bytes_total)"
+                  regex         = "up|container_(cpu_usage_seconds_total|memory_working_set_bytes|oom_events_total|network_receive_bytes_total|network_transmit_bytes_total)"
                   action        = "keep"
                 }
                 rule {
-                  source_labels = ["namespace"]
-                  regex = "demo|ingress-nginx|argocd"
+                  source_labels = ["__name__", "namespace"]
+                  regex         = "container_.*;(demo|ingress-nginx|argocd)"
                   action        = "keep"
                 }
                 rule {