Update alloy build instructions: Go 1.25.7 and codesign step

SCP'd binaries from another Mac get com.apple.provenance quarantine
and macOS kills them. Ad-hoc codesign (codesign --sign - --force)
resolves this without GUI approval.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ansible/roles/alloy/defaults/main.yml

@@ -13,7 +13,7 @@
 #    git clone ssh://forgejo@forge.ops.eblu.me:2222/mirrors/alloy.git ~/code/3rd/alloy
 #
 # 2. Set up build tools via mise:
-#    cd ~/code/3rd/alloy && mise use go@1.25 node yarn
+#    cd ~/code/3rd/alloy && mise use go@1.25.7 node yarn
 #
 # 3. Build with CGO enabled (default in Makefile):
 #    cd ~/code/3rd/alloy && mise x -- make alloy
@@ -21,7 +21,10 @@
 # 4. Copy binary to indri:
 #    scp ~/code/3rd/alloy/build/alloy indri:~/.local/bin/alloy
 #
-# 5. Run ansible to deploy config and LaunchAgent
+# 5. Ad-hoc codesign on indri (SCP'd binaries get quarantined by macOS):
+#    ssh indri 'codesign --sign - --force ~/.local/bin/alloy'
+#
+# 6. Run ansible to deploy config and LaunchAgent
 
 # Binary and paths
 alloy_binary: /Users/erichblume/.local/bin/alloy

argocd/manifests/alloy-k8s/kustomization.yaml

@@ -10,7 +10,7 @@ resources:
 
 images:
   - name: grafana/alloy
-    newTag: v1.13.1
+    newTag: v1.14.0
 
 configMapGenerator:
   - name: alloy-config

argocd/manifests/alloy-ringtail/kustomization.yaml

@@ -10,7 +10,7 @@ resources:
 
 images:
   - name: grafana/alloy
-    newTag: v1.13.1
+    newTag: v1.14.0
 
 configMapGenerator:
   - name: alloy-config

argocd/manifests/alloy-tracing-ringtail/kustomization.yaml

@@ -9,7 +9,7 @@ resources:
 
 images:
   - name: grafana/alloy
-    newTag: v1.13.1
+    newTag: v1.14.0
 
 configMapGenerator:
   - name: alloy-tracing-config

docs/changelog.d/bump-alloy-v1.14.0.infra.md

@@ -0,0 +1 @@
+Bump Grafana Alloy to v1.14.0 across all deployments (indri, alloy-k8s, alloy-ringtail, alloy-tracing-ringtail)

docs/reference/services/alloy.md

@@ -1,6 +1,6 @@
 ---
 title: Alloy
-modified: 2026-02-08
+modified: 2026-03-13
 tags:
   - service
   - observability
@@ -20,7 +20,7 @@ Unified observability collector for metrics and logs with three deployments:
 | **Indri Binary** | `~/.local/bin/alloy` |
 | **Indri Config** | `~/.config/grafana-alloy/config.alloy` |
 | **K8s Namespace** | `alloy` |
-| **K8s Image** | `grafana/alloy:v1.8.2` |
+| **K8s Image** | `grafana/alloy:v1.14.0` |
 | **ArgoCD App** | `alloy-k8s` |
 | **Fly.io Config** | `fly/alloy.river` |
 | **Fly.io Image** | `grafana/alloy:v1.5.1` (binary copied into nginx container) |

service-versions.yaml

@@ -71,15 +71,22 @@ services:
 
   - name: alloy-tracing-ringtail
     type: argocd
-    last-reviewed: 2026-03-05
-    current-version: "v1.13.1"
+    last-reviewed: 2026-03-13
+    current-version: "v1.14.0"
     upstream-source: https://github.com/grafana/alloy/releases
     notes: Privileged DaemonSet with Beyla eBPF for HTTP tracing on ringtail
 
+  - name: alloy-ringtail
+    type: argocd
+    last-reviewed: 2026-03-13
+    current-version: "v1.14.0"
+    upstream-source: https://github.com/grafana/alloy/releases
+    notes: DaemonSet on ringtail for host metrics and pod logs
+
   - name: alloy-k8s
     type: argocd
-    last-reviewed: 2026-02-16
-    current-version: "v1.13.1"
+    last-reviewed: 2026-03-13
+    current-version: "v1.14.0"
     upstream-source: https://github.com/grafana/alloy/releases
 
   - name: tailscale-operator
@@ -255,8 +262,8 @@ services:
 
   - name: alloy
     type: ansible
-    last-reviewed: null
-    current-version: null
+    last-reviewed: 2026-03-13
+    current-version: "v1.14.0"
     upstream-source: https://github.com/grafana/alloy/releases
     notes: Built from source on indri