Skip to content

Commit 53bf731

Browse files
rdiscalardiscala
committed
CNF-14592: add LokiStack configuration CRs to the optional reference section
Add Loki Operator installation and LokiStack log storage CRs for the telco-core optional logging configuration: - LokiStack CR with 1x.extra-small sizing, S3 storage, v13 schema, and 5-day retention - Loki Operator Namespace, OperatorGroup, Subscription, and installation status verification CR (ztp-deploy-wave: 2) - S3 object storage Secret template - Update ClusterLogForwarder to forward audit and infrastructure logs to the local LokiStack via the collector service account - Add ClusterLogForwarder-to_amend variant with commented-out external forwarding examples Co-authored-by: Claude
1 parent a88ca23 commit 53bf731

13 files changed

Lines changed: 199 additions & 6 deletions

File tree

‎telco-core/configuration/core-baseline.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,12 @@ policies:
4747
status: "True"
4848
reason: InstallSucceeded
4949

50+
# Loki operator (optional component)
51+
# - path: reference-crs/optional/logging/LokiOperatorNS.yaml
52+
# - path: reference-crs/optional/logging/LokiOperatorGroup.yaml
53+
# - path: reference-crs/optional/logging/LokiSubscription.yaml
54+
# - path: reference-crs/optional/logging/LokiOperatorStatus.yaml
55+
5056
# Cert-manager operator (optional component)
5157
# - path: reference-crs/optional/cert-manager/certManagerNS.yaml
5258
# - path: reference-crs/optional/cert-manager/certManagerOperatorgroup.yaml
@@ -94,6 +100,10 @@ policies:
94100
- path: reference-crs/optional/logging/ClusterLogServiceAccountAuditBinding.yaml
95101
- path: reference-crs/optional/logging/ClusterLogServiceAccountInfrastructureBinding.yaml
96102

103+
# LokiStack log storage (optional component)
104+
# - path: reference-crs/optional/logging/LokiSecret.yaml
105+
# - path: reference-crs/optional/logging/LokiStack.yaml
106+
97107
- path: reference-crs/required/networking/sriov/SriovOperatorConfig.yaml
98108
patches:
99109
- spec:

‎telco-core/configuration/core-overlay.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,23 @@ policies:
182182
name: kafka-open
183183
kafka:
184184
url: '{{hub fromConfigMap "" "regional" (printf "%s-log-url" (index .ManagedClusterLabels "region")) | toLiteral hub}}'
185+
# LokiStack local log storage (optional component)
186+
# - name: loki-local
187+
# type: lokiStack
188+
# lokiStack:
189+
# target:
190+
# name: logging-loki
191+
# namespace: openshift-logging
192+
# authentication:
193+
# token:
194+
# from: serviceAccount
195+
# tls:
196+
# ca:
197+
# key: service-ca.crt
198+
# configMapName: openshift-service-ca.crt
199+
# To add local Loki storage, uncomment the loki-local output above
200+
# and add a second pipeline. See ClusterLogForwarder-LokiStack.yaml
201+
# for a complete example.
185202
filters:
186203
- name: custom-labels
187204
type: openshiftLabels

‎telco-core/configuration/reference-crs-kube-compare/compare_ignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ required/machine-config/container-runtime.yaml
1313
ClusterLogging5Cleanup.yaml
1414
ClusterLogOperatorStatus.yaml
1515

16+
# LokiStack variant of ClusterLogForwarder (example only)
17+
ClusterLogForwarder-LokiStack.yaml
18+
1619
# Utility objects to wait for and acknowledge cluster ugprades
1720
ClusterVersion.yaml
1821
upgrade-ack.yaml

‎telco-core/configuration/reference-crs-kube-compare/optional/logging/ClusterLogForwarder.yaml‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,7 @@ metadata:
66
spec:
77
{{- if .spec.outputs }}
88
outputs:
9-
- name: {{ (index .spec.outputs 0).name }}
10-
type: kafka
11-
kafka:
12-
url: {{ (index .spec.outputs 0).kafka.url }}
9+
{{- .spec.outputs | toYaml | nindent 2 }}
1310
{{- end }}
1411
{{- if .spec.filters }}
1512
filters:

‎telco-core/configuration/reference-crs/optional/logging/ClusterLogForwarder-LokiStack.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
apiVersion: observability.openshift.io/v1
3+
kind: ClusterLogForwarder
4+
metadata:
5+
name: instance
6+
namespace: openshift-logging
7+
spec:
8+
outputs:
9+
- name: loki-local
10+
type: lokiStack
11+
lokiStack:
12+
target:
13+
name: logging-loki
14+
namespace: openshift-logging
15+
authentication:
16+
token:
17+
from: serviceAccount
18+
tls:
19+
ca:
20+
key: service-ca.crt
21+
configMapName: openshift-service-ca.crt
22+
23+
# - name: external-logs
24+
# type: <external_type> # e.g., kafka, splunk, syslog
25+
# <external_type>:
26+
# url: <external_url>
27+
pipelines:
28+
- name: infra-audit-to-local-loki
29+
inputRefs:
30+
- audit
31+
- infrastructure
32+
outputRefs:
33+
- loki-local
34+
# - name: infra-audit-to-external
35+
# inputRefs:
36+
# - audit
37+
# - infrastructure
38+
# outputRefs:
39+
# - external-logs
40+
serviceAccount:
41+
name: collector
42+
status:
43+
conditions:
44+
- type: observability.openshift.io/Valid
45+
status: "True"

‎telco-core/configuration/reference-crs/optional/logging/LokiOperatorGroup.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
apiVersion: operators.coreos.com/v1
3+
kind: OperatorGroup
4+
metadata:
5+
name: loki-operator
6+
namespace: openshift-operators-redhat
7+
annotations:
8+
operatorframework.io/bundle-unpack-min-retry-interval: 10m
9+
spec:
10+
upgradeStrategy: Default

‎telco-core/configuration/reference-crs/optional/logging/LokiOperatorNS.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
apiVersion: v1
3+
kind: Namespace
4+
metadata:
5+
name: openshift-operators-redhat
6+
labels:
7+
# The cluster-monitoring label ensures Prometheus scrapes this namespace.
8+
openshift.io/cluster-monitoring: "true"

‎telco-core/configuration/reference-crs/optional/logging/LokiOperatorStatus.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Operator installation verification
2+
# This CR can be used to verify the installation/upgrade of the
3+
# Loki Operator by including status fields as shown in
4+
# examples below
5+
---
6+
apiVersion: operators.coreos.com/v1
7+
kind: Operator
8+
metadata:
9+
name: loki-operator.openshift-operators-redhat
10+
# status:
11+
# components:
12+
# refs:
13+
# - kind: Subscription
14+
# namespace: openshift-operators-redhat
15+
# conditions:
16+
# - type: CatalogSourcesUnhealthy
17+
# status: "False"
18+
# - kind: InstallPlan
19+
# namespace: openshift-operators-redhat
20+
# conditions:
21+
# - type: Installed
22+
# status: "True"
23+
# - kind: ClusterServiceVersion
24+
# namespace: openshift-operators-redhat
25+
# conditions:
26+
# - type: Succeeded
27+
# status: "True"
28+
# reason: InstallSucceeded

‎telco-core/configuration/reference-crs/optional/logging/LokiSecret.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Object storage credentials template
2+
#
3+
# Note: In production environments, secrets should be managed via secure
4+
# methods such as the External Secrets Operator, Sealed Secrets, or a
5+
# secrets management platform (e.g., HashiCorp Vault, AWS Secrets Manager).
6+
# Avoid committing actual credentials to version control.
7+
---
8+
apiVersion: v1
9+
kind: Secret
10+
metadata:
11+
name: logging-loki-s3
12+
namespace: openshift-logging
13+
stringData:
14+
access_key_id: "<access key>"
15+
access_key_secret: "<access key secret>"
16+
bucketnames: "<bucket names>"
17+
endpoint: "<storage endpoint>" # e.g. <https://storage.endpoint.url>
18+
region: "<region>"

‎telco-core/configuration/reference-crs/optional/logging/LokiStack.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# Important: do not reuse the same LokiStack that is used for logging
2+
# See: https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/network_observability/installing-network-observability-operators
3+
---
4+
apiVersion: loki.grafana.com/v1
5+
kind: LokiStack
6+
metadata:
7+
name: logging-loki
8+
namespace: openshift-logging
9+
spec:
10+
managementState: Managed
11+
limits:
12+
global:
13+
retention:
14+
days: 5 # Default retention period. User-configurable.
15+
# Sizing: uses Loki's built-in defaults for PVC sizing, which are determined
16+
# by the operator based on the size profile.
17+
# Important: sufficient storage must be provided according to data
18+
# requirements and the retention period configured above.
19+
size: 1x.extra-small # 14 vCPUs, 31Gi memory, 430Gi disk, 100GB/day
20+
storage:
21+
schemas:
22+
- version: v13
23+
# effectiveDate controls when this schema version becomes active.
24+
# CRITICAL: Must be set to a date in the PAST (at least 2 months before
25+
# deployment) to ensure the schema is immediately active when Loki starts.
26+
# Setting it in the future will prevent Loki from ingesting any logs.
27+
# Setting it too recently may cause Loki to reject logs with timestamps
28+
# that predate the effectiveDate. Cannot be changed retroactively.
29+
# Example: If deploying in May 2026, set to "2026-03-01" or earlier.
30+
effectiveDate: "<yyyy-mm-dd>" # e.g., "2026-03-01"
31+
# Object storage configuration (LONG-TERM LOG STORAGE)
32+
# This secret contains S3-compatible object storage credentials where
33+
# compressed log chunks and indexes are stored permanently.
34+
secret:
35+
name: logging-loki-s3
36+
type: s3
37+
# Block storage configuration (SHORT-TERM BUFFERING)
38+
# storageClassName provisions PVCs for Loki component StatefulSets.
39+
# Used for: Write-Ahead Logs (WAL), temporary chunk caching, ingester buffering.
40+
# This is INDEPENDENT from object storage - both are required.
41+
storageClassName: "ocs-storagecluster-ceph-rbd" # Set to the cluster's available StorageClass
42+
tenants:
43+
mode: openshift-logging

0 commit comments

Comments
 (0)