You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
== Deploying a Loki log store on an STS enabled cluster
31
+
32
+
For cloud based storage, you can use the xref:/../../authentication/managing_cloud_provider_credentials/cco-short-term-creds.adoc[Cloud Credential Operator (CCO)] and CCO utility (`ccoctl`) to configure authentication for your {logging} object store.
33
+
34
+
[NOTE]
35
+
====
36
+
STS authentication must be configured during a new installation of {loki-op}, on an STS enabled cluster. You cannot configure an existing cluster that uses a different credentials strategy to use this feature.
= Creating a LokiStack custom resource by using the CLI
8
8
9
9
You can create a `LokiStack` custom resource (CR) by using the {oc-first}.
@@ -17,6 +17,7 @@ You can create a `LokiStack` custom resource (CR) by using the {oc-first}.
17
17
.Procedure
18
18
19
19
. Create a `LokiStack` CR:
20
+
// tag::pre-5.9[]
20
21
+
21
22
--
22
23
.Example `LokiStack` CR
@@ -38,26 +39,53 @@ spec:
38
39
type: s3 # <3>
39
40
storageClassName: <storage_class_name> # <4>
40
41
tenants:
41
-
mode: openshift-logging # <5>
42
+
mode: openshift-logging
42
43
----
43
44
<1> Specify the deployment size. In the {logging} 5.8 and later versions, the supported size options for production instances of Loki are `1x.extra-small`, `1x.small`, or `1x.medium`.
44
-
+
45
+
<2> Specify the name of your log store secret.
46
+
<3> Specify the type of your log store secret.
47
+
<4> Specify the name of a storage class for temporary storage. For best performance, specify a storage class that allocates block storage. Available storage classes for your cluster can be listed by using the `oc get storageclasses` command.
48
+
45
49
[IMPORTANT]
46
50
====
47
51
It is not possible to change the number `1x` for the deployment size.
48
52
====
49
-
<2> Specify the name of your log store secret.
50
-
<3> Specify the type of your log store secret.
51
-
<4> Specify the name of a storage class for temporary storage. For best performance, specify a storage class that allocates block storage. Available storage classes for your cluster can be listed by using the `oc get storageclasses` command.
52
-
<5> LokiStack defaults to running in multi-tenant mode, which cannot be modified. One tenant is provided for each log type: audit, infrastructure, and application logs. This enables access control for individual users and user groups to different log streams.
53
-
--
54
53
55
-
. Apply the `LokiStack` CR by running the following command:
54
+
// end::pre-5.9[]
55
+
56
+
// tag::5.9[]
56
57
+
57
-
[source,terminal]
58
+
.Example `LokiStack` CR
59
+
[source,yaml]
58
60
----
59
-
$ oc apply -f <filename>.yaml
61
+
apiVersion: loki.grafana.com/v1
62
+
kind: LokiStack
63
+
metadata:
64
+
name: logging-loki # <1>
65
+
namespace: openshift-logging
66
+
spec:
67
+
size: 1x.small # <2>
68
+
storage:
69
+
schemas:
70
+
- effectiveDate: '2023-10-15'
71
+
version: v13
72
+
secret:
73
+
name: logging-loki-s3 # <3>
74
+
type: s3 # <4>
75
+
credentialMode: # <5>
76
+
storageClassName: <storage_class_name> # <6>
77
+
tenants:
78
+
mode: openshift-logging
60
79
----
80
+
<1> Use the name `logging-loki`.
81
+
<2> Specify the deployment size. In the {logging} 5.8 and later versions, the supported size options for production instances of Loki are `1x.extra-small`, `1x.small`, or `1x.medium`.
82
+
<3> Specify the secret used for your log storage.
83
+
<4> Specify the corresponding storage type.
84
+
<5> Optional field, {logging} 5.9 and later. Supported user configured values are as follows: `static` is the default authentication mode available for all supported object storage types using credentials stored in a Secret. `token` for short-lived tokens retrieved from a credential source. In this mode the static configuration does not contain credentials needed for the object storage. Instead, they are generated during runtime using a service, which allows for shorter-lived credentials and much more granular control. This authentication mode is not supported for all object storage types. `token-cco` is the default value when Loki is running on managed STS mode and using CCO on STS/WIF clusters.
85
+
<6> Enter the name of a storage class for temporary storage. For best performance, specify a storage class that allocates block storage. Available storage classes for your cluster can be listed by using the `oc get storageclasses` command.
86
+
// end::5.9[]
87
+
88
+
. Apply the `LokiStack` CR by running the following command:
= Creating a LokiStack custom resource by using the web console
8
+
9
+
You can create a `LokiStack` custom resource (CR) by using the {product-title} web console.
10
+
11
+
.Prerequisites
12
+
13
+
* You have administrator permissions.
14
+
* You have access to the {product-title} web console.
15
+
* You installed the {loki-op}.
16
+
17
+
.Procedure
18
+
19
+
. Go to the *Operators*->*Installed Operators* page. Click the *All instances* tab.
20
+
21
+
. From the *Create new* drop-down list, select *LokiStack*.
22
+
23
+
. Select *YAML view*, and then use the following template to create a `LokiStack` CR:
24
+
// tag::pre-5.9[]
25
+
+
26
+
[source,yaml]
27
+
----
28
+
apiVersion: loki.grafana.com/v1
29
+
kind: LokiStack
30
+
metadata:
31
+
name: logging-loki # <1>
32
+
namespace: openshift-logging
33
+
spec:
34
+
size: 1x.small # <2>
35
+
storage:
36
+
schemas:
37
+
- version: v12
38
+
effectiveDate: '2022-06-01'
39
+
secret:
40
+
name: logging-loki-s3 # <3>
41
+
type: s3 # <4>
42
+
credentialMode: static #
43
+
storageClassName: <storage_class_name> # <5>
44
+
tenants:
45
+
mode: openshift-logging
46
+
----
47
+
<1> Use the name `logging-loki`.
48
+
<2> Specify the deployment size. In the {logging} 5.8 and later versions, the supported size options for production instances of Loki are `1x.extra-small`, `1x.small`, or `1x.medium`.
49
+
<3> Specify the secret used for your log storage.
50
+
<4> Specify the corresponding storage type.
51
+
<5> Enter the name of a storage class for temporary storage. For best performance, specify a storage class that allocates block storage. Available storage classes for your cluster can be listed by using the `oc get storageclasses` command.
52
+
// end::pre-5.9[]
53
+
54
+
// tag::5.9[]
55
+
+
56
+
[source,yaml]
57
+
----
58
+
apiVersion: loki.grafana.com/v1
59
+
kind: LokiStack
60
+
metadata:
61
+
name: logging-loki # <1>
62
+
namespace: openshift-logging
63
+
spec:
64
+
size: 1x.small # <2>
65
+
storage:
66
+
schemas:
67
+
- effectiveDate: '2023-10-15'
68
+
version: v13
69
+
secret:
70
+
name: logging-loki-s3 # <3>
71
+
type: s3 # <4>
72
+
credentialMode: # <5>
73
+
storageClassName: <storage_class_name> # <6>
74
+
tenants:
75
+
mode: openshift-logging
76
+
----
77
+
<1> Use the name `logging-loki`.
78
+
<2> Specify the deployment size. In the {logging} 5.8 and later versions, the supported size options for production instances of Loki are `1x.extra-small`, `1x.small`, or `1x.medium`.
79
+
<3> Specify the secret used for your log storage.
80
+
<4> Specify the corresponding storage type.
81
+
<5> Optional field, {logging} 5.9 and later. Supported user configured values are as follows: `static` is the default authentication mode available for all supported object storage types using credentials stored in a Secret. `token` for short-lived tokens retrieved from a credential source. In this mode the static configuration does not contain credentials needed for the object storage. Instead, they are generated during runtime using a service, which allows for shorter-lived credentials and much more granular control. This authentication mode is not supported for all object storage types. `token-cco` is the default value when Loki is running on managed STS mode and using CCO on STS/WIF clusters.
82
+
<6> Enter the name of a storage class for temporary storage. For best performance, specify a storage class that allocates block storage. Available storage classes for your cluster can be listed by using the `oc get storageclasses` command.
Workload identity federation enables authentication to cloud-based log stores using short-lived tokens.
8
+
9
+
.Prerequisites
10
+
* {product-title} 4.14 and later
11
+
* {logging-uc} 5.9 and later
12
+
13
+
.Procedure
14
+
* If you use the {product-title} web console to install the {loki-op}, STS clusters are automatically detected. You are prompted to create roles and supply the data required for the {loki-op} to create a `CredentialsRequest` object, which populates a secret.
15
+
16
+
* If you use the {oc-first} to install the {loki-op}, you must manually create a subscription object using the appropriate template for your storage provider, as shown in the following examples. This authentication strategy is only supported for the storage providers indicated.
0 commit comments