Setup Install Loki with Docker or Docker Compose You can install Loki and Alloy with Docker or Docker Compose if you are evaluating, testing, or developing Loki. For production, Grafana recommends installing with Helm or Tanka. The configuration files associated with these installation instructions run Loki as a single binary. Prerequisites Docker Docker Compose (optional, only needed for the Docker Compose install method) Install with Docker on Linux Create a directory called loki. Make loki your current working directory: mkdir loki cd loki Copy and paste the following command into your command line to download loki-local-config.yaml to your loki directory. If necessary, update the Loki version numbers in the commands to match your version of Loki. wget https://raw.githubusercontent.com/grafana/loki/v3.6.0/cmd/loki/loki-local-config.yaml -O loki-config.yaml Copy and paste the following command into your command line to start the Docker container using the configuration file you downloaded in the previous step. If necessary, update the Loki version numbers in the commands to match your version of Loki. docker run --name loki -d -v $(pwd):/mnt/config -p 3100:3100 grafana/loki:3.6.0 -config.file=/mnt/config/loki-config.yaml {{< admonition type="note" >}} The image is configured to run by default as user loki with UID 10001 and GID 10001. You can use a different user, specially if you are using bind mounts, by specifying the UID with a docker run command and using --user=UID with a numeric UID suited to your needs. {{< /admonition >}} To send logs to Loki, consider using Grafana Alloy. Verify that your containers are running: docker container ls You should see something similar to the following: CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES cece1df84519 grafana/loki:3.6.0 "/usr/bin/loki -conf…" About a minute ago Up About a minute 0.0.0.0:3100->3100/tcp, :::3100->3100/tcp loki Verify that Loki is up and running. To view readiness, navigate to http://localhost:3100/ready. To view metrics, navigate to http://localhost:3100/metrics. Install with Docker on Windows Copy and paste the following commands into your command line to download loki-local-config.yaml to your loki directory. Note that you will need to replace the in the commands with your local path. If necessary, update the Loki version numbers in the commands to match your version of Loki. cd "" wget https://raw.githubusercontent.com/grafana/loki/v3.6.0/cmd/loki/loki-local-config.yaml -O loki-config.yaml Copy and paste the following command into your command line to start the Docker container using the configuration file you downloaded in the previous step. Note that you will need to replace the in the commands with your local path. If necessary, update the Loki version numbers in the commands to match your version of Loki. docker run --name loki -v :/mnt/config -p 3100:3100 grafana/loki:3.6.0 --config.file=/mnt/config/loki-config.yaml To send logs to Loki, consider using Grafana Alloy. Verify that Loki is up and running. To view readiness, navigate to http://localhost:3100/ready. To view metrics, navigate to http://localhost:3100/metrics. Install with Docker Compose Run the following commands in your command line. They work for Windows or Linux systems. Create a directory called loki. Make loki your current working directory: mkdir loki cd loki Copy and paste the following commands into your command line to download the docker-compose.yaml and alloy-local-config.yaml files. If necessary, update the Loki version numbers in the commands to match your version of Loki. wget https://raw.githubusercontent.com/grafana/loki/v3.6.0/examples/getting-started/docker-compose.yaml -O docker-compose.yaml wget https://raw.githubusercontent.com/grafana/loki/v3.6.0/examples/getting-started/alloy-local-config.yaml -O alloy-local-config.yaml wget https://raw.githubusercontent.com/grafana/loki/v3.6.0/examples/getting-started/loki-config.yaml -O loki-config.yaml With loki as the current working directory, run the following 'docker-compose` command: docker-compose -f docker-compose.yaml up You should see something similar to the following: ✔ Container loki-loki-1 Started 0.0s ✔ Container loki-grafana-1 Started 0.0s ✔ Container loki-alloy-1 Started 0.0s Verify that Loki is up and running. To view read path readiness, navigate to http://localhost:3101/ready. To view read path metrics, navigate to http://localhost:3101/metrics. To view write path readiness, navigate to http://localhost:3102/ready. To view write path metrics, navigate to http://localhost:3102/metrics. Build from source Clone the Grafana Loki repository and use the provided Makefile to build Loki from source. {{< admonition type="note" >}} Grafana Loki does not come with any included authentication layer. You must run an authenticating reverse proxy in front of your services to prevent unauthorized access to Loki (for example, nginx). Refer to Manage authentication for a list of open-source reverse proxies you can use. {{< /admonition >}} Prerequisites Go, version 1.26 or later (check the go directive in go.mod for the exact minimum version); set your $GOPATH environment variable make Docker (for updating protobuf and yacc files) Build locally Clone Loki to $GOPATH/src/github.com/grafana/loki: git clone https://github.com/grafana/loki $GOPATH/src/github.com/grafana/loki With a current working directory of $GOPATH/src/github.com/grafana/loki: make loki The built executable will be in $GOPATH/src/github.com/grafana/loki/cmd/loki/loki. Install on Istio When installing Loki on Istio service mesh you must complete some additional steps. Without these steps, the ingester, querier, etc. might start, but you will see logs like the following: loki level=debug ts=2021-11-24T11:33:37.352544925Z caller=broadcast.go:48 msg="Invalidating forwarded broadcast" key=collectors/distributor version=123 oldVersion=122 content=[loki-distributor-59c4896444-t9t6g[] oldContent=[loki-distributor-59c4896444-t9t6g[] This means that the pod is failing to join the ring. If you try to add loki to Grafana data sources, you will see logs like ( empty ring): loki level=warn ts=2021-11-24T08:02:42.08262122Z caller=logging.go:72 traceID=3fc821042d8ada1a orgID=fake msg="GET /loki/api/v1/labels?end=1637740962079859431&start=1637740361925000000 (500) 97.4µs Response: \"empty ring\\n\" ws: false; X-Scope-Orgid: fake; uber-trace-id: 3fc821042d8ada1a:1feed8872deea75c:1180f95a8235bb6c:0; " When you enable istio-injection on the namespace where Loki is running, you need to also modify the configuration for the Loki services. Given that Istio will not allow a pod to resolve another pod using an IP address, you must also modify the memberlist service. Required changes Query frontend service Make the following modifications to the file for the Loki Query Frontend service. Change the name of grpc port to grpclb. This is used by the grpc load balancing strategy which relies on SRV records. Otherwise the querier will not be able to reach the query-frontend. See https://github.com/grafana/loki/blob/0116aa61c86fa983ddcbbd5e30a2141d2e89081a/production/ksonnet/loki/common.libsonnet#L19 and https://grpc.github.io/grpc/core/md_doc_load-balancing.html Set the appProtocol of grpclb to tcp Set publishNotReadyAddresses to true apiVersion: v1 kind: Service metadata: labels: app: loki-query-frontend app.kubernetes.io/instance: observability app.kubernetes.io/name: loki-query-frontend spec: ports: - appProtocol: http name: http port: 3100 protocol: TCP targetPort: http - appProtocol: tcp name: grpclb port: 9095 protocol: TCP targetPort: grpc publishNotReadyAddresses: true selector: app: loki-query-frontend app.kubernetes.io/instance: observability app.kubernetes.io/name: loki-query-frontend type: ClusterIP Querier service Make the following modifications to the file for the Loki Querier service. Set the appProtocol of the grpc service to tcp apiVersion: v1 kind: Service metadata: labels: app: loki-querier app.kubernetes.io/instance: observability app.kubernetes.io/name: loki-querier name: loki-querier namespace: observability spec: ports: - appProtocol: http name: http port: 3100 protocol: TCP targetPort: http - appProtocol: tcp name: grpc port: 9095 protocol: TCP targetPort: grpc selector: app: loki-querier app.kubernetes.io/instance: observability app.kubernetes.io/name: loki-querier type: ClusterIP Ingester service and Ingester headless service Make the following modifications to the file for the Loki Query Ingester and Ingester Headless service. Set the appProtocol of the grpc port to tcp. apiVersion: v1 kind: Service metadata: labels: app: loki-ingester-(headless) app.kubernetes.io/instance: observability app.kubernetes.io/name: loki-ingester name: loki-ingester-headless spec: clusterIP: None (if headless) ports: - name: http port: 3100 protocol: TCP targetPort: http - appProtocol: tcp name: grpc port: 9095 protocol: TCP targetPort: grpc selector: app: loki-ingester app.kubernetes.io/instance: observability app.kubernetes.io/name: loki-ingester type: ClusterIP Distributor service Make the following modifications to the file for the Loki Distributor service. Set the appProtocol of the grpc port to tcp. apiVersion: v1 kind: Service metadata: labels: app: loki-distributor app.kubernetes.io/instance: observability app.kubernetes.io/name: loki-distributor spec: ports: - name: http port: 3100 protocol: TCP targetPort: http - name: grpc port: 9095 protocol: TCP targetPort: grpc appProtocol: tcp selector: app: loki-distributor app.kubernetes.io/instance: observability app.kubernetes.io/name: loki-distributor sessionAffinity: None type: ClusterIP Memberlist service Make the following modifications to the file for the Memberlist service. Set the appProtocol of the http port to tcp. apiVersion: v1 kind: Service metadata: labels: app.kubernetes.io/instance: observability name: loki-memberlist namespace: observability spec: clusterIP: None ports: - name: http port: 7946 protocol: TCP targetPort: 7946 appProtocol: tcp selector: app.kubernetes.io/instance: observability app.kubernetes.io/part-of: memberlist Install Grafana Loki locally To log events with Grafana Loki, download and install Loki. Loki is the logging engine. Grafana Alloy is recommended for sending logs to Loki. The configuration runs Loki as a single binary. {{< admonition type="note" >}} Grafana Loki does not come with any included authentication layer. You must run an authenticating reverse proxy in front of your services to prevent unauthorized access to Loki (for example, nginx). Refer to Manage authentication for a list of open-source reverse proxies you can use. {{< /admonition >}} Install using APT or RPM package manager Add the Grafana Advanced Package Tool (APT) or RPM Package Manager (RPM) package repository following the linked instructions. Install Loki Using dnf dnf update dnf install loki Using apt-get apt-get update apt-get install loki Install manually Browse to the release page. Find the Assets section for the version that you want to install. Download the Loki archive file that corresponds to your system. Don't download LogCLI or Loki Canary at this time. LogCLI allows you to run Loki queries in a command line interface. Loki Canary is a tool to audit Loki performance. Extract the package contents into a directory. This is where Loki will run. In the command line, change directory ( cd on most systems) to the directory with Loki. Copy and paste the following command into your command line to download a generic configuration file. Use the Git references that match your downloaded Loki version to get the correct configuration file. For example, if you are using Loki version 3.6.0, you need to use the https://raw.githubusercontent.com/grafana/loki/v3.6.0/cmd/loki/loki-local-config.yaml URL to download the configuration file. wget https://raw.githubusercontent.com/grafana/loki/main/cmd/loki/loki-local-config.yaml Run the following command to start Loki: Windows .\loki-windows-amd64.exe --config.file=loki-local-config.yaml Linux ./loki-linux-amd64 -config.file=loki-local-config.yaml Loki runs and displays Loki logs in your command line and on http://localhost:3100/metrics. The next step is running an agent to send logs to Loki. Refer to Grafana Alloy for the recommended log collection agent. Release binaries - openSUSE Linux only Every release includes binaries for Loki. You can find them on the Releases page. Community openSUSE Linux packages The community provides packages of Loki for openSUSE Linux. To install them: Add the repository https://download.opensuse.org/repositories/security:/logging/ to your system. For example, if you are using Leap 15.1, run: sudo zypper ar https://download.opensuse.org/repositories/security:/logging/openSUSE_Leap_15.1/security:logging.repo sudo zypper ref Install the Loki package: zypper in loki Start and enable the Loki service: systemd start loki systemd enable loki Modify the /etc/loki/loki.yaml configuration file as needed. Tanka Tanka is a reimplementation of Ksonnet that Grafana Labs created after Ksonnet was deprecated. Tanka is used by Grafana Labs to run Grafana Loki in production. The Tanka installation runs the Loki cluster in microservices mode. {{< admonition type="note" >}} Grafana Loki does not come with any included authentication layer. You must run an authenticating reverse proxy in front of your services to prevent unauthorized access to Loki (for example, nginx). Refer to Manage authentication for a list of open-source reverse proxies you can use. {{< /admonition >}} Prerequisites Install the latest version of Tanka (version v0.31.0 or a more recent version) for the tk env commands. Prebuilt binaries for Tanka can be found at the Tanka releases URL. In your config repo, if you don't have a Tanka application, create a folder and call tk init inside of it. Then create an environment for Loki and provide the URL for the Kubernetes API server to deploy to (e.g., https://localhost:6443): mkdir cd tk init tk env add environments/loki --namespace=loki --server= Install jsonnet-bundler ( jb), find instructions for your platform in Tanka's installation docs. Deploying Download and install the Loki module using jb (version v0.6.0 or a more recent version): jb init # not required if you already ran `tk init` jb install github.com/grafana/loki/production/ksonnet/loki@main Install a log-shipping agent Use Grafana Alloy to ship logs to Loki. For installation guidance, refer to: Install Grafana Alloy Install Alloy on Kubernetes Revise the YAML contents of environments/loki/main.jsonnet, updating these variables: Update the username, password, and the relevant htpasswd variable values. Update object storage variables for one backend ( s3, gcs, or azure) and remove variables for backends that are not part of your setup. In this module, storage_backend must be a single value. Refer to storage_config for configuration details. Update the from value in the Loki schema_config section to no more than 7 days prior to the current date. The from date represents the first day for which the schema_config section is valid. For example, if today is 2021-01-15, set from to 2021-01-08. This recommendation is based on the Loki default acceptance of log lines up to 1 week ( 168h) in the past. The reject_old_samples_max_age configuration variable controls the acceptance range. Use TSDB ( store: tsdb, schema: v13) for new installs. local gateway = import 'loki/gateway.libsonnet'; local loki = import 'loki/loki.libsonnet'; loki + gateway { _config+:: { namespace: 'loki', htpasswd_contents: 'loki:$apr1$H4yGiGNg$ssl5/NymaGFRUvxIV1Nyr.', // Use TSDB shipper using_tsdb_shipper: true // Pick one object storage backend: 's3', 'gcs', or 'azure' storage_backend: 's3', // S3 variables (used when storage_backend = 's3') s3_access_key: 'key', s3_secret_access_key: 'secret access key', s3_address: 'url', s3_bucket_name: 'loki-chunks', s3_bucket_region: 'us-east-1', s3_path_style: false, // GCS variables (used when storage_backend = 'gcs') // gcs_bucket_name: 'loki-chunks', // Azure variables (used when storage_backend = 'azure') // azure_container_name: 'loki-chunks', // azure_account_name: 'account', // azure_account_key: 'key', // TSDB index store configuration loki+: { schema_config: { configs: [{ from: 'YYYY-MM-DD', store: 'tsdb', object_store: $._config.storage_backend, schema: 'v13', index: { prefix: '%s_index_' % $._config.table_prefix, period: '%dh' % $._config.index_period_hours, }, }], }, }, replication_factor: 3, memberlist_ring_enabled: true, }, } Run tk show environments/loki to see the manifests that will be deployed to the cluster. Run tk apply environments/loki to deploy the manifests. To delete the environment from cluster, run tk delete environments/loki. Helm chart components This section describes the components installed by the Helm Chart. For the ports and protocols these components use, refer to Loki network ports. 3 methods of deployment The Loki chart supports three methods of deployment: Monolithic Simple Scalable Microservice By default, the chart installs in Monolithic mode ( deploymentMode: Monolithic). For production at scale, we recommend deploying Loki in microservices ( deploymentMode: Distributed) mode. To understand the differences between deployment methods, see the Loki deployment modes documentation. {{< admonition type="note" >}} Simple Scalable Deployment (SSD) mode is being deprecated and removed in Loki 4.0. {{< /admonition >}} Zone-aware replication When deploying in microservices mode, the chart enables zone-aware replication for ingesters by default ( ingester.zoneAwareReplication.enabled: true). This creates three ingester StatefulSets (zone-a, zone-b, zone-c) and requires enabling the rollout-operator subchart ( rollout_operator.enabled: true) for coordinated zone rollouts. Zone-aware replication allows multiple ingesters within a single zone to be shut down and restarted simultaneously during rollouts, while the remaining two zones guarantee at least one copy of the data. To disable zone-aware replication (for example, in a development or test environment): ingester: zoneAwareReplication: enabled: false If you deploy Loki using the jsonnet (ksonnet) method instead of the Helm chart, refer to Speed up ingester rollout using zone awareness, which describes the equivalent multi_zone_ingester_* jsonnet configuration. Pattern ingester The chart includes an optional pattern ingester component ( patternIngester) for detecting and extracting log patterns. It is disabled by default ( patternIngester.enabled: false, replicas: 0). In Distributed mode ( deploymentMode: Distributed), enable the standalone workload with: deploymentMode: Distributed patternIngester: enabled: true replicas: 1 loki: pattern_ingester: enabled: true In Monolithic or SimpleScalable mode, enable it via Loki configuration only: loki: pattern_ingester: enabled: true Overrides exporter The overrides exporter ( overridesExporter) is an optional component that exposes per-tenant configuration overrides as Prometheus metrics. It is disabled by default ( overridesExporter.enabled: false). Enable it when you need visibility into tenancy-level limit settings. Bloom filters (deprecated) Bloom filters are deprecated and will be removed in a future release. The chart includes support for bloom filters through three components: bloomGateway: Serves bloom filter queries bloomPlanner: Plans bloom filter build jobs bloomBuilder: Builds bloom filters All three are disabled by default (replicas set to 0). Enable bloom filters in the Loki configuration ( loki.bloom_build.enabled: true, loki.bloom_gateway.enabled: true) and set non-zero replica counts for the corresponding components. Monitoring Loki The Loki Helm chart includes built-in monitoring resources that can be enabled: ServiceMonitor ( monitoring.serviceMonitor.enabled): Creates Prometheus Operator ServiceMonitor resources for scraping Loki metrics. Recording rules ( monitoring.rules.enabled): Creates a PrometheusRule resource with loki-mixin recording rules. Alert rules ( monitoring.alerts.enabled): Creates a PrometheusRule resource with alerts such as LokiRequestErrors, LokiRequestPanics, and LokiRequestLatency. Dashboards ( monitoring.dashboards.enabled): Creates ConfigMaps containing Grafana dashboards for monitoring Loki. These built-in monitoring resources are disabled by default. For comprehensive cluster-wide observability, use the Kubernetes monitoring Helm chart. See Monitoring for details. {{< admonition type="note" >}} For comprehensive cluster-wide observability, Grafana Labs recommends the Kubernetes monitoring Helm chart. The Loki chart still provides optional built-in Prometheus Operator resources under monitoring.*; only the former monitoring.selfMonitoring / Grafana Agent integration has been removed. {{< /admonition >}} Canary This chart installs the Loki Canary app by default. This is another tool to verify the Loki deployment is in a healthy state. It can be disabled by setting lokiCanary.enabled=false. Gateway By default and inspired by Grafana's Tanka setup, the chart installs the gateway component which is an NGINX that exposes the Loki API and automatically proxies requests to the correct Loki components (read or write, or single instance in the case of filesystem storage). You can expose Loki either through gateway.ingress (with gateway.enabled: true) or through the top-level ingress key (with gateway.enabled: false), but not both. If the gateway is enabled, Grafana and log shipping agents, such as Grafana Alloy, should be configured to use the gateway. If NetworkPolicies are enabled, they are more restrictive if the gateway is enabled. Caching By default, the chart deploys Memcached-based chunks cache ( chunksCache.enabled: true) and results cache ( resultsCache.enabled: true). To use an externally managed Memcached instead, disable the built-in caches and point chunksCache.addresses / resultsCache.addresses at your service. See caching for tuning guidance. StatefulSet persistence Several components in this chart run as Kubernetes StatefulSets, including ingester, write, backend, and singleBinary, which all use kind: StatefulSet by default. Some Helm values map to StatefulSet fields that Kubernetes treats as immutable after the StatefulSet is created, such as storage class, persistent volume claim (PVC) size, access modes, and podManagementPolicy. If you change one of these values and run helm upgrade, the upgrade can fail. For a few of these values, including PVC size and podManagementPolicy, you can set *.statefulSetRecreateJob.enabled on a Loki component. This runs an experimental job before the upgrade that deletes the StatefulSet but keeps its pods and PVCs, so no data is lost. The job does not handle other changes, such as storage class or access modes. Those still require a manual migration. For the full list of affected values, which components render StatefulSets in each deployment mode, and how the recreate job works, see the "StatefulSet immutability" section of the chart's README on GitHub. Helm chart values Helm chart values This is the generated reference for the Loki Helm chart values, sourced from the values.yaml of the chart in the grafana-community/helm-charts repository. Because the Loki Helm chart exposes a large number of configuration options, this reference is grouped into sections by top-level configuration key. Each section lists the configurable keys under that prefix along with their type, description, and default value. To navigate it: Use the Sections list below to jump to a configuration group. Use your browser search ( Ctrl+F) to locate a specific key. For installation examples and setup instructions, refer to the Helm installation guides rather than this reference. {{< admonition type="note" >}} This reference is for the Loki Helm chart version 3.0 or greater. If you are using the grafana/loki-stack Helm chart from the grafana repo, please refer to the values.yaml of the respective GitHub repository grafana/helm-charts. {{< /admonition >}} Sections Top-level values backend — Configuration for the backend pod(s) bloomBuilder — Configuration for the bloom-builder bloomGateway — Configuration for the bloom-gateway bloomPlanner — Configuration for the bloom-planner chunksCache — Configuration for the Memcached-based chunks-cache, which caches the log chunks Loki fetches from object storage. compactor — Configuration for the compactor defaults — Default settings applied to the Loki components only. distributor — Configuration for the distributor gateway — Configuration for the gateway, an NGINX reverse proxy that routes incoming read and write requests to the appropriate Loki components. global — Global values that apply to all components and subcharts, such as image registry, DNS configuration, and common environment variables. indexGateway — Configuration for the index-gateway ingester — Configuration for the ingester ingress — Ingress configuration Use either this ingress or the gateway, but not both at once. loki — Configuration for running Loki lokiCanary — Configuration for the Loki Canary, which continuously pushes logs to and queries them from this Loki installation to verify it is working correctly. memberlist — Configuration for the memberlist service, the gossip-based ring Loki components use for service discovery and hash-ring coordination. memcached — Common configuration shared by the Memcached deployments backing Loki's caches. memcachedExporter — Configuration for the Prometheus Memcached exporter sidecar that exposes cache metrics. migrate — Options that may be necessary when performing a migration from another helm chart monitoring — Monitoring section determines which monitoring features to enable networkPolicy — Configuration for the Kubernetes NetworkPolicies that control inbound and outbound traffic for Loki components. overridesExporter — Configuration for the overrides-exporter patternIngester — Configuration for the pattern ingester querier — Configuration for the querier queryFrontend — Configuration for the query-frontend queryScheduler — Configuration for the query-scheduler rbac — Configuration for the Kubernetes RBAC resources and Pod Security Policy settings created for Loki. read — Configuration for the read pod(s) resultsCache — Configuration for the Memcached-based results-cache, which caches query results to speed up repeated queries. rollout_operator — Setting for the Grafana Rollout Operator https://github.com/grafana/helm-charts/tree/main/charts/rollout-operator route — Gateway API routes for direct routing to Loki services, bypassing the nginx gateway. ruler — Configuration for the ruler serviceAccount — Configuration for the Kubernetes ServiceAccount used by Loki components. sidecar — Configuration for the k8s-sidecar container that watches for ConfigMaps and Secrets (such as rules and dashboards) and loads them into Loki. singleBinary — Configuration for the single binary node(s) used in Monolithic deployment mode, where all Loki components run in a single process. tableManager — DEPRECATED Configuration for the table-manager. test — Section for configuring optional Helm test write — Configuration for the write pod(s) in SimpleScalable mode, which run the distributor and ingester components. Top-level values Values that are not part of a specific component group. Key Type Description Default commonLabels object Labels to be added to resources {} deploymentMode string Deployment mode lets you specify how to deploy Loki. There are 3 options: - Monolithic (deprecated: SingleBinary): Loki is deployed as a single binary, useful for small installs typically without HA, up to a few tens of GB/day. - SimpleScalable (deprecated, removed in Loki 4): Loki is deployed as 3 targets: read, write, and backend. Useful for medium installs easier to manage than distributed, up to a about 1TB/day. - Distributed: Loki is deployed as individual microservices. The most complicated but most capable, useful for large installs, typically over 1TB/day. There are also 2 additional modes used for migrating between deployment modes: - Monolithic<->SimpleScalable (deprecated: SingleBinary<->SimpleScalable): Migrate from SingleBinary to SimpleScalable (or vice versa) - SimpleScalable<->Distributed: Migrate from SimpleScalable to Distributed (or vice versa) Note: SimpleScalable and Distributed REQUIRE the use of object storage. Ref: https://grafana.com/docs/loki/latest/get-started/deployment-modes/ "Monolithic" extraObjects string nil fullnameOverride string Overrides the chart's computed fullname "" ignoreMinioDeprecation bool Ignore MinIO deprecation validation when minio.enabled=true. This is a temporary compatibility escape hatch. false imagePullSecrets list Image pull secrets for Docker images [] kubeVersionOverride string Overrides the version used to determine compatibility of resources with the target Kubernetes cluster. This is useful when using helm template, because then helm will use the client version of kubectl as the Kubernetes version, which may or may not match your cluster's server version. Example: 'v1.24.4'. Set to null to use the version that helm devises. "" minio object Configuration for the minio subchart (deprecated) {"address":null,"buckets":[{"name":"chunks","policy":"none","purge":false},{"name":"ruler","policy":"none","purge":false}],"drivesPerNode":2,"enabled":false,"persistence":{"annotations":{},"size":"5Gi"},"replicas":1,"resources":{"requests":{"cpu":"100m","memory":"128Mi"}},"rootPassword":"supersecretpassword","rootUser":"root-user","users":[{"accessKey":"logs-user","policy":"readwrite","secretKey":"supersecretpassword"}]} nameOverride string Overrides the chart's name "" namespaceOverride string Overrides the chart's namespace "" podDisruptionBudget object Pod Disruption Budget for single binary deployment. Deprecated in favor of singleBinary.podDisruptionBudget {"enabled":true} backend Configuration for the backend pod(s) Key Type Description Default backend.affinity object Affinity for backend pods. The value will be passed through tpl. Hard node anti-affinity backend.annotations object Annotations for backend StatefulSet {} backend.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account true backend.autoscaling.behavior object Behavior policies while scaling. {} backend.autoscaling.enabled bool Enable autoscaling for the backend. false backend.autoscaling.maxReplicas int Maximum autoscaling replicas for the backend. 6 backend.autoscaling.minReplicas int Minimum autoscaling replicas for the backend. 3 backend.autoscaling.targetCPUUtilizationPercentage int Target CPU utilization percentage for the backend. 60 backend.autoscaling.targetMemoryUtilizationPercentage string Target memory utilization percentage for the backend. nil backend.dnsConfig object DNS config for backend pods {} backend.enabled bool Enable the component. Requires loki.deploymentMode to be set to SimpleScalable. true backend.extraArgs list Additional CLI args for the backend [] backend.extraContainers list Containers to add to the backend pods [] backend.extraEnv list Environment variables to add to the backend pods [] backend.extraEnvFrom list Environment variables from secrets or configmaps to add to the backend pods [] backend.extraVolumeMounts list Volume mounts to add to the backend pods [] backend.extraVolumes list Volumes to add to the backend pods [] backend.fullnameOverride string Override for the backend fullname. By default, this is generated using the fullname template with "-backend" "{{ include \"loki.name\" . }}-backend" backend.hostUsers string Use the host's user namespace in the backend pods. nil backend.image.registry string The Docker registry for the backend image. Overrides loki.image.registry nil backend.image.repository string Docker image repository for the backend image. Overrides loki.image.repository nil backend.image.tag string Docker image tag for the backend image. Overrides loki.image.tag nil backend.initContainers list Init containers to add to the backend pods [] backend.kedaAutoscaling.behavior object Behavior configuration for KEDA ScaledObject (horizontalPodAutoscalerConfig.behavior). Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#advanced {} backend.kedaAutoscaling.cooldownPeriod string Period to wait after the last trigger reported active before scaling the resource back to 0 (seconds). Defaults to defaults.kedaAutoscaling.cooldownPeriod if not set. nil backend.kedaAutoscaling.enabled bool Enable KEDA autoscaling for the backend. Mutually exclusive with autoscaling.enabled false backend.kedaAutoscaling.fallback object Fallback configuration for KEDA ScaledObject. Applied when the trigger metric cannot be retrieved. Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#fallback {} backend.kedaAutoscaling.maxReplicas int Maximum replicas for KEDA autoscaling 6 backend.kedaAutoscaling.minReplicas int Minimum replicas for KEDA autoscaling 3 backend.kedaAutoscaling.pollingInterval string Interval (seconds) to poll each trigger. Defaults to defaults.kedaAutoscaling.pollingInterval if not set. nil backend.kedaAutoscaling.triggers list KEDA triggers for the backend. Ref: https://keda.sh/docs/latest/scalers/ [] backend.kind string Kind of backend workload. StatefulSet and Deployment are supported. "StatefulSet" backend.labels object Additional labels for backend StatefulSet {} backend.maxUnavailable int Pod Disruption Budget maxUnavailable @deprecated -- This is deprecated in favor of podDisruptionBudget.maxUnavailable. 1 backend.nodeSelector object Node selector for backend pods {} backend.persistence.accessModes list Set access modes on the PersistentVolumeClaim ["ReadWriteOnce"] backend.persistence.annotations object Annotations for volume claim {} backend.persistence.dataVolumeParameters object Parameters used for the data volume when volumeClaimEnabled if false {"emptyDir":{}} backend.persistence.enableStatefulSetAutoDeletePVC bool Enable StatefulSetAutoDeletePVC feature true backend.persistence.enabled bool Enable volume claims in pod spec false backend.persistence.labels object Labels for volume claim {} backend.persistence.selector string Selector for persistent disk nil backend.persistence.size string Size of persistent disk "10Gi" backend.persistence.storageClass string Storage class to be used. If defined, storageClassName: . If set to "-", storageClassName: "", which disables dynamic provisioning. If empty or set to null, no storageClassName spec is set, choosing the default provisioner (gp2 on AWS, standard on GKE, AWS, and OpenStack). nil backend.persistence.volumeAttributesClassName string Volume attributes class name to be used. If empty or set to null, no volumeAttributesClassName spec is set. Requires Kubernetes 1.31 nil backend.persistence.volumeClaimsEnabled bool Enable volume claims in pod spec. Deprecated in favor of persistence.enabled. true backend.persistence.whenDeleted string What to do with the volumes when the StatefulSet is deleted. "Delete" backend.persistence.whenScaled string What to do with the volume when the StatefulSet is scaled down. "Delete" backend.podAnnotations object Annotations for backend pods {} backend.podDisruptionBudget.annotations object Annotations for Pod Disruption Budget {} backend.podDisruptionBudget.enabled bool Enable Pod Disruption Budget true backend.podDisruptionBudget.labels object Labels for Pod Disruption Budget {} backend.podDisruptionBudget.maxUnavailable string Pod Disruption Budget maxUnavailable nil backend.podDisruptionBudget.minAvailable string Pod Disruption Budget minAvailable nil backend.podDisruptionBudget.unhealthyPodEvictionPolicy string Pod Disruption Budget unhealthyPodEvictionPolicy nil backend.podLabels object Additional labels for each backend pod {} backend.podManagementPolicy string The default is to deploy all pods in parallel. "Parallel" backend.priorityClassName string The name of the PriorityClass for backend pods nil backend.replicas int Number of replicas for the backend. Set to null to omit spec.replicas from the workload, allowing an external controller (e.g. HPA, KEDA, rollout-operator) to manage replica counts without Helm resetting them. 3 backend.resizePolicy list Container resize policy for the backend Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] backend.resources object Resource requests and limits for the backend {} backend.selectorLabels object Additional selector labels for each backend pod {} backend.service.annotations object Annotations for backend Service {} backend.service.appProtocol.grpc string Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" "" backend.service.ipFamilies list ipFamilies for backend Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services [] backend.service.ipFamilyPolicy string ipFamilyPolicy for backend Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services "" backend.service.labels object Additional labels for backend Service {} backend.service.sessionAffinity string Session affinity for backend Service "" backend.service.sessionAffinityConfig object Session affinity config for backend Service {} backend.service.trafficDistribution string trafficDistribution for backend Service "" backend.service.type string Service type for backend Service "ClusterIP" backend.serviceAccount.annotations object Annotations for the service account {} backend.serviceAccount.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account true backend.serviceAccount.create bool Specifies whether a ServiceAccount should be created false backend.serviceAccount.imagePullSecrets list Image pull secrets for the service account [] backend.serviceAccount.labels object Labels for the service account {} backend.serviceAccount.name string The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template nil backend.sidecar bool Whether to enable the rules sidecar true backend.statefulSetRecreateJob object EXPERIMENTAL: Enable creating a Job to recreate the backend StatefulSet when the compactor configuration is changed. # Only applicable if compactor.kind is StatefulSet. Useful for PVC size changes, which require recreating the StatefulSet. {"enabled":false} backend.strategy object UpdateStrategy or Strategy for the backend. {"rollingUpdate":{"partition":0}} backend.terminationGracePeriodSeconds int Grace period to allow the backend to shutdown before it is killed. Especially for the ingester, this must be increased. It must be long enough so backends can be gracefully shutdown flushing/transferring all data and to successfully leave the member ring on shutdown. 300 backend.topologySpreadConstraints list Topology Spread Constraints for backend pods The value will be passed through tpl. [] bloomBuilder Configuration for the bloom-builder Key Type Description Default bloomBuilder.affinity object Affinity for bloom-builder pods. The value will be passed through tpl. Hard node anti-affinity bloomBuilder.annotations object Annotations for bloom-builder {} bloomBuilder.appProtocol.grpc string Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" "" bloomBuilder.autoscaling.behavior.enabled bool Enable autoscaling behaviours false bloomBuilder.autoscaling.behavior.scaleDown object define scale down policies, must conform to HPAScalingRules {} bloomBuilder.autoscaling.behavior.scaleUp object define scale up policies, must conform to HPAScalingRules {} bloomBuilder.autoscaling.customMetrics list Allows one to define custom metrics using the HPA/v2 schema (for example, Pods, Object or External metrics) [] bloomBuilder.autoscaling.enabled bool Enable autoscaling for the bloom-builder false bloomBuilder.autoscaling.maxReplicas int Maximum autoscaling replicas for the bloom-builder 3 bloomBuilder.autoscaling.minReplicas int Minimum autoscaling replicas for the bloom-builder 1 bloomBuilder.autoscaling.targetCPUUtilizationPercentage int Target CPU utilisation percentage for the bloom-builder 60 bloomBuilder.autoscaling.targetMemoryUtilizationPercentage string Target memory utilisation percentage for the bloom-builder nil bloomBuilder.command string Command to execute instead of defined in Docker image nil bloomBuilder.dnsConfig object DNSConfig for bloom-builder pods {} bloomBuilder.enabled bool Enable the component. Requires loki.deploymentMode to be set to Distributed. false bloomBuilder.extraArgs list Additional CLI args for the bloom-builder [] bloomBuilder.extraContainers list Containers to add to the bloom-builder pods [] bloomBuilder.extraEnv list Environment variables to add to the bloom-builder pods [] bloomBuilder.extraEnvFrom list Environment variables from secrets or configmaps to add to the bloom-builder pods [] bloomBuilder.extraVolumeMounts list Volume mounts to add to the bloom-builder pods [] bloomBuilder.extraVolumes list Volumes to add to the bloom-builder pods [] bloomBuilder.hostAliases list hostAliases to add [] bloomBuilder.hostUsers string Use the host's user namespace in the boom-builder nil bloomBuilder.image.registry string The Docker registry for the bloom-builder image. Overrides loki.image.registry nil bloomBuilder.image.repository string Docker image repository for the bloom-builder image. Overrides loki.image.repository nil bloomBuilder.image.tag string Docker image tag for the bloom-builder image. Overrides loki.image.tag nil bloomBuilder.initContainers list Init containers to add to the bloom-builder pods [] bloomBuilder.kedaAutoscaling.behavior object Behavior configuration for KEDA ScaledObject (horizontalPodAutoscalerConfig.behavior). Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#advanced {} bloomBuilder.kedaAutoscaling.cooldownPeriod string Period to wait after the last trigger reported active before scaling the resource back to 0 (seconds). Defaults to defaults.kedaAutoscaling.cooldownPeriod if not set. nil bloomBuilder.kedaAutoscaling.enabled bool Enable KEDA autoscaling for the bloom-builder. Mutually exclusive with autoscaling.enabled false bloomBuilder.kedaAutoscaling.fallback object Fallback configuration for KEDA ScaledObject. Applied when the trigger metric cannot be retrieved. Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#fallback {} bloomBuilder.kedaAutoscaling.maxReplicas int Maximum replicas for KEDA autoscaling 3 bloomBuilder.kedaAutoscaling.minReplicas int Minimum replicas for KEDA autoscaling 1 bloomBuilder.kedaAutoscaling.pollingInterval string Interval (seconds) to poll each trigger. Defaults to defaults.kedaAutoscaling.pollingInterval if not set. nil bloomBuilder.kedaAutoscaling.triggers list KEDA triggers for the bloom-builder. Ref: https://keda.sh/docs/latest/scalers/ [] bloomBuilder.kind string Kind of compactor deployment. StatefulSet and Deployment are supported. "Deployment" bloomBuilder.labels object Labels for bloom-builder {} bloomBuilder.maxUnavailable string Pod Disruption Budget maxUnavailable @deprecated -- This is deprecated in favor of podDisruptionBudget.maxUnavailable. nil bloomBuilder.nodeSelector object Node selector for bloom-builder pods {} bloomBuilder.persistence.accessModes list Set access modes on the generated volumeClaimTemplate. ["ReadWriteOnce"] bloomBuilder.persistence.annotations object Annotations for the generated volumeClaimTemplate. {} bloomBuilder.persistence.enabled bool Enable generic ephemeral volume-backed storage for the bloom-builder data volume. false bloomBuilder.persistence.labels object Labels for the generated volumeClaimTemplate. {} bloomBuilder.persistence.selector string Selector for the generated volumeClaimTemplate. nil bloomBuilder.persistence.size string Size of the generated volumeClaimTemplate. "10Gi" bloomBuilder.persistence.storageClass string Storage class to be used for the generated volumeClaimTemplate. If defined, storageClassName: . If set to "-", storageClassName: "", which disables dynamic provisioning. If empty or set to null, no storageClassName spec is set, choosing the default provisioner. nil bloomBuilder.persistence.type string Storage type for the bloom-builder. pvc and ephemeral are supported. "ephemeral" bloomBuilder.persistence.volumeAttributesClassName string Volume attributes class name to be used for the generated volumeClaimTemplate. If empty or set to null, no volumeAttributesClassName spec is set. Requires Kubernetes 1.31 nil bloomBuilder.podAnnotations object Annotations for bloom-builder pods {} bloomBuilder.podDisruptionBudget.annotations object Annotations for Pod Disruption Budget {} bloomBuilder.podDisruptionBudget.enabled bool Enable Pod Disruption Budget true bloomBuilder.podDisruptionBudget.labels object Labels for Pod Disruption Budget {} bloomBuilder.podDisruptionBudget.maxUnavailable string Pod Disruption Budget maxUnavailable nil bloomBuilder.podDisruptionBudget.minAvailable string Pod Disruption Budget minAvailable nil bloomBuilder.podDisruptionBudget.unhealthyPodEvictionPolicy string Pod Disruption Budget unhealthyPodEvictionPolicy nil bloomBuilder.podLabels object Labels for bloom-builder pods {} bloomBuilder.priorityClassName string The name of the PriorityClass for bloom-builder pods nil bloomBuilder.replicas int Number of replicas for the bloom-builder. Set to null to omit spec.replicas from the workload, allowing an external controller (e.g. HPA, KEDA, rollout-operator) to manage replica counts without Helm resetting them. 0 bloomBuilder.resizePolicy list Container resize policy for the bloom-builder Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] bloomBuilder.resources object Resource requests and limits for the bloom-builder {} bloomBuilder.service.annotations object Annotations for bloom-builder Service {} bloomBuilder.service.appProtocol.grpc string Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" "" bloomBuilder.service.ipFamilies list ipFamilies for bloom-builder Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services [] bloomBuilder.service.ipFamilyPolicy string ipFamilyPolicy for bloom-builder Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services "" bloomBuilder.service.labels object Additional labels for bloom-builder Service {} bloomBuilder.service.sessionAffinity string Session affinity for bloom-builder Service "" bloomBuilder.service.sessionAffinityConfig object Session affinity config for bloom-builder Service {} bloomBuilder.service.trafficDistribution string trafficDistribution for bloom-builder Service "" bloomBuilder.service.type string Service Type for bloom-builder Service "ClusterIP" bloomBuilder.serviceAccount.annotations object Annotations for the service account {} bloomBuilder.serviceAccount.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account true bloomBuilder.serviceAccount.create bool Specifies whether a ServiceAccount should be created false bloomBuilder.serviceAccount.imagePullSecrets list Image pull secrets for the service account [] bloomBuilder.serviceAccount.labels object Labels for the service account {} bloomBuilder.serviceAccount.name string The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template nil bloomBuilder.serviceAnnotations object Annotations for bloom-builder service @deprecated -- This option is deprecated in favor of bloomBuilder.service.annotations {} bloomBuilder.serviceLabels object Labels for bloom-builder service @deprecated -- This option is deprecated in favor of bloomBuilder.service.labels {} bloomBuilder.statefulSetRecreateJob object Enable creating a Job to recreate the compactor StatefulSet when the compactor configuration is changed. # Only applicable if compactor.kind is StatefulSet. Useful for PVC size changes, which require recreating the StatefulSet. {"enabled":false} bloomBuilder.strategy.rollingUpdate.maxUnavailable int Pod Disruption Budget maxUnavailable 1 bloomBuilder.terminationGracePeriodSeconds int Grace period to allow the bloom-builder to shutdown before it is killed 30 bloomBuilder.tolerations list Tolerations for bloom-builder pods [] bloomGateway Configuration for the bloom-gateway Key Type Description Default bloomGateway.affinity object Affinity for bloom-gateway pods. The value will be passed through tpl. Hard node anti-affinity bloomGateway.annotations object Annotations for bloom-builder {} bloomGateway.appProtocol object Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" @deprecated -- This option is deprecated in favor of bloomGateway.service.appProtocol {"grpc":""} bloomGateway.command string Command to execute instead of defined in Docker image nil bloomGateway.dnsConfig object DNSConfig for bloom-gateway pods {} bloomGateway.enabled bool Enable the component. Requires loki.deploymentMode to be set to Distributed. false bloomGateway.extraArgs list Additional CLI args for the bloom-gateway [] bloomGateway.extraContainers list Containers to add to the bloom-gateway pods [] bloomGateway.extraEnv list Environment variables to add to the bloom-gateway pods [] bloomGateway.extraEnvFrom list Environment variables from secrets or configmaps to add to the bloom-gateway pods [] bloomGateway.extraVolumeMounts list Volume mounts to add to the bloom-gateway pods [] bloomGateway.extraVolumes list Volumes to add to the bloom-gateway pods [] bloomGateway.hostAliases list hostAliases to add [] bloomGateway.hostUsers string Use the host's user namespace in the bloom-gateway nil bloomGateway.image.registry string The Docker registry for the bloom-gateway image. Overrides loki.image.registry nil bloomGateway.image.repository string Docker image repository for the bloom-gateway image. Overrides loki.image.repository nil bloomGateway.image.tag string Docker image tag for the bloom-gateway image. Overrides loki.image.tag nil bloomGateway.initContainers list Init containers to add to the bloom-gateway pods [] bloomGateway.kind string Kind of compactor deployment. StatefulSet and Deployment are supported. "StatefulSet" bloomGateway.labels object Labels for bloom-builder {} bloomGateway.livenessProbe object liveness probe settings for bloom-gateway pods. If empty use loki.livenessProbe {} bloomGateway.nodeSelector object Node selector for bloom-gateway pods {} bloomGateway.persistence.annotations object Annotations for bloom-gateway PVCs {} bloomGateway.persistence.claims list List of the bloom-gateway PVCs bloomGateway.persistence.claims[0].accessModes list Set access modes on the PersistentVolumeClaim ["ReadWriteOnce"] bloomGateway.persistence.claims[0].size string Size of persistent disk "10Gi" bloomGateway.persistence.claims[0].volumeAttributesClassName string Volume attributes class name to be used. If empty or set to null, no volumeAttributesClassName spec is set. Requires Kubernetes 1.31 nil bloomGateway.persistence.enableStatefulSetAutoDeletePVC bool Enable StatefulSetAutoDeletePVC feature false bloomGateway.persistence.enabled bool Enable creating PVCs for the bloom-gateway false bloomGateway.persistence.labels object Labels for bloom gateway PVCs {} bloomGateway.podAnnotations object Annotations for bloom-gateway pods {} bloomGateway.podDisruptionBudget.annotations object Annotations for Pod Disruption Budget {} bloomGateway.podDisruptionBudget.enabled bool Enable Pod Disruption Budget true bloomGateway.podDisruptionBudget.labels object Labels for Pod Disruption Budget {} bloomGateway.podDisruptionBudget.maxUnavailable string Pod Disruption Budget maxUnavailable nil bloomGateway.podDisruptionBudget.minAvailable string Pod Disruption Budget minAvailable nil bloomGateway.podDisruptionBudget.unhealthyPodEvictionPolicy string Pod Disruption Budget unhealthyPodEvictionPolicy nil bloomGateway.podLabels object Labels for bloom-gateway pods {} bloomGateway.podManagementPolicy string The default is to deploy all pods in parallel. "Parallel" bloomGateway.priorityClassName string The name of the PriorityClass for bloom-gateway pods nil bloomGateway.readinessProbe object readiness probe settings for bloom-gateway pods. If empty, use loki.readinessProbe {} bloomGateway.replicas int Number of replicas for the bloom-gateway 0 bloomGateway.resizePolicy list Container resize policy for the bloom-gateway Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] bloomGateway.resources object Resource requests and limits for the bloom-gateway {} bloomGateway.service.annotations object Annotations for bloom-gateway Service {} bloomGateway.service.appProtocol.grpc string Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" "" bloomGateway.service.ipFamilies list ipFamilies for bloom-gateway Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services [] bloomGateway.service.ipFamilyPolicy string ipFamilyPolicy for bloom-gateway Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services "" bloomGateway.service.labels object Additional labels for bloom-gateway Service {} bloomGateway.service.sessionAffinity string Session affinity for bloom-gateway Service "" bloomGateway.service.sessionAffinityConfig object Session affinity config for bloom-gateway Service {} bloomGateway.service.trafficDistribution string trafficDistribution for bloom-gateway Service "" bloomGateway.service.type string Service Type for bloom-gateway Service "ClusterIP" bloomGateway.serviceAccount.annotations object Annotations for the service account {} bloomGateway.serviceAccount.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account true bloomGateway.serviceAccount.create bool Specifies whether a ServiceAccount should be created false bloomGateway.serviceAccount.imagePullSecrets list Image pull secrets for the service account [] bloomGateway.serviceAccount.labels object Labels for the service account {} bloomGateway.serviceAccount.name string The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template nil bloomGateway.serviceAnnotations object Annotations for bloom-gateway service @deprecated -- This option is deprecated in favor of bloomGateway.service.annotations {} bloomGateway.serviceLabels object Labels for bloom-gateway service @deprecated -- This option is deprecated in favor of bloomGateway.service.labels {} bloomGateway.startupProbe object startup probe settings for bloom-gateway pods. If empty, use loki.startupProbe {} bloomGateway.statefulSetRecreateJob object Enable creating a Job to recreate the StatefulSet when the StatefulSet configuration is changed. # Only applicable if compactor.kind is StatefulSet. Useful for PVC size changes, which require recreating the StatefulSet. {"enabled":false} bloomGateway.strategy object UpdateStrategy or Strategy for the pattern ingester. {"rollingUpdate":{"partition":0}} bloomGateway.terminationGracePeriodSeconds int Grace period to allow the bloom-gateway to shutdown before it is killed 30 bloomGateway.tolerations list Tolerations for bloom-gateway pods [] bloomPlanner Configuration for the bloom-planner Key Type Description Default bloomPlanner.affinity object Affinity for bloom-planner pods. The value will be passed through tpl. Hard node anti-affinity bloomPlanner.annotations object Annotations for bloom-builder {} bloomPlanner.appProtocol object Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" @deprecated -- This option is deprecated in favor of bloomPlanner.service.appProtocol {"grpc":""} bloomPlanner.command string Command to execute instead of defined in Docker image nil bloomPlanner.dnsConfig object DNSConfig for bloom-planner pods {} bloomPlanner.enabled bool Enable the component. Requires loki.deploymentMode to be set to Distributed. false bloomPlanner.extraArgs list Additional CLI args for the bloom-planner [] bloomPlanner.extraContainers list Containers to add to the bloom-planner pods [] bloomPlanner.extraEnv list Environment variables to add to the bloom-planner pods [] bloomPlanner.extraEnvFrom list Environment variables from secrets or configmaps to add to the bloom-planner pods [] bloomPlanner.extraVolumeMounts list Volume mounts to add to the bloom-planner pods [] bloomPlanner.extraVolumes list Volumes to add to the bloom-planner pods [] bloomPlanner.hostAliases list hostAliases to add [] bloomPlanner.hostUsers string Use the host's user namespace in the bloom-planner nil bloomPlanner.image.registry string The Docker registry for the bloom-planner image. Overrides loki.image.registry nil bloomPlanner.image.repository string Docker image repository for the bloom-planner image. Overrides loki.image.repository nil bloomPlanner.image.tag string Docker image tag for the bloom-planner image. Overrides loki.image.tag nil bloomPlanner.initContainers list Init containers to add to the bloom-planner pods [] bloomPlanner.kind string Kind of compactor deployment. StatefulSet and Deployment are supported. "StatefulSet" bloomPlanner.labels object Labels for bloom-builder {} bloomPlanner.livenessProbe object liveness probe settings for bloom-planner pods. If empty use loki.livenessProbe {} bloomPlanner.nodeSelector object Node selector for bloom-planner pods {} bloomPlanner.persistence.claims list List of the bloom-planner PVCs bloomPlanner.persistence.claims[0].accessModes list Set access modes on the PersistentVolumeClaim ["ReadWriteOnce"] bloomPlanner.persistence.claims[0].annotations object Annotations for bloom-planner PVCs {} bloomPlanner.persistence.claims[0].labels object Labels for bloom planner PVCs {} bloomPlanner.persistence.claims[0].size string Size of persistent disk "10Gi" bloomPlanner.persistence.claims[0].volumeAttributesClassName string Volume attributes class name to be used. If empty or set to null, no volumeAttributesClassName spec is set. Requires Kubernetes 1.31 nil bloomPlanner.persistence.enableStatefulSetAutoDeletePVC bool Enable StatefulSetAutoDeletePVC feature false bloomPlanner.persistence.enabled bool Enable creating PVCs for the bloom-planner false bloomPlanner.podAnnotations object Annotations for bloom-planner pods {} bloomPlanner.podDisruptionBudget.annotations object Annotations for Pod Disruption Budget {} bloomPlanner.podDisruptionBudget.enabled bool Enable Pod Disruption Budget true bloomPlanner.podDisruptionBudget.labels object Labels for Pod Disruption Budget {} bloomPlanner.podDisruptionBudget.maxUnavailable string Pod Disruption Budget maxUnavailable nil bloomPlanner.podDisruptionBudget.minAvailable string Pod Disruption Budget minAvailable nil bloomPlanner.podDisruptionBudget.unhealthyPodEvictionPolicy string Pod Disruption Budget unhealthyPodEvictionPolicy nil bloomPlanner.podLabels object Labels for bloom-planner pods {} bloomPlanner.podManagementPolicy string The default is to deploy all pods in parallel. "Parallel" bloomPlanner.priorityClassName string The name of the PriorityClass for bloom-planner pods nil bloomPlanner.readinessProbe object readiness probe settings for bloom-planner pods. If empty, use loki.readinessProbe {} bloomPlanner.replicas int Number of replicas for the bloom-planner 0 bloomPlanner.resizePolicy list Container resize policy for the bloom-planner Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] bloomPlanner.resources object Resource requests and limits for the bloom-planner {} bloomPlanner.service.annotations object Annotations for bloom-planner Service {} bloomPlanner.service.appProtocol.grpc string Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" "" bloomPlanner.service.ipFamilies list ipFamilies for bloom-planner Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services [] bloomPlanner.service.ipFamilyPolicy string ipFamilyPolicy for bloom-planner Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services "" bloomPlanner.service.labels object Additional labels for bloom-planner Service {} bloomPlanner.service.sessionAffinity string Session affinity for bloom-planner Service "" bloomPlanner.service.sessionAffinityConfig object Session affinity config for bloom-planner Service {} bloomPlanner.service.trafficDistribution string trafficDistribution for bloom-planner Service "" bloomPlanner.service.type string Service Type for bloom-planner Service "ClusterIP" bloomPlanner.serviceAccount.annotations object Annotations for the service account {} bloomPlanner.serviceAccount.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account true bloomPlanner.serviceAccount.create bool Specifies whether a ServiceAccount should be created false bloomPlanner.serviceAccount.imagePullSecrets list Image pull secrets for the service account [] bloomPlanner.serviceAccount.labels object Labels for the service account {} bloomPlanner.serviceAccount.name string The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template nil bloomPlanner.serviceAnnotations object Annotations for bloom-planner service @deprecated -- This option is deprecated in favor of bloomPlanner.service.annotations {} bloomPlanner.serviceLabels object Labels for bloom-planner service @deprecated -- This option is deprecated in favor of bloomPlanner.service.labels {} bloomPlanner.startupProbe object startup probe settings for bloom-planner pods. If empty use loki.startupProbe {} bloomPlanner.statefulSetRecreateJob object Enable creating a Job to recreate the StatefulSet when the StatefulSet configuration is changed. # Only applicable if compactor.kind is StatefulSet. Useful for PVC size changes, which require recreating the StatefulSet. {"enabled":false} bloomPlanner.strategy object UpdateStrategy or Strategy for the pattern ingester. {"rollingUpdate":{"partition":0}} bloomPlanner.terminationGracePeriodSeconds int Grace period to allow the bloom-planner to shutdown before it is killed 30 bloomPlanner.tolerations list Tolerations for bloom-planner pods [] chunksCache Configuration for the Memcached-based chunks-cache, which caches the log chunks Loki fetches from object storage. Key Type Description Default chunksCache.addresses string Comma separated addresses list in DNS Service Discovery format "dnssrvnoa+_memcached-client._tcp.{{ include \"loki.resourceName\" (dict \"ctx\" $ \"component\" \"chunks-cache\" \"suffix\" $.Values.chunksCache.suffix ) }}.{{ include \"loki.namespace\" $ }}.svc.{{ .Values.global.clusterDomain }}" chunksCache.affinity object Affinity for chunks-cache pods {} chunksCache.allocatedCPU string Amount of cpu allocated to chunks-cache for object storage (in integer or millicores). "500m" chunksCache.allocatedMemory int Amount of memory allocated to chunks-cache for object storage (in MB). 8192 chunksCache.annotations object Annotations for the chunks-cache pods {} chunksCache.batchSize int Batchsize for sending and receiving chunks from chunks cache 4 chunksCache.connectionLimit int Maximum number of connections allowed 16384 chunksCache.defaultValidity string Specify how long cached chunks should be stored in the chunks-cache before being expired "0s" chunksCache.dnsConfig object DNSConfig for chunks-cache {} chunksCache.enabled bool Specifies whether memcached based chunks-cache should be enabled true chunksCache.extraArgs object Additional CLI args for chunks-cache {} chunksCache.extraContainers list Additional containers to be added to the chunks-cache pod. [] chunksCache.extraExtendedOptions string Add extended options for chunks-cache memcached container. The format is the same as for the memcached -o/--extend flag. Example: extraExtendedOptions: 'tls,no_hashexpand' "" chunksCache.extraVolumeMounts list Additional volume mounts to be added to the chunks-cache pod (applies to both memcached and exporter containers). Example: extraVolumeMounts: - name: extra-volume mountPath: /etc/extra-volume readOnly: true [] chunksCache.extraVolumes list Additional volumes to be added to the chunks-cache pod (applies to both memcached and exporter containers). Example: extraVolumes: - name: extra-volume secret: secretName: extra-volume-secret [] chunksCache.hostUsers string Use the host's user namespace in chunks-cache pods nil chunksCache.initContainers list Extra init containers for chunks-cache pods [] chunksCache.l2.addresses string Comma separated addresses list in DNS Service Discovery format "dnssrvnoa+_memcached-client._tcp.{{ include \"loki.resourceName\" (dict \"ctx\" $ \"component\" \"chunks-cache\" \"suffix\" $.Values.chunksCache.l2.suffix ) }}.{{ include \"loki.namespace\" $ }}.svc.{{ .Values.global.clusterDomain }}" chunksCache.l2.affinity object Affinity for chunks-cache-l2 pods {} chunksCache.l2.allocatedCPU string Amount of cpu allocated to chunks-cache-l2 for object storage (in integer or millicores). "500m" chunksCache.l2.allocatedMemory int Amount of memory allocated to chunks-cache-l2 for object storage (in MB). 8192 chunksCache.l2.annotations object Annotations for the chunks-cache-l2 pods {} chunksCache.l2.batchSize int Batchsize for sending and receiving chunks from chunks cache 4 chunksCache.l2.connectionLimit int Maximum number of connections allowed 16384 chunksCache.l2.defaultValidity string Specify how long cached chunks should be stored in the chunks-cache-l2 before being expired "0s" chunksCache.l2.dnsConfig object DNSConfig for chunks-cache-l2 {} chunksCache.l2.enabled bool Specifies whether memcached based chunks-cache-l2 should be enabled false chunksCache.l2.extraArgs object Additional CLI args for chunks-cache-l2 {} chunksCache.l2.extraContainers list Additional containers to be added to the chunks-cache-l2 pod. [] chunksCache.l2.extraExtendedOptions string Add extended options for chunks-cache-l2 memcached container. The format is the same as for the memcached -o/--extend flag. Example: extraExtendedOptions: 'tls,no_hashexpand' "" chunksCache.l2.extraVolumeMounts list Additional volume mounts to be added to the chunks-cache-l2 pod (applies to both memcached and exporter containers). Example: extraVolumeMounts: - name: extra-volume mountPath: /etc/extra-volume readOnly: true [] chunksCache.l2.extraVolumes list Additional volumes to be added to the chunks-cache-l2 pod (applies to both memcached and exporter containers). Example: extraVolumes: - name: extra-volume secret: secretName: extra-volume-secret [] chunksCache.l2.hostUsers string Use the host's user namespace in chunks-cache-l2 pods nil chunksCache.l2.initContainers list Extra init containers for chunks-cache-l2 pods [] chunksCache.l2.l2ChunkCacheHandoff string The age of chunks should be transferred from l1 cache to l2 4 days "345600s" chunksCache.l2.maxItemMemory int Maximum item memory for chunks-cache-l2 (in MB). 5 chunksCache.l2.maxUnavailable int Pod Disruption Budget maxUnavailable @deprecated -- This is deprecated in favor of podDisruptionBudget.maxUnavailable. 1 chunksCache.l2.nodeSelector object Node selector for chunks-cach-l2 pods {} chunksCache.l2.parallelism int Parallel threads for sending and receiving chunks from chunks cache 5 chunksCache.l2.persistence.enabled bool Enable creating PVCs for the chunks-cache-l2 false chunksCache.l2.persistence.mountPath string Volume mount path "/data" chunksCache.l2.persistence.storageClass string Storage class to be used. If defined, storageClassName: . If set to "-", storageClassName: "", which disables dynamic provisioning. If empty or set to null, no storageClassName spec is set, choosing the default provisioner (gp2 on AWS, standard on GKE, AWS, and OpenStack). nil chunksCache.l2.persistence.storageSize string Size of persistent disk, must be in G or Gi "10G" chunksCache.l2.persistence.volumeAttributesClassName string Volume attributes class name to be used. If empty or set to null, no volumeAttributesClassName spec is set. Requires Kubernetes 1.31 nil chunksCache.l2.podAnnotations object Annotations for chunks-cache-l2 pods {} chunksCache.l2.podDisruptionBudget.annotations object Annotations for Pod Disruption Budget {} chunksCache.l2.podDisruptionBudget.enabled bool Enable Pod Disruption Budget true chunksCache.l2.podDisruptionBudget.labels object Labels for Pod Disruption Budget {} chunksCache.l2.podLabels object Labels for chunks-cache-l2 pods {} chunksCache.l2.podManagementPolicy string Management policy for chunks-cache-l2 pods "Parallel" chunksCache.l2.port int Port of the chunks-cache-l2 service 11211 chunksCache.l2.priorityClassName string The name of the PriorityClass for chunks-cache-l2 pods nil chunksCache.l2.replicas int Total number of chunks-cache-l2 replicas 1 chunksCache.l2.resizePolicy list Container resize policy for the chunks-cache-l2 Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] chunksCache.l2.resources object Resource requests and limits for the chunks-cache-l2 By default a safe memory limit will be requested based on allocatedMemory value (floor (* 1.2 allocatedMemory)). {} chunksCache.l2.service object Service annotations and labels {"annotations":{},"labels":{}} chunksCache.l2.statefulStrategy object Stateful chunks-cache strategy {"type":"RollingUpdate"} chunksCache.l2.suffix string Append to the name of the resources to make names different for l1 and l2 "l2" chunksCache.l2.terminationGracePeriodSeconds int Grace period to allow the chunks-cache-l2 to shutdown before it is killed 60 chunksCache.l2.timeout string Memcached operation timeout "2000ms" chunksCache.l2.tolerations list Tolerations for chunks-cache-l2 pods [] chunksCache.l2.topologySpreadConstraints list topologySpreadConstraints allows to customize the default topologySpreadConstraints. This can be either a single dict as shown below or a slice of topologySpreadConstraints. labelSelector is taken from the constraint itself (if it exists) or is generated by the chart using the same selectors as for services. [] chunksCache.l2.writebackBuffer int Max number of objects to use for cache write back 500000 chunksCache.l2.writebackParallelism int Number of parallel threads for cache write back 1 chunksCache.l2.writebackSizeLimit string Max memory to use for cache write back "500MB" chunksCache.maxItemMemory int Maximum item memory for chunks-cache (in MB). 5 chunksCache.maxUnavailable int Pod Disruption Budget maxUnavailable @deprecated -- This is deprecated in favor of podDisruptionBudget.maxUnavailable. 1 chunksCache.nodeSelector object Node selector for chunks-cache pods {} chunksCache.parallelism int Parallel threads for sending and receiving chunks from chunks cache 5 chunksCache.persistence.enabled bool Enable creating PVCs for the chunks-cache false chunksCache.persistence.mountPath string Volume mount path "/data" chunksCache.persistence.storageClass string Storage class to be used. If defined, storageClassName: . If set to "-", storageClassName: "", which disables dynamic provisioning. If empty or set to null, no storageClassName spec is set, choosing the default provisioner (gp2 on AWS, standard on GKE, AWS, and OpenStack). nil chunksCache.persistence.storageSize string Size of persistent disk, must be in G or Gi "10G" chunksCache.persistence.volumeAttributesClassName string Volume attributes class name to be used. If empty or set to null, no volumeAttributesClassName spec is set. Requires Kubernetes 1.31 nil chunksCache.podAnnotations object Annotations for chunks-cache pods {} chunksCache.podDisruptionBudget.annotations object Annotations for Pod Disruption Budget {} chunksCache.podDisruptionBudget.enabled bool Enable Pod Disruption Budget true chunksCache.podDisruptionBudget.labels object Labels for Pod Disruption Budget {} chunksCache.podDisruptionBudget.maxUnavailable string Pod Disruption Budget maxUnavailable nil chunksCache.podDisruptionBudget.minAvailable string Pod Disruption Budget minAvailable nil chunksCache.podDisruptionBudget.unhealthyPodEvictionPolicy string Pod Disruption Budget unhealthyPodEvictionPolicy nil chunksCache.podLabels object Labels for chunks-cache pods {} chunksCache.podManagementPolicy string Management policy for chunks-cache pods "Parallel" chunksCache.port int Port of the chunks-cache service 11211 chunksCache.priorityClassName string The name of the PriorityClass for chunks-cache pods nil chunksCache.replicas int Total number of chunks-cache replicas 1 chunksCache.resizePolicy list Container resize policy for the chunks-cache Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] chunksCache.resources object Resource requests and limits for the chunks-cache By default a safe memory limit will be requested based on allocatedMemory value (floor (* 1.2 allocatedMemory)). {} chunksCache.service object Service annotations and labels {"annotations":{},"labels":{}} chunksCache.statefulStrategy object Stateful chunks-cache strategy {"type":"RollingUpdate"} chunksCache.suffix string Append to the name of the resources to make names different for l1 and l2 "" chunksCache.terminationGracePeriodSeconds int Grace period to allow the chunks-cache to shutdown before it is killed 60 chunksCache.timeout string Memcached operation timeout "2000ms" chunksCache.tolerations list Tolerations for chunks-cache pods [] chunksCache.topologySpreadConstraints list topologySpreadConstraints allows to customize the default topologySpreadConstraints. This can be either a single dict as shown below or a slice of topologySpreadConstraints. labelSelector is taken from the constraint itself (if it exists) or is generated by the chart using the same selectors as for services. [] chunksCache.writebackBuffer int Max number of objects to use for cache write back 500000 chunksCache.writebackParallelism int Number of parallel threads for cache write back 1 chunksCache.writebackSizeLimit string Max memory to use for cache write back "500MB" compactor Configuration for the compactor Key Type Description Default compactor.affinity object Affinity for compactor pods. The value will be passed through tpl. Hard node anti-affinity compactor.annotations object Annotations for compactor {} compactor.appProtocol object Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" @deprecated -- This option is deprecated in favor of compactor.service.appProtocol {"grpc":""} compactor.command string Command to execute instead of defined in Docker image nil compactor.dnsConfig object DNSConfig for compactor pods {} compactor.enabled bool Enable the component. Requires loki.deploymentMode to be set to Distributed. true compactor.extraArgs list Additional CLI args for the compactor [] compactor.extraContainers list Containers to add to the compactor pods [] compactor.extraEnv list Environment variables to add to the compactor pods [] compactor.extraEnvFrom list Environment variables from secrets or configmaps to add to the compactor pods [] compactor.extraVolumeMounts list Volume mounts to add to the compactor pods [] compactor.extraVolumes list Volumes to add to the compactor pods [] compactor.hostAliases list hostAliases to add [] compactor.hostUsers string Use the host's user namespace in the compactor nil compactor.image.registry string The Docker registry for the compactor image. Overrides loki.image.registry nil compactor.image.repository string Docker image repository for the compactor image. Overrides loki.image.repository nil compactor.image.tag string Docker image tag for the compactor image. Overrides loki.image.tag nil compactor.initContainers list Init containers to add to the compactor pods [] compactor.kind string Kind of compactor deployment. StatefulSet and Deployment are supported. "StatefulSet" compactor.labels object Labels for compactor {} compactor.livenessProbe object liveness probe settings for compactor pods. If empty use loki.livenessProbe {} compactor.nodeSelector object Node selector for compactor pods {} compactor.persistence.accessModes list Set access modes on the PersistentVolumeClaim ["ReadWriteOnce"] compactor.persistence.annotations object Annotations for the generated volumeClaimTemplate. {} compactor.persistence.claims list List of the compactor PVCs. Deprecated in favor of compactor.persistence.dataVolumeParameters and compactor.persistence.size. compactor.persistence.claims[0].accessModes list Set access modes on the PersistentVolumeClaim ["ReadWriteOnce"] compactor.persistence.claims[0].annotations object Annotations for compactor PVCs {} compactor.persistence.claims[0].labels object Labels for compactor PVCs {} compactor.persistence.claims[0].volumeAttributesClassName string Volume attributes class name to be used. If empty or set to null, no volumeAttributesClassName spec is set. Requires Kubernetes 1.31 nil compactor.persistence.dataVolumeParameters object Parameters used for the data volume when volumeClaimEnabled if false {"emptyDir":{}} compactor.persistence.enableStatefulSetAutoDeletePVC bool Enable StatefulSetAutoDeletePVC feature false compactor.persistence.enabled bool Enable creating PVCs for the compactor false compactor.persistence.labels object Labels for the generated volumeClaimTemplate. {} compactor.persistence.selector string Selector for the generated volumeClaimTemplate. nil compactor.persistence.size string Size of persistent disk "10Gi" compactor.persistence.storageClass string Storage class to be used. If defined, storageClassName: . If set to "-", storageClassName: "", which disables dynamic provisioning. If empty or set to null, no storageClassName spec is set, choosing the default provisioner (gp2 on AWS, standard on GKE, AWS, and OpenStack). nil compactor.persistence.type string Storage type for the compactor. pvc and ephemeral are supported. "pvc" compactor.persistence.volumeAttributesClassName string Volume attributes class name to be used. If empty or set to null, no volumeAttributesClassName spec is set. Requires Kubernetes 1.31 nil compactor.podAnnotations object Annotations for compactor pods {} compactor.podLabels object Labels for compactor pods {} compactor.podManagementPolicy string PodManagementPolicy for the compactor StatefulSet. Only applicable if compactor.kind is StatefulSet. # OrderedReady and Parallel are supported. "Parallel" compactor.priorityClassName string The name of the PriorityClass for compactor pods nil compactor.readinessProbe object readiness probe settings for compactor pods. If empty, use loki.readinessProbe {} compactor.replicas int Number of replicas for the compactor. Set to null to omit spec.replicas from the workload, allowing an external controller (e.g. HPA, KEDA, rollout-operator) to manage replica counts without Helm resetting them. 0 compactor.resizePolicy list Container resize policy for the compactor Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] compactor.resources object Resource requests and limits for the compactor {} compactor.service.annotations object Annotations for compactor Service {} compactor.service.appProtocol.grpc string Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" "" compactor.service.ipFamilies list ipFamilies for compactor Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services [] compactor.service.ipFamilyPolicy string ipFamilyPolicy for compactor Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services "" compactor.service.labels object Additional labels for compactor Service {} compactor.service.sessionAffinity string Session affinity for compactor Service "" compactor.service.sessionAffinityConfig object Session affinity config for compactor Service {} compactor.service.trafficDistribution string trafficDistribution for compactor Service "" compactor.service.type string Service Type for compactor Service "ClusterIP" compactor.serviceAccount.annotations object Annotations for the compactor service account {} compactor.serviceAccount.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account true compactor.serviceAccount.imagePullSecrets list Image pull secrets for the compactor service account [] compactor.serviceAccount.name string The name of the ServiceAccount to use for the compactor. If not set and create is true, a name is generated by appending "-compactor" to the common ServiceAccount. nil compactor.serviceAnnotations object Annotations for compactor service @deprecated -- This option is deprecated in favor of compactor.service.annotations {} compactor.serviceLabels object Labels for compactor service @deprecated -- This option is deprecated in favor of compactor.service.labels {} compactor.serviceType string Service type for compactor service @deprecated -- This option is deprecated in favor of compactor.service.type "ClusterIP" compactor.startupProbe object liveness probe settings for ingester pods. If empty use loki.livenessProbe {} compactor.statefulSetRecreateJob object EXPERIMENTAL: Enable creating a Job to recreate the compactor StatefulSet when the compactor configuration is changed. # Only applicable if compactor.kind is StatefulSet. Useful for PVC size changes, which require recreating the StatefulSet. {"enabled":false} compactor.strategy object UpdateStrategy or Strategy for the compactor. {"rollingUpdate":{"partition":0}} compactor.terminationGracePeriodSeconds int Grace period to allow the compactor to shutdown before it is killed 30 compactor.tolerations list Tolerations for compactor pods [] defaults Default settings applied to the Loki components only. Not applied to loki-canary, memcached, the gateway/nginx, or other components. Key Type Description Default defaults.annotations object Annotations for loki Deployments/StatefulSets {} defaults.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account true defaults.command string Command to execute instead of defined in Docker image nil defaults.containerSecurityContext object The SecurityContext for Loki containers for loki pods {} defaults.dnsConfig object DNSConfig for loki pods {} defaults.enableServiceLinks bool Should enableServiceLinks be enabled. Default to enable true defaults.extraArgs list Common additional CLI arguments for loki pods [] defaults.extraEnv list Common environment variables to add to all pods directly managed by this chart. [] defaults.extraEnvFrom list Common source of environment injections to add to all pods directly managed by this chart. For example to inject values from a Secret, use: extraEnvFrom: - secretRef: name: mysecret [] defaults.extraVolumeMounts list Common mount points to add to all pods directly managed by this chart. [] defaults.extraVolumes list Common volumes to add to all pods directly managed by this chart. [] defaults.goSettings.goMemLimitFactor float Fraction of the container memory limit used to compute GOMEMLIMIT (e.g. 0.85 = 85%). Set to 0 to disable automatic GOMEMLIMIT injection. 0.85 defaults.goSettings.gogc int Value to set for GOGC alongside GOMEMLIMIT. Lowering below the default of 100 reduces heap growth between GC cycles, working in tandem with GOMEMLIMIT to smooth memory usage. Set to 0 to disable automatic GOGC injection. 80 defaults.hostAliases list hostAliases for loki pods [] defaults.hostUsers string Use the host's user namespace for loki pods nil defaults.kedaAutoscaling.authentication.authModes string Authentication modes for the trigger (e.g. "bearer", "basic") "" defaults.kedaAutoscaling.authentication.enabled bool Enable TriggerAuthentication for KEDA triggers false defaults.kedaAutoscaling.authentication.secretTargetRef list Secret key references for TriggerAuthentication [] defaults.kedaAutoscaling.cooldownPeriod int Period (seconds) to wait after the last trigger reported active before scaling back to 0. Overridable per component. 300 defaults.kedaAutoscaling.customHeaders string Custom HTTP headers to include in Prometheus requests. Useful for multi-tenant setups (e.g. "X-Scope-OrgID=tenant1") "" defaults.kedaAutoscaling.ignoreNullValues bool Whether to ignore null values from Prometheus queries true defaults.kedaAutoscaling.pollingInterval int Interval (seconds) to poll each trigger. Overridable per component. 30 defaults.kedaAutoscaling.prometheusAddress string Prometheus server address for KEDA triggers "" defaults.kedaAutoscaling.unsafeSsl bool Whether to skip SSL verification when connecting to Prometheus false defaults.labels object Additional labels for loki Deployments/StatefulSets {} defaults.livenessProbe object Configures the liveness probe for loki pods {} defaults.nodeSelector object Node selector for loki pods {} defaults.podAnnotations object Annotations for loki pods {} defaults.podLabels object Additional labels for loki pod {} defaults.podSecurityContext object The SecurityContext for loki pods {} defaults.priorityClassName string The name of the PriorityClass for loki pods "" defaults.readinessProbe object Configures the readiness probe for loki pods {} defaults.service.annotations object Common annotations for all services {} defaults.service.ipFamilies list ipFamilies for all services Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services [] defaults.service.ipFamilyPolicy string ipFamilyPolicy for all services Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services "" defaults.service.labels object Common labels for all services {} defaults.service.publishNotReadyAddresses bool publishNotReadyAddresses for all services. Set to false so a pod's Service endpoint is withdrawn as soon as it becomes unready, instead of staying routable for the full termination window. Overridable per component via .service.publishNotReadyAddresses. true defaults.service.trafficDistribution string trafficDistribution for services Ref: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-distribution "" defaults.startupProbe object Configures the startup probe for loki pods {} defaults.statefulSetRecreateJob.image.registry string "registry.k8s.io" defaults.statefulSetRecreateJob.image.repository string "kubectl" defaults.statefulSetRecreateJob.image.tag string Overrides the image tag. Defaults to .Capabilities.KubeVersion.Version "" defaults.statefulSetRecreateJob.patchPVC bool When a component sets *.statefulSetRecreateJob.enabled, the pre-upgrade Job can patch PVC storage requests and recreate the StatefulSet for podManagementPolicy, serviceName, or volumeClaimTemplates count/name/size changes. It does not migrate storageClass, accessModes, selectors, or VCT labels. See the chart README section StatefulSet immutability. true defaults.terminationGracePeriodSeconds int Grace period to allow the gateway to shutdown before it is killed 30 defaults.tolerations list Tolerations for loki pods [] distributor Configuration for the distributor Key Type Description Default distributor.affinity object Affinity for distributor pods. The value will be passed through tpl. Hard node anti-affinity distributor.annotations object Annotations for distributor {} distributor.appProtocol.grpc string Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" @deprecated -- This option is deprecated in favor of distributor.service.appProtocol.grpc "" distributor.autoscaling.behavior.enabled bool Enable autoscaling behaviours false distributor.autoscaling.behavior.scaleDown object define scale down policies, must conform to HPAScalingRules {} distributor.autoscaling.behavior.scaleUp object define scale up policies, must conform to HPAScalingRules {} distributor.autoscaling.customMetrics list Allows one to define custom metrics using the HPA/v2 schema (for example, Pods, Object or External metrics) [] distributor.autoscaling.enabled bool Enable autoscaling for the distributor false distributor.autoscaling.maxReplicas int Maximum autoscaling replicas for the distributor 3 distributor.autoscaling.minReplicas int Minimum autoscaling replicas for the distributor 1 distributor.autoscaling.targetCPUUtilizationPercentage int Target CPU utilisation percentage for the distributor 60 distributor.autoscaling.targetMemoryUtilizationPercentage string Target memory utilisation percentage for the distributor nil distributor.command string Command to execute instead of defined in Docker image nil distributor.dnsConfig object DNSConfig for distributor pods {} distributor.enabled bool Enable the component. Requires loki.deploymentMode to be set to Distributed. true distributor.extraArgs list Additional CLI args for the distributor [] distributor.extraContainers list Containers to add to the distributor pods [] distributor.extraEnv list Environment variables to add to the distributor pods [] distributor.extraEnvFrom list Environment variables from secrets or configmaps to add to the distributor pods [] distributor.extraVolumeMounts list Volume mounts to add to the distributor pods [] distributor.extraVolumes list Volumes to add to the distributor pods [] distributor.hostAliases list hostAliases to add [] distributor.hostUsers string Use the host's user namespace in the distributor nil distributor.image.registry string The Docker registry for the distributor image. Overrides loki.image.registry nil distributor.image.repository string Docker image repository for the distributor image. Overrides loki.image.repository nil distributor.image.tag string Docker image tag for the distributor image. Overrides loki.image.tag nil distributor.initContainers list Init containers to add to the distributor pods [] distributor.kedaAutoscaling.behavior object Behavior configuration for KEDA ScaledObject (horizontalPodAutoscalerConfig.behavior). Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#advanced {} distributor.kedaAutoscaling.cooldownPeriod string Period to wait after the last trigger reported active before scaling the resource back to 0 (seconds). Defaults to defaults.kedaAutoscaling.cooldownPeriod if not set. nil distributor.kedaAutoscaling.enabled bool Enable KEDA autoscaling for the distributor. Mutually exclusive with autoscaling.enabled false distributor.kedaAutoscaling.fallback object Fallback configuration for KEDA ScaledObject. Applied when the trigger metric cannot be retrieved. Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#fallback {} distributor.kedaAutoscaling.maxReplicas int Maximum replicas for KEDA autoscaling 3 distributor.kedaAutoscaling.minReplicas int Minimum replicas for KEDA autoscaling 1 distributor.kedaAutoscaling.pollingInterval string Interval (seconds) to poll each trigger. Defaults to defaults.kedaAutoscaling.pollingInterval if not set. nil distributor.kedaAutoscaling.triggers list KEDA triggers for the distributor. Ref: https://keda.sh/docs/latest/scalers/ [] distributor.kind string Kind of compactor deployment. StatefulSet and Deployment are supported. "Deployment" distributor.labels object Labels for distributor {} distributor.maxSurge int Max Surge for distributor pods 0 distributor.maxUnavailable string Pod Disruption Budget maxUnavailable @deprecated -- This is deprecated in favor of podDisruptionBudget.maxUnavailable. nil distributor.nodeSelector object Node selector for distributor pods {} distributor.podAnnotations object Annotations for distributor pods {} distributor.podDisruptionBudget.annotations object Annotations for Pod Disruption Budget {} distributor.podDisruptionBudget.enabled bool Enable Pod Disruption Budget true distributor.podDisruptionBudget.labels object Labels for Pod Disruption Budget {} distributor.podDisruptionBudget.maxUnavailable string Pod Disruption Budget maxUnavailable nil distributor.podDisruptionBudget.minAvailable string Pod Disruption Budget minAvailable nil distributor.podDisruptionBudget.unhealthyPodEvictionPolicy string Pod Disruption Budget unhealthyPodEvictionPolicy nil distributor.podLabels object Labels for distributor pods {} distributor.priorityClassName string The name of the PriorityClass for distributor pods nil distributor.replicas int Number of replicas for the distributor. Set to null to omit spec.replicas from the workload, allowing an external controller (e.g. HPA, KEDA, rollout-operator) to manage replica counts without Helm resetting them. 0 distributor.resizePolicy list Container resize policy for the distributor Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] distributor.resources object Resource requests and limits for the distributor {} distributor.service.annotations object Annotations for distributor Service {} distributor.service.appProtocol.grpc string Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" "" distributor.service.ipFamilies list ipFamilies for distributor Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services [] distributor.service.ipFamilyPolicy string ipFamilyPolicy for distributor Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services "" distributor.service.labels object Additional labels for distributor Service {} distributor.service.sessionAffinity string Session affinity for distributor Service "" distributor.service.sessionAffinityConfig object Session affinity config for distributor Service {} distributor.service.trafficDistribution string trafficDistribution for distributor Service "" distributor.service.type string Service Type for distributor Service "ClusterIP" distributor.serviceAccount.annotations object Annotations for the service account {} distributor.serviceAccount.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account true distributor.serviceAccount.create bool Specifies whether a ServiceAccount should be created false distributor.serviceAccount.imagePullSecrets list Image pull secrets for the service account [] distributor.serviceAccount.labels object Labels for the service account {} distributor.serviceAccount.name string The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template nil distributor.serviceAnnotations object Annotations for distributor service @deprecated -- This option is deprecated in favor of ingester.service.annotations {} distributor.serviceLabels object Labels for distributor service @deprecated -- This option is deprecated in favor of ingester.service.labels {} distributor.serviceType string Service type for distributor service @deprecated -- This option is deprecated in favor of ingester.service.type "ClusterIP" distributor.shutdownDelay string On SIGTERM, report 503 on /ready and wait this long before shutdown so the LB drains the pod before connections are cut. "0s" (default) disables. When enabling, keep terminationGracePeriodSeconds above shutdownDelay + server.graceful_shutdown_timeout. "0s" distributor.strategy.rollingUpdate.maxUnavailable int Pod Disruption Budget maxUnavailable 1 distributor.terminationGracePeriodSeconds int Grace period to allow the distributor to shutdown before it is killed 30 distributor.topologySpreadConstraints list Topology Spread Constraints for distributor pods The value will be passed through tpl. [] distributor.trafficDistribution string trafficDistribution for distributor service "" gateway Configuration for the gateway, an NGINX reverse proxy that routes incoming read and write requests to the appropriate Loki components. Key Type Description Default gateway.affinity object Affinity for gateway pods. The value will be passed through tpl. Hard node anti-affinity gateway.annotations object Annotations for gateway deployment {} gateway.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account false gateway.autoscaling.behavior object Behavior policies while scaling. {} gateway.autoscaling.enabled bool Enable autoscaling for the gateway false gateway.autoscaling.maxReplicas int Maximum autoscaling replicas for the gateway 3 gateway.autoscaling.minReplicas int Minimum autoscaling replicas for the gateway 1 gateway.autoscaling.targetCPUUtilizationPercentage int Target CPU utilisation percentage for the gateway 60 gateway.autoscaling.targetMemoryUtilizationPercentage string Target memory utilisation percentage for the gateway nil gateway.basicAuth.enabled bool Enables basic authentication for the gateway false gateway.basicAuth.existingSecret string Existing basic auth secret to use. Must contain '.htpasswd' nil gateway.basicAuth.htpasswd string Uses the specified users from the loki.tenants list to create the htpasswd file. if loki.tenants is not set, the gateway.basicAuth.username and gateway.basicAuth.password are used. The value is templated using tpl. Override this to use a custom htpasswd, e.g. in case the default causes high CPU load. Either `loki.tenants` or `gateway.basicAuth.username` and `gateway.basicAuth.password`. gateway.basicAuth.password string The basic auth password for the gateway nil gateway.basicAuth.username string The basic auth username for the gateway nil gateway.containerPort int Default container port 8080 gateway.containerSecurityContext object The SecurityContext for gateway containers {"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"seccompProfile":{"type":"RuntimeDefault"}} gateway.deploymentStrategy.type string "RollingUpdate" gateway.dnsConfig object DNS config for gateway pods {} gateway.enabled bool Specifies whether the gateway should be enabled true gateway.extraArgs list Additional CLI args for the gateway [] gateway.extraContainers list Containers to add to the gateway pods [] gateway.extraEnv list Environment variables to add to the gateway pods [] gateway.extraEnvFrom list Environment variables from secrets or configmaps to add to the gateway pods [] gateway.extraVolumeMounts list Volume mounts to add to the gateway pods [] gateway.extraVolumes list Volumes to add to the gateway pods [] gateway.hostUsers string Use the host's user namespace in the gateway nil gateway.image.digest string Overrides the gateway image tag with an image digest nil gateway.image.pullPolicy string The gateway image pull policy "IfNotPresent" gateway.image.registry string The Docker registry for the gateway image "docker.io" gateway.image.repository string The gateway image repository "nginxinc/nginx-unprivileged" gateway.image.tag string The gateway image tag "1.31-alpine" gateway.ingress.annotations object Annotations for the gateway ingress {} gateway.ingress.enabled bool Specifies whether an ingress for the gateway should be created false gateway.ingress.hosts list Hosts configuration for the gateway ingress, passed through the tpl function to allow templating [{"host":"gateway.loki.example.com","paths":[{"path":"/"}]}] gateway.ingress.ingressClassName string Ingress Class Name. MAY be required for Kubernetes versions >= 1.18 "" gateway.ingress.labels object Labels for the gateway ingress {} gateway.ingress.tls list TLS configuration for the gateway ingress. Hosts passed through the tpl function to allow templating [{"hosts":["gateway.loki.example.com"],"secretName":"loki-gateway-tls"}] gateway.kedaAutoscaling.behavior object Behavior configuration for KEDA ScaledObject (horizontalPodAutoscalerConfig.behavior). Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#advanced {} gateway.kedaAutoscaling.cooldownPeriod string Period to wait after the last trigger reported active before scaling the resource back to 0 (seconds). Defaults to defaults.kedaAutoscaling.cooldownPeriod if not set. nil gateway.kedaAutoscaling.enabled bool Enable KEDA autoscaling for the gateway. Mutually exclusive with autoscaling.enabled false gateway.kedaAutoscaling.fallback object Fallback configuration for KEDA ScaledObject. Applied when the trigger metric cannot be retrieved. Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#fallback {} gateway.kedaAutoscaling.maxReplicas int Maximum replicas for KEDA autoscaling 3 gateway.kedaAutoscaling.minReplicas int Minimum replicas for KEDA autoscaling 1 gateway.kedaAutoscaling.pollingInterval string Interval (seconds) to poll each trigger. Defaults to defaults.kedaAutoscaling.pollingInterval if not set. nil gateway.kedaAutoscaling.triggers list KEDA triggers for the gateway. Ref: https://keda.sh/docs/latest/scalers/ [] gateway.lifecycle object Lifecycle for the gateway container {} gateway.livenessProbe object liveness probe for the nginx container in the gateway pods. {} gateway.metrics.containerSecurityContext object The SecurityContext for memcached exporter containers {"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}} gateway.metrics.enabled bool Whether gateway metrics should be exported true gateway.metrics.extraArgs list Extra args to add to the exporter container. [] gateway.metrics.image.pullPolicy string "IfNotPresent" gateway.metrics.image.registry string "ghcr.io" gateway.metrics.image.repository string "jkroepke/access-log-exporter" gateway.metrics.image.tag string "0.4.21" gateway.metrics.livenessProbe object Liveness probe for memcached exporter {"failureThreshold":3,"httpGet":{"path":"/health","port":"http-metrics"},"initialDelaySeconds":30,"periodSeconds":10,"timeoutSeconds":5} gateway.metrics.readinessProbe object Readiness probe for memcached exporter {"failureThreshold":3,"httpGet":{"path":"/health","port":"http-metrics"},"initialDelaySeconds":5,"periodSeconds":5,"timeoutSeconds":3} gateway.metrics.resizePolicy list Container resize policy for the gateway metrics exporter Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] gateway.metrics.resources.limits object {} gateway.metrics.resources.requests object {} gateway.metrics.service.annotations object Annotations for the gateway metrics exporter service. Use this instead of gateway.service.annotations to avoid propagating annotations (e.g. external-dns) to the exporter ClusterIP service. {} gateway.metrics.service.labels object Labels for the gateway metrics exporter service. {} gateway.metrics.startupProbe object Startup probe for memcached exporter {} gateway.nginxConfig.clientMaxBodySize string Allows customizing the client_max_body_size directive "4M" gateway.nginxConfig.customBackendUrl string Override Backend URL nil gateway.nginxConfig.customReadUrl string Override Read URL nil gateway.nginxConfig.customWriteUrl string Override Write URL nil gateway.nginxConfig.enableIPv6 bool Enable listener for IPv6, disable on IPv4-only systems true gateway.nginxConfig.file string Config file contents for Nginx. Passed through the tpl function to allow templating See values.yaml gateway.nginxConfig.httpSnippet string Allows appending custom configuration to the http block, passed through the tpl function to allow templating "" gateway.nginxConfig.locationSnippet string Allows appending custom configuration inside every location block, useful for authentication or setting headers that are not inherited from the server block, passed through the tpl function to allow templating. "{{ if .Values.loki.tenants }}proxy_set_header X-Scope-OrgID $remote_user;{{ end }}" gateway.nginxConfig.logFormat string NGINX log format "main '$remote_addr - $remote_user [$time_local] $status '\n '\"$request\" $body_bytes_sent \"$http_referer\" '\n '\"$http_user_agent\" \"$http_x_forwarded_for\"';" gateway.nginxConfig.resolver string Allows overriding the DNS resolver address nginx will use. "" gateway.nginxConfig.schema string Which schema to be used when building URLs. Can be 'http' or 'https'. "http" gateway.nginxConfig.serverSnippet string Allows appending custom configuration to the server block "" gateway.nginxConfig.ssl bool Whether ssl should be appended to the listen directive of the server block or not. false gateway.nodeSelector object Node selector for gateway pods {} gateway.podAnnotations object Annotations for gateway pods {} gateway.podDisruptionBudget.annotations object Annotations for Pod Disruption Budget {} gateway.podDisruptionBudget.enabled bool Enable Pod Disruption Budget true gateway.podDisruptionBudget.labels object Labels for Pod Disruption Budget {} gateway.podDisruptionBudget.maxUnavailable string Pod Disruption Budget maxUnavailable nil gateway.podDisruptionBudget.minAvailable string Pod Disruption Budget minAvailable nil gateway.podDisruptionBudget.unhealthyPodEvictionPolicy string Pod Disruption Budget unhealthyPodEvictionPolicy nil gateway.podLabels object Additional labels for gateway pods {} gateway.podSecurityContext object The SecurityContext for gateway containers {"fsGroup":101,"runAsGroup":101,"runAsNonRoot":true,"runAsUser":101,"seccompProfile":{"type":"RuntimeDefault"}} gateway.priorityClassName string The name of the PriorityClass for gateway pods nil gateway.readinessProbe.httpGet.path string "/" gateway.readinessProbe.httpGet.port string "http" gateway.readinessProbe.initialDelaySeconds int 15 gateway.readinessProbe.timeoutSeconds int 1 gateway.replicas int Number of replicas for the gateway 1 gateway.resizePolicy list Container resize policy for the gateway Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] gateway.resources object Resource requests and limits for the gateway {} gateway.route.main.additionalRules list Additional rules to prepend before the default catch-all rule. Each entry is rendered into spec.rules as written (templating is supported), so any HTTPRoute/GRPCRoute rule shape is accepted — including filter-only rules with no backendRefs (e.g. RequestRedirect, URLRewrite). Useful for advanced routing logic (e.g. header-based routing, auth policies, redirects). Note: the chart-generated rule that points at the gateway service is always rendered for this route — additionalRules are prepended, not a replacement. Example HTTP-to-HTTPS redirect: additionalRules: - filters: - type: RequestRedirect requestRedirect: scheme: https statusCode: 301 matches: - path: { type: PathPrefix, value: / } [] gateway.route.main.annotations object Additional annotations for the route {} gateway.route.main.apiVersion string Set the route apiVersion, e.g. gateway.networking.k8s.io/v1 or gateway.networking.k8s.io/v1beta1. If not set, the latest available version will be auto-detected. "" gateway.route.main.enabled bool Specifies whether this Gateway API route should be created false gateway.route.main.filters list Filters for the default rule [] gateway.route.main.hostnames list Hostnames for the route [] gateway.route.main.kind string Set the route kind. Valid options are GRPCRoute, HTTPRoute, TCPRoute, TLSRoute, UDPRoute "HTTPRoute" gateway.route.main.labels object Additional labels for the route {} gateway.route.main.matches list Matches for the default rule. Defaults to match all paths. [{"path":{"type":"PathPrefix","value":"/"}}] gateway.route.main.parentRefs list Parent gateway references to attach the route to [] gateway.route.main.timeouts object Timeouts for the default rule {} gateway.service.annotations object Annotations for the gateway service {} gateway.service.clusterIP string ClusterIP of the gateway service nil gateway.service.ipFamilies list ipFamilies for gateway Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services [] gateway.service.ipFamilyPolicy string ipFamilyPolicy for gateway Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services "" gateway.service.labels object Labels for gateway service {} gateway.service.loadBalancerIP string Load balancer IPO address if service type is LoadBalancer nil gateway.service.nodePort int Node port if service type is NodePort nil gateway.service.port int Port of the gateway service 80 gateway.service.sessionAffinity string Session affinity for gateway Service "" gateway.service.sessionAffinityConfig object Session affinity config for gateway Service {} gateway.service.trafficDistribution string trafficDistribution for gateway Service "" gateway.service.type string Type of the gateway service "ClusterIP" gateway.serviceAccount.annotations object Annotations for the service account {} gateway.serviceAccount.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account false gateway.serviceAccount.create bool Specifies whether a ServiceAccount should be created true gateway.serviceAccount.imagePullSecrets list Image pull secrets for the service account [] gateway.serviceAccount.labels object Labels for the service account {} gateway.serviceAccount.name string The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template nil gateway.startupProbe object startup probe for the nginx container in the gateway pods. {} gateway.terminationGracePeriodSeconds int Grace period to allow the gateway to shutdown before it is killed 30 gateway.tolerations list [] gateway.topologySpreadConstraints list Topology Spread Constraints for gateway pods The value will be passed through tpl. [] gateway.verboseLogging bool Enable logging of 2xx and 3xx HTTP requests true global Global values that apply to all components and subcharts, such as image registry, DNS configuration, and common environment variables. Key Type Description Default global.clusterDomain string configures cluster domain ("cluster.local" by default) "cluster.local" global.dnsNamespace string configures DNS service namespace "kube-system" global.dnsService string configures DNS service name "kube-dns" global.extraArgs list Common additional CLI arguments for all jobs (that is, -log.level debug, -config.expand-env=true or -log-config-reverse-order) (deprecated, use defaults.extraArgs) scope: backend, bloom-builder, bloom-gateway, bloom-planner, compactor, distributor, index-gateway, ingester, overrides-exporter, pattern-ingester, querier, query-frontend, query-scheduler, read, ruler, write. [] global.extraEnv list Common environment variables to add to all pods directly managed by this chart. (deprecated, use defaults.extraEnv) scope: backend, bloom-builder, bloom-gateway, bloom-planner, compactor, distributor, index-gateway, ingester, overrides-exporter, pattern-ingester, querier, query-frontend, query-scheduler, read, ruler, write. [] global.extraEnvFrom list Common source of environment injections to add to all pods directly managed by this chart. (deprecated, use defaults.extraEnvFrom) scope: backend, bloom-builder, bloom-gateway, bloom-planner, compactor, distributor, index-gateway, ingester, overrides-exporter, pattern-ingester, querier, query-frontend, query-scheduler, read, ruler, write. For example to inject values from a Secret, use: extraEnvFrom: - secretRef: name: mysecret [] global.extraVolumeMounts list Common mount points to add to all pods directly managed by this chart. (deprecated, use defaults.extraVolumeMounts) scope: backend, bloom-builder, bloom-gateway, bloom-planner, compactor, distributor, index-gateway, ingester, overrides-exporter, pattern-ingester, querier, query-frontend, query-scheduler, read, ruler, write. [] global.extraVolumes list Common volumes to add to all pods directly managed by this chart. (deprecated, use defaults.extraVolumes) scope: backend, bloom-builder, bloom-gateway, bloom-planner, compactor, distributor, index-gateway, ingester, overrides-exporter, pattern-ingester, querier, query-frontend, query-scheduler, read, ruler, write. [] global.image.registry string Overrides the Docker registry globally for all images (deprecated, use global.imageRegistry). This has lower precedence than global.imageRegistry, but higher precedence than component-level image.registry values. nil global.imageRegistry string Overrides the Docker registry globally for all images (standard format). This has the highest precedence and overrides every component-level image.registry value. nil global.priorityClassName string Overrides the priorityClassName for all pods nil indexGateway Configuration for the index-gateway Key Type Description Default indexGateway.affinity object Affinity for index-gateway pods. The value will be passed through tpl. Hard node anti-affinity indexGateway.annotations object Annotations for index-gateway {} indexGateway.appProtocol object Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" @deprecated -- This option is deprecated in favor of indexGateway.service.appProtocol {"grpc":""} indexGateway.dnsConfig object DNSConfig for index-gateway pods {} indexGateway.enabled bool Enable the component. Requires loki.deploymentMode to be set to Distributed. true indexGateway.extraArgs list Additional CLI args for the index-gateway [] indexGateway.extraContainers list Containers to add to the index-gateway pods [] indexGateway.extraEnv list Environment variables to add to the index-gateway pods [] indexGateway.extraEnvFrom list Environment variables from secrets or configmaps to add to the index-gateway pods [] indexGateway.extraVolumeMounts list Volume mounts to add to the index-gateway pods [] indexGateway.extraVolumes list Volumes to add to the index-gateway pods [] indexGateway.hostAliases list hostAliases to add [] indexGateway.hostUsers string Use the host's user namespace in the index-gateway nil indexGateway.image.registry string The Docker registry for the index-gateway image. Overrides loki.image.registry nil indexGateway.image.repository string Docker image repository for the index-gateway image. Overrides loki.image.repository nil indexGateway.image.tag string Docker image tag for the index-gateway image. Overrides loki.image.tag nil indexGateway.initContainers list Init containers to add to the index-gateway pods [] indexGateway.joinMemberlist bool Whether the index gateway should join the memberlist hashring true indexGateway.kind string Kind of index-gateway deployment. StatefulSet and Deployment are supported. "StatefulSet" indexGateway.labels object Labels for index-gateway {} indexGateway.lifecycle object Lifecycle for the index-gateway container {} indexGateway.maxUnavailable string Pod Disruption Budget maxUnavailable @deprecated -- This is deprecated in favor of podDisruptionBudget.maxUnavailable. nil indexGateway.nodeSelector object Node selector for index-gateway pods {} indexGateway.persistence.accessModes list Set access modes on the PersistentVolumeClaim ["ReadWriteOnce"] indexGateway.persistence.annotations object Annotations for index gateway PVCs {} indexGateway.persistence.dataVolumeParameters object Parameters used for the data volume when volumeClaimEnabled if false {"emptyDir":{}} indexGateway.persistence.enableStatefulSetAutoDeletePVC bool Enable StatefulSetAutoDeletePVC feature false indexGateway.persistence.enabled bool Enable creating PVCs which is required when using boltdb-shipper false indexGateway.persistence.labels object Labels for index gateway PVCs {} indexGateway.persistence.size string Size of persistent disk "10Gi" indexGateway.persistence.storageClass string Storage class to be used. If defined, storageClassName: . If set to "-", storageClassName: "", which disables dynamic provisioning. If empty or set to null, no storageClassName spec is set, choosing the default provisioner (gp2 on AWS, standard on GKE, AWS, and OpenStack). nil indexGateway.persistence.volumeAttributesClassName string Volume attributes class name to be used. If empty or set to null, no volumeAttributesClassName spec is set. Requires Kubernetes 1.31 nil indexGateway.podAnnotations object Annotations for index-gateway pods {} indexGateway.podDisruptionBudget.annotations object Annotations for Pod Disruption Budget {} indexGateway.podDisruptionBudget.enabled bool Enable Pod Disruption Budget true indexGateway.podDisruptionBudget.labels object Labels for Pod Disruption Budget {} indexGateway.podDisruptionBudget.maxUnavailable string Pod Disruption Budget maxUnavailable nil indexGateway.podDisruptionBudget.minAvailable string Pod Disruption Budget minAvailable nil indexGateway.podDisruptionBudget.unhealthyPodEvictionPolicy string Pod Disruption Budget unhealthyPodEvictionPolicy nil indexGateway.podLabels object Labels for index-gateway pods {} indexGateway.priorityClassName string The name of the PriorityClass for index-gateway pods nil indexGateway.replicas int Number of replicas for the index-gateway. Set to null to omit spec.replicas from the workload, allowing an external controller (e.g. HPA, KEDA, rollout-operator) to manage replica counts without Helm resetting them. 0 indexGateway.resizePolicy list Container resize policy for the index-gateway Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] indexGateway.resources object Resource requests and limits for the index-gateway {} indexGateway.service.annotations object Annotations for index-gateway Service {} indexGateway.service.appProtocol.grpc string Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" "" indexGateway.service.ipFamilies list ipFamilies for index-gateway Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services [] indexGateway.service.ipFamilyPolicy string ipFamilyPolicy for index-gateway Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services "" indexGateway.service.labels object Additional labels for index-gateway Service {} indexGateway.service.sessionAffinity string Session affinity for index-gateway Service "" indexGateway.service.sessionAffinityConfig object Session affinity config for index-gateway Service {} indexGateway.service.trafficDistribution string trafficDistribution for index-gateway Service "" indexGateway.service.type string Service Type for index-gateway Service "ClusterIP" indexGateway.serviceAccount.annotations object Annotations for the service account {} indexGateway.serviceAccount.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account true indexGateway.serviceAccount.create bool Specifies whether a ServiceAccount should be created false indexGateway.serviceAccount.imagePullSecrets list Image pull secrets for the service account [] indexGateway.serviceAccount.labels object Labels for the service account {} indexGateway.serviceAccount.name string The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template nil indexGateway.serviceAnnotations object Annotations for index-gateway service @deprecated -- This option is deprecated in favor of indexGateway.service.annotations {} indexGateway.serviceLabels object Labels for index-gateway service @deprecated -- This option is deprecated in favor of indexGateway.service.labels {} indexGateway.serviceType string Service type for index-gateway service @deprecated -- This option is deprecated in favor of indexGateway.service.type "ClusterIP" indexGateway.statefulSetRecreateJob object EXPERIMENTAL: Enable creating a Job to recreate the compactor StatefulSet when the compactor configuration is changed. # Only applicable if compactor.kind is StatefulSet. Useful for PVC size changes, which require recreating the StatefulSet. {"enabled":false} indexGateway.strategy.type string One of 'OnDelete' or 'RollingUpdate' "RollingUpdate" indexGateway.terminationGracePeriodSeconds int Grace period to allow the index-gateway to shutdown before it is killed. 300 indexGateway.topologySpreadConstraints list Topology Spread Constraints for index-gateway pods The value will be passed through tpl. [] indexGateway.trafficDistribution string trafficDistribution for index-gateway service "" ingester Configuration for the ingester Key Type Description Default ingester.affinity object Affinity for ingester pods. Ignored if zoneAwareReplication is enabled. The value will be passed through tpl. Hard node anti-affinity ingester.annotations object Annotations for ingester {} ingester.appProtocol.grpc string Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" @deprecated -- This option is deprecated in favor of ingester.service.appProtocol.grpc "" ingester.autoscaling.behavior.enabled bool Enable autoscaling behaviours false ingester.autoscaling.behavior.scaleDown object define scale down policies, must conform to HPAScalingRules {} ingester.autoscaling.behavior.scaleUp object define scale up policies, must conform to HPAScalingRules {} ingester.autoscaling.customMetrics list Allows one to define custom metrics using the HPA/v2 schema (for example, Pods, Object or External metrics) [] ingester.autoscaling.enabled bool Enable autoscaling for the ingester false ingester.autoscaling.maxReplicas int Maximum autoscaling replicas for the ingester 3 ingester.autoscaling.minReplicas int Minimum autoscaling replicas for the ingester 1 ingester.autoscaling.targetCPUUtilizationPercentage int Target CPU utilisation percentage for the ingester 60 ingester.autoscaling.targetMemoryUtilizationPercentage string Target memory utilisation percentage for the ingester nil ingester.command string Command to execute instead of defined in Docker image nil ingester.dnsConfig object DNSConfig for ingester pods {} ingester.enabled bool Enable the component. Requires loki.deploymentMode to be set to Distributed. true ingester.extraArgs list Additional CLI args for the ingester [] ingester.extraContainers list Containers to add to the ingester pods [] ingester.extraEnv list Environment variables to add to the ingester pods [] ingester.extraEnvFrom list Environment variables from secrets or configmaps to add to the ingester pods [] ingester.extraVolumeMounts list Volume mounts to add to the ingester pods [] ingester.extraVolumes list Volumes to add to the ingester pods [] ingester.hostAliases list hostAliases to add [] ingester.hostUsers string Use the host's user namespace in the ingester nil ingester.image.registry string The Docker registry for the ingester image. Overrides loki.image.registry nil ingester.image.repository string Docker image repository for the ingester image. Overrides loki.image.repository nil ingester.image.tag string Docker image tag for the ingester image. Overrides loki.image.tag nil ingester.initContainers list Init containers to add to the ingester pods [] ingester.kedaAutoscaling.behavior object Behavior configuration for KEDA ScaledObject (horizontalPodAutoscalerConfig.behavior). Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#advanced {} ingester.kedaAutoscaling.cooldownPeriod string Period to wait after the last trigger reported active before scaling the resource back to 0 (seconds). Defaults to defaults.kedaAutoscaling.cooldownPeriod if not set. nil ingester.kedaAutoscaling.enabled bool Enable KEDA autoscaling for the ingester. Mutually exclusive with autoscaling.enabled false ingester.kedaAutoscaling.fallback object Fallback configuration for KEDA ScaledObject. Applied when the trigger metric cannot be retrieved. Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#fallback {} ingester.kedaAutoscaling.maxReplicas int Maximum replicas for KEDA autoscaling 3 ingester.kedaAutoscaling.minReplicas int Minimum replicas for KEDA autoscaling 1 ingester.kedaAutoscaling.pollingInterval string Interval (seconds) to poll each trigger. Defaults to defaults.kedaAutoscaling.pollingInterval if not set. nil ingester.kedaAutoscaling.triggers list KEDA triggers for the ingester. Ref: https://keda.sh/docs/latest/scalers/ [] ingester.kind string Kind of compactor deployment. StatefulSet and Deployment are supported. "StatefulSet" ingester.labels object Labels for ingester {} ingester.lifecycle object Lifecycle for the ingester container {} ingester.livenessProbe object liveness probe settings for ingester pods. If empty use loki.livenessProbe {} ingester.maxUnavailable int Pod Disruption Budget maxUnavailable @deprecated -- This is deprecated in favor of podDisruptionBudget.maxUnavailable. 1 ingester.nodeSelector object Node selector for ingester pods {} ingester.persistence.claims list List of the ingester PVCs ingester.persistence.claims[0].accessModes list Set access modes on the PersistentVolumeClaim ["ReadWriteOnce"] ingester.persistence.claims[0].storageClass string Storage class to be used. If defined, storageClassName: . If set to "-", storageClassName: "", which disables dynamic provisioning. If empty or set to null, no storageClassName spec is set, choosing the default provisioner (gp2 on AWS, standard on GKE, AWS, and OpenStack). nil ingester.persistence.claims[0].volumeAttributesClassName string Volume attributes class name to be used. If empty or set to null, no volumeAttributesClassName spec is set. Requires Kubernetes 1.31 nil ingester.persistence.enableStatefulSetAutoDeletePVC bool Enable StatefulSetAutoDeletePVC feature false ingester.persistence.enabled bool Enable creating PVCs which is required when using boltdb-shipper false ingester.persistence.inMemory bool Use emptyDir with ramdisk for storage. Please note that all data in ingester will be lost on pod restart false ingester.podAnnotations object Annotations for ingester pods {} ingester.podDisruptionBudget.annotations object Annotations for Pod Disruption Budget {} ingester.podDisruptionBudget.enabled bool Enable Pod Disruption Budget true ingester.podDisruptionBudget.labels object Labels for Pod Disruption Budget {} ingester.podDisruptionBudget.maxUnavailable string Pod Disruption Budget maxUnavailable nil ingester.podDisruptionBudget.minAvailable string Pod Disruption Budget minAvailable nil ingester.podDisruptionBudget.unhealthyPodEvictionPolicy string Pod Disruption Budget unhealthyPodEvictionPolicy nil ingester.podLabels object Labels for ingester pods. Keys used by the workload selectors ( app.kubernetes.io/name, app.kubernetes.io/instance, app.kubernetes.io/component and, with zoneAwareReplication, name and rollout-group) are reserved and ignored here: the latter are also used by the per-zone headless Services and grafana/rollout-operator. {} ingester.podManagementPolicy string PodManagementPolicy for the ingester StatefulSet. Only applicable if compactor.kind is StatefulSet. # OrderedReady and Parallel are supported. "Parallel" ingester.priorityClassName string The name of the PriorityClass for ingester pods nil ingester.readinessProbe object readiness probe settings for ingester pods. If empty, use loki.readinessProbe {} ingester.replicas int Number of replicas for the ingester, when zoneAwareReplication.enabled is true, the total number of replicas will match this value with each zone having 1/3rd of the total replicas. Set to null to omit spec.replicas from the StatefulSet, allowing an external controller (e.g. HPA, KEDA, rollout-operator) to manage replica counts without Helm resetting them. 0 ingester.resizePolicy list Container resize policy for the ingester Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] ingester.resources object Resource requests and limits for the ingester {} ingester.service.annotations object Annotations for ingester Service {} ingester.service.appProtocol.grpc string Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" "" ingester.service.ipFamilies list ipFamilies for ingester Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services [] ingester.service.ipFamilyPolicy string ipFamilyPolicy for ingester Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services "" ingester.service.labels object Additional labels for ingester Service {} ingester.service.sessionAffinity string Session affinity for ingester Service "" ingester.service.sessionAffinityConfig object Session affinity config for ingester Service {} ingester.service.trafficDistribution string trafficDistribution for ingester Service "" ingester.service.type string Service Type for ingester Service "ClusterIP" ingester.serviceAccount.annotations object Annotations for the service account {} ingester.serviceAccount.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account true ingester.serviceAccount.create bool Specifies whether a ServiceAccount should be created false ingester.serviceAccount.imagePullSecrets list Image pull secrets for the service account [] ingester.serviceAccount.labels object Labels for the service account {} ingester.serviceAccount.name string The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template nil ingester.serviceAnnotations object Annotations for ingester service @deprecated -- This option is deprecated in favor of ingester.service.annotations {} ingester.serviceLabels object Labels for ingester service @deprecated -- This option is deprecated in favor of ingester.service.labels {} ingester.serviceType string Service type for ingester service @deprecated -- This option is deprecated in favor of ingester.service.type "ClusterIP" ingester.startupProbe object startup probe settings for ingester pods. If empty use loki.startupProbe {} ingester.statefulSetRecreateJob object EXPERIMENTAL: Enable creating a Job to recreate the ingester StatefulSet # Only applicable if ingester.kind is StatefulSet. Useful for PVC size changes, which require recreating the StatefulSet. {"enabled":false} ingester.strategy object UpdateStrategy or Strategy for the ingester. {"type":"RollingUpdate"} ingester.terminationGracePeriodSeconds int Grace period to allow the ingester to shutdown before it is killed. Especially for the ingestor, this must be increased. It must be long enough so ingesters can be gracefully shutdown flushing/transferring all data and to successfully leave the member ring on shutdown. 300 ingester.tolerations list Tolerations for ingester pods [] ingester.topologySpreadConstraints list topologySpread for ingester pods. The value will be passed through tpl. Defaults to allow skew no more than 1 node ingester.trafficDistribution string trafficDistribution for ingester service "" ingester.updateStrategy.type string One of 'OnDelete' or 'RollingUpdate' "RollingUpdate" ingester.zoneAwareReplication.enabled bool Enable zone awareness. true ingester.zoneAwareReplication.maxUnavailablePct int The percent of replicas in each zone that will be restarted at once. In a value of 0-100 33 ingester.zoneAwareReplication.migration object The migration block allows migrating non zone aware ingesters to zone aware ingesters. {"enabled":false,"excludeDefaultZone":false,"readPath":false,"writePath":false} ingester.zoneAwareReplication.zoneA.annotations object Specific annotations to add to zone A statefulset {} ingester.zoneAwareReplication.zoneA.extraAffinity object optionally define extra affinity rules, by default different zones are not allowed to schedule on the same host The value will be passed through tpl. {} ingester.zoneAwareReplication.zoneA.nodeSelector string optionally define a node selector for this zone nil ingester.zoneAwareReplication.zoneA.persistence.storageClass string Storage class to use for every PVC in zone A. Overrides the storageClass of each entry in ingester.persistence.claims for this zone only. Use this when you have one StorageClass per availability zone (for example a topology-pinned EBS/PD StorageClass). If null, the claim-level storageClass is used as before, preserving existing behavior. If set to "-", storageClassName: "" is rendered, which disables dynamic provisioning. nil ingester.zoneAwareReplication.zoneA.podAnnotations object Specific annotations to add to zone A pods {} ingester.zoneAwareReplication.zoneB.annotations object Specific annotations to add to zone B statefulset {} ingester.zoneAwareReplication.zoneB.extraAffinity object optionally define extra affinity rules, by default different zones are not allowed to schedule on the same host The value will be passed through tpl. {} ingester.zoneAwareReplication.zoneB.nodeSelector string optionally define a node selector for this zone nil ingester.zoneAwareReplication.zoneB.persistence.storageClass string Storage class to use for every PVC in zone B. See ingester.zoneAwareReplication.zoneA.persistence.storageClass for details. If null, the claim-level storageClass is used as before. nil ingester.zoneAwareReplication.zoneB.podAnnotations object Specific annotations to add to zone B pods {} ingester.zoneAwareReplication.zoneC.annotations object Specific annotations to add to zone C statefulset {} ingester.zoneAwareReplication.zoneC.extraAffinity object optionally define extra affinity rules, by default different zones are not allowed to schedule on the same host The value will be passed through tpl. {} ingester.zoneAwareReplication.zoneC.nodeSelector string optionally define a node selector for this zone nil ingester.zoneAwareReplication.zoneC.persistence.storageClass string Storage class to use for every PVC in zone C. See ingester.zoneAwareReplication.zoneA.persistence.storageClass for details. If null, the claim-level storageClass is used as before. nil ingester.zoneAwareReplication.zoneC.podAnnotations object Specific annotations to add to zone C pods {} ingress Ingress configuration Use either this ingress or the gateway, but not both at once. If you enable this, make sure to disable the gateway. You'll need to supply authn configuration for your ingress controller. Key Type Description Default ingress.hosts list Hosts configuration for the ingress, passed through the tpl function to allow templating ["loki.example.com"] ingress.paths.compactor list Paths that are exposed by Loki Compactor. If deployment mode is Distributed, the requests are forwarded to the service. If deployment mode is SimpleScalable, the requests are forwarded to k8s service. If deployment mode is SingleBinary, the requests are forwarded to the central/single k8s service` ["/loki/api/v1/delete"] ingress.paths.distributor list Paths that are exposed by Loki Distributor. If deployment mode is Distributed, the requests are forwarded to the service:. If deployment mode is SimpleScalable, the requests are forwarded to write k8s service:. If deployment mode is SingleBinary, the requests are forwarded to the central/single k8s service: ["/api/prom/push","/loki/api/v1/push","/otlp/v1/logs"] ingress.paths.queryFrontend list Paths that are exposed by Loki Query Frontend. If deployment mode is Distributed, the requests are forwarded to the service. If deployment mode is SimpleScalable, the requests are forwarded to write k8s service . If deployment mode is SingleBinary, the requests are forwarded to the central/single k8s service ["/api/prom/query","/api/prom/label","/api/prom/series","/api/prom/tail","/loki/api/v1/query","/loki/api/v1/query_range","/loki/api/v1/tail","/loki/api/v1/label","/loki/api/v1/labels","/loki/api/v1/series","/loki/api/v1/index/stats","/loki/api/v1/index/volume","/loki/api/v1/index/volume_range","/loki/api/v1/format_query","/loki/api/v1/detected_field","/loki/api/v1/detected_fields","/loki/api/v1/detected_labels","/loki/api/v1/patterns","/ui"] ingress.paths.ruler list Paths that are exposed by Loki Ruler. If deployment mode is Distributed, the requests are forwarded to the service. If deployment mode is SimpleScalable, the requests are forwarded to k8s service. If deployment mode is SingleBinary, the requests are forwarded to the central/single k8s service ["/api/prom/rules","/api/prom/api/v1/rules","/api/prom/api/v1/alerts","/loki/api/v1/rules","/prometheus/api/v1/rules","/prometheus/api/v1/alerts"] ingress.tls list TLS configuration for the ingress. Hosts passed through the tpl function to allow templating [] loki Configuration for running Loki Key Type Description Default loki.analytics object Optional analytics configuration {} loki.annotations object Common annotations for all deployments/StatefulSets {} loki.block_builder object Optional block builder configuration {} loki.commonConfig.compactor_grpc_address string The gRPC address of the compactor. The use of compactor_grpc_address is preferred over compactor_address. If a customized compactor_address is set, compactor_grpc_address should be set to an empty string. "{{ include \"loki.compactorAddress\" . }}" loki.compactor object Optional compactor configuration {} loki.compactor_grpc_client object Optional compactor grpc client configuration {} loki.config string Config file contents for Loki See values.yaml loki.configObjectName string The name of the object which Loki will mount as a volume containing the config. If the configStorageType is Secret, this will be the name of the Secret, if it is ConfigMap, this will be the name of the ConfigMap. The value will be passed through tpl. "{{ include \"loki.name\" . }}" loki.configStorageType string Defines what kind of object stores the configuration, a ConfigMap or a Secret. In order to move sensitive information (such as credentials) from the ConfigMap/Secret to a more secure location (e.g. vault), it is possible to use environment variables in the configuration. Such environment variables can be then stored in a separate Secret and injected via the global.extraEnvFrom value. For details about environment injection from a Secret please see Secrets. "ConfigMap" loki.containerSecurityContext object The SecurityContext for Loki containers {"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"seccompProfile":{"type":"RuntimeDefault"}} loki.distributor object Optional distributor configuration {} loki.dnsConfig object DNS config for Loki pods {} loki.enableServiceLinks bool Should enableServiceLinks be enabled. Default to enable true loki.extraMemberlistConfig object Extra memberlist configuration {"abort_if_cluster_join_fails":true,"advertise_port":7946,"bind_port":7946,"max_join_backoff":"1m","max_join_retries":10,"min_join_backoff":"1s","rejoin_interval":"90s"} loki.generatedConfigObjectName string The name of the Secret or ConfigMap that will be created by this chart. If empty, no configmap or secret will be created. The value will be passed through tpl. "{{ include \"loki.name\" . }}" loki.image.digest string Overrides the image tag with an image digest nil loki.image.pullPolicy string Docker image pull policy "IfNotPresent" loki.image.registry string The Docker registry "docker.io" loki.image.repository string Docker image repository "grafana/loki" loki.image.tag string Overrides the image tag whose default is the chart's appVersion nil loki.index_gateway object Optional index gateway configuration {"mode":"simple"} loki.ingester object Optional ingester configuration {"wal":{"flush_on_shutdown":true}} loki.ingester_client object Optional ingester client configuration {} loki.limits_config object Limits config {"max_cache_freshness_per_query":"10m","query_timeout":"300s","reject_old_samples":true,"reject_old_samples_max_age":"168h","split_queries_by_interval":"15m","volume_enabled":true} loki.memberlistConfig object memberlist configuration (overrides embedded default) {} loki.operational_config object Optional operational configuration {} loki.pattern_ingester object Optional pattern ingester configuration {"enabled":false} loki.podAnnotations object Common annotations for all pods {} loki.podLabels object Common labels for all pods {} loki.podSecurityContext object The SecurityContext for Loki pods {"fsGroup":10001,"fsGroupChangePolicy":"OnRootMismatch","runAsGroup":10001,"runAsNonRoot":true,"runAsUser":10001,"seccompProfile":{"type":"RuntimeDefault"}} loki.querier object Optional querier configuration {} loki.query_range object Optional querier configuration {} loki.query_scheduler object Additional query scheduler config {} loki.revisionHistoryLimit int The number of old ReplicaSets to retain to allow rollback 10 loki.rulerConfig object Check https://grafana.com/docs/loki/latest/configuration/#ruler for more info on configuring ruler {"wal":{"dir":"/var/loki/ruler-wal"}} loki.runtimeConfig object Provides a reloadable runtime configuration file for some specific configuration {} loki.schemaConfig object Check https://grafana.com/docs/loki/latest/configuration/#schema_config for more info on how to configure schemas {} loki.server object Check https://grafana.com/docs/loki/latest/configuration/#server for more info on the server configuration. {"graceful_shutdown_timeout":"5s","grpc_listen_port":9095,"grpc_server_max_concurrent_streams":1000,"grpc_server_max_recv_msg_size":104857600,"grpc_server_max_send_msg_size":104857600,"grpc_server_min_time_between_pings":"10s","grpc_server_ping_without_stream_allowed":true,"http_listen_port":3100,"http_server_idle_timeout":"30s","http_server_read_timeout":"10m0s","http_server_write_timeout":"10m0s","log_level":"info"} loki.service.ipFamilies list ipFamilies for all services Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services [] loki.service.ipFamilyPolicy string ipFamilyPolicy for all services Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services "" loki.service.trafficDistribution string trafficDistribution for services Ref: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-distribution "" loki.serviceAnnotations object Common annotations for all services {} loki.serviceLabels object Common labels for all services {} loki.storage.s3.backoff_config object Check https://grafana.com/docs/loki/latest/configure/#s3_storage_config for more info on how to provide a backoff_config {} loki.storage_config object Additional storage config {"bloom_shipper":{"working_directory":"/var/loki/data/bloomshipper"},"boltdb_shipper":{"index_gateway_client":{"server_address":"{{ include \"loki.indexGatewayAddress\" . }}"}},"hedging":{"at":"250ms","max_per_second":20,"up_to":3},"tsdb_shipper":{"index_gateway_client":{"server_address":"{{ include \"loki.indexGatewayAddress\" . }}"}}} loki.structuredConfig object Structured loki configuration, takes precedence over loki.config, loki.schemaConfig, loki.storageConfig {} loki.tenants list Tenants list to be created on nginx htpasswd file, with name and password or passwordHash keys

Example: 
 tenants:
 - name: "test-user-1"
 password: "test-password-1"
 - name: "test-user-2"
 passwordHash: "$2y$10$7O40CaY1yz7fu9O24k2/u.ct/wELYHRBsn25v/7AyuQ8E8hrLqpva" # generated using 
htpasswd -nbBC10 test-user-2 test-password-2
[] loki.tracing object Enable tracing {"enabled":false} loki.ui object Optional Loki UI: Provides access to a operators UI for Loki distributed. When enabled UI will be available at /ui/ of loki-gateway {"enabled":false,"gateway":{"enabled":true}} loki.useTestSchema bool a real Loki install requires a proper schemaConfig defined above this, however for testing or playing around you can enable useTestSchema false lokiCanary Configuration for the Loki Canary, which continuously pushes logs to and queries them from this Loki installation to verify it is working correctly. Key Type Description Default lokiCanary.affinity object Affinity for canary pods {} lokiCanary.annotations object Additional annotations for the loki-canary Daemonset {} lokiCanary.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account false lokiCanary.containerSecurityContext object The SecurityContext for loki-canary containers {"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"seccompProfile":{"type":"RuntimeDefault"}} lokiCanary.dnsConfig object DNS config for canary pods {} lokiCanary.enabled bool true lokiCanary.extraArgs list Additional CLI arguments for the 'loki-canary' command [] lokiCanary.extraEnv list Environment variables to add to the canary pods [] lokiCanary.extraEnvFrom list Environment variables from secrets or configmaps to add to the canary pods [] lokiCanary.extraVolumeMounts list Volume mounts to add to the canary pods [] lokiCanary.extraVolumes list Volumes to add to the canary pods [] lokiCanary.hostUsers string Use the host's user namespace in loki-canary pods nil lokiCanary.image.digest string Overrides the image tag with an image digest nil lokiCanary.image.pullPolicy string Docker image pull policy "IfNotPresent" lokiCanary.image.registry string The Docker registry "docker.io" lokiCanary.image.repository string Docker image repository "grafana/loki-canary" lokiCanary.image.tag string Overrides the image tag whose default is the chart's appVersion nil lokiCanary.kind string The type of the loki canary k8s rollout. This can be a DaemonSet or Deployment. "DaemonSet" lokiCanary.labelname string The name of the label to look for at loki when doing the checks. "pod" lokiCanary.labels object Additional labels for the loki-canary Daemonset {} lokiCanary.livenessProbe object Liveness probe {"httpGet":{"path":"/metrics","port":"http-metrics"},"initialDelaySeconds":15,"timeoutSeconds":1} lokiCanary.lokiurl string If set overwrites the default value set by loki.host helper function. Use this if gateway not enabled. nil lokiCanary.nodeSelector object Node selector for canary pods {} lokiCanary.podAnnotations object Additional annotations for each loki-canary pod {} lokiCanary.podDisruptionBudget.annotations object Annotations for Pod Disruption Budget {} lokiCanary.podDisruptionBudget.enabled bool Enable Pod Disruption Budget true lokiCanary.podDisruptionBudget.labels object Labels for Pod Disruption Budget {} lokiCanary.podDisruptionBudget.maxUnavailable string Pod Disruption Budget maxUnavailable nil lokiCanary.podDisruptionBudget.minAvailable string Pod Disruption Budget minAvailable nil lokiCanary.podDisruptionBudget.unhealthyPodEvictionPolicy string Pod Disruption Budget unhealthyPodEvictionPolicy nil lokiCanary.podLabels object Additional labels for each loki-canary pod {} lokiCanary.podSecurityContext object The SecurityContext for loki-canary pods {"fsGroup":10001,"fsGroupChangePolicy":"OnRootMismatch","runAsGroup":10001,"runAsNonRoot":true,"runAsUser":10001,"seccompProfile":{"type":"RuntimeDefault"}} lokiCanary.priorityClassName string The name of the PriorityClass for loki-canary pods nil lokiCanary.push bool true lokiCanary.readinessProbe object Readiness probe {"httpGet":{"path":"/metrics","port":"http-metrics"},"initialDelaySeconds":15,"timeoutSeconds":1} lokiCanary.replicas int Replicas for loki-canary when using a Deployment 1 lokiCanary.resizePolicy list Container resize policy for the canary Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] lokiCanary.resources object Resource requests and limits for the canary {} lokiCanary.revisionHistoryLimit int The number of old ReplicaSets to retain to allow rollback 10 lokiCanary.service.annotations object Annotations for loki-canary Service {} lokiCanary.service.labels object Additional labels for loki-canary Service {} lokiCanary.serviceAccount.annotations object Annotations for the service account {} lokiCanary.serviceAccount.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account false lokiCanary.serviceAccount.create bool Specifies whether a ServiceAccount should be created true lokiCanary.serviceAccount.imagePullSecrets list Image pull secrets for the service account [] lokiCanary.serviceAccount.labels object Labels for the service account {} lokiCanary.serviceAccount.name string The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template nil lokiCanary.startupProbe object Startup probe {} lokiCanary.tenant.name string Name of the tenant for loki-canary "self-monitoring" lokiCanary.tenant.password string Password of the gateway for Basic auth for loki-canary nil lokiCanary.tolerations list Tolerations for canary pods [] lokiCanary.updateStrategy.rollingUpdate.maxUnavailable int Pod Disruption Budget maxUnavailable 1 memberlist Configuration for the memberlist service, the gossip-based ring Loki components use for service discovery and hash-ring coordination. Key Type Description Default memberlist.service.annotations object {} memberlist.service.publishNotReadyAddresses bool false memcached Common configuration shared by the Memcached deployments backing Loki's caches. You can use a self-hosted Memcached by setting enabled to false and providing addresses. Key Type Description Default memcached.containerSecurityContext object The SecurityContext for memcached containers {"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}} memcached.enabled bool Enable the built in memcached server provided by the chart true memcached.image.pullPolicy string Memcached Docker image pull policy "IfNotPresent" memcached.image.registry string Memcached Docker image registry "docker.io" memcached.image.repository string Memcached Docker image repository "library/memcached" memcached.image.tag string Memcached Docker image tag "1.6.45-alpine" memcached.livenessProbe object Liveness probe for memcached pods {"failureThreshold":3,"initialDelaySeconds":30,"periodSeconds":10,"tcpSocket":{"port":"client"},"timeoutSeconds":5} memcached.podSecurityContext object The SecurityContext override for memcached pods {"fsGroup":11211,"runAsGroup":11211,"runAsNonRoot":true,"runAsUser":11211,"seccompProfile":{"type":"RuntimeDefault"}} memcached.priorityClassName string The name of the PriorityClass for memcached pods nil memcached.readinessProbe object Readiness probe for memcached pods (probe port defaults to container port) {"failureThreshold":6,"initialDelaySeconds":5,"periodSeconds":5,"tcpSocket":{"port":"client"},"timeoutSeconds":3} memcached.serviceAccount.annotations object Annotations for the service account {} memcached.serviceAccount.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account false memcached.serviceAccount.create bool Specifies whether a ServiceAccount should be created true memcached.serviceAccount.imagePullSecrets list Image pull secrets for the service account [] memcached.serviceAccount.labels object Labels for the service account {} memcached.serviceAccount.name string The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template nil memcached.startupProbe object Startup probe for memcached pods {} memcachedExporter Configuration for the Prometheus Memcached exporter sidecar that exposes cache metrics. Key Type Description Default memcachedExporter.containerSecurityContext object The SecurityContext for memcached exporter containers {"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}} memcachedExporter.enabled bool Whether memcached metrics should be exported true memcachedExporter.extraArgs object Extra args to add to the exporter container. Example: extraArgs: memcached.tls.enable: true memcached.tls.cert-file: /certs/cert.crt memcached.tls.key-file: /certs/cert.key memcached.tls.ca-file: /certs/ca.crt memcached.tls.insecure-skip-verify: false memcached.tls.server-name: memcached {} memcachedExporter.image.pullPolicy string Memcached exporter Docker image pull policy "IfNotPresent" memcachedExporter.image.registry string Memcached exporter Docker image registry "docker.io" memcachedExporter.image.repository string Memcached exporter Docker image repository "prom/memcached-exporter" memcachedExporter.image.tag string Memcached exporter Docker image tag "v0.17.0" memcachedExporter.livenessProbe object Liveness probe for memcached exporter {"failureThreshold":3,"httpGet":{"path":"/metrics","port":"http-metrics"},"initialDelaySeconds":30,"periodSeconds":10,"timeoutSeconds":5} memcachedExporter.readinessProbe object Readiness probe for memcached exporter {"failureThreshold":3,"httpGet":{"path":"/metrics","port":"http-metrics"},"initialDelaySeconds":5,"periodSeconds":5,"timeoutSeconds":3} memcachedExporter.resizePolicy list Container resize policy for the memcached exporter Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] memcachedExporter.resources.limits object {} memcachedExporter.resources.requests object {} memcachedExporter.startupProbe object Startup probe for memcached exporter {} migrate Options that may be necessary when performing a migration from another helm chart Key Type Description Default migrate.fromDistributed.enabled bool Set to true if migrating from a distributed helm chart false migrate.fromDistributed.memberlistService string If migrating from a distributed service, provide the distributed deployment's memberlist service DNS so the new deployment can join its ring. "" monitoring Monitoring section determines which monitoring features to enable Key Type Description Default monitoring.additionalPrometheusRules object Additional PrometheusRule objects to create alongside the chart-managed ones. Each key becomes the resource name suffix; the value must contain a 'groups' key with standard Prometheus rule groups. Can contain both recording rules and alerts. e.g.: additionalPrometheusRules: my-alerts: groups: - name: my-loki-alerts rules: - alert: MyLokiAlert expr: 'up{job="loki"} == 0' {} monitoring.alerts.additionalAggregationLabels list Extra label dimensions added to all by() aggregation clauses in alert expressions [] monitoring.alerts.additionalRuleAnnotations object Additional annotations applied to all individual alert rules {} monitoring.alerts.additionalRuleLabels object Additional labels applied to all individual alert rules {} monitoring.alerts.annotations object Additional annotations for the alerts PrometheusRule resource {} monitoring.alerts.disabled object Selectively disable individual alerts by name. e.g.: disabled: { LokiRequestErrors: true } {} monitoring.alerts.enabled bool If enabled, create a PrometheusRule resource with Loki alert rules false monitoring.alerts.keepFiringFor string Global keepFiringFor applied to all alert rules "" monitoring.alerts.labels object Additional labels for the alerts PrometheusRule resource {} monitoring.alerts.overrides object Override for/severity on individual alerts. e.g.: overrides: { LokiRequestErrors: { for: 5m, severity: warning } } {} monitoring.appInstanceLabelName string Label name for the app_instance label injected into scraped metrics and recording rules. "app_instance" monitoring.appInstanceLabelValue string Value for the app_instance label injected into scraped metrics and recording rules. Supports Helm templating. "{{ include \"loki.fullname\" . }}" monitoring.dashboards.annotations object Additional annotations for the dashboards ConfigMap resources {} monitoring.dashboards.defaultDashboardsEditable bool Editable flag for the default dashboards true monitoring.dashboards.defaultDashboardsInterval string Default interval for Grafana dashboards "1m" monitoring.dashboards.defaultDashboardsTimezone string Timezone for the default dashboards "utc" monitoring.dashboards.enabled bool If enabled, create configmap resources with dashboards for monitoring Loki false monitoring.dashboards.grafanaOperator.annotations object Additional annotations for the GrafanaOperator resources {} monitoring.dashboards.grafanaOperator.enabled bool If enabled, GrafanaOperator resources for Grafana Operator are created to deploy the dashboards. false monitoring.dashboards.grafanaOperator.folder string Which folder contains all dashboards in Grafana # This folder will be created on the Root level # Only one of 'folder', 'folderUID' or 'folderRef' can be set # "General" monitoring.dashboards.grafanaOperator.folderRef string Which GrafanaFolder reference contains all dashboards in Grafana # This allows you to use subfolder hierarchy. # Only one of 'folder', 'folderUID' or 'folderRef' can be set # nil monitoring.dashboards.grafanaOperator.folderUID string Which UID of the target folder contains all dashboards in Grafana # This allows you to use subfolder hierarchy # Only one of 'folder', 'folderUID' or 'folderRef' can be set # nil monitoring.dashboards.grafanaOperator.instanceSelector object instanceSelector for the GrafanaDashboard resources # The grafana-operator matches this against the labels on your Grafana CR # An empty selector (the default) matches every Grafana instance {} monitoring.dashboards.grafanaOperator.labels object Additional labels for the GrafanaOperator resources {} monitoring.dashboards.grafanaOperator.resyncPeriod string How frequently the operator should resync resources (in duration format) "10m" monitoring.dashboards.labels object Labels for the dashboards ConfigMap resources {"grafana_dashboard":"1"} monitoring.multiCluster.clusterName string Value for the 'cluster' label. Supports Helm templating. When empty, recording rules and alerts are not modified — only dashboards show the cluster variable. e.g. clusterName: '{{ .Values.global.clusterName }}' "" monitoring.multiCluster.enabled bool When enabled, shows the cluster variable in dashboards. If clusterName is also set, the chart adds 'cluster' labels to scraped metrics, recording rules, and alerts, and includes 'cluster' in recording rule aggregations. If clusterName is left empty, only dashboard changes are applied — use this when an external tool (e.g. Grafana Alloy) manages cluster label injection and PromQL rewriting. false monitoring.namespace string Alternative namespace to deploy all monitoring resources (ServiceMonitor, PrometheusRule, ConfigMap dashboards) in. Defaults to the release namespace. nil monitoring.rules.additionalAggregationLabels list Extra label dimensions added to all by() aggregation clauses in recording rules [] monitoring.rules.additionalRuleAnnotations object Additional annotations applied to all individual recording rules {} monitoring.rules.additionalRuleLabels object Additional labels applied to all individual recording rules {} monitoring.rules.annotations object Additional annotations for the PrometheusRule resource {} monitoring.rules.enabled bool If enabled, create a PrometheusRule resource with Loki recording rules false monitoring.rules.labels object Additional labels for the PrometheusRule resource {} monitoring.serviceMonitor.annotations object ServiceMonitor annotations {} monitoring.serviceMonitor.enabled bool If enabled, ServiceMonitor resources for Prometheus Operator are created false monitoring.serviceMonitor.interval string ServiceMonitor scrape interval Default is 15s because included recording rules use a 1m rate, and scrape interval needs to be at least 1/4 rate interval. "15s" monitoring.serviceMonitor.jobPrefix string The job label is required for the included dashboards to work. "{{ include \"loki.namespace\" $ }}/" monitoring.serviceMonitor.labels object Additional ServiceMonitor labels {} monitoring.serviceMonitor.metricRelabelings list ServiceMonitor metric relabel configs to apply to samples before ingestion https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#endpoint [] monitoring.serviceMonitor.namespaceSelector object Namespace selector for ServiceMonitor resources {} monitoring.serviceMonitor.relabelings list ServiceMonitor relabel configs to apply to samples before scraping https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/api.md#relabelconfig [] monitoring.serviceMonitor.scheme string ServiceMonitor will use http by default, but you can pick https as well "http" monitoring.serviceMonitor.scrapeTimeout string ServiceMonitor scrape timeout in Go duration format (e.g. 15s) nil monitoring.serviceMonitor.tlsConfig string ServiceMonitor will use these tlsConfig settings to make the health check requests nil networkPolicy Configuration for the Kubernetes NetworkPolicies that control inbound and outbound traffic for Loki components. Key Type Description Default networkPolicy.alertmanager.namespaceSelector object Specifies the namespace the Alertmanager is running in {} networkPolicy.alertmanager.podSelector object Specifies the Alertmanager Pods. As this is cross-namespace communication, you also need the namespaceSelector. {} networkPolicy.alertmanager.port int Specify the Alertmanager port used for alerting 9093 networkPolicy.discovery.namespaceSelector object Specifies the namespace the discovery Pods are running in {} networkPolicy.discovery.podSelector object Specifies the Pods labels used for discovery. As this is cross-namespace communication, you also need the namespaceSelector. {} networkPolicy.discovery.port int Specify the port used for discovery nil networkPolicy.enabled bool Specifies whether Network Policies should be created false networkPolicy.externalStorage.cidrs list Specifies specific network CIDRs you want to limit access to [] networkPolicy.externalStorage.ports list Specify the port used for external storage, e.g. AWS S3 [] networkPolicy.ingress.namespaceSelector object Specifies the namespaces which are allowed to access the http port {} networkPolicy.ingress.podSelector object Specifies the Pods which are allowed to access the http port. As this is cross-namespace communication, you also need the namespaceSelector. {} networkPolicy.metrics.cidrs list Specifies specific network CIDRs which are allowed to access the metrics port. In case you use namespaceSelector, you also have to specify your kubelet networks here. The metrics ports are also used for probes. [] networkPolicy.metrics.namespaceSelector object Specifies the namespaces which are allowed to access the metrics port {} networkPolicy.metrics.podSelector object Specifies the Pods which are allowed to access the metrics port. As this is cross-namespace communication, you also need the namespaceSelector. {} overridesExporter Configuration for the overrides-exporter Key Type Description Default overridesExporter.affinity object Affinity for overrides-exporter pods. The value will be passed through tpl. Hard node anti-affinity overridesExporter.annotations object Annotations for overrides-exporter {} overridesExporter.appProtocol object Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" @deprecated -- This option is deprecated in favor of overridesExporter.service.appProtocol {"grpc":""} overridesExporter.command string Command to execute instead of defined in Docker image nil overridesExporter.dnsConfig object DNSConfig for overrides-exporter {} overridesExporter.enabled bool The overrides-exporter component is optional and can be disabled if desired. false overridesExporter.extraArgs list Additional CLI args for the overrides-exporter [] overridesExporter.extraContainers list Containers to add to the overrides-exporter pods [] overridesExporter.extraEnv list Environment variables to add to the overrides-exporter pods [] overridesExporter.extraEnvFrom list Environment variables from secrets or configmaps to add to the overrides-exporter pods [] overridesExporter.extraVolumeMounts list Volume mounts to add to the overrides-exporter pods [] overridesExporter.extraVolumes list Volumes to add to the overrides-exporter pods [] overridesExporter.hostAliases list hostAliases to add [] overridesExporter.hostUsers string Use the host's user namespace in the overrides-exporter nil overridesExporter.image.registry string The Docker registry for the overrides-exporter image. Overrides loki.image.registry nil overridesExporter.image.repository string Docker image repository for the overrides-exporter image. Overrides loki.image.repository nil overridesExporter.image.tag string Docker image tag for the overrides-exporter image. Overrides loki.image.tag nil overridesExporter.initContainers list Init containers to add to the overrides-exporter pods [] overridesExporter.kind string Kind of backend workload. StatefulSet and Deployment are supported. "Deployment" overridesExporter.labels object Labels for overrides-exporter {} overridesExporter.maxUnavailable string Pod Disruption Budget maxUnavailable @deprecated -- This is deprecated in favor of podDisruptionBudget.maxUnavailable. nil overridesExporter.nodeSelector object Node selector for overrides-exporter pods {} overridesExporter.podAnnotations object Annotations for overrides-exporter pods {} overridesExporter.podDisruptionBudget.annotations object Annotations for Pod Disruption Budget {} overridesExporter.podDisruptionBudget.enabled bool Enable Pod Disruption Budget true overridesExporter.podDisruptionBudget.labels object Labels for Pod Disruption Budget {} overridesExporter.podDisruptionBudget.maxUnavailable string Pod Disruption Budget maxUnavailable nil overridesExporter.podDisruptionBudget.minAvailable string Pod Disruption Budget minAvailable nil overridesExporter.podDisruptionBudget.unhealthyPodEvictionPolicy string Pod Disruption Budget unhealthyPodEvictionPolicy nil overridesExporter.podLabels object Labels for overrides-exporter pods {} overridesExporter.priorityClassName string The name of the PriorityClass for overrides-exporter pods nil overridesExporter.replicas int Number of replicas for the overrides-exporter. Set to null to omit spec.replicas from the workload, allowing an external controller (e.g. HPA, KEDA, rollout-operator) to manage replica counts without Helm resetting them. 0 overridesExporter.resizePolicy list Container resize policy for the overrides-exporter Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] overridesExporter.resources object Resource requests and limits for the overrides-exporter {} overridesExporter.service.annotations object Annotations for overrides-exporter Service {} overridesExporter.service.appProtocol.grpc string Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" "" overridesExporter.service.ipFamilies list ipFamilies for overrides-exporter Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services [] overridesExporter.service.ipFamilyPolicy string ipFamilyPolicy for overrides-exporter Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services "" overridesExporter.service.labels object Additional labels for overrides-exporter Service {} overridesExporter.service.sessionAffinity string Session affinity for overrides-exporter Service "" overridesExporter.service.sessionAffinityConfig object Session affinity config for overrides-exporter Service {} overridesExporter.service.trafficDistribution string trafficDistribution for overrides-exporter Service "" overridesExporter.service.type string Service Type for overrides-exporter Service "ClusterIP" overridesExporter.serviceAccount.annotations object Annotations for the service account {} overridesExporter.serviceAccount.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account true overridesExporter.serviceAccount.create bool Specifies whether a ServiceAccount should be created false overridesExporter.serviceAccount.imagePullSecrets list Image pull secrets for the service account [] overridesExporter.serviceAccount.labels object Labels for the service account {} overridesExporter.serviceAccount.name string The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template nil overridesExporter.serviceAnnotations object Annotations for overrides-exporter service @deprecated -- This option is deprecated in favor of overridesExporter.service.annotations {} overridesExporter.serviceLabels object Labels for overrides-exporter service @deprecated -- This option is deprecated in favor of overridesExporter.service.labels {} overridesExporter.terminationGracePeriodSeconds int Grace period to allow the overrides-exporter to shutdown before it is killed 300 overridesExporter.topologySpreadConstraints list Topology Spread Constraints for overrides-exporter pods The value will be passed through tpl. [] patternIngester Configuration for the pattern ingester Key Type Description Default patternIngester.affinity object Affinity for pattern ingester pods. The value will be passed through tpl. Hard node anti-affinity patternIngester.annotations object Annotations for pattern ingester {} patternIngester.appProtocol object Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" {"grpc":""} patternIngester.command string Command to execute instead of defined in Docker image nil patternIngester.dnsConfig object DNSConfig for pattern ingester pods {} patternIngester.enabled bool Enable the component. Requires loki.deploymentMode to be set to Distributed. false patternIngester.extraArgs list Additional CLI args for the pattern ingester [] patternIngester.extraContainers list Containers to add to the pattern ingester pods [] patternIngester.extraEnv list Environment variables to add to the pattern ingester pods [] patternIngester.extraEnvFrom list Environment variables from secrets or configmaps to add to the pattern ingester pods [] patternIngester.extraVolumeMounts list Volume mounts to add to the pattern ingester pods [] patternIngester.extraVolumes list Volumes to add to the pattern ingester pods [] patternIngester.hostAliases list hostAliases to add [] patternIngester.hostUsers string Use the host's user namespace in the pattern ingester nil patternIngester.image.registry string The Docker registry for the pattern ingester image. Overrides loki.image.registry nil patternIngester.image.repository string Docker image repository for the pattern ingester image. Overrides loki.image.repository nil patternIngester.image.tag string Docker image tag for the pattern ingester image. Overrides loki.image.tag nil patternIngester.initContainers list Init containers to add to the pattern ingester pods [] patternIngester.kind string Kind of compactor deployment. StatefulSet and Deployment are supported. "StatefulSet" patternIngester.labels object Labels for pattern ingester {} patternIngester.livenessProbe object liveness probe settings for pattern ingester pods. If empty use loki.livenessProbe {} patternIngester.maxUnavailable string Pod Disruption Budget maxUnavailable @deprecated -- This is deprecated in favor of podDisruptionBudget.maxUnavailable. nil patternIngester.nodeSelector object Node selector for pattern ingester pods {} patternIngester.persistence.claims list List of the pattern ingester PVCs patternIngester.persistence.claims[0].accessModes list Set access modes on the PersistentVolumeClaim ["ReadWriteOnce"] patternIngester.persistence.claims[0].annotations object Annotations for pattern ingester PVCs {} patternIngester.persistence.claims[0].labels object Labels for pattern ingester PVCs {} patternIngester.persistence.claims[0].volumeAttributesClassName string Volume attributes class name to be used. If empty or set to null, no volumeAttributesClassName spec is set. Requires Kubernetes 1.31 nil patternIngester.persistence.enableStatefulSetAutoDeletePVC bool Enable StatefulSetAutoDeletePVC feature false patternIngester.persistence.enabled bool Enable creating PVCs for the pattern ingester false patternIngester.persistence.size string Size of persistent disk "10Gi" patternIngester.persistence.storageClass string Storage class to be used. If defined, storageClassName: . If set to "-", storageClassName: "", which disables dynamic provisioning. If empty or set to null, no storageClassName spec is set, choosing the default provisioner (gp2 on AWS, standard on GKE, AWS, and OpenStack). nil patternIngester.podAnnotations object Annotations for pattern ingester pods {} patternIngester.podDisruptionBudget.annotations object Annotations for Pod Disruption Budget {} patternIngester.podDisruptionBudget.enabled bool Enable Pod Disruption Budget true patternIngester.podDisruptionBudget.labels object Labels for Pod Disruption Budget {} patternIngester.podDisruptionBudget.maxUnavailable string Pod Disruption Budget maxUnavailable nil patternIngester.podDisruptionBudget.minAvailable string Pod Disruption Budget minAvailable nil patternIngester.podDisruptionBudget.unhealthyPodEvictionPolicy string Pod Disruption Budget unhealthyPodEvictionPolicy nil patternIngester.podLabels object Labels for pattern ingester pods {} patternIngester.priorityClassName string The name of the PriorityClass for pattern ingester pods nil patternIngester.readinessProbe object readiness probe settings for pattern ingester pods. If empty, use loki.readinessProbe {} patternIngester.replicas int Number of replicas for the pattern ingester. Set to null to omit spec.replicas from the workload, allowing an external controller (e.g. HPA, KEDA, rollout-operator) to manage replica counts without Helm resetting them. 0 patternIngester.resizePolicy list Container resize policy for the pattern ingester Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] patternIngester.resources object Resource requests and limits for the pattern ingester {} patternIngester.serviceAccount.annotations object Annotations for the service account {} patternIngester.serviceAccount.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account true patternIngester.serviceAccount.create bool Specifies whether a ServiceAccount should be created false patternIngester.serviceAccount.imagePullSecrets list Image pull secrets for the service account [] patternIngester.serviceAccount.labels object Labels for the service account {} patternIngester.serviceAccount.name string The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template nil patternIngester.startupProbe object startup probe settings for pattern ingester pods. If empty use loki.startupProbe {} patternIngester.statefulSetRecreateJob object EXPERIMENTAL: Enable creating a Job to recreate the compactor StatefulSet when the compactor configuration is changed. # Only applicable if compactor.kind is StatefulSet. Useful for PVC size changes, which require recreating the StatefulSet. {"enabled":false} patternIngester.strategy object UpdateStrategy or Strategy for the pattern ingester. {"rollingUpdate":{"partition":0}} patternIngester.terminationGracePeriodSeconds int Grace period to allow the pattern ingester to shutdown before it is killed 30 patternIngester.topologySpreadConstraints list Topology Spread Constraints for pattern ingester pods The value will be passed through tpl. [] querier Configuration for the querier Key Type Description Default querier.affinity object Affinity for querier pods. The value will be passed through tpl. Hard node anti-affinity querier.annotations object Annotations for querier {} querier.appProtocol.grpc string Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" @deprecated -- This option is deprecated in favor of querier.service.appProtocol.grpc "" querier.autoscaling.behavior.enabled bool Enable autoscaling behaviours false querier.autoscaling.behavior.scaleDown object define scale down policies, must conform to HPAScalingRules {} querier.autoscaling.behavior.scaleUp object define scale up policies, must conform to HPAScalingRules {} querier.autoscaling.customMetrics list Allows one to define custom metrics using the HPA/v2 schema (for example, Pods, Object or External metrics) [] querier.autoscaling.enabled bool Enable autoscaling for the querier, this is only used if indexGateway.enabled: true false querier.autoscaling.maxReplicas int Maximum autoscaling replicas for the querier 3 querier.autoscaling.minReplicas int Minimum autoscaling replicas for the querier 1 querier.autoscaling.targetCPUUtilizationPercentage int Target CPU utilisation percentage for the querier 60 querier.autoscaling.targetMemoryUtilizationPercentage string Target memory utilisation percentage for the querier nil querier.command string Command to execute instead of defined in Docker image nil querier.dnsConfig object DNSConfig for querier pods {} querier.enabled bool Enable the component. Requires loki.deploymentMode to be set to Distributed. true querier.extraArgs list Additional CLI args for the querier [] querier.extraContainers list Containers to add to the querier pods [] querier.extraEnv list Environment variables to add to the querier pods [] querier.extraEnvFrom list Environment variables from secrets or configmaps to add to the querier pods [] querier.extraVolumeMounts list Volume mounts to add to the querier pods [] querier.extraVolumes list Volumes to add to the querier pods [] querier.hostAliases list hostAliases to add [] querier.hostUsers string Use the host's user namespace in the querier nil querier.image.registry string The Docker registry for the querier image. Overrides loki.image.registry nil querier.image.repository string Docker image repository for the querier image. Overrides loki.image.repository nil querier.image.tag string Docker image tag for the querier image. Overrides loki.image.tag nil querier.initContainers list Init containers to add to the querier pods [] querier.kedaAutoscaling.behavior object Behavior configuration for KEDA ScaledObject (horizontalPodAutoscalerConfig.behavior). Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#advanced {} querier.kedaAutoscaling.cooldownPeriod string Period to wait after the last trigger reported active before scaling the resource back to 0 (seconds). Defaults to defaults.kedaAutoscaling.cooldownPeriod if not set. nil querier.kedaAutoscaling.enabled bool Enable KEDA autoscaling for the querier. Mutually exclusive with autoscaling.enabled false querier.kedaAutoscaling.fallback object Fallback configuration for KEDA ScaledObject. Applied when the trigger metric cannot be retrieved. Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#fallback {} querier.kedaAutoscaling.maxReplicas int Maximum replicas for KEDA autoscaling 10 querier.kedaAutoscaling.minReplicas int Minimum replicas for KEDA autoscaling 1 querier.kedaAutoscaling.pollingInterval string Interval (seconds) to poll each trigger. Defaults to defaults.kedaAutoscaling.pollingInterval if not set. nil querier.kedaAutoscaling.triggers list KEDA triggers for the querier. Defaults to a Prometheus trigger using inflight requests. [{"metadata":{"authModes":"{{ .Values.defaults.kedaAutoscaling.authentication.authModes }}","customHeaders":"{{ .Values.defaults.kedaAutoscaling.customHeaders }}","ignoreNullValues":"{{ .Values.defaults.kedaAutoscaling.ignoreNullValues }}","query":"sum(max_over_time(loki_query_scheduler_inflight_requests{quantile=\"0.75\"}[2m]))","serverAddress":"{{ .Values.defaults.kedaAutoscaling.prometheusAddress }}","threshold":"4","unsafeSsl":"{{ .Values.defaults.kedaAutoscaling.unsafeSsl }}"},"name":"querier_autoscaling_metric","type":"prometheus"}] querier.kind string Kind of compactor deployment. StatefulSet and Deployment are supported. "Deployment" querier.labels object Labels for querier {} querier.maxSurge int Max Surge for querier pods 0 querier.maxUnavailable string Pod Disruption Budget maxUnavailable @deprecated -- This is deprecated in favor of podDisruptionBudget.maxUnavailable. nil querier.nodeSelector object Node selector for querier pods {} querier.podAnnotations object Annotations for querier pods {} querier.podDisruptionBudget.annotations object Annotations for Pod Disruption Budget {} querier.podDisruptionBudget.enabled bool Enable Pod Disruption Budget true querier.podDisruptionBudget.labels object Labels for Pod Disruption Budget {} querier.podDisruptionBudget.maxUnavailable string Pod Disruption Budget maxUnavailable nil querier.podDisruptionBudget.minAvailable string Pod Disruption Budget minAvailable nil querier.podDisruptionBudget.unhealthyPodEvictionPolicy string Pod Disruption Budget unhealthyPodEvictionPolicy nil querier.podLabels object Labels for querier pods {} querier.priorityClassName string The name of the PriorityClass for querier pods nil querier.replicas int Number of replicas for the querier. Set to null to omit spec.replicas from the workload, allowing an external controller (e.g. HPA, KEDA, rollout-operator) to manage replica counts without Helm resetting them. 0 querier.resizePolicy list Container resize policy for the querier Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] querier.resources object Resource requests and limits for the querier {} querier.service.annotations object Annotations for querier Service {} querier.service.appProtocol.grpc string Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" "" querier.service.ipFamilies list ipFamilies for querier Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services [] querier.service.ipFamilyPolicy string ipFamilyPolicy for querier Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services "" querier.service.labels object Additional labels for querier Service {} querier.service.sessionAffinity string Session affinity for querier Service "" querier.service.sessionAffinityConfig object Session affinity config for querier Service {} querier.service.trafficDistribution string trafficDistribution for querier Service "" querier.service.type string Service Type for querier Service "ClusterIP" querier.serviceAccount.annotations object Annotations for the service account {} querier.serviceAccount.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account true querier.serviceAccount.create bool Specifies whether a ServiceAccount should be created false querier.serviceAccount.imagePullSecrets list Image pull secrets for the service account [] querier.serviceAccount.labels object Labels for the service account {} querier.serviceAccount.name string The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template nil querier.serviceAnnotations object Annotations for querier service @deprecated -- This option is deprecated in favor of querier.service.annotations {} querier.serviceLabels object Labels for querier service @deprecated -- This option is deprecated in favor of querier.service.labels {} querier.serviceType string Service type for querier service @deprecated -- This option is deprecated in favor of querier.service.type "ClusterIP" querier.strategy.rollingUpdate.maxUnavailable int Pod Disruption Budget maxUnavailable 1 querier.terminationGracePeriodSeconds int Grace period to allow the querier to shutdown before it is killed 30 querier.tolerations list Tolerations for querier pods [] querier.topologySpreadConstraints list topologySpread for querier pods. The value will be passed through tpl. Defaults to allow skew no more then 1 node querier.trafficDistribution string trafficDistribution for querier service "" queryFrontend Configuration for the query-frontend Key Type Description Default queryFrontend.affinity object Affinity for query-frontend pods. The value will be passed through tpl. Hard node anti-affinity queryFrontend.annotations object Annotations for query-frontend {} queryFrontend.appProtocol.grpc string Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" @deprecated -- This option is deprecated in favor of queryFrontend.service.appProtocol.grpc "" queryFrontend.autoscaling.behavior.enabled bool Enable autoscaling behaviours false queryFrontend.autoscaling.behavior.scaleDown object define scale down policies, must conform to HPAScalingRules {} queryFrontend.autoscaling.behavior.scaleUp object define scale up policies, must conform to HPAScalingRules {} queryFrontend.autoscaling.customMetrics list Allows one to define custom metrics using the HPA/v2 schema (for example, Pods, Object or External metrics) [] queryFrontend.autoscaling.enabled bool Enable autoscaling for the query-frontend false queryFrontend.autoscaling.maxReplicas int Maximum autoscaling replicas for the query-frontend 3 queryFrontend.autoscaling.minReplicas int Minimum autoscaling replicas for the query-frontend 1 queryFrontend.autoscaling.targetCPUUtilizationPercentage int Target CPU utilisation percentage for the query-frontend 60 queryFrontend.autoscaling.targetMemoryUtilizationPercentage string Target memory utilisation percentage for the query-frontend nil queryFrontend.command string Command to execute instead of defined in Docker image nil queryFrontend.enabled bool Enable the component. Requires loki.deploymentMode to be set to Distributed. true queryFrontend.extraArgs list Additional CLI args for the query-frontend [] queryFrontend.extraContainers list Containers to add to the query-frontend pods [] queryFrontend.extraEnv list Environment variables to add to the query-frontend pods [] queryFrontend.extraEnvFrom list Environment variables from secrets or configmaps to add to the query-frontend pods [] queryFrontend.extraVolumeMounts list Volume mounts to add to the query-frontend pods [] queryFrontend.extraVolumes list Volumes to add to the query-frontend pods [] queryFrontend.hostAliases list hostAliases to add [] queryFrontend.hostUsers string Use the host's user namespace in the query-frontend nil queryFrontend.image.registry string The Docker registry for the query-frontend image. Overrides loki.image.registry nil queryFrontend.image.repository string Docker image repository for the query-frontend image. Overrides loki.image.repository nil queryFrontend.image.tag string Docker image tag for the query-frontend image. Overrides loki.image.tag nil queryFrontend.initContainers list init containers to add to the query-frontend pods [] queryFrontend.kedaAutoscaling.behavior object Behavior configuration for KEDA ScaledObject (horizontalPodAutoscalerConfig.behavior). Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#advanced {} queryFrontend.kedaAutoscaling.cooldownPeriod string Period to wait after the last trigger reported active before scaling the resource back to 0 (seconds). Defaults to defaults.kedaAutoscaling.cooldownPeriod if not set. nil queryFrontend.kedaAutoscaling.enabled bool Enable KEDA autoscaling for the query-frontend. Mutually exclusive with autoscaling.enabled false queryFrontend.kedaAutoscaling.fallback object Fallback configuration for KEDA ScaledObject. Applied when the trigger metric cannot be retrieved. Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#fallback {} queryFrontend.kedaAutoscaling.maxReplicas int Maximum replicas for KEDA autoscaling 3 queryFrontend.kedaAutoscaling.minReplicas int Minimum replicas for KEDA autoscaling 1 queryFrontend.kedaAutoscaling.pollingInterval string Interval (seconds) to poll each trigger. Defaults to defaults.kedaAutoscaling.pollingInterval if not set. nil queryFrontend.kedaAutoscaling.triggers list KEDA triggers for the query-frontend. Ref: https://keda.sh/docs/latest/scalers/ [] queryFrontend.kind string Kind of compactor deployment. StatefulSet and Deployment are supported. "Deployment" queryFrontend.labels object Labels for query-frontend {} queryFrontend.loadBalancer object Enable load balancer port for query-frontend {"enabled":true} queryFrontend.maxUnavailable string Pod Disruption Budget maxUnavailable @deprecated -- This is deprecated in favor of podDisruptionBudget.maxUnavailable. nil queryFrontend.nodeSelector object Node selector for query-frontend pods {} queryFrontend.podAnnotations object Annotations for query-frontend pods {} queryFrontend.podDisruptionBudget.annotations object Annotations for Pod Disruption Budget {} queryFrontend.podDisruptionBudget.enabled bool Enable Pod Disruption Budget true queryFrontend.podDisruptionBudget.labels object Labels for Pod Disruption Budget {} queryFrontend.podDisruptionBudget.maxUnavailable string Pod Disruption Budget maxUnavailable nil queryFrontend.podDisruptionBudget.minAvailable string Pod Disruption Budget minAvailable nil queryFrontend.podDisruptionBudget.unhealthyPodEvictionPolicy string Pod Disruption Budget unhealthyPodEvictionPolicy nil queryFrontend.podLabels object Labels for query-frontend pods {} queryFrontend.priorityClassName string The name of the PriorityClass for query-frontend pods nil queryFrontend.replicas int Number of replicas for the query-frontend. Set to null to omit spec.replicas from the workload, allowing an external controller (e.g. HPA, KEDA, rollout-operator) to manage replica counts without Helm resetting them. 0 queryFrontend.resizePolicy list Container resize policy for the query-frontend Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] queryFrontend.resources object Resource requests and limits for the query-frontend {} queryFrontend.service.annotations object Annotations for query-frontend Service {} queryFrontend.service.appProtocol.grpc string Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" "" queryFrontend.service.ipFamilies list ipFamilies for query-frontend Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services [] queryFrontend.service.ipFamilyPolicy string ipFamilyPolicy for query-frontend Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services "" queryFrontend.service.labels object Additional labels for query-frontend Service {} queryFrontend.service.sessionAffinity string Session affinity for query-frontend Service "" queryFrontend.service.sessionAffinityConfig object Session affinity config for query-frontend Service {} queryFrontend.service.trafficDistribution string trafficDistribution for query-frontend Service "" queryFrontend.service.type string Service Type for query-frontend Service "ClusterIP" queryFrontend.serviceAccount.annotations object Annotations for the service account {} queryFrontend.serviceAccount.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account true queryFrontend.serviceAccount.create bool Specifies whether a ServiceAccount should be created false queryFrontend.serviceAccount.imagePullSecrets list Image pull secrets for the service account [] queryFrontend.serviceAccount.labels object Labels for the service account {} queryFrontend.serviceAccount.name string The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template nil queryFrontend.serviceAnnotations object Annotations for query-frontend service @deprecated -- This option is deprecated in favor of queryFrontend.service.annotations {} queryFrontend.serviceLabels object Labels for query-frontend service @deprecated -- This option is deprecated in favor of queryFrontend.service.labels {} queryFrontend.serviceType string Service type for query-frontend service @deprecated -- This option is deprecated in favor of queryFrontend.service.type "ClusterIP" queryFrontend.strategy.rollingUpdate.maxUnavailable int Pod Disruption Budget maxUnavailable 1 queryFrontend.terminationGracePeriodSeconds int Grace period to allow the query-frontend to shutdown before it is killed 30 queryFrontend.topologySpreadConstraints list Topology Spread Constraints for query-frontend pods The value will be passed through tpl. [] queryFrontend.trafficDistribution string trafficDistribution for query-frontend service "" queryScheduler Configuration for the query-scheduler Key Type Description Default queryScheduler.affinity object Affinity for query-scheduler pods. The value will be passed through tpl. Hard node anti-affinity queryScheduler.annotations object Annotations for query-scheduler {} queryScheduler.appProtocol object Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" @deprecated -- This option is deprecated in favor of queryScheduler.service.appProtocol {"grpc":""} queryScheduler.dnsConfig object DNSConfig for query-scheduler {} queryScheduler.enabled bool Enable the component. Requires loki.deploymentMode to be set to Distributed. true queryScheduler.extraArgs list Additional CLI args for the query-scheduler [] queryScheduler.extraContainers list Containers to add to the query-scheduler pods [] queryScheduler.extraEnv list Environment variables to add to the query-scheduler pods [] queryScheduler.extraEnvFrom list Environment variables from secrets or configmaps to add to the query-scheduler pods [] queryScheduler.extraVolumeMounts list Volume mounts to add to the query-scheduler pods [] queryScheduler.extraVolumes list Volumes to add to the query-scheduler pods [] queryScheduler.hostAliases list hostAliases to add [] queryScheduler.hostUsers string Use the host's user namespace in the query-scheduler nil queryScheduler.image.registry string The Docker registry for the query-scheduler image. Overrides loki.image.registry nil queryScheduler.image.repository string Docker image repository for the query-scheduler image. Overrides loki.image.repository nil queryScheduler.image.tag string Docker image tag for the query-scheduler image. Overrides loki.image.tag nil queryScheduler.initContainers list init containers to add to the query-scheduler pods [] queryScheduler.kind string Kind of query-scheduler deployment. StatefulSet and Deployment are supported. "Deployment" queryScheduler.labels object Labels for query-scheduler {} queryScheduler.maxUnavailable int Pod Disruption Budget maxUnavailable @deprecated -- This is deprecated in favor of podDisruptionBudget.maxUnavailable. 1 queryScheduler.nodeSelector object Node selector for query-scheduler pods {} queryScheduler.podAnnotations object Annotations for query-scheduler pods {} queryScheduler.podDisruptionBudget.annotations object Annotations for Pod Disruption Budget {} queryScheduler.podDisruptionBudget.enabled bool Enable Pod Disruption Budget true queryScheduler.podDisruptionBudget.labels object Labels for Pod Disruption Budget {} queryScheduler.podDisruptionBudget.maxUnavailable string Pod Disruption Budget maxUnavailable nil queryScheduler.podDisruptionBudget.minAvailable string Pod Disruption Budget minAvailable nil queryScheduler.podDisruptionBudget.unhealthyPodEvictionPolicy string Pod Disruption Budget unhealthyPodEvictionPolicy nil queryScheduler.podLabels object Labels for query-scheduler pods {} queryScheduler.priorityClassName string The name of the PriorityClass for query-scheduler pods nil queryScheduler.replicas int Number of replicas for the query-scheduler. It should be lower than -querier.max-concurrent to avoid generating back-pressure in queriers; it's also recommended that this value evenly divides the latter Set to null to omit spec.replicas from the workload, allowing an external controller (e.g. HPA, KEDA, rollout-operator) to manage replica counts without Helm resetting them. 0 queryScheduler.resizePolicy list Container resize policy for the query-scheduler Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] queryScheduler.resources object Resource requests and limits for the query-scheduler {} queryScheduler.service.annotations object Annotations for query-scheduler Service {} queryScheduler.service.appProtocol.grpc string Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" "" queryScheduler.service.ipFamilies list ipFamilies for query-scheduler Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services [] queryScheduler.service.ipFamilyPolicy string ipFamilyPolicy for query-scheduler Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services "" queryScheduler.service.labels object Additional labels for query-scheduler Service {} queryScheduler.service.sessionAffinity string Session affinity for query-scheduler Service "" queryScheduler.service.sessionAffinityConfig object Session affinity config for query-scheduler Service {} queryScheduler.service.trafficDistribution string trafficDistribution for query-scheduler Service "" queryScheduler.service.type string Service Type for query-scheduler Service "ClusterIP" queryScheduler.serviceAccount.annotations object Annotations for the service account {} queryScheduler.serviceAccount.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account true queryScheduler.serviceAccount.create bool Specifies whether a ServiceAccount should be created false queryScheduler.serviceAccount.imagePullSecrets list Image pull secrets for the service account [] queryScheduler.serviceAccount.labels object Labels for the service account {} queryScheduler.serviceAccount.name string The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template nil queryScheduler.serviceAnnotations object Annotations for query-scheduler service @deprecated -- This option is deprecated in favor of queryScheduler.service.annotations {} queryScheduler.serviceLabels object Labels for query-scheduler service @deprecated -- This option is deprecated in favor of queryScheduler.service.labels {} queryScheduler.serviceType string Service type for query-scheduler service @deprecated -- This option is deprecated in favor of queryScheduler.service.type "ClusterIP" queryScheduler.strategy.rollingUpdate.maxUnavailable int Pod Disruption Budget maxUnavailable 1 queryScheduler.terminationGracePeriodSeconds int Grace period to allow the query-scheduler to shutdown before it is killed 30 queryScheduler.topologySpreadConstraints list Topology Spread Constraints for query-scheduler pods The value will be passed through tpl. [] queryScheduler.trafficDistribution string trafficDistribution for query-scheduler service "" rbac Configuration for the Kubernetes RBAC resources and Pod Security Policy settings created for Loki. Key Type Description Default rbac.namespaced bool Whether to install RBAC in the namespace only or cluster-wide. Useful if you want to watch ConfigMap globally. false rbac.sccAllowHostDirVolumePlugin bool Toggle this to true to allow the use of hostPath volumes on OpenShift false rbac.sccEnabled bool For OpenShift set sccEnabled to 'true' to use the SecurityContextConstraints. false read Configuration for the read pod(s) Key Type Description Default read.affinity object Affinity for read pods. The value will be passed through tpl. Hard node anti-affinity read.annotations object Annotations for read deployment {} read.autoscaling.behavior object Behavior policies while scaling. {} read.autoscaling.enabled bool Enable autoscaling for the read, this is only used if queryIndex.enabled: true false read.autoscaling.maxReplicas int Maximum autoscaling replicas for the read 6 read.autoscaling.minReplicas int Minimum autoscaling replicas for the read 2 read.autoscaling.targetCPUUtilizationPercentage int Target CPU utilisation percentage for the read 60 read.autoscaling.targetMemoryUtilizationPercentage string Target memory utilisation percentage for the read nil read.dnsConfig object DNS config for read pods {} read.enabled bool Enable the component. Requires loki.deploymentMode to be set to SimpleScalable. true read.extraArgs list Additional CLI args for the read [] read.extraContainers list Containers to add to the read pods [] read.extraEnv list Environment variables to add to the read pods [] read.extraEnvFrom list Environment variables from secrets or configmaps to add to the read pods [] read.extraVolumeMounts list Volume mounts to add to the read pods [] read.extraVolumes list Volumes to add to the read pods [] read.fullnameOverride string Override for the read fullname. By default, this is generated using the fullname template with "-backend" "{{ include \"loki.name\" . }}-read" read.hostUsers string Use the host's user namespace in the read pods. nil read.image.registry string The Docker registry for the read image. Overrides loki.image.registry nil read.image.repository string Docker image repository for the read image. Overrides loki.image.repository nil read.image.tag string Docker image tag for the read image. Overrides loki.image.tag nil read.initContainers list init containers to add to the read pods [] read.kedaAutoscaling.behavior object Behavior configuration for KEDA ScaledObject (horizontalPodAutoscalerConfig.behavior). Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#advanced {} read.kedaAutoscaling.cooldownPeriod string Period to wait after the last trigger reported active before scaling the resource back to 0 (seconds). Defaults to defaults.kedaAutoscaling.cooldownPeriod if not set. nil read.kedaAutoscaling.enabled bool Enable KEDA autoscaling for the read. Mutually exclusive with autoscaling.enabled false read.kedaAutoscaling.fallback object Fallback configuration for KEDA ScaledObject. Applied when the trigger metric cannot be retrieved. Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#fallback {} read.kedaAutoscaling.maxReplicas int Maximum replicas for KEDA autoscaling 6 read.kedaAutoscaling.minReplicas int Minimum replicas for KEDA autoscaling 2 read.kedaAutoscaling.pollingInterval string Interval (seconds) to poll each trigger. Defaults to defaults.kedaAutoscaling.pollingInterval if not set. nil read.kedaAutoscaling.triggers list KEDA triggers for the read. Ref: https://keda.sh/docs/latest/scalers/ [] read.kind string Kind of read deployment. StatefulSet and Deployment are supported. "Deployment" read.labels object Additional labels for read deployment {} read.lifecycle object Lifecycle for the read container {} read.livenessProbe object liveness probe settings for read pods. If empty, applies no livenessProbe {} read.maxUnavailable int Pod Disruption Budget maxUnavailable @deprecated -- This is deprecated in favor of podDisruptionBudget.maxUnavailable. 1 read.nodeSelector object Node selector for read pods {} read.podAnnotations object Annotations for read pods {} read.podDisruptionBudget.annotations object Annotations for read Pod Disruption Budget {} read.podDisruptionBudget.enabled bool Enable Pod Disruption Budget for read pods true read.podDisruptionBudget.labels object Labels for read Pod Disruption Budget {} read.podDisruptionBudget.maxUnavailable string Pod Disruption Budget maxUnavailable nil read.podDisruptionBudget.minAvailable string Pod Disruption Budget minAvailable nil read.podDisruptionBudget.unhealthyPodEvictionPolicy string Pod Disruption Budget unhealthyPodEvictionPolicy nil read.podLabels object Additional labels for each read pod {} read.priorityClassName string The name of the PriorityClass for read pods nil read.replicas int Number of replicas for the read. Set to null to omit spec.replicas from the workload, allowing an external controller (e.g. HPA, KEDA, rollout-operator) to manage replica counts without Helm resetting them. 3 read.resizePolicy list Container resize policy for the read Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] read.resources object Resource requests and limits for the read {} read.selectorLabels object Additional selector labels for each read pod {} read.service.annotations object Annotations for read Service {} read.service.appProtocol.grpc string Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" "" read.service.ipFamilies list ipFamilies for read Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services [] read.service.ipFamilyPolicy string ipFamilyPolicy for read Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services "" read.service.labels object Additional labels for read Service {} read.service.sessionAffinity string Session affinity for read Service "" read.service.sessionAffinityConfig object Session affinity config for read Service {} read.service.trafficDistribution string trafficDistribution for read Service "" read.service.type string Service Type for read Service "ClusterIP" read.serviceAccount.annotations object Annotations for the service account {} read.serviceAccount.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account true read.serviceAccount.create bool Specifies whether a ServiceAccount should be created false read.serviceAccount.imagePullSecrets list Image pull secrets for the service account [] read.serviceAccount.labels object Labels for the service account {} read.serviceAccount.name string The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template nil read.startupProbe object startup probe for the read pods. If empty, applies no startupProbe {} read.strategy.rollingUpdate.maxUnavailable int Pod Disruption Budget maxUnavailable 1 read.terminationGracePeriodSeconds int Grace period to allow the read to shutdown before it is killed 30 read.topologySpreadConstraints list Topology Spread Constraints for read pods The value will be passed through tpl. [] resultsCache Configuration for the Memcached-based results-cache, which caches query results to speed up repeated queries. Key Type Description Default resultsCache.addresses string Comma separated addresses list in DNS Service Discovery format "dnssrvnoa+_memcached-client._tcp.{{ include \"loki.resourceName\" (dict \"ctx\" $ \"component\" \"results-cache\") }}.{{ include \"loki.namespace\" $ }}.svc.{{ .Values.global.clusterDomain }}" resultsCache.affinity object Affinity for results-cache pods {} resultsCache.allocatedCPU string Amount of cpu allocated to results-cache for object storage (in integer or millicores). "500m" resultsCache.allocatedMemory int Amount of memory allocated to results-cache for object storage (in MB). 1024 resultsCache.annotations object Annotations for the results-cache pods {} resultsCache.connectionLimit int Maximum number of connections allowed 16384 resultsCache.defaultValidity string Specify how long cached results should be stored in the results-cache before being expired "12h" resultsCache.dnsConfig object DNSConfig for results-cache {} resultsCache.enabled bool Specifies whether memcached based results-cache should be enabled true resultsCache.extraArgs object Additional CLI args for results-cache {} resultsCache.extraContainers list Additional containers to be added to the results-cache pod. [] resultsCache.extraExtendedOptions string Add extended options for results-cache memcached container. The format is the same as for the memcached -o/--extend flag. Example: extraExtendedOptions: 'tls,modern,track_sizes' "" resultsCache.extraVolumeMounts list Additional volume mounts to be added to the results-cache pod (applies to both memcached and exporter containers). Example: extraVolumeMounts: - name: extra-volume mountPath: /etc/extra-volume readOnly: true [] resultsCache.extraVolumes list Additional volumes to be added to the results-cache pod (applies to both memcached and exporter containers). Example: extraVolumes: - name: extra-volume secret: secretName: extra-volume-secret [] resultsCache.hostUsers string Use the host's user namespace in results-cache pods nil resultsCache.initContainers list Extra init containers for results-cache pods [] resultsCache.maxItemMemory int Maximum item results-cache for memcached (in MB). 5 resultsCache.maxUnavailable int Pod Disruption Budget maxUnavailable @deprecated -- This is deprecated in favor of podDisruptionBudget.maxUnavailable. 1 resultsCache.nodeSelector object Node selector for results-cache pods {} resultsCache.persistence.enabled bool Enable creating PVCs for the results-cache false resultsCache.persistence.labels object PVC additional labels {} resultsCache.persistence.mountPath string Volume mount path "/data" resultsCache.persistence.storageClass string Storage class to be used. If defined, storageClassName: . If set to "-", storageClassName: "", which disables dynamic provisioning. If empty or set to null, no storageClassName spec is set, choosing the default provisioner (gp2 on AWS, standard on GKE, AWS, and OpenStack). nil resultsCache.persistence.storageSize string Size of persistent disk, must be in G or Gi "10G" resultsCache.persistence.volumeAttributesClassName string Volume attributes class name to be used. If empty or set to null, no volumeAttributesClassName spec is set. Requires Kubernetes 1.31 nil resultsCache.podAnnotations object Annotations for results-cache pods {} resultsCache.podDisruptionBudget.annotations object Annotations for Pod Disruption Budget {} resultsCache.podDisruptionBudget.enabled bool Enable Pod Disruption Budget true resultsCache.podDisruptionBudget.labels object Labels for Pod Disruption Budget {} resultsCache.podDisruptionBudget.maxUnavailable string Pod Disruption Budget maxUnavailable nil resultsCache.podDisruptionBudget.minAvailable string Pod Disruption Budget minAvailable nil resultsCache.podDisruptionBudget.unhealthyPodEvictionPolicy string Pod Disruption Budget unhealthyPodEvictionPolicy nil resultsCache.podLabels object Labels for results-cache pods {} resultsCache.podManagementPolicy string Management policy for results-cache pods "Parallel" resultsCache.port int Port of the results-cache service 11211 resultsCache.priorityClassName string The name of the PriorityClass for results-cache pods nil resultsCache.replicas int Total number of results-cache replicas 1 resultsCache.resizePolicy list Container resize policy for the results-cache Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] resultsCache.resources object Resource requests and limits for the results-cache By default a safe memory limit will be requested based on allocatedMemory value (floor (* 1.2 allocatedMemory)). {} resultsCache.service object Service annotations and labels {"annotations":{},"labels":{}} resultsCache.statefulStrategy object Stateful results-cache strategy {"type":"RollingUpdate"} resultsCache.terminationGracePeriodSeconds int Grace period to allow the results-cache to shutdown before it is killed 60 resultsCache.timeout string Memcached operation timeout "500ms" resultsCache.tolerations list Tolerations for results-cache pods [] resultsCache.topologySpreadConstraints list topologySpreadConstraints allows to customize the default topologySpreadConstraints. This can be either a single dict as shown below or a slice of topologySpreadConstraints. labelSelector is taken from the constraint itself (if it exists) or is generated by the chart using the same selectors as for services. [] resultsCache.writebackBuffer int Max number of objects to use for cache write back 500000 resultsCache.writebackParallelism int Number of parallel threads for cache write back 1 resultsCache.writebackSizeLimit string Max memory to use for cache write back "500MB" rollout_operator Setting for the Grafana Rollout Operator https://github.com/grafana/helm-charts/tree/main/charts/rollout-operator Key Type Description Default rollout_operator.podSecurityContext object podSecurityContext is the pod security context for the rollout operator. When installing on OpenShift, override podSecurityContext settings with rollout_operator: podSecurityContext: fsGroup: null runAsGroup: null runAsUser: null {"fsGroup":10001,"runAsGroup":10001,"runAsNonRoot":true,"runAsUser":10001,"seccompProfile":{"type":"RuntimeDefault"}} rollout_operator.webhooks.enabled bool Enable the rollout-operator webhooks. See https://github.com/grafana/rollout-operator/#webhooks. Note that the webhooks require custom resource definitions. If upgrading, manually apply the files in the crds directory. true rollout_operator.webhooks.failurePolicy string Validating and mutating webhook failure policy. Ignore or Fail. "Ignore" rollout_operator.webhooks.timeoutSeconds int Timeout in seconds for the prepare-downscale mutating webhook. Must be between 1 and 30. 10 route Gateway API routes for direct routing to Loki services, bypassing the nginx gateway. Use either this or the top-level ingress, but not both at once. Each entry in the map creates a separate HTTPRoute resource. The key "main" produces a route named after the loki fullname; any other key appends the key as a suffix. This allows defining multiple routes, e.g. one HTTPRoute and one GRPCRoute. Key Type Description Default route.main.additionalRules list Additional rules to prepend before the generated path-routing rules. Each entry is rendered into spec.rules as written (templating is supported), so any HTTPRoute/GRPCRoute rule shape is accepted — including filter-only rules with no backendRefs (e.g. RequestRedirect, URLRewrite). [] route.main.annotations object Annotations for the route {} route.main.apiVersion string Gateway API version to use. Auto-detected from cluster capabilities if empty. "" route.main.backendPort string Backend port override for all generated rules. When unset, GRPCRoute automatically uses loki.server.grpc_listen_port (default 9095) and all other kinds use loki.server.http_listen_port (default 3100). nil route.main.enabled bool Specifies whether this Gateway API route should be created false route.main.hostnames list Hostnames for the route [] route.main.kind string Kind of the route resource. Valid options are GRPCRoute, HTTPRoute, TCPRoute, TLSRoute, UDPRoute "HTTPRoute" route.main.labels object Labels for the route {} route.main.parentRefs list Parent references for the route (required for Gateway API) [] route.main.paths.compactor list Paths that are exposed by Loki Compactor. If deployment mode is Distributed, the requests are forwarded to the service. If deployment mode is SimpleScalable, the requests are forwarded to k8s service. If deployment mode is SingleBinary, the requests are forwarded to the central/single k8s service. ["/loki/api/v1/delete"] route.main.paths.distributor list Paths that are exposed by Loki Distributor. If deployment mode is Distributed, the requests are forwarded to the service: {{"loki.distributorFullname"}}. If deployment mode is SimpleScalable, the requests are forwarded to write k8s service: {{"loki.writeFullname"}}. If deployment mode is SingleBinary, the requests are forwarded to the central/single k8s service: {{"loki.fullname"}} ["/api/prom/push","/loki/api/v1/push","/otlp/v1/logs"] route.main.paths.queryFrontend list Paths that are exposed by Loki Query Frontend. If deployment mode is Distributed, the requests are forwarded to the service. If deployment mode is SimpleScalable, the requests are forwarded to read k8s service. If deployment mode is SingleBinary, the requests are forwarded to the central/single k8s service` ["/api/prom/query","/api/prom/label","/api/prom/series","/api/prom/tail","/loki/api/v1/query","/loki/api/v1/query_range","/loki/api/v1/tail","/loki/api/v1/label","/loki/api/v1/labels","/loki/api/v1/series","/loki/api/v1/index/stats","/loki/api/v1/index/volume","/loki/api/v1/index/volume_range","/loki/api/v1/format_query","/loki/api/v1/detected_field","/loki/api/v1/detected_fields","/loki/api/v1/detected_labels","/loki/api/v1/patterns","/ui"] route.main.paths.ruler list Paths that are exposed by Loki Ruler. If deployment mode is Distributed, the requests are forwarded to the service. If deployment mode is SimpleScalable, the requests are forwarded to k8s service. If deployment mode is SingleBinary, the requests are forwarded to the central/single k8s service. ["/api/prom/rules","/api/prom/api/v1/rules","/api/prom/api/v1/alerts","/loki/api/v1/rules","/prometheus/api/v1/rules","/prometheus/api/v1/alerts"] ruler Configuration for the ruler Key Type Description Default ruler.affinity object Affinity for ruler pods. The value will be passed through tpl. Hard node anti-affinity ruler.annotations object Annotations for ruler {} ruler.appProtocol object Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" @deprecated -- This option is deprecated in favor of ruler.service.appProtocol {"grpc":""} ruler.command string Command to execute instead of defined in Docker image nil ruler.directories object Directories containing rules files. If used, you must also configure loki.rulerConfig.storage to use local storage. {} ruler.dnsConfig object DNSConfig for ruler pods {} ruler.enabled bool The ruler component is optional and can be disabled if desired. true ruler.extraArgs list Additional CLI args for the ruler [] ruler.extraContainers list Containers to add to the ruler pods [] ruler.extraEnv list Environment variables to add to the ruler pods [] ruler.extraEnvFrom list Environment variables from secrets or configmaps to add to the ruler pods [] ruler.extraVolumeMounts list Volume mounts to add to the ruler pods [] ruler.extraVolumes list Volumes to add to the ruler pods [] ruler.hostAliases list hostAliases to add [] ruler.hostUsers string Use the host's user namespace in the ruler nil ruler.image.registry string The Docker registry for the ruler image. Overrides loki.image.registry nil ruler.image.repository string Docker image repository for the ruler image. Overrides loki.image.repository nil ruler.image.tag string Docker image tag for the ruler image. Overrides loki.image.tag nil ruler.initContainers list Init containers to add to the ruler pods [] ruler.kind string Kind of ruler deployment. StatefulSet and Deployment are supported. "StatefulSet" ruler.labels object Labels for ruler {} ruler.maxUnavailable string Pod Disruption Budget maxUnavailable @deprecated -- This is deprecated in favor of podDisruptionBudget.maxUnavailable. nil ruler.nodeSelector object Node selector for ruler pods {} ruler.persistence.accessModes list Set access modes on the PersistentVolumeClaim ["ReadWriteOnce"] ruler.persistence.annotations object Annotations for ruler PVCs {} ruler.persistence.enabled bool Enable creating PVCs which is required when using recording rules false ruler.persistence.labels object Labels for ruler PVCs {} ruler.persistence.size string Size of persistent disk "10Gi" ruler.persistence.storageClass string Storage class to be used. If defined, storageClassName: . If set to "-", storageClassName: "", which disables dynamic provisioning. If empty or set to null, no storageClassName spec is set, choosing the default provisioner (gp2 on AWS, standard on GKE, AWS, and OpenStack). nil ruler.persistence.volumeAttributesClassName string Volume attributes class name to be used. If empty or set to null, no volumeAttributesClassName spec is set. Requires Kubernetes 1.31 nil ruler.podAnnotations object Annotations for ruler pods {} ruler.podDisruptionBudget.annotations object Annotations for Pod Disruption Budget {} ruler.podDisruptionBudget.enabled bool Enable Pod Disruption Budget true ruler.podDisruptionBudget.labels object Labels for Pod Disruption Budget {} ruler.podDisruptionBudget.maxUnavailable string Pod Disruption Budget maxUnavailable nil ruler.podDisruptionBudget.minAvailable string Pod Disruption Budget minAvailable nil ruler.podDisruptionBudget.unhealthyPodEvictionPolicy string Pod Disruption Budget unhealthyPodEvictionPolicy nil ruler.podLabels object Labels for ruler pods {} ruler.priorityClassName string The name of the PriorityClass for ruler pods nil ruler.replicas int Number of replicas for the ruler. Set to null to omit spec.replicas from the workload, allowing an external controller (e.g. HPA, KEDA, rollout-operator) to manage replica counts without Helm resetting them. 0 ruler.resizePolicy list Container resize policy for the ruler Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] ruler.resources object Resource requests and limits for the ruler {} ruler.service.annotations object Annotations for ruler Service {} ruler.service.appProtocol.grpc string Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" "" ruler.service.ipFamilies list ipFamilies for ruler Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services [] ruler.service.ipFamilyPolicy string ipFamilyPolicy for ruler Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services "" ruler.service.labels object Additional labels for ruler Service {} ruler.service.sessionAffinity string Session affinity for ruler Service "" ruler.service.sessionAffinityConfig object Session affinity config for ruler Service {} ruler.service.trafficDistribution string trafficDistribution for ruler Service "" ruler.service.type string Service Type for ruler Service "ClusterIP" ruler.serviceAccount.annotations object Annotations for the service account {} ruler.serviceAccount.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account true ruler.serviceAccount.create bool Specifies whether a ServiceAccount should be created false ruler.serviceAccount.imagePullSecrets list Image pull secrets for the service account [] ruler.serviceAccount.labels object Labels for the service account {} ruler.serviceAccount.name string The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template nil ruler.serviceAnnotations object Annotations for ruler service @deprecated -- This option is deprecated in favor of ruler.service.annotations {} ruler.serviceLabels object Labels for ruler service @deprecated -- This option is deprecated in favor of ruler.service.labels {} ruler.sidecar bool Whether to enable the rules sidecar false ruler.statefulSetRecreateJob object EXPERIMENTAL: Enable creating a Job to recreate the ruler StatefulSet when the ruler configuration is changed. # Only applicable if ruler.kind is StatefulSet. Useful for PVC size changes, which require recreating the StatefulSet. {"enabled":false} ruler.terminationGracePeriodSeconds int Grace period to allow the ruler to shutdown before it is killed 300 ruler.topologySpreadConstraints list Topology Spread Constraints for ruler pods The value will be passed through tpl. [] serviceAccount Configuration for the Kubernetes ServiceAccount used by Loki components. Key Type Description Default serviceAccount.annotations object Annotations for the service account {} serviceAccount.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account true serviceAccount.create bool Specifies whether a ServiceAccount should be created true serviceAccount.imagePullSecrets list Image pull secrets for the service account [] serviceAccount.labels object Labels for the service account {} serviceAccount.name string The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template nil sidecar Configuration for the k8s-sidecar container that watches for ConfigMaps and Secrets (such as rules and dashboards) and loads them into Loki. Key Type Description Default sidecar.disableX509StrictVerification bool Set to true to disable strict x509 verification for kube api calls. false sidecar.enableUniqueFilenames bool Ensure that rule files aren't conflicting and being overwritten by prefixing their name with the namespace they are defined in. false sidecar.image.pullPolicy string Docker image pull policy "IfNotPresent" sidecar.image.registry string "docker.io" sidecar.image.repository string The Docker registry and image for the k8s sidecar "kiwigrid/k8s-sidecar" sidecar.image.sha string Docker image sha. If empty, no sha will be used "" sidecar.image.tag string Docker image tag "2.11.2" sidecar.livenessProbe object Liveness probe definition. {"enabled":true,"failureThreshold":3,"httpGet":{"path":"/healthz","port":"http-sidecar"},"initialDelaySeconds":30,"periodSeconds":30,"successThreshold":1,"timeoutSeconds":1} sidecar.readinessProbe object Readiness probe definition. {"enabled":true,"failureThreshold":3,"httpGet":{"path":"/healthz","port":"http-sidecar"},"initialDelaySeconds":3,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":1} sidecar.resizePolicy list Container resize policy for the sidecar Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] sidecar.resources object Resource requests and limits for the sidecar {} sidecar.rules.enabled bool Whether or not to create a sidecar to ingest rule from specific ConfigMaps and/or Secrets. true sidecar.rules.folder string Folder into which the rules will be placed. "/rules" sidecar.rules.folderAnnotation string The annotation overwriting the folder value. The annotation value can be either an absolute or a relative path. Relative paths will be relative to FOLDER. Useful for multi-tenancy setups. nil sidecar.rules.healthPort int Health Server port of the sidecar container. 8080 sidecar.rules.label string Label that the configmaps/secrets with rules will be marked with. "loki_rule" sidecar.rules.labelValue string Label value that the configmaps/secrets with rules will be set to. "" sidecar.rules.logLevel string Log level of the sidecar container. "INFO" sidecar.rules.resource string Search in configmap, secret, or both. "both" sidecar.rules.script string Absolute path to the shell script to execute after a configmap or secret has been reloaded. nil sidecar.rules.searchNamespace string Comma separated list of namespaces. If specified, the sidecar will search for config-maps/secrets inside these namespaces. Otherwise the namespace in which the sidecar is running will be used. It's also possible to specify 'ALL' to search in all namespaces. nil sidecar.rules.watchClientTimeout int WatchClientTimeout: is a client-side timeout, configuring your local socket. If you have a network outage dropping all packets with no RST/FIN, this is how long your client waits before realizing & dropping the connection. Defaults to 66sec. 60 sidecar.rules.watchMethod string Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH request, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds. "WATCH" sidecar.rules.watchServerTimeout int WatchServerTimeout: request to the server, asking it to cleanly close the connection after that. defaults to 60sec; much higher values like 3600 seconds (1h) are feasible for non-Azure K8S. 60 sidecar.securityContext object The SecurityContext for the sidecar. {"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"seccompProfile":{"type":"RuntimeDefault"}} sidecar.skipTlsVerify bool Set to true to skip tls verification for kube api calls. false sidecar.startupProbe object Startup probe definition. {"enabled":false} singleBinary Configuration for the single binary node(s) used in Monolithic deployment mode, where all Loki components run in a single process. Key Type Description Default singleBinary.affinity object Affinity for single binary pods. The value will be passed through tpl. Hard node anti-affinity singleBinary.annotations object Annotations for single binary StatefulSet {} singleBinary.autoscaling.behavior.enabled bool Enable autoscaling behaviours false singleBinary.autoscaling.behavior.scaleDown object define scale down policies, must conform to HPAScalingRules {} singleBinary.autoscaling.behavior.scaleUp object define scale up policies, must conform to HPAScalingRules {} singleBinary.autoscaling.customMetrics list Allows one to define custom metrics using the HPA/v2 schema (for example, Pods, Object or External metrics) [] singleBinary.autoscaling.enabled bool Enable autoscaling false singleBinary.autoscaling.maxReplicas int Maximum autoscaling replicas for the single binary 3 singleBinary.autoscaling.minReplicas int Minimum autoscaling replicas for the single binary 1 singleBinary.autoscaling.targetCPUUtilizationPercentage int Target CPU utilisation percentage for the single binary 60 singleBinary.autoscaling.targetMemoryUtilizationPercentage string Target memory utilisation percentage for the single binary nil singleBinary.dnsConfig object {} singleBinary.enabled bool Enable the single binary component. Requires loki.deploymentMode to be set to SingleBinary. true singleBinary.extraArgs list Labels for single binary service [] singleBinary.extraContainers list Extra containers to add to the single binary loki pod [] singleBinary.extraEnv list Environment variables to add to the single binary pods [] singleBinary.extraEnvFrom list Environment variables from secrets or configmaps to add to the single binary pods [] singleBinary.extraVolumeMounts list Volume mounts to add to the single binary pods [] singleBinary.extraVolumes list Volumes to add to the single binary pods [] singleBinary.hostUsers string Use the host's user namespace in the single binary pods nil singleBinary.image.registry string The Docker registry for the single binary image. Overrides loki.image.registry nil singleBinary.image.repository string Docker image repository for the single binary image. Overrides loki.image.repository nil singleBinary.image.tag string Docker image tag for the single binary image. Overrides loki.image.tag nil singleBinary.initContainers list Init containers to add to the single binary pods [] singleBinary.kedaAutoscaling.behavior object Behavior configuration for KEDA ScaledObject (horizontalPodAutoscalerConfig.behavior). Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#advanced {} singleBinary.kedaAutoscaling.cooldownPeriod string Period to wait after the last trigger reported active before scaling the resource back to 0 (seconds). Defaults to defaults.kedaAutoscaling.cooldownPeriod if not set. nil singleBinary.kedaAutoscaling.enabled bool Enable KEDA autoscaling for the single binary. Mutually exclusive with autoscaling.enabled false singleBinary.kedaAutoscaling.fallback object Fallback configuration for KEDA ScaledObject. Applied when the trigger metric cannot be retrieved. Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#fallback {} singleBinary.kedaAutoscaling.maxReplicas int Maximum replicas for KEDA autoscaling 3 singleBinary.kedaAutoscaling.minReplicas int Minimum replicas for KEDA autoscaling 1 singleBinary.kedaAutoscaling.pollingInterval string Interval (seconds) to poll each trigger. Defaults to defaults.kedaAutoscaling.pollingInterval if not set. nil singleBinary.kedaAutoscaling.triggers list KEDA triggers for the single binary. Ref: https://keda.sh/docs/latest/scalers/ [] singleBinary.kind string Kind of read deployment. StatefulSet and Deployment are supported. "StatefulSet" singleBinary.labels object Additional labels for single binary StatefulSet {} singleBinary.nodeSelector object Node selector for single binary pods {} singleBinary.persistence.accessModes list Set access modes on the PersistentVolumeClaim ["ReadWriteOnce"] singleBinary.persistence.annotations object Annotations for volume claim {} singleBinary.persistence.dataVolumeParameters object Parameters used for the storage volume when persistence.enabled is false. Allows replacing the default emptyDir volume with a custom volume definition. For example, to use an existing PVC: dataVolumeParameters: persistentVolumeClaim: claimName: my-existing-pvc {} singleBinary.persistence.enableStatefulSetAutoDeletePVC bool Enable StatefulSetAutoDeletePVC feature false singleBinary.persistence.enabled bool Enable persistent disk true singleBinary.persistence.labels object Labels for volume claim {} singleBinary.persistence.selector string Selector for persistent disk nil singleBinary.persistence.size string Size of persistent disk "10Gi" singleBinary.persistence.storageClass string Storage class to be used. If defined, storageClassName: . If set to "-", storageClassName: "", which disables dynamic provisioning. If empty or set to null, no storageClassName spec is set, choosing the default provisioner (gp2 on AWS, standard on GKE, AWS, and OpenStack). nil singleBinary.persistence.whenDeleted string What to do with the volumes when the StatefulSet is deleted. "Delete" singleBinary.persistence.whenScaled string What to do with the volume when the StatefulSet is scaled down. "Delete" singleBinary.podAnnotations object Annotations for single binary pods {} singleBinary.podDisruptionBudget.annotations object Annotations for Pod Disruption Budget {} singleBinary.podDisruptionBudget.enabled bool Enable Pod Disruption Budget true singleBinary.podDisruptionBudget.labels object Labels for Pod Disruption Budget {} singleBinary.podDisruptionBudget.maxUnavailable string Pod Disruption Budget maxUnavailable nil singleBinary.podDisruptionBudget.minAvailable string Pod Disruption Budget minAvailable nil singleBinary.podDisruptionBudget.unhealthyPodEvictionPolicy string Pod Disruption Budget unhealthyPodEvictionPolicy nil singleBinary.podLabels object Additional labels for each single binary pod {} singleBinary.podManagementPolicy string The default is to deploy all pods in parallel. "Parallel" singleBinary.priorityClassName string The name of the PriorityClass for single binary pods nil singleBinary.replicas int Number of replicas for the single binary. Set to null to omit spec.replicas from the workload, allowing an external controller (e.g. HPA, KEDA, rollout-operator) to manage replica counts without Helm resetting them. 0 singleBinary.resizePolicy list Container resize policy for the single binary Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] singleBinary.resources object Resource requests and limits for the single binary {} singleBinary.selectorLabels object Additional selector labels for each single binary pod {} singleBinary.service.annotations object Annotations for single binary Service {} singleBinary.service.appProtocol.grpc string Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" "" singleBinary.service.ipFamilies list ipFamilies for single binary Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services [] singleBinary.service.ipFamilyPolicy string ipFamilyPolicy for single binary Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services "" singleBinary.service.labels object Additional labels for single binary Service {} singleBinary.service.sessionAffinity string Session affinity for single binary Service "" singleBinary.service.sessionAffinityConfig object Session affinity config for single binary Service {} singleBinary.service.trafficDistribution string trafficDistribution single binary Service "" singleBinary.service.type string Service Type for single binary Service "ClusterIP" singleBinary.sidecar bool Whether to enable the rules sidecar true singleBinary.statefulSetRecreateJob object EXPERIMENTAL: Enable creating a Job to recreate the write StatefulSet when the compactor configuration is changed. # Only applicable if compactor.kind is StatefulSet. Useful for PVC size changes, which require recreating the StatefulSet. {"enabled":false} singleBinary.strategy object UpdateStrategy or Strategy for single binary. {"rollingUpdate":{"partition":0}} singleBinary.targetModule string Comma-separated list of Loki modules to load for the single binary "all" singleBinary.terminationGracePeriodSeconds int Grace period to allow the single binary to shutdown before it is killed 30 singleBinary.tolerations list Tolerations for single binary pods [] singleBinary.topologySpreadConstraints list Topology Spread Constraints for single binary pods The value will be passed through tpl. [] tableManager DEPRECATED Configuration for the table-manager. The table-manager is only necessary when using a deprecated index type such as Cassandra, Bigtable, or DynamoDB, it has not been necessary since loki introduced self- contained index types like 'boltdb-shipper' and 'tsdb'. This will be removed in a future helm chart. Key Type Description Default tableManager.affinity object Affinity for table-manager pods. The value will be passed through tpl. Hard node and anti-affinity tableManager.annotations object Annotations for table-manager deployment {} tableManager.command string Command to execute instead of defined in Docker image nil tableManager.dnsConfig object DNS config table-manager pods {} tableManager.enabled bool Specifies whether the table-manager should be enabled false tableManager.extraArgs list Additional CLI args for the table-manager [] tableManager.extraContainers list Containers to add to the table-manager pods [] tableManager.extraEnv list Environment variables to add to the table-manager pods [] tableManager.extraEnvFrom list Environment variables from secrets or configmaps to add to the table-manager pods [] tableManager.extraVolumeMounts list Volume mounts to add to the table-manager pods [] tableManager.extraVolumes list Volumes to add to the table-manager pods [] tableManager.hostUsers string Use the host's user namespace in table-manager pods nil tableManager.image.registry string The Docker registry for the table-manager image. Overrides loki.image.registry nil tableManager.image.repository string Docker image repository for the table-manager image. Overrides loki.image.repository nil tableManager.image.tag string Docker image tag for the table-manager image. Overrides loki.image.tag nil tableManager.nodeSelector object Node selector for table-manager pods {} tableManager.podAnnotations object Annotations for table-manager pods {} tableManager.podLabels object Labels for table-manager pods {} tableManager.priorityClassName string The name of the PriorityClass for table-manager pods nil tableManager.resizePolicy list Container resize policy for the table-manager Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] tableManager.resources object Resource requests and limits for the table-manager {} tableManager.retention_deletes_enabled bool Enable deletes by retention false tableManager.retention_period int Set retention period 0 tableManager.service.annotations object Annotations for table-manager Service {} tableManager.service.appProtocol.grpc string Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" "" tableManager.service.ipFamilies list ipFamilies for table-manager Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services [] tableManager.service.ipFamilyPolicy string ipFamilyPolicy for table-manager Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services "" tableManager.service.labels object Additional labels for table-manager Service {} tableManager.service.sessionAffinity string Session affinity for table-manager Service "" tableManager.service.sessionAffinityConfig object Session affinity config for table-manager Service {} tableManager.service.trafficDistribution string trafficDistribution for table-manager Service "" tableManager.service.type string Service Type for table-manager Service "ClusterIP" tableManager.serviceAccount.annotations object Annotations for the service account {} tableManager.serviceAccount.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account true tableManager.serviceAccount.create bool Specifies whether a ServiceAccount should be created false tableManager.serviceAccount.imagePullSecrets list Image pull secrets for the service account [] tableManager.serviceAccount.labels object Labels for the service account {} tableManager.serviceAccount.name string The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template nil tableManager.terminationGracePeriodSeconds int Grace period to allow the table-manager to shutdown before it is killed 30 tableManager.tolerations list Tolerations for table-manager pods [] test Section for configuring optional Helm test Key Type Description Default test.annotations object Additional annotations for test pods {} test.canaryServiceAddress string Used to directly query the metrics endpoint of the canary for testing, this approach avoids needing prometheus for testing. This in a newer approach to using prometheusAddress such that tests do not have a dependency on prometheus "http://{{ include \"loki.resourceName\" (dict \"ctx\" $ \"component\" \"canary\") }}.{{ include \"loki.namespace\" $ }}.svc.{{ .Values.global.clusterDomain }}:3500/metrics" test.hostUsers string Use the host's user namespace in test pods nil test.image.digest string Overrides the image tag with an image digest nil test.image.pullPolicy string Docker image pull policy "IfNotPresent" test.image.registry string The Docker registry "docker.io" test.image.repository string Docker image repository "grafana/loki-helm-test" test.image.tag string Overrides the image tag whose default is the chart's appVersion "latest" test.labels object Additional labels for the test pods {} test.prometheusAddress string Address of the prometheus server to query for the test. This overrides any value set for canaryServiceAddress. This is kept for backward compatibility and may be removed in future releases. Previous value was 'http://prometheus:9090' "" test.timeout string Number of times to retry the test before failing "1m" write Configuration for the write pod(s) in SimpleScalable mode, which run the distributor and ingester components. Key Type Description Default write.affinity object Affinity for write pods. The value will be passed through tpl. Hard node anti-affinity write.annotations object Annotations for write StatefulSet {} write.autoscaling.behavior.scaleUp object see https://github.com/grafana/loki/blob/main/docs/sources/operations/storage/wal.md#how-to-scale-updown for scaledown details {"policies":[{"periodSeconds":900,"type":"Pods","value":1}]} write.autoscaling.enabled bool Enable autoscaling for the write. false write.autoscaling.maxReplicas int Maximum autoscaling replicas for the write. 6 write.autoscaling.minReplicas int Minimum autoscaling replicas for the write. 2 write.autoscaling.targetCPUUtilizationPercentage int Target CPU utilisation percentage for the write. 60 write.autoscaling.targetMemoryUtilizationPercentage string Target memory utilization percentage for the write. nil write.dnsConfig object DNS config for write pods {} write.enabled bool Enable the component. Requires loki.deploymentMode to be set to SimpleScalable. true write.extraArgs list Additional CLI args for the write [] write.extraContainers list Containers to add to the write pods [] write.extraEnv list Environment variables to add to the write pods [] write.extraEnvFrom list Environment variables from secrets or configmaps to add to the write pods [] write.extraVolumeClaimTemplates list volumeClaimTemplates to add to StatefulSet [] write.extraVolumeMounts list Volume mounts to add to the write pods [] write.extraVolumes list Volumes to add to the write pods [] write.fullnameOverride string Override for the write fullname. By default, this is generated using the fullname template with "-backend" "{{ include \"loki.name\" . }}-write" write.hostUsers string Use the host's user namespace in the write pods. nil write.image.registry string The Docker registry for the write image. Overrides loki.image.registry nil write.image.repository string Docker image repository for the write image. Overrides loki.image.repository nil write.image.tag string Docker image tag for the write image. Overrides loki.image.tag nil write.initContainers list Init containers to add to the write pods [] write.kedaAutoscaling.behavior object Behavior configuration for KEDA ScaledObject (horizontalPodAutoscalerConfig.behavior). Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#advanced {} write.kedaAutoscaling.cooldownPeriod string Period to wait after the last trigger reported active before scaling the resource back to 0 (seconds). Defaults to defaults.kedaAutoscaling.cooldownPeriod if not set. nil write.kedaAutoscaling.enabled bool Enable KEDA autoscaling for the write. Mutually exclusive with autoscaling.enabled false write.kedaAutoscaling.fallback object Fallback configuration for KEDA ScaledObject. Applied when the trigger metric cannot be retrieved. Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#fallback {} write.kedaAutoscaling.maxReplicas int Maximum replicas for KEDA autoscaling 6 write.kedaAutoscaling.minReplicas int Minimum replicas for KEDA autoscaling 2 write.kedaAutoscaling.pollingInterval string Interval (seconds) to poll each trigger. Defaults to defaults.kedaAutoscaling.pollingInterval if not set. nil write.kedaAutoscaling.triggers list KEDA triggers for the write. Ref: https://keda.sh/docs/latest/scalers/ [] write.kind string Kind of write workload. StatefulSet and Deployment are supported. "StatefulSet" write.labels object Additional labels for write StatefulSet {} write.lifecycle object Lifecycle for the write container {} write.maxUnavailable int Pod Disruption Budget maxUnavailable @deprecated -- This is deprecated in favor of podDisruptionBudget.maxUnavailable. 1 write.nodeSelector object Node selector for write pods {} write.persistence.accessModes list Set access modes on the PersistentVolumeClaim ["ReadWriteOnce"] write.persistence.annotations object Annotations for volume claim {} write.persistence.dataVolumeParameters object Parameters used for the data volume when volumeClaimEnabled if false {"emptyDir":{}} write.persistence.enableStatefulSetAutoDeletePVC bool Enable StatefulSetAutoDeletePVC feature false write.persistence.labels object Labels for volume claim {} write.persistence.selector string Selector for persistent disk nil write.persistence.size string Size of persistent disk "10Gi" write.persistence.storageClass string Storage class to be used. If defined, storageClassName: . If set to "-", storageClassName: "", which disables dynamic provisioning. If empty or set to null, no storageClassName spec is set, choosing the default provisioner (gp2 on AWS, standard on GKE, AWS, and OpenStack). nil write.persistence.volumeAttributesClassName string Volume attributes class name to be used. If empty or set to null, no volumeAttributesClassName spec is set. Requires Kubernetes 1.31 nil write.persistence.volumeClaimsEnabled bool Enable volume claims in pod spec true write.persistence.whenDeleted string What to do with the volumes when the StatefulSet is deleted. "Delete" write.persistence.whenScaled string What to do with the volume when the StatefulSet is scaled down. "Delete" write.podAnnotations object Annotations for write pods {} write.podDisruptionBudget.annotations object Annotations for Pod Disruption Budget {} write.podDisruptionBudget.enabled bool Enable Pod Disruption Budget true write.podDisruptionBudget.labels object Labels for Pod Disruption Budget {} write.podDisruptionBudget.maxUnavailable string Pod Disruption Budget maxUnavailable nil write.podDisruptionBudget.minAvailable string Pod Disruption Budget minAvailable nil write.podDisruptionBudget.unhealthyPodEvictionPolicy string Pod Disruption Budget unhealthyPodEvictionPolicy nil write.podLabels object Additional labels for each write pod {} write.podManagementPolicy string The default is to deploy all pods in parallel. "Parallel" write.priorityClassName string The name of the PriorityClass for write pods nil write.replicas int Number of replicas for the write. Set to null to omit spec.replicas from the workload, allowing an external controller (e.g. HPA, KEDA, rollout-operator) to manage replica counts without Helm resetting them. 3 write.resizePolicy list Container resize policy for the write Example: resizePolicy: - resourceName: cpu restartPolicy: NotRequired - resourceName: memory restartPolicy: RestartContainer [] write.resources object Resource requests and limits for the write {} write.selectorLabels object Additional selector labels for each write pod {} write.service.annotations object Annotations for write Service {} write.service.appProtocol.grpc string Set the optional grpc service protocol. Ex: "grpc", "http2" or "https" "" write.service.ipFamilies list ipFamilies for write Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services [] write.service.ipFamilyPolicy string ipFamilyPolicy for write Service Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services "" write.service.labels object Additional labels for write Service {} write.service.sessionAffinity string Session affinity for write Service "" write.service.sessionAffinityConfig object Session affinity config for write Service {} write.service.trafficDistribution string trafficDistribution for write Service "" write.service.type string Service Type for write Service "ClusterIP" write.serviceAccount.annotations object Annotations for the service account {} write.serviceAccount.automountServiceAccountToken bool Set this toggle to false to opt out of automounting API credentials for the service account true write.serviceAccount.create bool Specifies whether a ServiceAccount should be created false write.serviceAccount.imagePullSecrets list Image pull secrets for the service account [] write.serviceAccount.labels object Labels for the service account {} write.serviceAccount.name string The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template nil write.statefulSetRecreateJob object EXPERIMENTAL: Enable creating a Job to recreate the write StatefulSet when the compactor configuration is changed. # Only applicable if compactor.kind is StatefulSet. Useful for PVC size changes, which require recreating the StatefulSet. {"enabled":false} write.strategy object UpdateStrategy or Strategy for the write. {"rollingUpdate":{"partition":0}} write.terminationGracePeriodSeconds int Grace period to allow the write to shutdown before it is killed. Especially for the ingester, this must be increased. It must be long enough so writes can be gracefully shutdown flushing/transferring all data and to successfully leave the member ring on shutdown. 300 write.tolerations list [] write.topologySpreadConstraints list Topology Spread Constraints for write pods The value will be passed through tpl. [] Deploy the Loki Helm chart on AWS This guide shows how to deploy a minimally viable Loki in microservice mode on AWS using the Helm chart. To run through this guide, we expect you to have the necessary tools and permissions to deploy resources on AWS, such as: Full access to EKS (Amazon Elastic Kubernetes Service) Full access to S3 (Amazon Simple Storage Service) Sufficient permissions to create IAM (Identity Access Management) roles and policies There are two methods for authenticating and connecting Loki to AWS S3. We will guide you through the recommended method of granting access via an IAM role. {{< youtube id="5lXmWmofqwM" >}} Considerations {{< admonition type="caution" >}} This guide was accurate at the time it was last updated on 31st October, 2024. As cloud providers frequently update their services and offerings, as a best practice, you should refer to the AWS S3 documentation before creating your buckets and assigning roles. {{< /admonition >}} IAM Role: The IAM role created in this guide is a basic role that allows Loki to read and write to the S3 bucket. You may wish to add more granular permissions based on your requirements. Authentication: Grafana Loki comes with a basic authentication layer. The Loki gateway (NGINX) is exposed to the internet using basic authentication in this example. NGINX can also be replaced with other open-source reverse proxies. Refer to Authentication for more information. Retention: The retention period is set to 28 days in the values.yaml file. You may wish to adjust this based on your requirements. Costs: Running Loki on AWS will incur costs. Make sure to monitor your usage and costs to avoid any unexpected bills. In this guide we have used a simple EKS cluster with 3 nodes and m5.xlarge instances. You may wish to adjust the instance types and number of nodes based on your workload. Prerequisites Helm 3 or above. Refer to Installing Helm. This should be installed on your local machine. Kubernetes 1.25 or later. A running Kubernetes cluster on AWS. A simple way to get started is by using EKSctl. Refer to Getting started with EKSctl. Kubectl installed on your local machine. Refer to Install and Set Up kubectl. (Optional) AWS CLI installed on your local machine. Refer to Installing the AWS CLI. This is required if you plan to use EKSctl to create the EKS cluster and modify the IAM roles and policies locally. EKS Minimum Requirements {{< admonition type="caution" >}} These EKS requirements are the minimum specification needed to deploy Loki using this guide. You may wish to adjust plugins and instance types based on your AWS environment and workload. If you choose to do so, we cannot guarantee that this sample configuration will still meet your needs. In this guide, we deploy Loki using m5.xlarge instances. This is a instance type that should work for most scenarios. However, you can modify the instance types and count based on your specific needs. {{< /admonition >}} The minimum requirements for deploying Loki on EKS are: Kubernetes version 1.30 or above. 3 nodes for the EKS cluster. Instance type depends on your workload. A good starting point for a production cluster is m7i.2xlarge. Here is the EKSctl cluster configuration file used in this guide: # A simple example of ClusterConfig object: --- apiVersion: eksctl.io/v1alpha5 kind: ClusterConfig metadata: name: region: version: "1.31" iam: withOIDC: true addons: - name: aws-ebs-csi-driver managedNodeGroups: - name: loki-workers instanceType: m7i.2xlarge desiredCapacity: 3 minSize: 2 maxSize: 3 amiFamily: AmazonLinux2023 iam: withAddonPolicies: ebs: true volumeSize: 80 volumeType: gp3 ebsOptimized: true The following plugins must also be installed within the EKS cluster: Amazon EBS CSI Driver: Enables Kubernetes to dynamically provision and manage EBS volumes as persistent storage for applications. We use this to provision the node volumes for Loki. CoreDNS: Provides internal DNS service for Kubernetes clusters, ensuring that services and pods can communicate with each other using DNS names. kube-proxy: Maintains network rules on nodes, enabling communication between pods and services within the cluster. You must also install an OIDC (OpenID Connect) provider on the EKS cluster. This is required for the IAM roles and policies to work correctly. If you are using EKSctl, you can install the OIDC provider using the following command: {{< admonition type="tip" >}} If you used the above EKSctl configuration file to create the cluster, you do not need to run this command. The OIDC provider is automatically installed. {{< /admonition >}} eksctl utils associate-iam-oidc-provider --cluster loki --approve Create S3 buckets {{< admonition type="warning" >}} DO NOT use the default bucket names; chunk, ruler and admin. Choose a unique name for each bucket. For more information see the following security update. {{< /admonition >}} Before deploying Loki, you need to create two S3 buckets; one to store logs (chunks), the second to store alert rules. You can create the bucket using the AWS Management Console or the AWS CLI. The bucket name must be globally unique. {{< admonition type="note" >}} GEL customers will require a third bucket to store the admin data. This bucket is not required for OSS users. {{< /admonition >}} aws s3api create-bucket --bucket --region --create-bucket-configuration LocationConstraint= \ aws s3api create-bucket --bucket --region --create-bucket-configuration LocationConstraint= Make sure to replace the region and bucket name with your desired values. We will revisit the bucket policy later in this guide. Defining IAM roles and policies The recommended method for connecting Loki to AWS S3 is to use an IAM role. This method is more secure than using access keys and secret keys which are directly stored in the Loki configuration. The role and policy can be created using the AWS CLI or the AWS Management Console. The below steps show how to create the role and policy using the AWS CLI. Create a new directory and navigate to it. Make sure to create the files in this directory. All commands in this guide assume you are in this directory. Create a loki-s3-policy.json file with the following content: { "Version": "2012-10-17", "Statement": [ { "Sid": "LokiStorage", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:PutObject", "s3:GetObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::< CHUNK BUCKET NAME >", "arn:aws:s3:::< CHUNK BUCKET NAME >/*", "arn:aws:s3:::< RULER BUCKET NAME >", "arn:aws:s3:::< RULER BUCKET NAME >/*" ] } ] } Make sure to replace the placeholders with the names of the buckets you created earlier. Create the IAM policy using the AWS CLI: aws iam create-policy --policy-name LokiS3AccessPolicy --policy-document file://loki-s3-policy.json Create a trust policy document named trust-policy.json with the following content: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Federated": "arn:aws:iam::< ACCOUNT ID >:oidc-provider/oidc.eks..amazonaws.com/id/< OIDC ID >" }, "Action": "sts:AssumeRoleWithWebIdentity", "Condition": { "StringEquals": { "oidc.eks..amazonaws.com/id/< OIDC ID >:sub": "system:serviceaccount:loki:loki", "oidc.eks..amazonaws.com/id/< OIDC ID >:aud": "sts.amazonaws.com" } } } ] } Make sure to replace the placeholders with your AWS account ID, region, and the OIDC ID (you can find this in the EKS cluster configuration). Create the IAM role using the AWS CLI: aws iam create-role --role-name LokiServiceAccountRole --assume-role-policy-document file://trust-policy.json Attach the policy to the role: aws iam attach-role-policy --role-name LokiServiceAccountRole --policy-arn arn:aws:iam:::policy/LokiS3AccessPolicy Make sure to replace the placeholder with your AWS account ID. Deploying the Helm chart Before we can deploy the Loki Helm chart, we need to add the Grafana Community chart repository to Helm. This repository contains the Loki Helm chart. Add the Grafana Community chart repository to Helm: helm repo add grafana-community https://grafana-community.github.io/helm-charts Update the chart repository: helm repo update Create a new namespace for Loki: kubectl create namespace loki Loki Basic Authentication Loki by default does not come with any authentication. Since we will be deploying Loki to AWS and exposing the gateway to the internet, we recommend adding at least basic authentication. In this guide we will give Loki a username and password: To start we will need create a .htpasswd file with the username and password. You can use the htpasswd command to create the file: {{< admonition type="tip" >}} If you don't have the htpasswd command installed, you can install it using brew or apt-get or yum depending on your OS. {{< /admonition >}} htpasswd -c .htpasswd This will create a file called .htpasswd with the username you provided. You will be prompted to enter a password. Create a Kubernetes secret with the .htpasswd file: kubectl create secret generic loki-basic-auth --from-file=.htpasswd -n loki This will create a secret called loki-basic-auth in the loki namespace. We will reference this secret in the Loki Helm chart configuration. Create a canary-basic-auth secret for the canary: kubectl create secret generic canary-basic-auth \ --from-literal=username= \ --from-literal=password= \ -n loki We create a literal secret with the username and password for Loki canary to authenticate with the Loki gateway. Make sure to replace the placeholders with your desired username and password. Loki Helm chart configuration Create a values.yaml file choosing the configuration options that best suit your requirements. Below there is an example of values.yaml files for the Loki Helm chart in microservices mode. loki: schemaConfig: configs: - from: "2024-04-01" store: tsdb object_store: s3 schema: v13 index: prefix: loki_index_ period: 24h storage_config: aws: region: # for example, eu-west-2 bucketnames: # Your actual S3 bucket name, for example, loki-aws-dev-chunks s3forcepathstyle: false ingester: chunk_encoding: snappy pattern_ingester: enabled: true limits_config: allow_structured_metadata: true volume_enabled: true retention_period: 672h # 28 days retention compactor: retention_enabled: true delete_request_store: s3 rulerConfig: enable_api: true alertmanager_url: http://prom:9093 querier: max_concurrent: 4 storage: type: s3 bucketNames: chunks: "" # Your actual S3 bucket name (loki-aws-dev-chunks) ruler: "" # Your actual S3 bucket name (loki-aws-dev-ruler) # admin: "" # Your actual S3 bucket name (loki-aws-dev-admin) - GEL customers only s3: region: # eu-west-2 #insecure: false # s3forcepathstyle: false serviceAccount: create: true annotations: "eks.amazonaws.com/role-arn": "arn:aws:iam:::role/LokiServiceAccountRole" # The service role you created deploymentMode: Distributed ingester: replicas: 3 zoneAwareReplication: enabled: false querier: replicas: 3 maxUnavailable: 2 queryFrontend: replicas: 2 maxUnavailable: 1 queryScheduler: replicas: 2 distributor: replicas: 3 maxUnavailable: 2 compactor: replicas: 1 indexGateway: replicas: 2 maxUnavailable: 1 patternIngester: enabled: true replicas: 1 ruler: replicas: 1 maxUnavailable: 1 # This exposes the Loki gateway so it can be written to and queried externaly gateway: service: type: LoadBalancer basicAuth: enabled: true existingSecret: loki-basic-auth # Since we are using basic auth, we need to pass the username and password to the canary lokiCanary: extraArgs: - -pass=$(LOKI_PASS) - -user=$(LOKI_USER) extraEnv: - name: LOKI_PASS valueFrom: secretKeyRef: name: canary-basic-auth key: password - name: LOKI_USER valueFrom: secretKeyRef: name: canary-basic-auth key: username # Disable minio storage minio: enabled: false backend: replicas: 0 read: replicas: 0 write: replicas: 0 singleBinary: replicas: 0 {{< admonition type="caution" >}} Make sure to replace the placeholders with your actual values. {{< /admonition >}} It is critical to define a valid values.yaml file for the Loki deployment. To remove the risk of misconfiguration, let's break down the configuration options to keep in mind when deploying to AWS: Loki Config vs. Values Config: The values.yaml file contains a section called loki, which contains a direct representation of the Loki configuration file. This section defines the Loki configuration, including the schema, storage, and querier configuration. The key configuration for chunks is loki.storage (type, bucketNames, and provider settings such as loki.storage.s3.region), which the chart maps into Loki's common.storage section. This tells Loki where to store the chunks. The rulerConfig section defines ruler-specific settings such as enable_api and alertmanager_url. Ruler object storage is derived automatically from loki.storage and loki.storage.bucketNames.ruler. For the full Loki configuration, refer to the Loki Configuration documentation. Storage: Defines where the Helm chart stores data. Set the type to s3 since we are using Amazon S3. Configure the bucket names for the chunks and ruler to match the buckets created earlier. The s3 section specifies the region of the bucket. Service Account: The serviceAccount section is used to define the IAM role for the Loki service account. This is where the IAM role created earlier is linked. Zone-Aware Replication: The Helm chart enables zone-aware ingester replication by default, which creates three ingester StatefulSets (zone-a, zone-b, zone-c) for faster rollouts. In this guide, zone-aware replication is explicitly disabled ( ingester.zoneAwareReplication.enabled: false) for simplicity. For production deployments, consider enabling it to improve rollout resilience. Gateway: Defines how the Loki gateway will be exposed. We are using a LoadBalancer service type in this configuration. Deploy Loki Now that you have created the values.yaml file, you can deploy Loki using the Helm chart. Deploy using the newly created values.yaml file: helm install --values values.yaml loki grafana-community/loki -n loki --create-namespace It is important to create a namespace called loki as our trust policy is set to allow the IAM role to be used by the loki service account in the loki namespace. This is configurable but make sure to update your service account. Verify the deployment: kubectl get pods -n loki You should see the Loki pods running. NAME READY STATUS RESTARTS AGE loki-canary-crqpg 1/1 Running 0 10m loki-canary-hm26p 1/1 Running 0 10m loki-canary-v9wv9 1/1 Running 0 10m loki-chunks-cache-0 2/2 Running 0 10m loki-compactor-0 1/1 Running 0 10m loki-distributor-78ccdcc9b4-9wlhl 1/1 Running 0 10m loki-distributor-78ccdcc9b4-km6j2 1/1 Running 0 10m loki-distributor-78ccdcc9b4-ptwrb 1/1 Running 0 10m loki-gateway-5f97f78755-hm6mx 1/1 Running 0 10m loki-index-gateway-0 1/1 Running 0 10m loki-index-gateway-1 1/1 Running 0 10m loki-ingester-0 1/1 Running 0 10m loki-ingester-1 1/1 Running 0 10m loki-ingester-2 1/1 Running 0 10m loki-pattern-ingester-0 1/1 Running 0 10m loki-querier-89d4ff448-4vr9b 1/1 Running 0 10m loki-querier-89d4ff448-7nvrf 1/1 Running 0 10m loki-querier-89d4ff448-q89kh 1/1 Running 0 10m loki-query-frontend-678899db5-n5wc4 1/1 Running 0 10m loki-query-frontend-678899db5-tf69b 1/1 Running 0 10m loki-query-scheduler-7d666bf759-9xqb5 1/1 Running 0 10m loki-query-scheduler-7d666bf759-kpb5q 1/1 Running 0 10m loki-results-cache-0 2/2 Running 0 10m loki-ruler-0 1/1 Running 0 10m Find the Loki Gateway Service The Loki Gateway service is a LoadBalancer service that exposes the Loki gateway to the internet. This is where you will write logs to and query logs from. By default NGINX is used as the gateway. {{< admonition type="caution" >}} The Loki Gateway service is exposed to the internet. We provide basic authentication using a username and password in this tutorial. Refer to the Authentication documentation for more information. {{< /admonition >}} To find the Loki Gateway service, run the following command: kubectl get svc -n loki You should see the Loki Gateway service with an external IP address. This is the address you will use to write to and query Loki. NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE loki-gateway LoadBalancer 10.100.201.74 12345678975675456-1433434453245433545656563.eu-west-2.elb.amazonaws.com 80:30707/TCP 46m Congratulations! You have successfully deployed Loki on AWS using the Helm chart. Before we finish, let's test the deployment. Testing Your Loki Deployment k6 is one of the fastest ways to test your Loki deployment. This will allow you to both write and query logs to Loki. To get started with k6, follow the steps below: Install k6 with the Loki extension on your local machine. Refer to Installing k6 and the xk6-loki extension. Create a aws-test.js file with the following content: import {sleep, check} from 'k6'; import loki from 'k6/x/loki'; /** * URL used for push and query requests * Path is automatically appended by the client * @constant {string} */ const username = ''; const password = ''; const external_ip = ''; const credentials = `${username}:${password}`; const BASE_URL = `http://${credentials}@${external_ip}`; /** * Helper constant for byte values * @constant {number} */ const KB = 1024; /** * Helper constant for byte values * @constant {number} */ const MB = KB * KB; /** * Instantiate config and Loki client */ const conf = new loki.Config(BASE_URL); const client = new loki.Client(conf); /** * Define test scenario */ export const options = { vus: 10, iterations: 10, }; export default () => { // Push request with 10 streams and uncompressed logs between 800KB and 2MB var res = client.pushParameterized(10, 800 * KB, 2 * MB); // Check for successful write check(res, { 'successful write': (res) => res.status == 204 }); // Pick a random log format from label pool let format = randomChoice(conf.labels["format"]); // Execute instant query with limit 1 res = client.instantQuery(`count_over_time({format="${format}"}[1m])`, 1) // Check for successful read check(res, { 'successful instant query': (res) => res.status == 200 }); // Execute range query over last 5m and limit 1000 res = client.rangeQuery(`{format="${format}"}`, "5m", 1000) // Check for successful read check(res, { 'successful range query': (res) => res.status == 200 }); // Wait before next iteration sleep(1); } /** * Helper function to get random item from array */ function randomChoice(items) { return items[Math.floor(Math.random() * items.length)]; } Replace with the external IP address of the Loki Gateway service. This script will write logs to Loki and query logs from Loki. It will write logs in a random format between 800KB and 2MB and query logs in a random format over the last 5 minutes. Run the test: ./k6 run aws-test.js This will run the test and output the results. You should see the test writing logs to Loki and querying logs from Loki. Now that you have successfully deployed Loki in microservices mode on AWS, you may wish to explore the following: Sending data to Loki Querying Loki Manage Deploy the Loki Helm chart on Azure This guide shows how to deploy a minimally viable Loki in microservice mode on Azure using the Helm chart. In order to successfully complete this guide, you must have the necessary tools and permissions to deploy resources on Azure, such as: Full access to AKS (Azure Kubernetes Service) Full access to Azure Blob Storage Sufficient permissions to create federated credentials and roles in Azure AD (Active Directory) There are four primary ways to authenticate Loki with Azure: Hard coding a connection string - this is the simplest method but is not recommended for production environments. Service principal Managed identity Federated token In this guide, we will use the federated token method to deploy Loki on Azure. This method is more secure than hard coding a connection string and is more suitable for production environments. Considerations {{< admonition type="caution" >}} This guide was accurate at the time it was last updated on 6th of February, 2026. As cloud providers frequently update their services and offerings, as a best practice, you should refer to the Azure documentation before creating your storage account and assigning roles. {{< /admonition >}} AD Role: In this tutorial we will create a role in Azure Active Directory (Azure AD) to allow Loki to read and write from Azure Blob Storage. This role will be assigned to the Loki service account. You may want to adjust the permissions based on your requirements. Authentication: Grafana Loki comes with a basic authentication layer. The Loki gateway (NGINX) is exposed to the internet using basic authentication in this example. NGINX can also be replaced with other open-source reverse proxies. Refer to Authentication for more information. Retention: The retention period is set to 28 days in the values.yaml file. You may wish to adjust this based on your requirements. Costs: Running Loki on Azure will incur costs. Make sure to monitor your usage and costs to avoid any unexpected bills. In this guide we have used a simple AKS cluster with 3 nodes and Standard_E2ds_v5 instances. You may wish to adjust the instance types and number of nodes based on your workload. Prerequisites Helm 3 or above. Refer to Installing Helm. This should be installed on your local machine. Kubernetes 1.25 or later. Kubectl installed on your local machine. Refer to Install and Set Up kubectl. Azure CLI installed on your local machine. Refer to Installing the Azure CLI. This is a requirement for following this guide as all resources will be created using the Azure CLI. AKS minimum requirements Before creating an AKS cluster in Azure you need to create a resource group. You can create a resource group using the Azure CLI: az group create --name -location {{< admonition type="caution" >}} These AKS requirements are the minimum specification needed to deploy Loki using this guide. You may wish to adjust the instance types based on your Azure environment and workload. If you choose to do so, we cannot guarantee that this sample configuration will still meet your needs. In this guide, we deploy Loki using Standard_E2ds_v5 instances. This is to make sure we remain within the free tier limits for Azure. Which allows us to deploy up to 10 vCPUs within a region. We recommend for large production workloads to scale these nodes up to Standard_D4_v5. {{< /admonition >}} The minimum requirements for deploying Loki on AKS are: Kubernetes version 1.30 or above. 3 nodes for the AKS cluster. Instance type depends on your workload. A good starting point for a production cluster in the free tier is Standard_E2ds_v5 instances and for large production workloads Standard_D4_v5 instances. Here is how to create an AKS cluster with the minimum requirements: az aks create \ --resource-group \ --name \ --node-count 3 \ --node-vm-size Standard_E2ds_v5 \ --generate-ssh-keys \ --enable-workload-identity \ --enable-oidc-issuer Note in the above command we have enabled workload identity and OIDC issuer. This is required for the Loki service account to authenticate with Azure AD. If you have already created an AKS cluster, you can enable these features using the following command: az aks update \ --resource-group \ --name \ --enable-workload-identity \ --enable-oidc-issuer The Azure CLI also lets you bind the AKS cluster to kubectl. You can do this by running the following command: az aks get-credentials --resource-group --name Configuring Azure Blob Storage {{< admonition type="tip" >}} Consider using unique bucket names rather than: chunk, ruler, and admin. Although Azure Blog Storage is not directly affected by this security update it is a best practice to use unique container names for buckets. {{< /admonition >}} Before deploying Loki, you need to create two Azure storage containers; one to store logs (chunks), the second to store alert rules. You can create the containers using the Azure CLI. Containers must exist inside a storage account. {{< admonition type="note" >}} GEL customers will require a third container to store the admin data. This container is not required for OSS users. {{< /admonition >}} Create a storage account: az storage account create \ --name \ --location \ --sku Standard_ZRS \ --encryption-services blob \ --resource-group Replace the placeholders with your desired values. Create the containers for chunks and ruler: az storage container create --account-name --name --auth-mode login && \ az storage container create --account-name --name --auth-mode login Make sure --account-name matches the account you just created With the storage account and containers created, you can now proceed to creating the Azure AD role and federated credentials. Creating the Azure AD role and federated credentials The recommended way to authenticate Loki with Azure Blob Storage is to use federated credentials. This method is more secure than hard coding a connection string directly into the Loki configuration. In this next section, we will create an Azure AD role and federated credentials for Loki to allow it to read and write from Azure Blob Storage: Locate the OpenID Connect (OIDC) issuer URL: az aks show \ --resource-group \ --name \ --query "oidcIssuerProfile.issuerUrl" \ -o tsv This command will return the OIDC issuer URL. You will need this URL to create the federated credentials. Generate a credentials.json file with the following content: { "name": "LokiFederatedIdentity", "issuer": "", "subject": "system:serviceaccount:loki:loki", "description": "Federated identity for Loki accessing Azure resources", "audiences": [ "api://AzureADTokenExchange" ] } Replace with the OIDC issuer URL you found in the previous step. Make sure you to save the credentials.json file before continuing. Next generate an Azure directory app. We will use this to assign our federated credentials to: az ad app create \ --display-name loki \ --query appId \ -o tsv This will return the app ID. Save this for later use. If you need to find the app ID later you can run the following command: az ad app list --display-name loki --query "[].appId" -o tsv The app requires a service principal to authenticate with Azure AD. Create a service principal for the app: az ad sp create --id Replace with the app ID you generated in the previous step. Next assign the federated credentials to the app: az ad app federated-credential create \ --id \ --parameters credentials.json Replace with the app ID you generated in the previous step. Lastly add a role assignment to the app: az role assignment create \ --role "Storage Blob Data Contributor" \ --assignee \ --scope /subscriptions//resourceGroups//providers/Microsoft.Storage/storageAccounts/ Replace the placeholders with your actual values. Now that you have created the Azure AD role and federated credentials, you can proceed to deploying Loki using the Helm chart. Deploying the Helm chart The following steps require the use of helm and kubectl. Make sure you have run the az command to bind your AKS cluster to kubectl: az aks get-credentials --resource-group --name Before we can deploy the Loki Helm chart, we need to add the Grafana Community chart repository to Helm. This repository contains the Loki Helm chart. Add the Grafana Community chart repository to Helm: helm repo add grafana-community https://grafana-community.github.io/helm-charts Update the chart repository: helm repo update Create a new namespace for Loki: kubectl create namespace loki Loki basic authentication Loki by default does not come with any authentication. Since we will be deploying Loki to Azure and exposing the gateway to the internet, we recommend adding at least basic authentication. In this guide we will give Loki a username and password: To start we will need create a .htpasswd file with the username and password. You can use the htpasswd command to create the file: {{< admonition type="tip" >}} If you don't have the htpasswd command installed, you can install it using brew or apt-get or yum depending on your OS. {{< /admonition >}} htpasswd -c .htpasswd This will create a file called .htpasswd with the username you provided. You will be prompted to enter a password. Create a Kubernetes secret with the .htpasswd file: kubectl create secret generic loki-basic-auth --from-file=.htpasswd -n loki This will create a secret called loki-basic-auth in the loki namespace. We will reference this secret in the Loki Helm chart configuration. Create a canary-basic-auth secret for the canary: kubectl create secret generic canary-basic-auth \ --from-literal=username= \ --from-literal=password= \ -n loki We create a literal secret with the username and password for Loki canary to authenticate with the Loki gateway. Make sure to replace the placeholders with your desired username and password. Loki Helm chart configuration Create a values.yaml file choosing the configuration options that best suit your requirements. Below there is an example of values.yaml files for the Loki Helm chart in microservices mode. loki: podLabels: "azure.workload.identity/use": "true" # Add this label to the Loki pods to enable workload identity schemaConfig: configs: - from: "2024-04-01" store: tsdb object_store: azure schema: v13 index: prefix: loki_index_ period: 24h storage: type: azure bucketNames: chunks: "" # Your actual Azure Blob Storage container name (loki-azure-dev-chunks) ruler: "" # Your actual Azure Blob Storage container name (loki-azure-dev-ruler) # admin: "admin-loki-devrel" # Your actual Azure Blob Storage container name (loki-azure-dev-admin) azure: accountName: useFederatedToken: true # Use federated token for authentication ingester: chunk_encoding: snappy pattern_ingester: enabled: true limits_config: allow_structured_metadata: true volume_enabled: true retention_period: 672h # 28 days retention compactor: retention_enabled: true delete_request_store: azure rulerConfig: enable_api: true alertmanager_url: http://prom:9093 querier: max_concurrent: 4 # Define the Azure workload identity serviceAccount: name: loki annotations: "azure.workload.identity/client-id": "" # The app ID of the Azure AD app deploymentMode: Distributed ingester: replicas: 3 zoneAwareReplication: enabled: false querier: replicas: 3 maxUnavailable: 2 queryFrontend: replicas: 2 maxUnavailable: 1 queryScheduler: replicas: 2 distributor: replicas: 3 maxUnavailable: 2 compactor: replicas: 1 indexGateway: replicas: 2 maxUnavailable: 1 patternIngester: enabled: true replicas: 1 ruler: replicas: 1 maxUnavailable: 1 # This exposes the Loki gateway so it can be written to and queried externaly gateway: service: type: LoadBalancer basicAuth: enabled: true existingSecret: loki-basic-auth # Since we are using basic auth, we need to pass the username and password to the canary lokiCanary: extraArgs: - -pass=$(LOKI_PASS) - -user=$(LOKI_USER) extraEnv: - name: LOKI_PASS valueFrom: secretKeyRef: name: canary-basic-auth key: password - name: LOKI_USER valueFrom: secretKeyRef: name: canary-basic-auth key: username # Disable minio storage minio: enabled: false backend: replicas: 0 read: replicas: 0 write: replicas: 0 singleBinary: replicas: 0 {{< admonition type="caution" >}} Make sure to replace the placeholders with your actual values. {{< /admonition >}} It is critical to define a valid values.yaml file for the Loki deployment. To remove the risk of misconfiguration, let's break down the configuration options to keep in mind when deploying to Azure: Loki Config vs. Values Config: The values.yaml file contains a section called loki, which contains a direct representation of the Loki configuration file. This section defines the Loki configuration, including the schema, storage, and querier configuration. The key configuration for chunks is loki.storage (type, bucketNames, and provider settings such as the Azure account name), which the chart maps into Loki's common.storage section. This tells Loki where to store the chunks. The rulerConfig section defines ruler-specific settings such as enable_api and alertmanager_url. Ruler object storage is derived automatically from loki.storage and loki.storage.bucketNames.ruler. For the full Loki configuration, refer to the Loki Configuration documentation. Storage: Defines where the Helm chart stores data. Set the type to azure since we are using Azure Blob Storage. Configure the container names for the chunks and ruler to match the containers created earlier. The azure section specifies the storage account name and also sets useFederatedToken to true. This tells Loki to use federated credentials for authentication. Service Account: The serviceAccount section is used to define the federated workload identity Loki will use to authenticate with Azure AD. We set the azure.workload.identity/client-id annotation to the app ID of the Azure AD app. Zone-Aware Replication: The Helm chart enables zone-aware ingester replication by default, which creates three ingester StatefulSets (zone-a, zone-b, zone-c) for faster rollouts. In this guide, zone-aware replication is explicitly disabled ( ingester.zoneAwareReplication.enabled: false) for simplicity. For production deployments, consider enabling it to improve rollout resilience. Gateway: Defines how the Loki gateway will be exposed. We are using a LoadBalancer service type in this configuration. Deploy Loki Now that you have created the values.yaml file, you can deploy Loki using the Helm chart. Deploy using the newly created values.yaml file: helm install --values values.yaml loki grafana-community/loki -n loki --create-namespace It is important to create a namespace called loki as our federated credentials were generated with the value system:serviceaccount:loki:loki. This translates to the loki service account in the loki namespace. This is configurable but make sure to update the federated credentials file first. Verify the deployment: kubectl get pods -n loki You should see the Loki pods running. NAME READY STATUS RESTARTS AGE loki-canary-crqpg 1/1 Running 0 10m loki-canary-hm26p 1/1 Running 0 10m loki-canary-v9wv9 1/1 Running 0 10m loki-chunks-cache-0 2/2 Running 0 10m loki-compactor-0 1/1 Running 0 10m loki-distributor-78ccdcc9b4-9wlhl 1/1 Running 0 10m loki-distributor-78ccdcc9b4-km6j2 1/1 Running 0 10m loki-distributor-78ccdcc9b4-ptwrb 1/1 Running 0 10m loki-gateway-5f97f78755-hm6mx 1/1 Running 0 10m loki-index-gateway-0 1/1 Running 0 10m loki-index-gateway-1 1/1 Running 0 10m loki-ingester-0 1/1 Running 0 10m loki-ingester-1 1/1 Running 0 10m loki-ingester-2 1/1 Running 0 10m loki-pattern-ingester-0 1/1 Running 0 10m loki-querier-89d4ff448-4vr9b 1/1 Running 0 10m loki-querier-89d4ff448-7nvrf 1/1 Running 0 10m loki-querier-89d4ff448-q89kh 1/1 Running 0 10m loki-query-frontend-678899db5-n5wc4 1/1 Running 0 10m loki-query-frontend-678899db5-tf69b 1/1 Running 0 10m loki-query-scheduler-7d666bf759-9xqb5 1/1 Running 0 10m loki-query-scheduler-7d666bf759-kpb5q 1/1 Running 0 10m loki-results-cache-0 2/2 Running 0 10m loki-ruler-0 1/1 Running 0 10m Find the Loki gateway service The Loki gateway service is a load balancer service that exposes the Loki gateway to the internet. This is where you will write logs to and query logs from. By default NGINX is used as the gateway. {{< admonition type="caution" >}} The Loki gateway service is exposed to the internet. We provide basic authentication using a username and password in this tutorial. Refer to the Authentication documentation for more information. {{< /admonition >}} To find the Loki gateway service, run the following command: kubectl get svc -n loki You should see the Loki gateway service with an external IP address. This is the address you will use to write to and query Loki. NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE loki-gateway LoadBalancer 10.100.201.74 134.236.21.145 80:30707/TCP 46m Congratulations! You have successfully deployed Loki on Azure using the Helm chart. Before we finish, let's test the deployment. Testing Your Loki Deployment k6 is one of the fastest ways to test your Loki deployment. This will allow you to both write and query logs to Loki. To get started with k6, follow the steps below: Install k6 with the Loki extension on your local machine. Refer to Installing k6 and the xk6-loki extension. Create a azure-test.js file with the following content: import {sleep, check} from 'k6'; import loki from 'k6/x/loki'; /** * URL used for push and query requests * Path is automatically appended by the client * @constant {string} */ const username = ''; const password = ''; const external_ip = ''; const credentials = `${username}:${password}`; const BASE_URL = `http://${credentials}@${external_ip}`; /** * Helper constant for byte values * @constant {number} */ const KB = 1024; /** * Helper constant for byte values * @constant {number} */ const MB = KB * KB; /** * Instantiate config and Loki client */ const conf = new loki.Config(BASE_URL); const client = new loki.Client(conf); /** * Define test scenario */ export const options = { vus: 10, iterations: 10, }; export default () => { // Push request with 10 streams and uncompressed logs between 800KB and 2MB var res = client.pushParameterized(10, 800 * KB, 2 * MB); // Check for successful write check(res, { 'successful write': (res) => res.status == 204 }); // Pick a random log format from label pool let format = randomChoice(conf.labels["format"]); // Execute instant query with limit 1 res = client.instantQuery(`count_over_time({format="${format}"}[1m])`, 1) // Check for successful read check(res, { 'successful instant query': (res) => res.status == 200 }); // Execute range query over last 5m and limit 1000 res = client.rangeQuery(`{format="${format}"}`, "5m", 1000) // Check for successful read check(res, { 'successful range query': (res) => res.status == 200 }); // Wait before next iteration sleep(1); } /** * Helper function to get random item from array */ function randomChoice(items) { return items[Math.floor(Math.random() * items.length)]; } Replace with the external IP address of the Loki Gateway service. This script will write logs to Loki and query logs from Loki. It will write logs in a random format between 800KB and 2MB and query logs in a random format over the last 5 minutes. Run the test: ./k6 run azure-test.js This will run the test and output the results. You should see the test writing logs to Loki and querying logs from Loki. Now that you have successfully deployed Loki in microservices mode on Microsoft Azure, you may wish to explore the following: Sending data to Loki Querying Loki Manage Loki Deploy the Loki Helm chart on GCP This guide shows how to deploy a minimally viable Loki in microservices mode on Google Cloud Platform (GCP) using the Helm chart. To run through this guide, we expect you to have the necessary tools and permissions to deploy resources on GCP, such as: Full access to Google Kubernetes Engine (GKE) Full access to Google Cloud Storage (GCS) Sufficient permissions to create Identity Access Management (IAM) roles and policies There are two methods for authenticating and connecting Loki to GCP GCS. We will guide you through the recommended method of granting access via an IAM role: using Workload Identity Federation. Considerations {{< admonition type="caution" >}} This guide was accurate at the time it was last updated on 10th of June, 2025. As cloud providers frequently update their services and offerings, as a best practice, you should refer to the GCP GCS documentation before creating your buckets and assigning roles. {{< /admonition >}} IAM Role: The IAM role created in this guide is a basic role that allows Loki to read and write to the GCS bucket. You may wish to add more granular permissions based on your requirements. Authentication: Grafana Loki comes with a basic authentication layer. The Loki gateway (NGINX) is exposed to the internet using basic authentication in this example. NGINX can also be replaced with other open-source reverse proxies. Refer to Authentication for more information. Retention: The retention period is set to 28 days in the values.yaml file. You may wish to adjust this based on your requirements. Costs: Running Loki on GCP will incur costs. Make sure to monitor your usage and costs to avoid any unexpected bills. In this guide we have used a simple GKE cluster with 3 nodes (n2-standard-8 instances). You may wish to adjust the instance types and number of nodes based on your workload. Prerequisites Helm 3 or above. Refer to Installing Helm. This should be installed on your local machine. Kubernetes 1.25 or later. A running Kubernetes cluster on GCP. Refer to Create a cluster and deploy a workload in the Google Cloud console. Kubectl installed on your local machine. Refer to Install and Set Up kubectl. gcloud CLI installed on your local machine. Refer to Install the Google Cloud CLI. In this guide, we use gcloud CLI to create the GKE cluster and modify the IAM roles and policies locally. GKE Minimum Requirements {{< admonition type="caution" >}} These GKE requirements are the minimum specification needed to deploy Loki using this guide. You may wish to adjust plugins and instance types based on your GCP environment and workload. If you choose to do so, we cannot guarantee that this sample configuration will still meet your needs. In this guide, we deploy Loki using n2-standard-8 instances. This is a instance type that should work for most scenarios. However, you can modify the instance types and count based on your specific needs. {{< /admonition >}} The minimum requirements for deploying Loki on GKE are: Kubernetes version 1.30 or above. 3 nodes for the GKE cluster. Instance type depends on your workload. A good starting point for a production cluster is n2-standard-8. To allow kubectl to support GKE, install the gcloud kubectl auth plugin: gcloud components install gke-gcloud-auth-plugin This plugin is necessary to use kubectl to authenticate with GKE. Click here for more details on this plugin. {{< admonition type="warning" >}} Regional clusters in GKE are designed for resilience, and thus by default span three zones within the region. In the command below, num-nodes=1. Note that if you set num_nodes=3, you would get 9 nodes in total for the region: 3 in each zone. Therefore, leave num_nodes=1 when you create your cluster. {{< /admonition >}} Here is an example of a command you can run using gcloud CLI to create a new cluster: gcloud container clusters create loki-gcp \ --location=europe-west4 \ --num-nodes=1 \ --machine-type=n2-standard-8 \ --release-channel=regular \ --workload-pool=.svc.id.goog \ --enable-ip-alias \ --no-enable-basic-auth \ --no-issue-client-certificate Replace with the ID of the project you want to create the cluster in. This should be something like my-project-123456. Create GCS buckets {{< admonition type="warning" >}} DO NOT use the default bucket names; chunks, ruler and admin. Choose a unique name for each bucket. For more information see the following security update. {{< /admonition >}} Before deploying Loki, you need to create two GCS buckets: one to store logs (chunks) and another to store alert rules (ruler). You can create the bucket using the GCP Management Console or the GCP CLI. The bucket name must be globally unique. {{< admonition type="note" >}} GEL customers will require a third bucket to store the admin data. This bucket is not required for OSS users. {{< /admonition >}} gcloud storage buckets create gs:// gs:// \ --location= \ --default-storage-class=STANDARD \ --public-access-prevention \ --uniform-bucket-level-access \ --soft-delete-duration=7d Make sure to replace the region and bucket name with your desired values. We will revisit the bucket policy later in this guide. Here's an example with all the variables filled in: gcloud storage buckets create gs://loki-gcp-chunks gs://loki-gcp-ruler \ --location=europe-west4 \ --default-storage-class=STANDARD \ --public-access-prevention \ --uniform-bucket-level-access \ --soft-delete-duration=7d When you run this command, you should get something like this in response: Creating gs://loki-gcp-chunks/... Creating gs://loki-gcp-ruler/... Defining IAM roles and policies IAM determines who can access which resources on GCP and can be configured in several ways. The recommended method for allowing Loki to access GCS is to use Workload Identity Federation. This method is more secure than creating and distributing a service account key. The following steps show how to create the role and policy using the gcloud CLI. Authenticating to the GKE cluster You need to be able to run kubectl commands on the cluster, so make sure you have it installed (run gcloud components install kubectl if not) and then run this command: gcloud container clusters get-credentials \ --region= Here's an example of that command with the variables filled in: gcloud container clusters get-credentials loki-gcp \ --region=europe-west4 This will authenticate you via your GCP IAM identity, write the cluster's access info to your local kubeconfig (usually ~/.kube/config), and then allow kubectl commands to talk to the right cluster from now on. Then check that you're connected to the GKE cluster and that you're accessing it via kubectl by running: kubectl config current-context You should get something like this in return: gke_my-project-123456_europe-west4_loki-gcp Create a Kubernetes Namespace Create a Kubernetes namespace where you'll install your Loki workloads: kubectl create namespace Replace with the namespace where your Loki workloads will be located. Example: kubectl create namespace loki You should get the output: namespace/loki created Create Kubernetes Service Account (KSA) A KSA is a cluster identity (service account, named default by default) assigned to pods that allows pods to interact with each other. Create a KSA on your Kubernetes cluster: kubectl create serviceaccount \ --namespace Replace with the name of the KSA created above, and with the namespace where your Loki workloads are located. Example: kubectl create serviceaccount loki-gcp-ksa \ --namespace loki You should get this in response: serviceaccount/loki-gcp-ksa created Add IAM Policy to Buckets {{< admonition type="note" >}} The pre-defined roles/storage.objectUser role is sufficient for Loki to operate. See IAM permissions for Cloud Storage for details about each individual permission. You can use this predefined role or create your own with matching permissions. {{< /admonition >}} Create an IAM policy binding on the buckets using the KSA created previously and the roles of your choice. Use a separate command for each bucket, one for chunks, and another for the ruler. gcloud storage buckets add-iam-policy-binding gs:// \ --role=roles/storage.objectUser \ --member=principal://iam.googleapis.com/projects//locations/global/workloadIdentityPools/.svc.id.goog/subject/ns//sa/ \ --condition=None Replace with the GCP project ID (for example, project-name), with the project number (for example, 1234567890), with the namespace where Loki is installed, and with the name of the KSA you created above. Then do the same thing for the other bucket. Examples: gcloud storage buckets add-iam-policy-binding gs://loki-gcp-chunks \ --role=roles/storage.objectUser \ --member=principal://iam.googleapis.com/projects/12345678901/locations/global/workloadIdentityPools/my-project-123456.svc.id.goog/subject/ns/loki/sa/loki-gcp-ksa \ --condition=None and gcloud storage buckets add-iam-policy-binding gs://loki-gcp-ruler \ --role=roles/storage.objectUser \ --member=principal://iam.googleapis.com/projects/12345678901/locations/global/workloadIdentityPools/my-project-123456.svc.id.goog/subject/ns/loki/sa/loki-gcp-ksa \ --condition=None You should get something like this in response: bindings: - members: - projectEditor:my-project-123456 - projectOwner:my-project-123456 role: roles/storage.legacyBucketOwner - members: - projectViewer:my-project-123456 role: roles/storage.legacyBucketReader - members: - projectEditor:my-project-123456 - projectOwner:my-project-123456 role: roles/storage.legacyObjectOwner - members: - projectViewer:my-project-123456 role: roles/storage.legacyObjectReader - members: - principal://iam.googleapis.com/projects/12345678901/locations/global/workloadIdentityPools/my-project-123456.svc.id.goog/subject/ns/loki/sa/loki-gcp-ksa role: roles/storage.objectUser etag: CAI= kind: storage#policy resourceId: projects/_/buckets/loki-gcp-chunks version: 1 Deploying the Helm chart Before we can deploy the Loki Helm chart, we need to add the Grafana Community chart repository to Helm. This repository contains the Loki Helm chart. Add the Grafana Community chart repository to Helm: helm repo add grafana-community https://grafana-community.github.io/helm-charts Update the chart repository: helm repo update Loki Basic Authentication Loki by default does not come with any authentication. Since we will be deploying Loki to GCP and exposing the gateway to the internet, we recommend adding at least basic authentication. In this guide we will give Loki a username and password: To start we will need create a .htpasswd file with the username and password. You can use the htpasswd command to create the file: {{< admonition type="tip" >}} If you don't have the htpasswd command installed, you can install it using brew or apt-get or yum depending on your OS. {{< /admonition >}} htpasswd -c .htpasswd This will create a file called .htpasswd with the username you provided. You will be prompted to enter a password. Create a Kubernetes secret with the .htpasswd file: kubectl create secret generic loki-basic-auth --from-file=.htpasswd -n loki This will create a secret called loki-basic-auth in the loki namespace. We will reference this secret in the Loki Helm chart configuration. Create a canary-basic-auth secret for the canary: kubectl create secret generic canary-basic-auth \ --from-literal=username= \ --from-literal=password= \ -n loki We create a literal secret with the username and password for Loki canary to authenticate with the Loki gateway. Make sure to replace the placeholders with your desired username and password. Loki Helm chart configuration Create a values.yaml file choosing the configuration options that best suit your requirements. Below there is an example of values.yaml files for the Loki Helm chart in microservices mode. loki: schemaConfig: configs: - from: "2024-04-01" store: tsdb object_store: gcs schema: v13 index: prefix: loki_index_ period: 24h storage_config: gcs: bucket_name: # Your actual gcs bucket name, for example, loki-gcp-chunks ingester: chunk_encoding: snappy pattern_ingester: enabled: true limits_config: allow_structured_metadata: true volume_enabled: true retention_period: 672h # 28 days retention compactor: retention_enabled: true delete_request_store: gcs rulerConfig: enable_api: true alertmanager_url: http://prom:9093 # The URL of the Alertmanager to send alerts (Prometheus, Mimir, etc.) querier: max_concurrent: 4 storage: type: gcs bucketNames: chunks: # Your actual gcs bucket name, for example, loki-gcp-chunks ruler: # Your actual gcs bucket name, for example, loki-gcp-ruler serviceAccount: create: false name: deploymentMode: Distributed ingester: replicas: 3 zoneAwareReplication: enabled: false querier: replicas: 3 maxUnavailable: 2 queryFrontend: replicas: 2 maxUnavailable: 1 queryScheduler: replicas: 2 distributor: replicas: 3 maxUnavailable: 2 compactor: replicas: 1 indexGateway: replicas: 2 maxUnavailable: 1 patternIngester: enabled: true replicas: 1 ruler: replicas: 1 maxUnavailable: 1 # This exposes the Loki gateway so it can be written to and queried externaly gateway: service: type: LoadBalancer basicAuth: enabled: true existingSecret: loki-basic-auth # Since we are using basic auth, we need to pass the username and password to the canary lokiCanary: extraArgs: - -pass=$(LOKI_PASS) - -user=$(LOKI_USER) extraEnv: - name: LOKI_PASS valueFrom: secretKeyRef: name: canary-basic-auth key: password - name: LOKI_USER valueFrom: secretKeyRef: name: canary-basic-auth key: username # Disable minio storage minio: enabled: false backend: replicas: 0 read: replicas: 0 write: replicas: 0 singleBinary: replicas: 0 {{< admonition type="caution" >}} Make sure to replace the placeholders with your actual values. {{< /admonition >}} {{< admonition type="note" >}} In values.yaml above, you may notice that serviceAccount is set to create: false. This is because you want to use the service account that you created earlier instead of creating a new one. {{< /admonition >}} It is critical to define a valid values.yaml file for the Loki deployment. To remove the risk of misconfiguration, let's break down the configuration options to keep in mind when deploying to GCP: Loki Config vs. Values Config: The values.yaml file contains a section called loki, which contains a direct representation of the Loki configuration file. This section defines the Loki configuration, including the schema, storage, and querier configuration. The key configuration for chunks is loki.storage (type, bucketNames, and provider settings), which the chart maps into Loki's common.storage section. This tells Loki where to store the chunks. The rulerConfig section defines ruler-specific settings such as enable_api and alertmanager_url. Ruler object storage is derived automatically from loki.storage and loki.storage.bucketNames.ruler. For the full Loki configuration, refer to the Loki Configuration documentation. Storage: Defines where the Helm chart stores data. Set the type to GCS since we are using Google Cloud Storage. Configure the bucket names for the chunks and ruler to match the buckets created earlier. The GCS section specifies the region of the bucket. Service Account: The serviceAccount section is used to define the IAM role for the Loki service account. This is where the IAM role created earlier is linked. Zone-Aware Replication: The Helm chart enables zone-aware ingester replication by default, which creates three ingester StatefulSets (zone-a, zone-b, zone-c) for faster rollouts. In this guide, zone-aware replication is explicitly disabled ( ingester.zoneAwareReplication.enabled: false) for simplicity. For production deployments, consider enabling it to improve rollout resilience. Gateway: Defines how the Loki gateway will be exposed. We are using a LoadBalancer service type in this configuration. Deploy Loki Now that you have created the values.yaml file, you can deploy Loki using the Helm chart. Deploy using the newly created values.yaml file: helm install --values values.yaml loki grafana-community/loki -n loki --create-namespace Ensure the namespace and service account name in your values ( serviceAccount.name) match the Workload Identity principal used in the bucket IAM bindings. Verify the deployment: kubectl get pods -n loki You should see the Loki pods running. NAME READY STATUS RESTARTS AGE loki-canary-crqpg 1/1 Running 0 10m loki-canary-hm26p 1/1 Running 0 10m loki-canary-v9wv9 1/1 Running 0 10m loki-chunks-cache-0 2/2 Running 0 10m loki-compactor-0 1/1 Running 0 10m loki-distributor-78ccdcc9b4-9wlhl 1/1 Running 0 10m loki-distributor-78ccdcc9b4-km6j2 1/1 Running 0 10m loki-distributor-78ccdcc9b4-ptwrb 1/1 Running 0 10m loki-gateway-5f97f78755-hm6mx 1/1 Running 0 10m loki-index-gateway-0 1/1 Running 0 10m loki-index-gateway-1 1/1 Running 0 10m loki-ingester-0 1/1 Running 0 10m loki-ingester-1 1/1 Running 0 10m loki-ingester-2 1/1 Running 0 10m loki-pattern-ingester-0 1/1 Running 0 10m loki-querier-89d4ff448-4vr9b 1/1 Running 0 10m loki-querier-89d4ff448-7nvrf 1/1 Running 0 10m loki-querier-89d4ff448-q89kh 1/1 Running 0 10m loki-query-frontend-678899db5-n5wc4 1/1 Running 0 10m loki-query-frontend-678899db5-tf69b 1/1 Running 0 10m loki-query-scheduler-7d666bf759-9xqb5 1/1 Running 0 10m loki-query-scheduler-7d666bf759-kpb5q 1/1 Running 0 10m loki-results-cache-0 2/2 Running 0 10m loki-ruler-0 1/1 Running 0 10m Find the Loki Gateway Service The Loki Gateway service is a LoadBalancer service that exposes the Loki gateway to the internet. This is where you will write logs to and query logs from. By default NGINX is used as the gateway. {{< admonition type="caution" >}} The Loki Gateway service is exposed to the internet. We provide basic authentication using a username and password in this tutorial. Refer to the Authentication documentation for more information. {{< /admonition >}} To find the Loki Gateway service, run the following command: kubectl get svc -n loki You should see the Loki Gateway service with an external IP address. This is the address you will use to write to and query Loki. NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE loki-gateway LoadBalancer 34.118.239.140 34.91.203.240 80:30566/TCP 25m In this case, the external IP address is 34.91.203.240. Congratulations! You have successfully deployed Loki on GCP using the Helm chart. Before we finish, let's test the deployment. Testing Your Loki Deployment k6 is one of the fastest ways to test your Loki deployment. This will allow you to both write and query logs to Loki. To get started with k6, follow the steps below: Install k6 with the Loki extension on your local machine. Refer to Installing k6 and the xk6-loki extension. Create a gcp-test.js file with the following content: import {sleep, check} from 'k6'; import loki from 'k6/x/loki'; /** * URL used for push and query requests * Path is automatically appended by the client * @constant {string} */ const username = ''; const password = ''; const external_ip = ''; const credentials = `${username}:${password}`; const BASE_URL = `http://${credentials}@${external_ip}`; /** * Helper constant for byte values * @constant {number} */ const KB = 1024; /** * Helper constant for byte values * @constant {number} */ const MB = KB * KB; /** * Instantiate config and Loki client */ const conf = new loki.Config(BASE_URL); const client = new loki.Client(conf); /** * Define test scenario */ export const options = { vus: 10, iterations: 10, }; export default () => { // Push request with 10 streams and uncompressed logs between 800KB and 2MB var res = client.pushParameterized(10, 800 * KB, 2 * MB); // Check for successful write check(res, { 'successful write': (res) => res.status == 204 }); // Pick a random log format from label pool let format = randomChoice(conf.labels["format"]); // Execute instant query with limit 1 res = client.instantQuery(`count_over_time({format="${format}"}[1m])`, 1) // Check for successful read check(res, { 'successful instant query': (res) => res.status == 200 }); // Execute range query over last 5m and limit 1000 res = client.rangeQuery(`{format="${format}"}`, "5m", 1000) // Check for successful read check(res, { 'successful range query': (res) => res.status == 200 }); // Wait before next iteration sleep(1); } /** * Helper function to get random item from array */ function randomChoice(items) { return items[Math.floor(Math.random() * items.length)]; } Replace with the external IP address of the Loki Gateway service. This script will write logs to Loki and query logs from Loki. It will write logs in a random format between 800KB and 2MB and query logs in a random format over the last 5 minutes. Run the test: ./k6 run gcp-test.js This will run the test and output the results. You should see the test writing logs to Loki and querying logs from Loki. Now that you have successfully deployed Loki in microservices mode on GCP, you may wish to explore the following: Monitor a Loki Cluster Sending data to Loki Querying Loki Manage Migrate from `loki-distributed` Helm chart This guide will walk you through migrating to the loki Helm Chart, v3.0 or higher, from the loki-distributed Helm Chart (v0.63.2 at time of writing). The process consists of deploying the new loki Helm Chart alongside the existing loki-distributed installation. By joining the new cluster to the existing cluster's ring, you will create one large cluster. This will allow you to manually bring down the loki-distributed components in a safe way to avoid any data loss. Before you begin: We recommend having a Grafana instance available to monitor both the existing and new clusters, to make sure there is no data loss during the migration process. The loki chart ships with self-monitoring features, including dashboards. These are useful for monitoring the health of the new cluster as it spins up. Start by updating your existing Grafana Agent or Promtail config (whatever is scraping logs from your environment) to exclude the new deployment. The new loki chart ships with its own self-monitoring mechanisms, and we want to make sure it's not scraped twice, which would produce duplicate logs. The best way to do this is via a relabel config that will drop logs from the new deployment, for example something like: - source_labels: - "__meta_kubernetes_pod_label_app_kubernetes_io_component" regex: "(canary|read|write)" action: "drop" This leverages the fact that the new deployment adds a app.kubernetes.io/component label of either read for the Read pods, write for the Write pods, and canary for the Loki Canary pods. These annotations are not present in the loki-distributed deployment, so this should only match logs from the new deployment. To Migrate from loki-distributed to loki Deploy new Loki Cluster Next you will deploy the new loki chart in the same namespace as your existing loki-distributed installation. Make sure to use the same buckets and storage configuration as your existing installation. You will need to set some special migrate values as well: migrate: fromDistributed: enabled: true memberlistService: loki-loki-distributed-memberlist The value of memberlistService must be the kubernetes service created for the purpose of Memberlist DNS in the loki-distributed deployment. It should match the value of memberlist.join_members in the config of the loki-distributed deployment. This is what will make the new cluster join the existing clusters ring. It is important to join all existing rings, if you are using different memberlist DNS for different rings, you must manually set the value of each applicable join_members configuration for each ring. If using the same memberlist DNS for all rings, as is the default in the loki-distributed chart, setting migrate.memberlistService should be enough. Once the new cluster is up, add the appropriate data source in Grafana for the new cluster. Check that the following queries return results: Confirm new and old logs are in the new deployment. Using the new deployment's Loki data source in Grafana, look for: Logs with a job that is unique to your existing Promtail or Grafana Agent, the one we adjusted above to exclude logs from the new deployment which is not yet pushing logs to the new deployment. If you can query those via the new deployment in shows we have not lost historical logs. Logs with the label job="loki/loki-read". The read component does not exist in loki-distributed, so this show the new Loki cluster's self monitoring is working correctly. Confirm new logs are in the old deployment. Using the old deployment's Loki data source in Grafana, look for: Logs with the label job="loki/loki-read". Since you have excluded logs from the new deployment from going to the loki-distributed deployment, if you can query them through the loki-distributed Loki data source that show the ingesters have joined the same ring, and are queryable from the loki-distributed queriers. Convert all Clients to Push Logs to New loki Deployment Assuming everything is working as expected, you can now modify the clients section of your Grafana Agent or Promtail configuration to push logs to the new deployment. After this change is made, the loki-distributed cluster will no longer receive new logs and can be carefully scaled down. Once this has deployed, query the new loki cluster's Loki data source for new logs to make sure they're still being ingested. Tear Down the Old Loki Canary If you had previously deployed the canary via the loki-canary Helm Chart, you can now tear it down. The new chart ships the canary by default and is automatically configured to scrape it. Update Flush Config On loki-distributed Deployment You are almost ready to start scaling down the old loki-distributed cluster. Before you start, however, it is important to make sure the loki-distributed ingesters are configured to flush on shutdown. Since these ingesters will not be coming back, there will be no opportunity for them to replay their WALs, so they need to flush all in-memory logs before shutting down to prevent data loss. The easiest way to do this is via the extraArgs argument in the ingester section of the loki-distributed chart. You may also want to set the ingester's log level to debug to see messages about the flushing process. ingester: replicas: 3 extraArgs: - '-ingester.flush-on-shutdown=true' - '-log.level=debug' ``` Deploy this change, and make sure all ingesters restart and are running the latest configuration. Scale Down Ingesters One at a Time It is now time to start scaling down loki-distributed. Scale down the ingester StatefulSet or Deployment (depending on how your loki-distributed chart is deployed) 1 replica at a time. If debug logs were enabled, you can monitor the logs of each ingester as it's terminating to make sure the flushing process was successful. Once the ingester pod is fully terminated, continue decrementing by another 1 replica. Continue until there are 0 instances of the ingester running. You can use the following command to edit the ingester StatefulSet in order to change the number of replicas (making sure to replace with the correct namespace): kubectl -n edit statefulsets.apps loki-distributed-ingester Remove loki-distributed cluster Double check that logs are still coming in to the new cluster. If something is wrong, it will be much easier to quickly scale back up loki-distributed ingesters before tearing down the whole cluster so you can investigate. If everything looks good, you can tear down loki-distributed using helm uninstall. For example: helm uninstall -n loki loki-distributed Now edit the new loki cluster to remove the migrate options you added when first installing. Remove all of the following from your values.yaml: migrate: fromDistributed: enabled: true memberlistService: loki-loki-distributed-memberlist To apply the new configuration (assuming you installed the new chart as loki in the loki namespace): helm upgrade -n loki loki grafana-community/loki --values values.yaml The migrate.fromDistributed.memberlistService was added as an additional memberlist join member, so once this new config is pushed, the components should roll without interruption. Check the Dashboards Now that the migration is finished, you can check the dashboards included with the new loki chart to make sure everything is working as expected. You can also check the loki canary metrics to make sure nothing was lost during the migration. Assuming everything was in the loki namespace, the following query, if run over a time period that starts before the migration, and ends after it was complete, should clearly illustrate when metrics started coming from the new canary, and if and when there was data detected by either during the process: ( sum(increase(loki_canary_missing_entries_total{namespace="loki"}[$__range])) by (job) / sum(increase(loki_canary_entries_total{namespace="loki"}[$__range])) by (job) )*100 Upgrade Loki 1.x versions Every attempt is made to keep Grafana Loki backwards compatible, such that upgrades should be low risk and low friction. Unfortunately Loki is software and software is hard and sometimes we are forced to make decisions between ease of use and ease of maintenance. If we have any expectation of difficulty upgrading, we will document it here. As more versions are released it becomes more likely unexpected problems arise moving between multiple versions at once. If possible try to stay current and do sequential updates. If you want to skip versions, try it in a development environment before attempting to upgrade production. The following are upgrade instructions for Grafana Loki 1.x versions. Checking for config changes Using docker you can check changes between 2 versions of Loki with a command like this: export OLD_LOKI=2.9.4 export NEW_LOKI=3.0.0 export CONFIG_FILE=local-config.yaml diff --color=always --side-by-side <(docker run --rm -t -v "${PWD}":/config grafana/loki:${OLD_LOKI} -config.file=/etc/loki/${CONFIG_FILE} -print-config-stderr 2>&1 | sed '/Starting Loki/q' | tr -d '\r') <(docker run --rm -t -v "${PWD}":/config grafana/loki:${NEW_LOKI} -config.file=/etc/loki/${CONFIG_FILE} -print-config-stderr 2>&1 | sed '/Starting Loki/q' | tr -d '\r') | less -R The tr -d '\r' is likely not necessary for most people, seems like WSL2 was sneaking in some windows newline characters... The output is incredibly verbose as it shows the entire internal config struct used to run Loki, you can play around with the diff command if you prefer to only show changes or a different style output. 1.6.0 Important: Ksonnet port changed and removed NET_BIND_SERVICE capability from Docker image In 1.5.0 we changed the Loki user to not run as root which created problems binding to port 80. To address this we updated the docker image to add the NET_BIND_SERVICE capability to the loki process which allowed Loki to bind to port 80 as a non root user, so long as the underlying system allowed that linux capability. This has proved to be a problem for many reasons and in PR 2294 the capability was removed. It is now no longer possible for the Loki to be started with a port less than 1024 with the published docker image. The default for Helm has always been port 3100, and Helm users should be unaffected unless they changed the default. Ksonnet users however should closely check their configuration, in PR 2294 the loki port was changed from 80 to 3100 IMPORTANT: If you run Loki in microservices mode, special rollout instructions A new ingester GRPC API has been added allowing to speed up metric queries, to ensure a rollout without query errors make sure you upgrade all ingesters first. Once this is done you can then proceed with the rest of the deployment, this is to ensure that queriers won't look for an API not yet available. If you roll out everything at once, queriers with this new code will attempt to query ingesters which may not have the new method on the API and queries will fail. This will only affect reads(queries) and not writes and only for the duration of the rollout. IMPORTANT: Scrape config changes to both Helm and Ksonnet will affect labels created by Promtail Loki PR 2091 makes several changes to the Promtail scrape config: This is triggered by jsonnet-libs PR 261: The above PR changes the instance label to be actually unique within a scrape config. It also adds a pod and a container target label so that metrics can easily be joined with metrics from cAdvisor, KSM, and the Kubelet. This commit adds the same to the Loki scrape config. It also removes the container_name label. It is the same as the container label and was already added to Loki previously. However, the container_name label is deprecated and has disappeared in Kubernetes 1.16, so that it will soon become useless for direct joining. TL;DR The following label have been changed in both the Helm and Ksonnet Promtail scrape configs: instance -> pod container_name -> container Experimental boltdb-shipper changes PR 2166 now forces the index to have a period of exactly 24h: Loki will fail to start with an error if the active schema or upcoming schema are not set to a period of 24h You can add a new schema config like this: schema_config: configs: - from: 2020-01-01 <----- This is your current entry, date will be different store: boltdb-shipper object_store: aws schema: v11 index: prefix: index_ period: 168h - from: [INSERT FUTURE DATE HERE] <----- Add another entry, set a future date store: boltdb-shipper object_store: aws schema: v11 index: prefix: index_ period: 24h <--- This must be 24h If you are not on schema: v11 this would be a good opportunity to make that change in the new schema config also. {{< admonition type="note" >}} If the current time in your timezone is after midnight UTC already, set the date one additional day forward. {{< /admonition >}} There was also a significant overhaul to how boltdb-shipper internals, this should not be visible to a user but as this feature is experimental and under development bug are possible! The most noticeable change if you look in the storage, Loki no longer updates an existing file and instead creates a new index file every 15mins, this is an important move to make sure objects in the object store are immutable and will simplify future operations like compaction and deletion. Breaking CLI flags changes The following CLI flags where changed to improve consistency, they are not expected to be widely used - querier.query_timeout + querier.query-timeout - distributor.extra-query-delay + querier.extra-query-delay - max-chunk-batch-size + store.max-chunk-batch-size - ingester.concurrent-flushed + ingester.concurrent-flushes Loki Canary metric name changes When adding some new features to the canary we realized the existing metrics were not compliant with standards for counter names, the following metrics have been renamed: loki_canary_total_entries -> loki_canary_entries_total loki_canary_out_of_order_entries -> loki_canary_out_of_order_entries_total loki_canary_websocket_missing_entries -> loki_canary_websocket_missing_entries_total loki_canary_missing_entries -> loki_canary_missing_entries_total loki_canary_unexpected_entries -> loki_canary_unexpected_entries_total loki_canary_duplicate_entries -> loki_canary_duplicate_entries_total loki_canary_ws_reconnects -> loki_canary_ws_reconnects_total loki_canary_response_latency -> loki_canary_response_latency_seconds Ksonnet Changes In production/ksonnet/loki/config.libsonnet the variable storage_backend used to have a default value of 'bigtable,gcs'. This has been changed to providing no default and will error if not supplied in your environment jsonnet, here is an example of what you should add to have the same behavior as the default (namespace and cluster should already be defined): _config+:: { namespace: 'loki-dev', cluster: 'us-central1', storage_backend: 'gcs,bigtable', Defaulting to gcs,bigtable was confusing for anyone using ksonnet with other storage backends as it would manifest itself with obscure bigtable errors. 1.5.0 {{< admonition type="note" >}} The required upgrade path outlined for version 1.4.0 below is still true for moving to 1.5.0 from any release older than 1.4.0 (e.g. 1.3.0 -> 1.5.0 needs to also look at the 1.4.0 upgrade requirements). {{< /admonition >}} Breaking config changes Loki 1.5.0 vendors Cortex v1.0.0 (congratulations!), which has a massive list of changes. While changes in the command line flags affect Loki as well, we usually recommend people to use configuration file instead. Cortex has done lot of cleanup in the configuration files, and you are strongly urged to take a look at the annotated diff for config file before upgrading to Loki 1.5.0. Following fields were removed from YAML configuration completely: claim_on_rollout (always true), normalise_tokens (always true). Test Your Config To see if your config needs to change, one way to quickly test is to download a 1.5.0 (or newer) binary from the release page Then run the binary providing your config file ./loki-linux-amd64 -config.file=myconfig.yaml If there are configs which are no longer valid you will see errors immediately: ./loki-linux-amd64 -config.file=loki-local-config.yaml failed parsing config: loki-local-config.yaml: yaml: unmarshal errors: line 35: field dynamodbconfig not found in type aws.StorageConfig Referencing the list of diffs I can see this config changed: - dynamodbconfig: + dynamodb: Also several other AWS related configs changed and would need to update those as well. Loki Docker Image User and File Location Changes To improve security concerns, in 1.5.0 the Docker container no longer runs the loki process as root and instead the process runs as user loki with UID 10001 and GID 10001 This may affect people in a couple ways: Loki Port If you are running Loki with a config that opens a port number above 1024 (which is the default, 3100 for HTTP and 9095 for GRPC) everything should work fine in regards to ports. If you are running Loki with a config that opens a port number less than 1024 Linux normally requires root permissions to do this, HOWEVER in the Docker container we run setcap cap_net_bind_service=+ep /usr/bin/loki This capability lets the loki process bind to a port less than 1024 when run as a non root user. Not every environment will allow this capability however, it's possible to restrict this capability in linux. If this restriction is in place, you will be forced to run Loki with a config that has HTTP and GRPC ports above 1024. Filesystem {{< admonition type="note" >}} The location Loki is looking for files with the provided config in the docker image has changed. {{< /admonition >}} In 1.4.0 and earlier the included config file in the docker container was using directories: /tmp/loki/index /tmp/loki/chunks In 1.5.0 this has changed: /loki/index /loki/chunks This will mostly affect anyone using docker-compose or docker to run Loki and are specifying a volume to persist storage. There are two concerns to track here, one is the correct ownership of the files and the other is making sure your mounts updated to the new location. One possible upgrade path would look like this: If I were running Loki with this command docker run -d --name=loki --mount source=loki-data,target=/tmp/loki -p 3100:3100 grafana/loki:1.4.0 This would mount a docker volume named loki-data to the /tmp/loki folder which is where Loki will persist the index and chunks folder in 1.4.0 To move to 1.5.0 I can do the following (note that your container names and paths and volumes etc may be different): docker stop loki docker rm loki docker run --rm --name="loki-perm" -it --mount source=loki-data,target=/mnt ubuntu /bin/bash cd /mnt chown -R 10001:10001 ./* exit docker run -d --name=loki --mount source=loki-data,target=/loki -p 3100:3100 grafana/loki:1.5.0 Notice the change in the target=/loki for 1.5.0 to the new data directory location specified in the included Loki config file. The intermediate step of using an ubuntu image to change the ownership of the Loki files to the new user might not be necessary if you can easily access these files to run the chown command directly. That is if you have access to /var/lib/docker/volumes or if you mounted to a different local filesystem directory, you can change the ownership directly without using a container. Loki Duration Configs If you get an error like: ./loki-linux-amd64-1.5.0 -log.level=debug -config.file=/etc/loki/config.yml failed parsing config: /etc/loki/config.yml: not a valid duration string: "0" This is because of some underlying changes that no longer allow durations without a unit. Unfortunately the yaml parser doesn't give a line number but it's likely to be one of these two: chunk_store_config: max_look_back_period: 0s # DURATION VALUES MUST HAVE A UNIT EVEN IF THEY ARE ZERO table_manager: retention_deletes_enabled: false retention_period: 0s # DURATION VALUES MUST HAVE A UNIT EVEN IF THEY ARE ZERO Promtail Config Changes The underlying backoff library used in Promtail had a config change which wasn't originally noted in the release notes: If you get this error: Unable to parse config: /etc/promtail/promtail.yaml: yaml: unmarshal errors: line 3: field maxbackoff not found in type util.BackoffConfig line 4: field maxretries not found in type util.BackoffConfig line 5: field minbackoff not found in type util.BackoffConfig The new values are: min_period: max_period: max_retries: 1.4.0 Loki 1.4.0 vendors Cortex v0.7.0-rc.0 which contains several breaking config changes. In the cache_config, defaul_validity has changed to default_validity. If you configured your schema via arguments and not a config file, this is no longer supported. This is not something we had ever provided as an option via docs and is unlikely anyone is doing, but worth mentioning. The other config changes should not be relevant to Loki. Required Upgrade Path The newly vendored version of Cortex removes code related to de-normalized tokens in the ring. What you need to know is this: A "shared ring" as mentioned below refers to using consul or etcd for values in the following config: kvstore: # The backend storage to use for the ring. Supported values are # consul, etcd, inmemory store: Running without using a shared ring (inmemory): No action required Running with a shared ring and upgrading from v1.3.0 -> v1.4.0: No action required Running with a shared ring and upgrading from any version less than v1.3.0 (e.g. v1.2.0) -> v1.4.0: ACTION REQUIRED There are two options for upgrade if you are not on version 1.3.0 and are using a shared ring: Upgrade first to v1.3.0 BEFORE upgrading to v1.4.0 OR If you are running a single binary you only need to add this flag to your single binary command. Add the following configuration to your ingesters command: -ingester.normalise-tokens=true Restart your ingesters with this config Proceed with upgrading to v1.4.0 Remove the config option (only do this after everything is running v1.4.0) It is also possible to enable this flag via config file, see the lifecycler_config configuration option. If using the Helm Loki chart: extraArgs: ingester.normalise-tokens: true If using the Helm Loki-Stack chart: loki: extraArgs: ingester.normalise-tokens: true What will go wrong If you attempt to add a v1.4.0 ingester to a ring created by Loki v1.2.0 or older which does not have the commandline argument -ingester.normalise-tokens=true (or configured via config file), the v1.4.0 ingester will remove all the entries in the ring for all the other ingesters as it cannot "see" them. This will result in distributors failing to write and a general ingestion failure for the system. If this happens to you, you will want to rollback your deployment immediately. You need to remove the v1.4.0 ingester from the ring ASAP, this should allow the existing ingesters to re-insert their tokens. You will also want to remove any v1.4.0 distributors as they will not understand the old ring either and will fail to send traffic. Upgrade Loki 2.x versions Every attempt is made to keep Grafana Loki backwards compatible, such that upgrades should be low risk and low friction. Unfortunately Loki is software and software is hard and sometimes we are forced to make decisions between ease of use and ease of maintenance. If we have any expectation of difficulty upgrading, we will document it here. As more versions are released it becomes more likely unexpected problems arise moving between multiple versions at once. If possible try to stay current and do sequential updates. If you want to skip versions, try it in a development environment before attempting to upgrade production. The following are upgrade instructions for Grafana Loki 2.x versions. Checking for config changes Using docker you can check changes between 2 versions of Loki with a command like this: export OLD_LOKI=2.9.4 export NEW_LOKI=3.0.0 export CONFIG_FILE=local-config.yaml diff --color=always --side-by-side <(docker run --rm -t -v "${PWD}":/config grafana/loki:${OLD_LOKI} -config.file=/etc/loki/${CONFIG_FILE} -print-config-stderr 2>&1 | sed '/Starting Loki/q' | tr -d '\r') <(docker run --rm -t -v "${PWD}":/config grafana/loki:${NEW_LOKI} -config.file=/etc/loki/${CONFIG_FILE} -print-config-stderr 2>&1 | sed '/Starting Loki/q' | tr -d '\r') | less -R The tr -d '\r' is likely not necessary for most people, seems like WSL2 was sneaking in some windows newline characters... The output is incredibly verbose as it shows the entire internal config struct used to run Loki, you can play around with the diff command if you prefer to only show changes or a different style output. 2.9.0 Loki 2.9.0 Index gateway shuffle sharding The index gateway now supports shuffle sharding of index data when running in "ring" mode. The index data is sharded by tenant where each tenant gets assigned a sub-set of all available instances of the index gateways in the ring. If you configured a high replication factor to accommodate for load, since in the past this was the only option to give a tenant more instances for querying, you should consider reducing the replication factor to a meaningful value for replication (for example, from 12 to 3) and instead set the shard factor for individual tenants as required. If the global shard factor (no per-tenant) is 0 (default value), the global shard factor is set to replication factor. It can still be overwritten per tenant. In the context of the index gateway, sharding is synonymous to replication. Index shipper multi-store support In previous releases, if you did not explicitly configure -boltdb.shipper.shared-store, -tsdb.shipper.shared-store, those values default to the object_store configured in the latest period_config of the corresponding index type. These defaults are removed in favor of uploading indexes to multiple stores. If you do not explicitly configure a shared-store, the boltdb and tsdb indexes will be shipped to the object_store configured for that period. Shutdown marker file A shutdown marker file can be written by the /ingester/prepare_shutdown endpoint. If the new ingester.shutdown_marker_path config setting has a value that value is used. If not the common.path_prefix config setting is used if it has a value. Otherwise a warning is shown in the logs on startup and the /ingester/prepare_shutdown endpoint will return a 500 status code. Compactor multi-store support In previous releases, setting -boltdb.shipper.compactor.shared-store configured the following: store used for managing delete requests. store on which index compaction should be performed. If -boltdb.shipper.compactor.shared-store was not set, it used to default to the object_store configured in the latest period_config that uses either the tsdb or boltdb-shipper index. Compactor now supports index compaction on multiple buckets/object stores. And going forward loki will not set any defaults on -boltdb.shipper.compactor.shared-store, this has a couple of side effects detailed as follows: store on which index compaction should be performed If -boltdb.shipper.compactor.shared-store is configured by the user, loki would run index compaction only on the store specified by the config. If not set, compaction would be performed on all the object stores that contain either a boltdb-shipper or tsdb index. store used for managing delete requests A new config option -boltdb.shipper.compactor.delete-request-store decides where delete requests should be stored. This new option takes precedence over -boltdb.shipper.compactor.shared-store. In the case where neither of these options are set, the object_store configured in the latest period_config that uses either a tsdb or boltdb-shipper index is used for storing delete requests to ensure pending requests are processed. logfmt parser non-strict parsing logfmt parser now performs non-strict parsing which helps scan semi-structured log lines. It skips invalid tokens and tries to extract as many key/value pairs as possible from the rest of the log line. If you have a use-case that relies on strict parsing where you expect the parser to throw an error, use | logfmt --strict to enable strict mode. logfmt parser doesn't include standalone keys(keys without a value) in the resulting label set anymore. You can use --keep-empty flag to retain them. Jsonnet 2..9.0 Deprecated PodDisruptionBudget definition has been removed The policy/v1beta1 API version of PodDisruptionBudget is no longer served as of Kubernetes v1.25. To support the latest versions of the Kubernetes, it was necessary to replace policy/v1beta1 with the new definition policy/v1 that is available since v1.21. No impact is expected if you use Kubernetes v1.21 or newer. Please refer to official migration guide for more details. 2.8.0 Loki 2.8.0 Change in LogQL behavior When there are duplicate labels in a log line, only the first value will be kept. Previously only the last value was kept. Default retention_period has changed This change will affect you if you have: compactor: retention_enabled: true And did not define a retention_period in limits_config, thus relying on the previous default of 744h In this release the default has been changed to 0s. A value of 0s is the same as "retain forever" or "disable retention". If, and only if, you wish to retain the previous default of 744h, apply this config. limits_config: retention_period: 744h {{< admonition type="note" >}} In previous versions, the zero value of 0 or 0s will result in immediate deletion of all logs, only in 2.8 and forward releases does the zero value disable retention. {{< /admonition >}} metrics.go log line subqueries replaced with splits and shards The metrics.go log line emitted for every query had an entry called subqueries which was intended to represent the amount a query was parallelized on execution. In the current form it only displayed the count of subqueries generated with the Loki split by time logic and did not include counts for shards. There wasn't a clean way to update subqueries to include sharding information and there is value in knowing the difference between the subqueries generated when we split by time vs sharding factors, especially now that TSDB can do dynamic sharding. In 2.8 we no longer include subqueries in metrics.go, it does still exist in the statistics API data returned but just for backwards compatibility, the value will always be zero now. Instead, now you can use splits to see how many split by time intervals were created and shards to see the total number of shards created for a query. {{< admonition type="note" >}} Currently not every query can be sharded and a shards value of zero is a good indicator the query was not able to be sharded. {{< /admonition >}} Promtail 2.8.0 The go build tag promtail_journal_enabled was introduced The go build tag promtail_journal_enabled should be passed to include Journal support to the promtail binary. If you need Journal support you will need to run go build with tag promtail_journal_enabled: go build --tags=promtail_journal_enabled ./clients/cmd/promtail Introducing this tag aims to relieve Linux/CentOS users with CGO enabled from installing libsystemd-dev/systemd-devel libraries if they don't need Journal support. Ruler CLI flag ruler.wal-cleaer.period deprecated CLI flag ruler.wal-cleaer.period is now deprecated and replaced with a typo fix ruler.wal-cleaner.period. The yaml configuration remains unchanged: ruler: wal_cleaner: period: 5s Querier query-frontend Kubernetes headless service changed to load balanced service {{< admonition type="note" >}} This is relevant only if you are using jsonnet for deploying Loki in Kubernetes. {{< /admonition >}} The query-frontend Kubernetes service was previously headless and was used for two purposes: Distributing the Loki query requests amongst all the available Query Frontend pods. Discover IPs of Query Frontend pods from Queriers to connect as workers. The problem here is that a headless service does not support load balancing and leaves it up to the client to balance the load. Additionally, a load-balanced service does not let us discover the IPs of the underlying pods. To meet both these requirements, we have made the following changes: Changed the existing query-frontend Kubernetes service from headless to load-balanced to have a fair load distribution on all the Query Frontend instances. Added query-frontend-headless to discover QF pod IPs from queriers to connect as workers. If you are deploying Loki with Query Scheduler by setting query_scheduler_enabled config to true, then there is nothing to do here for this change. If you are not using Query Scheduler, then to avoid any issues on the Read path until the rollout finishes, it would be good to follow below steps: Create just the query-frontend-headless service without applying any changes to the query-frontend service. Rollout changes to queriers. Roll out the rest of the changes. General Store & Cache Statistics Statistics are now logged in metrics.go lines about how long it takes to download chunks from the store, as well as how long it takes to download chunks, index query, and result cache responses from cache. Example (note the *_download_time fields): level=info ts=2022-12-20T15:27:54.858554127Z caller=metrics.go:147 component=frontend org_id=docker latency=fast query="sum(count_over_time({job=\"generated-logs\"}[1h]))" query_type=metric range_type=range length=6h17m48.865587821s start_delta=6h17m54.858533178s end_delta=5.99294552s step=1m30s duration=5.990829396s status=200 limit=30 returned_lines=0 throughput=123MB total_bytes=738MB total_entries=1 store_chunks_download_time=2.319297059s queue_time=2m21.476090991s subqueries=8 cache_chunk_req=81143 cache_chunk_hit=32390 cache_chunk_bytes_stored=1874098 cache_chunk_bytes_fetched=94289610 cache_chunk_download_time=56.96914ms cache_index_req=994 cache_index_hit=710 cache_index_download_time=1.587842ms cache_result_req=7 cache_result_hit=0 cache_result_download_time=380.555µs These statistics are also displayed when using --stats with LogCLI. 2.7.0 Loki 2.7.0 Loki Canary Permission The new push mode to Loki canary can push logs that are generated by a Loki canary directly to a given Loki URL. Previously, it only wrote to a local file and you needed some agent, such as promtail, to scrape and push it to Loki. So if you run Loki behind some proxy with different authorization policies to read and write to Loki, then auth credentials we pass to Loki canary now needs to have both READ and WRITE permissions. engine.timeout and querier.query_timeout are deprecated Previously, we had two configurations to define a query timeout: engine.timeout and querier.query-timeout. As they were conflicting and engine.timeout isn't as expressive as querier.query-timeout, we're deprecating it and moving it to Limits Config limits_config.query_timeout with same default values. fifocache has been renamed The in-memory fifocache has been renamed to embedded-cache. This allows us to replace the implementation (currently a simple FIFO data structure) with something else in the future without causing confusion Evenly spread Memcached pods for chunks across kubernetes nodes We now evenly spread memcached_chunks pods across the available kubernetes nodes, but allowing more than one pod to be scheduled into the same node. If you want to run at most a single pod per node, set $.memcached.memcached_chunks.use_topology_spread to false. While we attempt to schedule at most 1 memcached_chunks pod per Kubernetes node with the topology_spread_max_skew: 1 field, if no more nodes are available then multiple pods will be scheduled on the same node. This can potentially impact your service's reliability so consider tuning these values according to your risk tolerance. Evenly spread distributors across kubernetes nodes We now evenly spread distributors across the available kubernetes nodes, but allowing more than one distributors to be scheduled into the same node. If you want to run at most a single distributors per node, set $._config.distributors.use_topology_spread to false. While we attempt to schedule at most 1 distributor per Kubernetes node with the topology_spread_max_skew: 1 field, if no more nodes are available then multiple distributors will be scheduled on the same node. This can potentially impact your service's reliability so consider tuning these values according to your risk tolerance. Evenly spread queriers across kubernetes nodes We now evenly spread queriers across the available kubernetes nodes, but allowing more than one querier to be scheduled into the same node. If you want to run at most a single querier per node, set $._config.querier.use_topology_spread to false. While we attempt to schedule at most 1 querier per Kubernetes node with the topology_spread_max_skew: 1 field, if no more nodes are available then multiple queriers will be scheduled on the same node. This can potentially impact your service's reliability so consider tuning these values according to your risk tolerance. Default value for server.http-listen-port changed This value now defaults to 3100, so the Loki process doesn't require special privileges. Previously, it had been set to port 80, which is a privileged port. If you need Loki to listen on port 80, you can set it back to the previous default using -server.http-listen-port=80. docker-compose setup has been updated The docker-compose setup has been updated to v2.6.0 and includes many improvements. Notable changes include: authentication (multi-tenancy) is enabled by default; you can disable it in production/docker/config/loki.yaml by setting auth_enabled: false storage is now using Minio instead of local filesystem move your current storage into .data/minio and it should work transparently log-generator was added - if you don't need it, simply remove the service from docker-compose.yaml or don't start the service Configuration for deletes has changed The global deletion_mode option in the compactor configuration moved to runtime configurations. The deletion_mode option needs to be removed from your compactor configuration The deletion_mode global override needs to be set to the desired mode: disabled, filter-only, or filter-and-delete. By default, filter-and-delete is enabled. Any allow_delete per-tenant overrides need to be removed or changed to deletion_mode overrides with the desired mode. Metric name for loki_log_messages_total changed The name of this metric was changed to loki_internal_log_messages_total to reduce ambiguity. The previous name is still present but is deprecated. Usage Report / Telemetry config has changed named The configuration for anonymous usage statistics reporting to Grafana has changed from usage_report to analytics. TLS cipher_suites and tls_min_version have moved These were previously configurable under server.http_tls_config and server.grpc_tls_config separately. They are now under server.tls_cipher_suites and server.tls_min_version. These values are also now configurable for individual clients, for example: distributor.ring.etcd or querier.ingester_client.grpc_client_config. ruler.storage.configdb has been removed ConfigDB was disallowed as a Ruler storage option back in 2.0. The config struct has finally been removed. ruler.remote_write.client has been removed Can no longer specify a remote write client for the ruler. Promtail 2.7.0 gcp_push_target_parsing_errors_total has a new reason label The gcp_push_target_parsing_errors_total GCP Push Target metrics has been added a new label named reason. This includes detail on what might have caused the parsing to fail. Windows event logs: now correctly includes user_data The contents of the user_data field was erroneously set to the same value as event_data in previous versions. This was fixed in #7461 and log queries relying on this broken behavior may be impacted. 2.6.0 Loki 2.6.0 Implementation of unwrapped rate aggregation changed The implementation of the rate() aggregation function changed back to the previous implementation prior to #5013. This means that the rate per second is calculated based on the sum of the extracted values, instead of the average increase over time. If you want the extracted values to be treated as Counter metric, you should use the new rate_counter() aggregation function, which calculates the per-second average rate of increase of the vector. Default value for azure.container-name changed This value now defaults to loki, it was previously set to cortex. If you are relying on this container name for your chunks or ruler storage, you will have to manually specify -azure.container-name=cortex or -ruler.storage.azure.container-name=cortex respectively. 2.5.0 Loki 2.5.0 split_queries_by_interval yaml configuration has moved It was previously possible to define this value in two places query_range: split_queries_by_interval: 10m and/or limits_config: split_queries_by_interval: 10m In 2.5.0 it can only be defined in the limits_config section, Loki will fail to start if you do not remove the split_queries_by_interval config from the query_range section. Additionally, it has a new default value of 30m rather than 0. The CLI flag is not changed and remains querier.split-queries-by-interval. Dropped support for old Prometheus rules configuration format Alerting rules previously could be specified in two formats: 1.x format (legacy one, named v0 internally) and 2.x. We decided to drop support for format 1.x as it is fairly old and keeping support for it required a lot of code. In case you're still using the legacy format, take a look at Alerting Rules for instructions on how to write alerting rules in the new format. For reference, the newer format follows a structure similar to the one below: groups: - name: example rules: - alert: HighErrorRate expr: job:request_latency_seconds:mean5m{job="myjob"} > 0.5 for: 10m labels: severity: page annotations: summary: High request latency Meanwhile, the legacy format is a string in the following format: ALERT IF [ FOR ] [ LABELS