Skip to content

Commit 5636380

Browse files
xperimentalxperimental
authored
operator: Update Grafana and forwarding documentation (grafana#6442)
1 parent 8d6e2f0 commit 5636380

File tree

3 files changed

+67
-51
lines changed

3 files changed

+67
-51
lines changed

‎operator/docs/forwarding_logs_to_gateway.md

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Forwarding Logs to LokiStack
22

3-
This document will describe how to send application, infrastructure, and audit logs to the Lokistack Gateway as different tenants using Promtail or Fluentd. The built-in gateway provides secure access to the distributor (and query-frontend) via consulting an OAuth/OIDC endpoint for the request subject.
3+
This document will describe how to send application, infrastructure, and audit logs to the LokiStack Gateway as different tenants using Promtail or Fluentd. The built-in gateway provides secure access to the distributor (and query-frontend) via consulting an OAuth/OIDC endpoint for the request subject.
44

55
__Please read the [hacking guide](./hack_loki_operator.md) before proceeding with the following instructions.__
66

@@ -37,7 +37,8 @@ _Note: While this document will only give instructions for two methods of log fo
3737

3838
```console
3939
kubectl -n openshift-logging create secret generic lokistack-gateway-bearer-token \
40-
--from-literal=token="/var/run/secrets/kubernetes.io/serviceaccount/token"
40+
--from-literal=token="/var/run/secrets/kubernetes.io/serviceaccount/token" \
41+
--from-literal=ca-bundle.crt="$(kubectl get cm lokistack-dev-ca-bundle -o json | jq -r '.data."service-ca.crt"')"
4142
```
4243

4344
* Create the following `ClusterRole` and `ClusterRoleBinding` which will allow the cluster to authenticate the user(s) submitting the logs:
@@ -178,13 +179,19 @@ To configure Promtail to send application, audit, and infrastructure logs, add t
178179
clients:
179180
- # ...
180181
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
181-
url: http://lokistack-dev-gateway-http.openshift-logging.svc:8080/api/logs/v1/audit/loki/api/v1/push
182+
tls_config:
183+
ca_file: /run/secrets/kubernetes.io/serviceaccount/service-ca.crt
184+
url: https://lokistack-dev-gateway-http.openshift-logging.svc:8080/api/logs/v1/audit/loki/api/v1/push
182185
- # ...
183186
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
184-
url: http://lokistack-dev-gateway-http.openshift-logging.svc:8080/api/logs/v1/application/loki/api/v1/push
187+
tls_config:
188+
ca_file: /run/secrets/kubernetes.io/serviceaccount/service-ca.crt
189+
url: https://lokistack-dev-gateway-http.openshift-logging.svc:8080/api/logs/v1/application/loki/api/v1/push
185190
- # ...
186191
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
187-
url: http://lokistack-dev-gateway-http.openshift-logging.svc:8080/api/logs/v1/infrastructure/loki/api/v1/push
192+
tls_config:
193+
ca_file: /run/secrets/kubernetes.io/serviceaccount/service-ca.crt
194+
url: https://lokistack-dev-gateway-http.openshift-logging.svc:8080/api/logs/v1/infrastructure/loki/api/v1/push
188195
```
189196
190197
The rest of the configuration can be configured to the developer's desire.
@@ -199,8 +206,9 @@ The Fluentd configuration can be overrided to target the `application` endpoint
199206
<match **>
200207
@type loki
201208
# ...
202-
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
203-
url: http://lokistack-dev-gateway-http.openshift-logging.svc:8080/api/logs/v1/application
209+
bearer_token_file /var/run/secrets/kubernetes.io/serviceaccount/token
210+
ca_cert /run/secrets/kubernetes.io/serviceaccount/service-ca.crt
211+
url https://lokistack-dev-gateway-http.openshift-logging.svc:8080/api/logs/v1/application
204212
</match>
205213
```
206214

‎operator/hack/addon_grafana_gateway_ocp.yaml

Lines changed: 24 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ data:
8181
mode = console
8282
kind: ConfigMap
8383
metadata:
84-
name: grafana-config-mbkktkdhtm
84+
name: grafana-config
8585
namespace: openshift-logging
8686
---
8787
apiVersion: v1
@@ -93,30 +93,36 @@ data:
9393
isDefault: true
9494
type: loki
9595
access: proxy
96-
url: http://${GATEWAY_ADDRESS}/api/logs/v1/application/
96+
url: https://${GATEWAY_ADDRESS}/api/logs/v1/application/
9797
jsonData:
98+
tlsAuthWithCACert: true
9899
httpHeaderName1: Authorization
99100
secureJsonData:
101+
tlsCACert: ${GATEWAY_SERVICE_CA}
100102
httpHeaderValue1: Bearer ${GATEWAY_BEARER_TOKEN}
101103
- name: Loki (Infrastructure)
102104
type: loki
103105
access: proxy
104-
url: http://${GATEWAY_ADDRESS}/api/logs/v1/infrastructure/
106+
url: https://${GATEWAY_ADDRESS}/api/logs/v1/application/
105107
jsonData:
108+
tlsAuthWithCACert: true
106109
httpHeaderName1: Authorization
107110
secureJsonData:
111+
tlsCACert: ${GATEWAY_SERVICE_CA}
108112
httpHeaderValue1: Bearer ${GATEWAY_BEARER_TOKEN}
109113
- name: Loki (Audit)
110114
type: loki
111115
access: proxy
112-
url: http://${GATEWAY_ADDRESS}/api/logs/v1/audit/
116+
url: https://${GATEWAY_ADDRESS}/api/logs/v1/application/
113117
jsonData:
118+
tlsAuthWithCACert: true
114119
httpHeaderName1: Authorization
115120
secureJsonData:
121+
tlsCACert: ${GATEWAY_SERVICE_CA}
116122
httpHeaderValue1: Bearer ${GATEWAY_BEARER_TOKEN}
117123
kind: ConfigMap
118124
metadata:
119-
name: grafana-datasources-hkh56t48tg
125+
name: grafana-datasources
120126
namespace: openshift-logging
121127
---
122128
apiVersion: v1
@@ -130,7 +136,7 @@ data:
130136
sed "s/\${GATEWAY_BEARER_TOKEN}/$bearer_token/g" /input/loki.yaml > /output/loki.yaml
131137
kind: ConfigMap
132138
metadata:
133-
name: grafana-init-scripts-6mt2bg5dd8
139+
name: grafana-init-scripts
134140
namespace: openshift-logging
135141
---
136142
apiVersion: v1
@@ -158,7 +164,7 @@ spec:
158164
type: ClusterIP
159165
---
160166
apiVersion: apps/v1
161-
kind: StatefulSet
167+
kind: Deployment
162168
metadata:
163169
labels:
164170
app: grafana
@@ -168,7 +174,6 @@ spec:
168174
selector:
169175
matchLabels:
170176
app: grafana
171-
serviceName: grafana
172177
template:
173178
metadata:
174179
labels:
@@ -178,13 +183,18 @@ spec:
178183
- args:
179184
- -config=/etc/grafana/config.ini
180185
env:
186+
- name: GATEWAY_SERVICE_CA
187+
valueFrom:
188+
configMapKeyRef:
189+
key: service-ca.crt
190+
name: openshift-service-ca.crt
181191
- name: GATEWAY_ADDRESS
182192
value: lokistack-dev-gateway-http.openshift-logging.svc:8080
183193
- name: GF_PATHS_PROVISIONING
184194
value: /var/lib/provisioning
185195
- name: GF_SECURITY_ADMIN_USER
186196
value: kube:admin
187-
image: docker.io/grafana/grafana:8.5.2
197+
image: docker.io/grafana/grafana:8.5.6
188198
imagePullPolicy: IfNotPresent
189199
livenessProbe:
190200
failureThreshold: 3
@@ -282,32 +292,23 @@ spec:
282292
serviceAccountName: grafana
283293
volumes:
284294
- configMap:
285-
name: grafana-config-mbkktkdhtm
295+
name: grafana-config
286296
name: grafana-config
287297
- name: secret-grafana-tls
288298
secret:
289299
defaultMode: 420
290300
secretName: grafana-tls
291301
- configMap:
292302
defaultMode: 493
293-
name: grafana-init-scripts-6mt2bg5dd8
303+
name: grafana-init-scripts
294304
name: grafana-init-scripts
295305
- emptyDir: {}
296306
name: patched-datasources
297307
- configMap:
298-
name: grafana-datasources-hkh56t48tg
308+
name: grafana-datasources
299309
name: grafana-datasources
300-
volumeClaimTemplates:
301-
- metadata:
302-
labels:
303-
app: grafana
304-
name: grafana
305-
spec:
306-
accessModes:
307-
- ReadWriteOnce
308-
resources:
309-
requests:
310-
storage: 1Gi
310+
- emptyDir: {}
311+
name: grafana
311312
---
312313
apiVersion: route.openshift.io/v1
313314
kind: Route

‎operator/hack/addon_grafana_gateway_ocp_oauth.yaml

Lines changed: 28 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ data:
7676
mode = console
7777
kind: ConfigMap
7878
metadata:
79-
name: grafana-config-5kt2h4545b
79+
name: grafana-config
8080
namespace: openshift-logging
8181
---
8282
apiVersion: v1
@@ -88,18 +88,30 @@ data:
8888
isDefault: true
8989
type: loki
9090
access: proxy
91-
url: http://${GATEWAY_ADDRESS}/api/logs/v1/application/
91+
url: https://${GATEWAY_ADDRESS}/api/logs/v1/application/
92+
jsonData:
93+
tlsAuthWithCACert: true
94+
secureJsonData:
95+
tlsCACert: ${GATEWAY_SERVICE_CA}
9296
- name: Loki (Infrastructure)
9397
type: loki
9498
access: proxy
95-
url: http://${GATEWAY_ADDRESS}/api/logs/v1/infrastructure/
99+
url: https://${GATEWAY_ADDRESS}/api/logs/v1/infrastructure/
100+
jsonData:
101+
tlsAuthWithCACert: true
102+
secureJsonData:
103+
tlsCACert: ${GATEWAY_SERVICE_CA}
96104
- name: Loki (Audit)
97105
type: loki
98106
access: proxy
99-
url: http://${GATEWAY_ADDRESS}/api/logs/v1/audit/
107+
url: https://${GATEWAY_ADDRESS}/api/logs/v1/audit/
108+
jsonData:
109+
tlsAuthWithCACert: true
110+
secureJsonData:
111+
tlsCACert: ${GATEWAY_SERVICE_CA}
100112
kind: ConfigMap
101113
metadata:
102-
name: grafana-datasources-d9f6t65c72
114+
name: grafana-datasources
103115
namespace: openshift-logging
104116
---
105117
apiVersion: v1
@@ -127,7 +139,7 @@ spec:
127139
type: ClusterIP
128140
---
129141
apiVersion: apps/v1
130-
kind: StatefulSet
142+
kind: Deployment
131143
metadata:
132144
labels:
133145
app: grafana
@@ -137,7 +149,6 @@ spec:
137149
selector:
138150
matchLabels:
139151
app: grafana
140-
serviceName: grafana
141152
template:
142153
metadata:
143154
labels:
@@ -147,11 +158,16 @@ spec:
147158
- args:
148159
- -config=/etc/grafana/config.ini
149160
env:
161+
- name: GATEWAY_SERVICE_CA
162+
valueFrom:
163+
configMapKeyRef:
164+
key: service-ca.crt
165+
name: openshift-service-ca.crt
150166
- name: GATEWAY_ADDRESS
151167
value: lokistack-dev-gateway-http.openshift-logging.svc:8080
152168
- name: GF_SECURITY_ADMIN_USER
153169
value: kube:admin
154-
image: docker.io/grafana/grafana:8.5.2
170+
image: docker.io/grafana/grafana:8.5.6
155171
imagePullPolicy: IfNotPresent
156172
livenessProbe:
157173
failureThreshold: 3
@@ -234,26 +250,17 @@ spec:
234250
serviceAccountName: grafana
235251
volumes:
236252
- configMap:
237-
name: grafana-config-5kt2h4545b
253+
name: grafana-config
238254
name: grafana-config
239255
- name: secret-grafana-tls
240256
secret:
241257
defaultMode: 420
242258
secretName: grafana-tls
243259
- configMap:
244-
name: grafana-datasources-d9f6t65c72
260+
name: grafana-datasources
245261
name: grafana-datasources
246-
volumeClaimTemplates:
247-
- metadata:
248-
labels:
249-
app: grafana
250-
name: grafana
251-
spec:
252-
accessModes:
253-
- ReadWriteOnce
254-
resources:
255-
requests:
256-
storage: 1Gi
262+
- emptyDir: {}
263+
name: grafana
257264
---
258265
apiVersion: route.openshift.io/v1
259266
kind: Route

0 commit comments

Comments
 (0)