Skip to content
Snippets Groups Projects
Verified Commit 47e3ec57 authored by Sheogorath's avatar Sheogorath :european_castle:
Browse files

feat(loki): Add initial loki deployment to cluster

This patch adds a whole loki stack to the cluster, providing a logging
setup for all pods and namespaces in the cluster. This will allow to
use centralised logging and persist logs beyond the existence of a Pod.
This will also help to provide auditing to pods like mail.
parent fe17e3d0
No related branches found
No related tags found
No related merge requests found
...@@ -11,6 +11,7 @@ resources: ...@@ -11,6 +11,7 @@ resources:
- nginx-system - nginx-system
- longhorn - longhorn
- monitoring - monitoring
- loki
- flux-system - flux-system
- k8up - k8up
- postgres - postgres
......
Loki
===
Keeping all logs centralised.
Links
---
- [Docs](https://grafana.com/docs/loki/latest/)
- [Helm Chart](https://artifacthub.io/packages/helm/grafana/loki-stack)
- [Source Code](https://github.com/grafana/loki)
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: loki-system
resources:
- namespace.yaml
- repository.yaml
- loki.yaml
- promtail.yaml
- ../../shared/networkpolicies/allow-from-monitoring.yaml
- ../../shared/networkpolicies/allow-from-same-namespace.yaml
patchesStrategicMerge:
- networkpolicy.yaml
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: loki
namespace: loki-system
spec:
releaseName: loki
chart:
spec:
chart: loki
sourceRef:
kind: HelmRepository
name: grafana
namespace: loki-system
version: 3.2.0
interval: 5m
upgrade:
remediation:
retries: -1
crds: CreateReplace
install:
remediation:
retries: -1
crds: CreateReplace
valuesFrom:
- kind: ConfigMap
name: loki-base-values
valuesKey: values.yaml
- kind: Secret
name: loki-override-values
valuesKey: values-overrides.yaml
optional: true
---
apiVersion: v1
kind: ConfigMap
metadata:
name: loki-base-values
namespace: loki-system
data:
values.yaml: |
loki:
auth_enabled: false
commonConfig:
replication_factor: 1
storage:
type: s3
s3:
endpoint: loki-minio.loki-system.svc.cluster.local:9000
insecure: true
accessKeyId: loki
secretAccessKey: supersecret
s3ForcePathStyle: true
read:
replicas: 2
write:
replicas: 2
ruler:
enabled: false
monitoring:
enabled: true
selfMonitoring:
grafanaAgent:
installOperator: false
networkPolicy:
enabled: true
metrics:
namespaceSelector:
matchLabels:
monitoring.shivering-isles.com/network-access-required: "true"
podSelector:
matchLabels:
app.kubernetes.io/name: prometheus
ingress:
namespaceSelector:
matchLabels:
ingress.shivering-isles.com/network-access-required: "true"
alertmanager:
namespaceSelector:
matchLabels:
monitoring.shivering-isles.com/network-access-required: "true"
podSelector:
matchLabels:
app.kubernetes.io/name: alertmanager
externalStorage:
ports:
- 9000
minio:
enabled: true
mode: standalone
rootUser: loki
rootPassword: supersecret
persistence:
size: 50Gi
networkPolicy:
enabled: true
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-from-grafana
spec:
policyTypes:
- Ingress
ingress:
- from:
- namespaceSelector:
matchLabels:
monitoring.shivering-isles.com/network-access-required: "true"
podSelector:
matchLabels:
app.kubernetes.io/name: grafana
podSelector:
matchLabels:
app.kubernetes.io/component: gateway
app.kubernetes.io/instance: loki
app.kubernetes.io/name: loki
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-from-job-to-minio
spec:
policyTypes:
- Egress
egress:
- ports:
- protocol: TCP
port: 9000
podSelector:
matchLabels:
app: minio-job
release: loki
---
apiVersion: v1
kind: ConfigMap
metadata:
name: datasource-loki
namespace: loki-system
labels:
grafana_datasource: "1"
data:
loki-stack-datasource.yaml: |-
apiVersion: 1
datasources:
- name: Loki
type: loki
access: proxy
url: http://loki-gateway.loki-system.svc.cluster.local
version: 1
isDefault: false
apiVersion: v1
kind: Namespace
metadata:
name: loki-system
labels:
kyverno.shivering-isles.com/class: "system"
pod-security.kubernetes.io/enforce: privileged
pod-security.kubernetes.io/audit: privileged
pod-security.kubernetes.io/warn: privileged
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-from-monitoring
spec:
podSelector:
matchLabels:
app.kubernetes.io/instance: loki
app.kubernetes.io/name: loki
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: promtail
namespace: loki-system
spec:
releaseName: promtail
chart:
spec:
chart: promtail
sourceRef:
kind: HelmRepository
name: grafana
namespace: loki-system
version: 6.4.0
interval: 5m
upgrade:
remediation:
retries: -1
crds: CreateReplace
install:
remediation:
retries: -1
crds: CreateReplace
valuesFrom:
- kind: ConfigMap
name: promtail-base-values
valuesKey: values.yaml
- kind: Secret
name: promtail-override-values
valuesKey: values-overrides.yaml
optional: true
---
apiVersion: v1
kind: ConfigMap
metadata:
name: promtail-base-values
namespace: loki-system
data:
values.yaml: |
serviceMonitor:
enabled: true
networkPolicy:
enabled: true
metrics:
namespaceSelector:
matchLabels:
monitoring.shivering-isles.com/network-access-required: "true"
podSelector:
matchLabels:
app.kubernetes.io/name: prometheus
# Required for journald collection
containerSecurityContext:
privileged: true
capabilities: null
allowPrivilegeEscalation: true
config:
snippets:
extraScrapeConfigs: |
# Add an additional scrape config for journald
- job_name: journal
journal:
path: /var/log/journal
max_age: 12h
labels:
job: systemd-journal
relabel_configs:
- source_labels:
- __journal__hostname
target_label: hostname
# example label values: kubelet.service, containerd.service
- source_labels:
- __journal__systemd_unit
target_label: unit
# example label values: debug, notice, info, warning, error
- source_labels:
- __journal_priority_keyword
target_label: level
# Mount journal directory and machine-id file into promtail pods
extraVolumes:
- name: journal
hostPath:
path: /var/log/journal
- name: machine-id
hostPath:
path: /etc/machine-id
extraVolumeMounts:
- name: journal
mountPath: /var/log/journal
readOnly: true
- name: machine-id
mountPath: /etc/machine-id
readOnly: true
apiVersion: source.toolkit.fluxcd.io/v1beta1
kind: HelmRepository
metadata:
name: grafana
namespace: loki-system
spec:
interval: 30m
url: https://grafana.github.io/helm-charts
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment