---
# Source: loki/charts/minio/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: "minio-sa"
---
# Source: loki/templates/loki-canary/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: loki-canary
  namespace: loki
  labels:
    helm.sh/chart: loki-7.0.0
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/version: "3.6.7"
    app.kubernetes.io/component: canary
automountServiceAccountToken: true
---
# Source: loki/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: loki
  namespace: loki
  labels:
    helm.sh/chart: loki-7.0.0
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/version: "3.6.7"
automountServiceAccountToken: true
---
# Source: loki/charts/minio/templates/secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: loki-minio
  labels:
    app: minio
    chart: minio-5.4.0
    release: loki
    heritage: Helm
type: Opaque
data:
  rootUser: "cm9vdC11c2Vy"
  rootPassword: "c3VwZXJzZWNyZXRwYXNzd29yZA=="
---
# Source: loki/charts/minio/templates/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: loki-minio
  labels:
    app: minio
    chart: minio-5.4.0
    release: loki
    heritage: Helm
data:
  initialize: |-
    #!/bin/sh
    set -e # Have script exit in the event of a failed command.
    MC_CONFIG_DIR="/etc/minio/mc/"
    MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}"

    # connectToMinio
    # Use a check-sleep-check loop to wait for MinIO service to be available
    connectToMinio() {
    	SCHEME=$1
    	ATTEMPTS=0
    	LIMIT=29 # Allow 30 attempts
    	set -e   # fail if we can't read the keys.
    	ACCESS=$(cat /config/rootUser)
    	SECRET=$(cat /config/rootPassword)
    	set +e # The connections to minio are allowed to fail.
    	echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT"
    	MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET"
    	$MC_COMMAND
    	STATUS=$?
    	until [ $STATUS = 0 ]; do
    		ATTEMPTS=$(expr $ATTEMPTS + 1)
    		echo \"Failed attempts: $ATTEMPTS\"
    		if [ $ATTEMPTS -gt $LIMIT ]; then
    			exit 1
    		fi
    		sleep 2 # 1 second intervals between attempts
    		$MC_COMMAND
    		STATUS=$?
    	done
    	set -e # reset `e` as active
    	return 0
    }

    # checkBucketExists ($bucket)
    # Check if the bucket exists, by using the exit code of `mc ls`
    checkBucketExists() {
    	BUCKET=$1
    	CMD=$(${MC} stat myminio/$BUCKET >/dev/null 2>&1)
    	return $?
    }

    # createBucket ($bucket, $policy, $purge)
    # Ensure bucket exists, purging if asked to
    createBucket() {
    	BUCKET=$1
    	POLICY=$2
    	PURGE=$3
    	VERSIONING=$4
    	OBJECTLOCKING=$5

    	# Purge the bucket, if set & exists
    	# Since PURGE is user input, check explicitly for `true`
    	if [ $PURGE = true ]; then
    		if checkBucketExists $BUCKET; then
    			echo "Purging bucket '$BUCKET'."
    			set +e # don't exit if this fails
    			${MC} rm -r --force myminio/$BUCKET
    			set -e # reset `e` as active
    		else
    			echo "Bucket '$BUCKET' does not exist, skipping purge."
    		fi
    	fi

    	# Create the bucket if it does not exist and set objectlocking if enabled (NOTE: versioning will be not changed if OBJECTLOCKING is set because it enables versioning to the Buckets created)
    	if ! checkBucketExists $BUCKET; then
    		if [ ! -z $OBJECTLOCKING ]; then
    			if [ $OBJECTLOCKING = true ]; then
    				echo "Creating bucket with OBJECTLOCKING '$BUCKET'"
    				${MC} mb --with-lock myminio/$BUCKET
    			elif [ $OBJECTLOCKING = false ]; then
    				echo "Creating bucket '$BUCKET'"
    				${MC} mb myminio/$BUCKET
    			fi
    		elif [ -z $OBJECTLOCKING ]; then
    			echo "Creating bucket '$BUCKET'"
    			${MC} mb myminio/$BUCKET
    		else
    			echo "Bucket '$BUCKET' already exists."
    		fi
    	fi

    	# set versioning for bucket if objectlocking is disabled or not set
    	if [ $OBJECTLOCKING = false ]; then
    		if [ ! -z $VERSIONING ]; then
    			if [ $VERSIONING = true ]; then
    				echo "Enabling versioning for '$BUCKET'"
    				${MC} version enable myminio/$BUCKET
    			elif [ $VERSIONING = false ]; then
    				echo "Suspending versioning for '$BUCKET'"
    				${MC} version suspend myminio/$BUCKET
    			fi
    		fi
    	else
    		echo "Bucket '$BUCKET' versioning unchanged."
    	fi

    	# At this point, the bucket should exist, skip checking for existence
    	# Set policy on the bucket
    	echo "Setting policy of bucket '$BUCKET' to '$POLICY'."
    	${MC} anonymous set $POLICY myminio/$BUCKET
    }

    # Try connecting to MinIO instance
    scheme=http
    connectToMinio $scheme



    # Create the buckets
    createBucket chunks "none" false false false
    createBucket ruler "none" false false false
    createBucket admin "none" false false false

  add-user: |-
    #!/bin/sh
    set -e ; # Have script exit in the event of a failed command.
    MC_CONFIG_DIR="/etc/minio/mc/"
    MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}"

    # AccessKey and secretkey credentials file are added to prevent shell execution errors caused by special characters.
    # Special characters for example : ',",<,>,{,}
    MINIO_ACCESSKEY_SECRETKEY_TMP="/tmp/accessKey_and_secretKey_tmp"

    # connectToMinio
    # Use a check-sleep-check loop to wait for MinIO service to be available
    connectToMinio() {
      SCHEME=$1
      ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts
      set -e ; # fail if we can't read the keys.
      ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ;
      set +e ; # The connections to minio are allowed to fail.
      echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ;
      MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ;
      $MC_COMMAND ;
      STATUS=$? ;
      until [ $STATUS = 0 ]
      do
        ATTEMPTS=`expr $ATTEMPTS + 1` ;
        echo \"Failed attempts: $ATTEMPTS\" ;
        if [ $ATTEMPTS -gt $LIMIT ]; then
          exit 1 ;
        fi ;
        sleep 2 ; # 1 second intervals between attempts
        $MC_COMMAND ;
        STATUS=$? ;
      done ;
      set -e ; # reset `e` as active
      return 0
    }

    # checkUserExists ()
    # Check if the user exists, by using the exit code of `mc admin user info`
    checkUserExists() {
      CMD=$(${MC} admin user info myminio $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) > /dev/null 2>&1)
      return $?
    }

    # createUser ($policy)
    createUser() {
      POLICY=$1
      #check accessKey_and_secretKey_tmp file
      if [[ ! -f $MINIO_ACCESSKEY_SECRETKEY_TMP ]];then
        echo "credentials file does not exist"
        return 1
      fi
      if [[ $(cat $MINIO_ACCESSKEY_SECRETKEY_TMP|wc -l) -ne 2 ]];then
        echo "credentials file is invalid"
        rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP
        return 1
      fi
      USER=$(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP)
      # Create the user if it does not exist
      if ! checkUserExists ; then
        echo "Creating user '$USER'"
        cat $MINIO_ACCESSKEY_SECRETKEY_TMP | ${MC} admin user add myminio
      else
        echo "User '$USER' already exists."
      fi
      #clean up credentials files.
      rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP

      # set policy for user
      if [ ! -z $POLICY -a $POLICY != " " ] ; then
          echo "Adding policy '$POLICY' for '$USER'"
          set +e ; # policy already attach errors out, allow it.
          ${MC} admin policy attach myminio $POLICY --user=$USER
          set -e
      else
          echo "User '$USER' has no policy attached."
      fi
    }

    # Try connecting to MinIO instance
    scheme=http
    connectToMinio $scheme



    # Create the users
    echo logs-user > $MINIO_ACCESSKEY_SECRETKEY_TMP
    echo supersecretpassword >> $MINIO_ACCESSKEY_SECRETKEY_TMP
    createUser readwrite

  add-policy: |-
    #!/bin/sh
    set -e ; # Have script exit in the event of a failed command.
    MC_CONFIG_DIR="/etc/minio/mc/"
    MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}"

    # connectToMinio
    # Use a check-sleep-check loop to wait for MinIO service to be available
    connectToMinio() {
      SCHEME=$1
      ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts
      set -e ; # fail if we can't read the keys.
      ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ;
      set +e ; # The connections to minio are allowed to fail.
      echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ;
      MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ;
      $MC_COMMAND ;
      STATUS=$? ;
      until [ $STATUS = 0 ]
      do
        ATTEMPTS=`expr $ATTEMPTS + 1` ;
        echo \"Failed attempts: $ATTEMPTS\" ;
        if [ $ATTEMPTS -gt $LIMIT ]; then
          exit 1 ;
        fi ;
        sleep 2 ; # 1 second intervals between attempts
        $MC_COMMAND ;
        STATUS=$? ;
      done ;
      set -e ; # reset `e` as active
      return 0
    }

    # checkPolicyExists ($policy)
    # Check if the policy exists, by using the exit code of `mc admin policy info`
    checkPolicyExists() {
      POLICY=$1
      CMD=$(${MC} admin policy info myminio $POLICY > /dev/null 2>&1)
      return $?
    }

    # createPolicy($name, $filename)
    createPolicy () {
      NAME=$1
      FILENAME=$2

      # Create the name if it does not exist
      echo "Checking policy: $NAME (in /config/$FILENAME.json)"
      if ! checkPolicyExists $NAME ; then
        echo "Creating policy '$NAME'"
      else
        echo "Policy '$NAME' already exists."
      fi
      ${MC} admin policy create myminio $NAME /config/$FILENAME.json

    }

    # Try connecting to MinIO instance
    scheme=http
    connectToMinio $scheme



  add-svcacct: |-
    #!/bin/sh
    set -e ; # Have script exit in the event of a failed command.
    MC_CONFIG_DIR="/etc/minio/mc/"
    MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}"

    # AccessKey and secretkey credentials file are added to prevent shell execution errors caused by special characters.
    # Special characters for example : ',",<,>,{,}
    MINIO_ACCESSKEY_SECRETKEY_TMP="/tmp/accessKey_and_secretKey_svcacct_tmp"

    # connectToMinio
    # Use a check-sleep-check loop to wait for MinIO service to be available
    connectToMinio() {
      SCHEME=$1
      ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts
      set -e ; # fail if we can't read the keys.
      ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ;
      set +e ; # The connections to minio are allowed to fail.
      echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ;
      MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ;
      $MC_COMMAND ;
      STATUS=$? ;
      until [ $STATUS = 0 ]
      do
        ATTEMPTS=`expr $ATTEMPTS + 1` ;
        echo \"Failed attempts: $ATTEMPTS\" ;
        if [ $ATTEMPTS -gt $LIMIT ]; then
          exit 1 ;
        fi ;
        sleep 2 ; # 2 second intervals between attempts
        $MC_COMMAND ;
        STATUS=$? ;
      done ;
      set -e ; # reset `e` as active
      return 0
    }

    # checkSvcacctExists ()
    # Check if the svcacct exists, by using the exit code of `mc admin user svcacct info`
    checkSvcacctExists() {
      CMD=$(${MC} admin user svcacct info myminio $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) > /dev/null 2>&1)
      return $?
    }

    # createSvcacct ($user)
    createSvcacct () {
      USER=$1
      FILENAME=$2
      #check accessKey_and_secretKey_tmp file
      if [[ ! -f $MINIO_ACCESSKEY_SECRETKEY_TMP ]];then
        echo "credentials file does not exist"
        return 1
      fi
      if [[ $(cat $MINIO_ACCESSKEY_SECRETKEY_TMP|wc -l) -ne 2 ]];then
        echo "credentials file is invalid"
        rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP
        return 1
      fi
      SVCACCT=$(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP)
      # Create the svcacct if it does not exist
      if ! checkSvcacctExists ; then
        echo "Creating svcacct '$SVCACCT'"
        # Check if policy file is define
        if [ -z $FILENAME ]; then
          ${MC} admin user svcacct add --access-key $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --secret-key $(tail -n1 $MINIO_ACCESSKEY_SECRETKEY_TMP) myminio $USER
        else
          ${MC} admin user svcacct add --access-key $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --secret-key $(tail -n1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --policy /config/$FILENAME.json myminio $USER
        fi
      else
        echo "Svcacct '$SVCACCT' already exists."
      fi
      #clean up credentials files.
      rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP
    }

    # Try connecting to MinIO instance
    scheme=http
    connectToMinio $scheme



  custom-command: |-
    #!/bin/sh
    set -e ; # Have script exit in the event of a failed command.
    MC_CONFIG_DIR="/etc/minio/mc/"
    MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}"

    # connectToMinio
    # Use a check-sleep-check loop to wait for MinIO service to be available
    connectToMinio() {
      SCHEME=$1
      ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts
      set -e ; # fail if we can't read the keys.
      ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ;
      set +e ; # The connections to minio are allowed to fail.
      echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ;
      MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ;
      $MC_COMMAND ;
      STATUS=$? ;
      until [ $STATUS = 0 ]
      do
        ATTEMPTS=`expr $ATTEMPTS + 1` ;
        echo \"Failed attempts: $ATTEMPTS\" ;
        if [ $ATTEMPTS -gt $LIMIT ]; then
          exit 1 ;
        fi ;
        sleep 2 ; # 1 second intervals between attempts
        $MC_COMMAND ;
        STATUS=$? ;
      done ;
      set -e ; # reset `e` as active
      return 0
    }

    # runCommand ($@)
    # Run custom mc command
    runCommand() {
      ${MC} "$@"
      return $?
    }

    # Try connecting to MinIO instance
    scheme=http
    connectToMinio $scheme
---
# Source: loki/templates/config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: loki
  namespace: loki
  labels:
    helm.sh/chart: loki-7.0.0
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/version: "3.6.7"
data:
  config.yaml: |

    auth_enabled: true
    bloom_build:
      builder:
        planner_address: loki-backend-headless.loki.svc.cluster.local:9095
      enabled: false
    bloom_gateway:
      client:
        addresses: dnssrvnoa+_grpc._tcp.loki-backend-headless.loki.svc.cluster.local
      enabled: false
    chunk_store_config:
      chunk_cache_config:
        background:
          writeback_buffer: 500000
          writeback_goroutines: 1
          writeback_size_limit: 500MB
        default_validity: 0s
        memcached:
          batch_size: 4
          parallelism: 5
        memcached_client:
          addresses: dnssrvnoa+_memcached-client._tcp.loki-chunks-cache.loki.svc.cluster.local
          consistent_hash: true
          max_idle_conns: 72
          timeout: 2000ms
    common:
      compactor_grpc_address: 'loki-backend.loki.svc.cluster.local:9095'
      path_prefix: /var/loki
      replication_factor: 1
      storage:
        s3:
          access_key_id: root-user
          bucketnames: chunks
          endpoint: loki-minio.loki.svc:9000
          insecure: true
          s3forcepathstyle: true
          secret_access_key: supersecretpassword
    frontend:
      scheduler_address: ""
      tail_proxy_url: ""
    frontend_worker:
      scheduler_address: ""
    index_gateway:
      mode: simple
    limits_config:
      max_cache_freshness_per_query: 10m
      query_timeout: 300s
      reject_old_samples: true
      reject_old_samples_max_age: 168h
      split_queries_by_interval: 15m
      volume_enabled: true
    memberlist:
      join_members:
      - loki-memberlist.loki.svc.cluster.local
    pattern_ingester:
      enabled: false
    query_range:
      align_queries_with_step: true
      cache_results: true
      results_cache:
        cache:
          background:
            writeback_buffer: 500000
            writeback_goroutines: 1
            writeback_size_limit: 500MB
          default_validity: 12h
          memcached_client:
            addresses: dnssrvnoa+_memcached-client._tcp.loki-results-cache.loki.svc.cluster.local
            consistent_hash: true
            timeout: 500ms
            update_interval: 1m
    ruler:
      storage:
        s3:
          bucketnames: ruler
        type: s3
      wal:
        dir: /var/loki/ruler-wal
    runtime_config:
      file: /etc/loki/runtime-config/runtime-config.yaml
    schema_config:
      configs:
      - from: "2024-04-01"
        index:
          period: 24h
          prefix: loki_index_
        object_store: s3
        schema: v13
        store: tsdb
    server:
      grpc_listen_port: 9095
      http_listen_port: 3100
      http_server_read_timeout: 600s
      http_server_write_timeout: 600s
    storage_config:
      bloom_shipper:
        working_directory: /var/loki/data/bloomshipper
      boltdb_shipper:
        index_gateway_client:
          server_address: dns+loki-backend-headless.loki.svc.cluster.local:9095
      hedging:
        at: 250ms
        max_per_second: 20
        up_to: 3
      tsdb_shipper:
        index_gateway_client:
          server_address: dns+loki-backend-headless.loki.svc.cluster.local:9095
      use_thanos_objstore: false
    tracing:
      enabled: false
---
# Source: loki/templates/gateway/configmap-gateway.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: loki-gateway
  namespace: loki
  labels:
    helm.sh/chart: loki-7.0.0
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/version: "3.6.7"
    app.kubernetes.io/component: gateway
data:
  nginx.conf: |
    worker_processes  5;  ## Default: 1
    error_log  /dev/stderr;
    pid        /tmp/nginx.pid;
    worker_rlimit_nofile 8192;

    events {
      worker_connections  4096;  ## Default: 1024
    }

    http {
      client_body_temp_path /tmp/client_temp;
      proxy_temp_path       /tmp/proxy_temp_path;
      fastcgi_temp_path     /tmp/fastcgi_temp;
      uwsgi_temp_path       /tmp/uwsgi_temp;
      scgi_temp_path        /tmp/scgi_temp;

      client_max_body_size  4M;

      proxy_read_timeout    600; ## 10 minutes
      proxy_send_timeout    600;
      proxy_connect_timeout 600;

      proxy_http_version    1.1;

      default_type application/octet-stream;
      log_format   main '$remote_addr - $remote_user [$time_local]  $status '
            '"$request" $body_bytes_sent "$http_referer" '
            '"$http_user_agent" "$http_x_forwarded_for"';
      access_log   /dev/stderr  main;

      sendfile     on;
      tcp_nopush   on;
      resolver kube-dns.kube-system.svc.cluster.local.;

      # if the X-Query-Tags header is empty, set a noop= without a value as empty values are not logged
      map $http_x_query_tags $query_tags {
        ""        "noop=";            # When header is empty, set noop=
        default   $http_x_query_tags; # Otherwise, preserve the original value
      }

      server {
        listen             8080;
        listen             [::]:8080;

        location = / {

          return 200 'OK';
          auth_basic off;
        }

        ########################################################
        # Configure backend targets
        location ^~ /ui {

          proxy_pass       http://loki-read.loki.svc.cluster.local:3100$request_uri;
        }

        # Distributor
        location = /api/prom/push {

          proxy_pass       http://loki-write.loki.svc.cluster.local:3100$request_uri;
        }
        location = /loki/api/v1/push {

          proxy_pass       http://loki-write.loki.svc.cluster.local:3100$request_uri;
        }
        location = /distributor/ring {

          proxy_pass       http://loki-write.loki.svc.cluster.local:3100$request_uri;
        }
        location = /otlp/v1/logs {

          proxy_pass       http://loki-write.loki.svc.cluster.local:3100$request_uri;
        }

        # Ingester
        location = /flush {

          proxy_pass       http://loki-write.loki.svc.cluster.local:3100$request_uri;
        }
        location ^~ /ingester/ {

          proxy_pass       http://loki-write.loki.svc.cluster.local:3100$request_uri;
        }
        location = /ingester {

          internal;        # to suppress 301
        }

        # Ring
        location = /ring {

          proxy_pass       http://loki-write.loki.svc.cluster.local:3100$request_uri;
        }

        # MemberListKV
        location = /memberlist {

          proxy_pass       http://loki-write.loki.svc.cluster.local:3100$request_uri;
        }

        # Ruler
        location = /ruler/ring {

          proxy_pass       http://loki-backend.loki.svc.cluster.local:3100$request_uri;
        }
        location = /api/prom/rules {

          proxy_pass       http://loki-backend.loki.svc.cluster.local:3100$request_uri;
        }
        location ^~ /api/prom/rules/ {

          proxy_pass       http://loki-backend.loki.svc.cluster.local:3100$request_uri;
        }
        location = /loki/api/v1/rules {

          proxy_pass       http://loki-backend.loki.svc.cluster.local:3100$request_uri;
        }
        location ^~ /loki/api/v1/rules/ {

          proxy_pass       http://loki-backend.loki.svc.cluster.local:3100$request_uri;
        }
        location = /prometheus/api/v1/alerts {

          proxy_pass       http://loki-backend.loki.svc.cluster.local:3100$request_uri;
        }
        location = /prometheus/api/v1/rules {

          proxy_pass       http://loki-backend.loki.svc.cluster.local:3100$request_uri;
        }

        # Compactor
        location = /compactor/ring {

          proxy_pass       http://loki-backend.loki.svc.cluster.local:3100$request_uri;
        }
        location = /loki/api/v1/delete {

          proxy_pass       http://loki-backend.loki.svc.cluster.local:3100$request_uri;
        }
        location = /loki/api/v1/cache/generation_numbers {

          proxy_pass       http://loki-backend.loki.svc.cluster.local:3100$request_uri;
        }

        # IndexGateway
        location = /indexgateway/ring {

          proxy_pass       http://loki-backend.loki.svc.cluster.local:3100$request_uri;
        }

        # QueryScheduler
        location = /scheduler/ring {

          proxy_pass       http://loki-backend.loki.svc.cluster.local:3100$request_uri;
        }

        # Config
        location = /config {

          proxy_pass       http://loki-write.loki.svc.cluster.local:3100$request_uri;
        }


        # QueryFrontend, Querier
        location = /api/prom/tail {
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "upgrade";

          proxy_pass       http://loki-read.loki.svc.cluster.local:3100$request_uri;
        }
        location = /loki/api/v1/tail {
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "upgrade";

          proxy_pass       http://loki-read.loki.svc.cluster.local:3100$request_uri;
        }
        location ^~ /api/prom/ {

          proxy_pass       http://loki-read.loki.svc.cluster.local:3100$request_uri;
        }
        location = /api/prom {

          internal;        # to suppress 301
        }
        location ^~ /loki/api/v1/ {
          # pass custom headers set by Grafana as X-Query-Tags which are logged as key/value pairs in metrics.go log messages
          proxy_set_header X-Query-Tags "${query_tags},user=${http_x_grafana_user},dashboard_id=${http_x_dashboard_uid},dashboard_title=${http_x_dashboard_title},panel_id=${http_x_panel_id},panel_title=${http_x_panel_title},source_rule_uid=${http_x_rule_uid},rule_name=${http_x_rule_name},rule_folder=${http_x_rule_folder},rule_version=${http_x_rule_version},rule_source=${http_x_rule_source},rule_type=${http_x_rule_type}";

          proxy_pass       http://loki-read.loki.svc.cluster.local:3100$request_uri;
        }
        location = /loki/api/v1 {

          internal;        # to suppress 301
        }
      }
    }
---
# Source: loki/templates/runtime-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: loki-runtime
  namespace: loki
  labels:
    helm.sh/chart: loki-7.0.0
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/version: "3.6.7"
data:
  runtime-config.yaml: |
    {}
---
# Source: loki/templates/backend/clusterrole.yaml
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  labels:
    helm.sh/chart: loki-7.0.0
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/version: "3.6.7"
  name: loki-clusterrole
rules:
- apiGroups: [""] # "" indicates the core API group
  resources: ["configmaps", "secrets"]
  verbs: ["get", "watch", "list"]
---
# Source: loki/templates/backend/clusterrolebinding.yaml
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: loki-clusterrolebinding
  labels:
    helm.sh/chart: loki-7.0.0
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/version: "3.6.7"
subjects:
  - kind: ServiceAccount
    name: loki
    namespace: loki
roleRef:
  kind: ClusterRole
  name: loki-clusterrole
  apiGroup: rbac.authorization.k8s.io
---
# Source: loki/charts/minio/templates/console-service.yaml
apiVersion: v1
kind: Service
metadata:
  name: loki-minio-console
  labels:
    app: minio
    chart: minio-5.4.0
    release: loki
    heritage: Helm
spec:
  type: ClusterIP
  ports:
    - name: http
      port: 9001
      protocol: TCP
      targetPort: 9001
  selector:
    app: minio
    release: loki
---
# Source: loki/charts/minio/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: loki-minio
  labels:
    app: minio
    chart: minio-5.4.0
    release: loki
    heritage: Helm
    monitoring: "true"
spec:
  type: ClusterIP
  ports:
    - name: http
      port: 9000
      protocol: TCP
      targetPort: 9000
  selector:
    app: minio
    release: loki
---
# Source: loki/charts/minio/templates/statefulset.yaml
apiVersion: v1
kind: Service
metadata:
  name: loki-minio-svc
  labels:
    app: minio
    chart: minio-5.4.0
    release: loki
    heritage: Helm
spec:
  publishNotReadyAddresses: true
  clusterIP: None
  ports:
    - name: http
      port: 9000
      protocol: TCP
      targetPort: 9000
  selector:
    app: minio
    release: loki
---
# Source: loki/templates/backend/query-scheduler-discovery.yaml
apiVersion: v1
kind: Service
metadata:
  name: loki-query-scheduler-discovery
  namespace: loki
  labels:
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/component: backend
    prometheus.io/service-monitor: "false"
  annotations:
spec:
  type: ClusterIP
  clusterIP: None
  publishNotReadyAddresses: true
  ports:
    - name: http-metrics
      port: 3100
      targetPort: http-metrics
      protocol: TCP
    - name: grpc
      port: 9095
      targetPort: grpc
      protocol: TCP
  selector:
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/component: backend
---
# Source: loki/templates/backend/service-backend-headless.yaml
apiVersion: v1
kind: Service
metadata:
  name: loki-backend-headless
  namespace: loki
  labels:
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/component: backend
    variant: headless
    prometheus.io/service-monitor: "false"
  annotations:
spec:
  type: ClusterIP
  clusterIP: None
  ports:
    - name: http-metrics
      port: 3100
      targetPort: http-metrics
      protocol: TCP
    - name: grpc
      port: 9095
      targetPort: grpc
      protocol: TCP
      appProtocol: tcp
  selector:
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/component: backend
---
# Source: loki/templates/backend/service-backend.yaml
apiVersion: v1
kind: Service
metadata:
  name: loki-backend
  namespace: loki
  labels:
    helm.sh/chart: loki-7.0.0
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/version: "3.6.7"
    app.kubernetes.io/component: backend
  annotations:
spec:
  type: ClusterIP
  ports:
    - name: http-metrics
      port: 3100
      targetPort: http-metrics
      protocol: TCP
    - name: grpc
      port: 9095
      targetPort: grpc
      protocol: TCP
  selector:
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/component: backend
---
# Source: loki/templates/chunks-cache/service-chunks-cache-headless.yaml
apiVersion: v1
kind: Service
metadata:
  name: loki-chunks-cache
  labels:
    helm.sh/chart: loki-7.0.0
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/version: "3.6.7"
    app.kubernetes.io/component: "memcached-chunks-cache"
  annotations:
    {}
  namespace: "loki"
spec:
  type: ClusterIP
  clusterIP: None
  ports:
    - name: memcached-client
      port: 11211
      targetPort: client
    - name: http-metrics
      port: 9150
      targetPort: http-metrics

  selector:
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/component: "memcached-chunks-cache"
---
# Source: loki/templates/gateway/service-gateway.yaml
apiVersion: v1
kind: Service
metadata:
  name: loki-gateway
  namespace: loki
  labels:
    helm.sh/chart: loki-7.0.0
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/version: "3.6.7"
    app.kubernetes.io/component: gateway
    prometheus.io/service-monitor: "false"
  annotations:
spec:
  type: ClusterIP
  ports:
    - name: http-metrics
      port: 80
      targetPort: http-metrics
      protocol: TCP
  selector:
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/component: gateway
---
# Source: loki/templates/loki-canary/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: loki-canary
  namespace: loki
  labels:
    helm.sh/chart: loki-7.0.0
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/version: "3.6.7"
    app.kubernetes.io/component: canary
  annotations:
spec:
  type: ClusterIP
  ports:
    - name: http-metrics
      port: 3500
      targetPort: http-metrics
      protocol: TCP
  selector:
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/component: canary
---
# Source: loki/templates/read/service-read-headless.yaml
apiVersion: v1
kind: Service
metadata:
  name: loki-read-headless
  namespace: loki
  labels:
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/component: read
    variant: headless
    prometheus.io/service-monitor: "false"
  annotations:
spec:
  type: ClusterIP
  clusterIP: None
  ports:
    - name: http-metrics
      port: 3100
      targetPort: http-metrics
      protocol: TCP
    - name: grpc
      port: 9095
      targetPort: grpc
      protocol: TCP
      appProtocol: tcp
  selector:
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/component: read
---
# Source: loki/templates/read/service-read.yaml
apiVersion: v1
kind: Service
metadata:
  name: loki-read
  namespace: loki
  labels:
    helm.sh/chart: loki-7.0.0
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/version: "3.6.7"
    app.kubernetes.io/component: read
  annotations:
spec:
  type: ClusterIP
  ports:
    - name: http-metrics
      port: 3100
      targetPort: http-metrics
      protocol: TCP
    - name: grpc
      port: 9095
      targetPort: grpc
      protocol: TCP
  selector:
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/component: read
---
# Source: loki/templates/results-cache/service-results-cache-headless.yaml
apiVersion: v1
kind: Service
metadata:
  name: loki-results-cache
  labels:
    helm.sh/chart: loki-7.0.0
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/version: "3.6.7"
    app.kubernetes.io/component: "memcached-results-cache"
  annotations:
    {}
  namespace: "loki"
spec:
  type: ClusterIP
  clusterIP: None
  ports:
    - name: memcached-client
      port: 11211
      targetPort: client
    - name: http-metrics
      port: 9150
      targetPort: http-metrics

  selector:
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/component: "memcached-results-cache"
---
# Source: loki/templates/service-memberlist.yaml
apiVersion: v1
kind: Service
metadata:
  name: loki-memberlist
  namespace: loki
  labels:
    helm.sh/chart: loki-7.0.0
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/version: "3.6.7"
  annotations:
spec:
  type: ClusterIP
  clusterIP: None
  ports:
    - name: tcp
      port: 7946
      targetPort: http-memberlist
      protocol: TCP
  selector:
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/part-of: memberlist
---
# Source: loki/templates/write/service-write-headless.yaml
apiVersion: v1
kind: Service
metadata:
  name: loki-write-headless
  namespace: loki
  labels:
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/component: write
    variant: headless
    prometheus.io/service-monitor: "false"
  annotations:
spec:
  type: ClusterIP
  clusterIP: None
  ports:
    - name: http-metrics
      port: 3100
      targetPort: http-metrics
      protocol: TCP
    - name: grpc
      port: 9095
      targetPort: grpc
      protocol: TCP
      appProtocol: tcp
  selector:
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/component: write
---
# Source: loki/templates/write/service-write.yaml
apiVersion: v1
kind: Service
metadata:
  name: loki-write
  namespace: loki
  labels:
    helm.sh/chart: loki-7.0.0
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/version: "3.6.7"
    app.kubernetes.io/component: write
  annotations:
spec:
  type: ClusterIP
  ports:
    - name: http-metrics
      port: 3100
      targetPort: http-metrics
      protocol: TCP
    - name: grpc
      port: 9095
      targetPort: grpc
      protocol: TCP
  selector:
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/component: write
---
# Source: loki/templates/loki-canary/daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: loki-canary
  namespace: loki
  labels:
    helm.sh/chart: loki-7.0.0
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/version: "3.6.7"
    app.kubernetes.io/component: canary
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: loki
      app.kubernetes.io/instance: loki
      app.kubernetes.io/component: canary
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      labels:
        app.kubernetes.io/name: loki
        app.kubernetes.io/instance: loki
        app.kubernetes.io/component: canary
    spec:
      serviceAccountName: loki-canary

      securityContext:
        fsGroup: 10001
        fsGroupChangePolicy: OnRootMismatch
        runAsGroup: 10001
        runAsNonRoot: true
        runAsUser: 10001
      containers:
        - name: loki-canary
          image: docker.io/grafana/loki-canary:3.6.7
          imagePullPolicy: IfNotPresent
          args:
            - -addr=loki-gateway.loki.svc.cluster.local.:80
            - -labelname=pod
            - -labelvalue=$(POD_NAME)
            - -user=self-monitoring
            - -tenant-id=self-monitoring
            - -pass=
            - -push=true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
          volumeMounts:
          ports:
            - name: http-metrics
              containerPort: 3500
              protocol: TCP
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name

          readinessProbe:
            httpGet:
              path: /metrics
              port: http-metrics
            initialDelaySeconds: 15
            timeoutSeconds: 1
      volumes:
---
# Source: loki/templates/gateway/deployment-gateway-nginx.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: loki-gateway
  namespace: loki
  labels:
    helm.sh/chart: loki-7.0.0
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/version: "3.6.7"
    app.kubernetes.io/component: gateway
spec:
  replicas: 1
  strategy:
    type: RollingUpdate
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.kubernetes.io/name: loki
      app.kubernetes.io/instance: loki
      app.kubernetes.io/component: gateway
  template:
    metadata:
      annotations:
        checksum/config: 551f2f0b8c3a57d612deebdb6e46ed5e64807c15eebb972a030549402e4e6183
      labels:
        app.kubernetes.io/name: loki
        app.kubernetes.io/instance: loki
        app.kubernetes.io/component: gateway
    spec:
      serviceAccountName: loki
      enableServiceLinks: true

      securityContext:
        fsGroup: 101
        runAsGroup: 101
        runAsNonRoot: true
        runAsUser: 101
      terminationGracePeriodSeconds: 30
      containers:
        - name: nginx
          image: docker.io/nginxinc/nginx-unprivileged:1.29-alpine
          imagePullPolicy: IfNotPresent
          ports:
            - name: http-metrics
              containerPort: 8080
              protocol: TCP
          readinessProbe:
            httpGet:
              path: /
              port: http-metrics
            initialDelaySeconds: 15
            timeoutSeconds: 1
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
          volumeMounts:
            - name: config
              mountPath: /etc/nginx
            - name: tmp
              mountPath: /tmp
            - name: docker-entrypoint-d-override
              mountPath: /docker-entrypoint.d
          resources:
            {}
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                app.kubernetes.io/component: gateway
                app.kubernetes.io/instance: 'loki'
                app.kubernetes.io/name: 'loki'
            topologyKey: kubernetes.io/hostname
      volumes:
        - name: config
          configMap:
            name: loki-gateway
        - name: tmp
          emptyDir: {}
        - name: docker-entrypoint-d-override
          emptyDir: {}
---
# Source: loki/templates/read/deployment-read.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: loki-read
  namespace: loki
  labels:
    app.kubernetes.io/part-of: memberlist
    helm.sh/chart: loki-7.0.0
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/version: "3.6.7"
    app.kubernetes.io/component: read
spec:
  replicas: 1
  strategy:
    rollingUpdate:
      maxSurge: 0
      maxUnavailable: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.kubernetes.io/name: loki
      app.kubernetes.io/instance: loki
      app.kubernetes.io/component: read
  template:
    metadata:
      annotations:
        checksum/config: 4eef0afb58cecadace9be7d3d45e81fe45e43a6eb6c767089b8e22b155889b47
      labels:
        app.kubernetes.io/part-of: memberlist
        app.kubernetes.io/name: loki
        app.kubernetes.io/instance: loki
        app.kubernetes.io/component: read
    spec:
      serviceAccountName: loki
      automountServiceAccountToken: true

      securityContext:
        fsGroup: 10001
        fsGroupChangePolicy: OnRootMismatch
        runAsGroup: 10001
        runAsNonRoot: true
        runAsUser: 10001
      terminationGracePeriodSeconds: 30
      containers:
        - name: loki
          image: docker.io/grafana/loki:3.6.7
          imagePullPolicy: IfNotPresent
          args:
            - -config.file=/etc/loki/config/config.yaml
            - -target=read
            - -legacy-read-mode=false
            - -common.compactor-grpc-address=loki-backend.loki.svc.cluster.local:9095
          ports:
            - name: http-metrics
              containerPort: 3100
              protocol: TCP
            - name: grpc
              containerPort: 9095
              protocol: TCP
            - name: http-memberlist
              containerPort: 7946
              protocol: TCP
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /ready
              port: http-metrics
            initialDelaySeconds: 15
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          volumeMounts:
            - name: config
              mountPath: /etc/loki/config
            - name: runtime-config
              mountPath: /etc/loki/runtime-config
            - name: tmp
              mountPath: /tmp
            - name: data
              mountPath: /var/loki
          resources:
            {}
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                app.kubernetes.io/component: read
                app.kubernetes.io/instance: 'loki'
                app.kubernetes.io/name: 'loki'
            topologyKey: kubernetes.io/hostname
      volumes:
        - name: tmp
          emptyDir: {}
        - name: data
          emptyDir: {}
        - name: config
          configMap:
            name: loki
            items:
              - key: "config.yaml"
                path: "config.yaml"
        - name: runtime-config
          configMap:
            name: loki-runtime
---
# Source: loki/charts/minio/templates/statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: loki-minio
  labels:
    app: minio
    chart: minio-5.4.0
    release: loki
    heritage: Helm
spec:
  updateStrategy:
    type: RollingUpdate
  podManagementPolicy: "Parallel"
  serviceName: loki-minio-svc
  replicas: 1
  selector:
    matchLabels:
      app: minio
      release: loki
  template:
    metadata:
      name: loki-minio
      labels:
        app: minio
        release: loki
      annotations:
        checksum/secrets: a24420cd2e540a1a4450d0c9c9eec9c54974c87203e17500a7e7ab32e762b639
        checksum/config: c6991decd6e21178368a30e50fface4a5e2be73d6f997ade38de9d235be74fb5
    spec:
      securityContext:
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
        runAsGroup: 1000
        runAsUser: 1000
      serviceAccountName: minio-sa
      containers:
        - name: minio
          image: docker.io/pgsty/minio:RELEASE.2026-03-14T12-00-00Z
          imagePullPolicy: IfNotPresent
          command: [
            "/bin/sh",
            "-ce",
            "/usr/bin/docker-entrypoint.sh minio server http://loki-minio-{0...0}.loki-minio-svc.loki.svc/export-{0...1} -S /etc/minio/certs/ --address :9000 --console-address :9001"
          ]
          volumeMounts:
            - name: export-0
              mountPath: /export-0
            - name: export-1
              mountPath: /export-1
          ports:
            - name: http
              containerPort: 9000
            - name: http-console
              containerPort: 9001
          env:
            - name: MINIO_ROOT_USER
              valueFrom:
                secretKeyRef:
                  name: loki-minio
                  key: rootUser
            - name: MINIO_ROOT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: loki-minio
                  key: rootPassword
            - name: MINIO_PROMETHEUS_AUTH_TYPE
              value: "public"
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
          securityContext:
            readOnlyRootFilesystem: false
      volumes:
        - name: minio-user
          secret:
            secretName: loki-minio
  volumeClaimTemplates:
    - apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: export-0
      spec:
        accessModes: [ "ReadWriteOnce" ]
        resources:
          requests:
            storage: 5Gi
    - apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: export-1
      spec:
        accessModes: [ "ReadWriteOnce" ]
        resources:
          requests:
            storage: 5Gi
---
# Source: loki/templates/backend/statefulset-backend.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: loki-backend
  namespace: loki
  labels:
    helm.sh/chart: loki-7.0.0
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/version: "3.6.7"
    app.kubernetes.io/component: backend
    app.kubernetes.io/part-of: memberlist
spec:
  replicas: 1
  podManagementPolicy: Parallel
  updateStrategy:
    rollingUpdate:
      partition: 0
  serviceName: loki-backend-headless
  revisionHistoryLimit: 10

  persistentVolumeClaimRetentionPolicy:
    whenDeleted: Delete
    whenScaled: Delete
  selector:
    matchLabels:
      app.kubernetes.io/name: loki
      app.kubernetes.io/instance: loki
      app.kubernetes.io/component: backend
  template:
    metadata:
      annotations:
        checksum/config: 4eef0afb58cecadace9be7d3d45e81fe45e43a6eb6c767089b8e22b155889b47
        kubectl.kubernetes.io/default-container: "loki"
      labels:
        helm.sh/chart: loki-7.0.0
        app.kubernetes.io/name: loki
        app.kubernetes.io/instance: loki
        app.kubernetes.io/version: "3.6.7"
        app.kubernetes.io/component: backend
        app.kubernetes.io/part-of: memberlist
    spec:
      serviceAccountName: loki
      automountServiceAccountToken: true

      securityContext:
        fsGroup: 10001
        fsGroupChangePolicy: OnRootMismatch
        runAsGroup: 10001
        runAsNonRoot: true
        runAsUser: 10001
      terminationGracePeriodSeconds: 300
      containers:
        - name: loki
          image: docker.io/grafana/loki:3.6.7
          imagePullPolicy: IfNotPresent
          args:
            - -config.file=/etc/loki/config/config.yaml
            - -target=backend
            - -legacy-read-mode=false
          ports:
            - name: http-metrics
              containerPort: 3100
              protocol: TCP
            - name: grpc
              containerPort: 9095
              protocol: TCP
            - name: http-memberlist
              containerPort: 7946
              protocol: TCP
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /ready
              port: http-metrics
            initialDelaySeconds: 15
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          volumeMounts:
            - name: config
              mountPath: /etc/loki/config
            - name: runtime-config
              mountPath: /etc/loki/runtime-config
            - name: tmp
              mountPath: /tmp
            - name: data
              mountPath: /var/loki
            - name: sc-rules-volume
              mountPath: "/rules"
          resources:
            {}
        - name: loki-sc-rules
          image: docker.io/kiwigrid/k8s-sidecar:2.5.0
          imagePullPolicy: IfNotPresent
          env:
            - name: METHOD
              value: WATCH
            - name: LABEL
              value: "loki_rule"
            - name: FOLDER
              value: "/rules"
            - name: RESOURCE
              value: "both"
            - name: WATCH_SERVER_TIMEOUT
              value: "60"
            - name: WATCH_CLIENT_TIMEOUT
              value: "60"
            - name: LOG_LEVEL
              value: "INFO"
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
          volumeMounts:
            - name: tmp
              mountPath: /tmp
            - name: sc-rules-volume
              mountPath: "/rules"
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                app.kubernetes.io/component: backend
                app.kubernetes.io/instance: 'loki'
                app.kubernetes.io/name: 'loki'
            topologyKey: kubernetes.io/hostname
      volumes:
        - name: tmp
          emptyDir: {}
        - name: config
          configMap:
            name: loki
            items:
              - key: "config.yaml"
                path: "config.yaml"
        - name: runtime-config
          configMap:
            name: loki-runtime
        - name: sc-rules-volume
          emptyDir: {}
  volumeClaimTemplates:
    - apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: data
      spec:
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: "10Gi"
---
# Source: loki/templates/chunks-cache/statefulset-chunks-cache.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: loki-chunks-cache
  labels:
    helm.sh/chart: loki-7.0.0
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/version: "3.6.7"
    app.kubernetes.io/component: "memcached-chunks-cache"
    name: "memcached-chunks-cache"
  annotations:
    {}
  namespace: "loki"
spec:
  podManagementPolicy: Parallel
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: loki
      app.kubernetes.io/instance: loki
      app.kubernetes.io/component: "memcached-chunks-cache"
      name: "memcached-chunks-cache"
  updateStrategy:
    type: RollingUpdate
  serviceName: loki-chunks-cache
  template:
    metadata:
      labels:
        app.kubernetes.io/name: loki
        app.kubernetes.io/instance: loki
        app.kubernetes.io/component: "memcached-chunks-cache"
        name: "memcached-chunks-cache"
      annotations:
    spec:
      serviceAccountName: loki
      securityContext:
        fsGroup: 11211
        runAsGroup: 11211
        runAsNonRoot: true
        runAsUser: 11211
      initContainers:
        []
      nodeSelector:
        {}
      affinity:
        {}
      topologySpreadConstraints:
        []
      tolerations:
        []
      terminationGracePeriodSeconds: 60
      containers:
        - name: memcached
          image: memcached:1.6.39-alpine
          imagePullPolicy: IfNotPresent
          resources:
            limits:
              memory: 9830Mi
            requests:
              cpu: 500m
              memory: 9830Mi
          ports:
            - containerPort: 11211
              name: client
          args:
            - -m 8192
            - --extended=modern,track_sizes
            - -I 5m
            - -c 16384
            - -v
            - -u 11211
          env:
          envFrom:
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
          readinessProbe:
            failureThreshold: 6
            initialDelaySeconds: 5
            periodSeconds: 5
            tcpSocket:
              port: client
            timeoutSeconds: 3
          livenessProbe:
            failureThreshold: 3
            initialDelaySeconds: 30
            periodSeconds: 10
            tcpSocket:
              port: client
            timeoutSeconds: 5
        - name: exporter
          image: prom/memcached-exporter:v0.15.4
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 9150
              name: http-metrics
          args:
            - "--memcached.address=localhost:11211"
            - "--web.listen-address=0.0.0.0:9150"
          resources:
            limits: {}
            requests: {}
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /metrics
              port: http-metrics
            initialDelaySeconds: 5
            periodSeconds: 5
            timeoutSeconds: 3
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /metrics
              port: http-metrics
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 5
---
# Source: loki/templates/results-cache/statefulset-results-cache.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: loki-results-cache
  labels:
    helm.sh/chart: loki-7.0.0
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/version: "3.6.7"
    app.kubernetes.io/component: "memcached-results-cache"
    name: "memcached-results-cache"
  annotations:
    {}
  namespace: "loki"
spec:
  podManagementPolicy: Parallel
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: loki
      app.kubernetes.io/instance: loki
      app.kubernetes.io/component: "memcached-results-cache"
      name: "memcached-results-cache"
  updateStrategy:
    type: RollingUpdate
  serviceName: loki-results-cache
  template:
    metadata:
      labels:
        app.kubernetes.io/name: loki
        app.kubernetes.io/instance: loki
        app.kubernetes.io/component: "memcached-results-cache"
        name: "memcached-results-cache"
      annotations:
    spec:
      serviceAccountName: loki
      securityContext:
        fsGroup: 11211
        runAsGroup: 11211
        runAsNonRoot: true
        runAsUser: 11211
      initContainers:
        []
      nodeSelector:
        {}
      affinity:
        {}
      topologySpreadConstraints:
        []
      tolerations:
        []
      terminationGracePeriodSeconds: 60
      containers:
        - name: memcached
          image: memcached:1.6.39-alpine
          imagePullPolicy: IfNotPresent
          resources:
            limits:
              memory: 1229Mi
            requests:
              cpu: 500m
              memory: 1229Mi
          ports:
            - containerPort: 11211
              name: client
          args:
            - -m 1024
            - --extended=modern,track_sizes
            - -I 5m
            - -c 16384
            - -v
            - -u 11211
          env:
          envFrom:
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
          readinessProbe:
            failureThreshold: 6
            initialDelaySeconds: 5
            periodSeconds: 5
            tcpSocket:
              port: client
            timeoutSeconds: 3
          livenessProbe:
            failureThreshold: 3
            initialDelaySeconds: 30
            periodSeconds: 10
            tcpSocket:
              port: client
            timeoutSeconds: 5
        - name: exporter
          image: prom/memcached-exporter:v0.15.4
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 9150
              name: http-metrics
          args:
            - "--memcached.address=localhost:11211"
            - "--web.listen-address=0.0.0.0:9150"
          resources:
            limits: {}
            requests: {}
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /metrics
              port: http-metrics
            initialDelaySeconds: 5
            periodSeconds: 5
            timeoutSeconds: 3
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /metrics
              port: http-metrics
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 5
---
# Source: loki/templates/write/statefulset-write.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: loki-write
  namespace: loki
  labels:
    helm.sh/chart: loki-7.0.0
    app.kubernetes.io/name: loki
    app.kubernetes.io/instance: loki
    app.kubernetes.io/version: "3.6.7"
    app.kubernetes.io/component: write
    app.kubernetes.io/part-of: memberlist
spec:
  replicas: 1
  podManagementPolicy: Parallel
  updateStrategy:
    rollingUpdate:
      partition: 0
  serviceName: loki-write-headless
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.kubernetes.io/name: loki
      app.kubernetes.io/instance: loki
      app.kubernetes.io/component: write
  template:
    metadata:
      annotations:
        checksum/config: 4eef0afb58cecadace9be7d3d45e81fe45e43a6eb6c767089b8e22b155889b47
      labels:
        helm.sh/chart: loki-7.0.0
        app.kubernetes.io/name: loki
        app.kubernetes.io/instance: loki
        app.kubernetes.io/version: "3.6.7"
        app.kubernetes.io/component: write
        app.kubernetes.io/part-of: memberlist
    spec:
      serviceAccountName: loki
      automountServiceAccountToken: true
      enableServiceLinks: true

      securityContext:
        fsGroup: 10001
        fsGroupChangePolicy: OnRootMismatch
        runAsGroup: 10001
        runAsNonRoot: true
        runAsUser: 10001
      terminationGracePeriodSeconds: 300
      containers:
        - name: loki
          image: docker.io/grafana/loki:3.6.7
          imagePullPolicy: IfNotPresent
          args:
            - -config.file=/etc/loki/config/config.yaml
            - -target=write
          ports:
            - name: http-metrics
              containerPort: 3100
              protocol: TCP
            - name: grpc
              containerPort: 9095
              protocol: TCP
            - name: http-memberlist
              containerPort: 7946
              protocol: TCP
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /ready
              port: http-metrics
            initialDelaySeconds: 15
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          volumeMounts:
            - name: config
              mountPath: /etc/loki/config
            - name: runtime-config
              mountPath: /etc/loki/runtime-config
            - name: data
              mountPath: /var/loki
          resources:
            {}
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                app.kubernetes.io/component: write
                app.kubernetes.io/instance: 'loki'
                app.kubernetes.io/name: 'loki'
            topologyKey: kubernetes.io/hostname
      volumes:
        - name: config
          configMap:
            name: loki
            items:
              - key: "config.yaml"
                path: "config.yaml"
        - name: runtime-config
          configMap:
            name: loki-runtime
  volumeClaimTemplates:
    - apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: data
      spec:
        accessModes:
          - ReadWriteOnce
        resources:
          requests:
            storage: "10Gi"