community-loki

# $schema: ./values.schema.json

# helm-schema-args: --schema-root.additional-properties=false

# -- Overrides the version used to determine compatibility of resources with the target Kubernetes cluster.

# This is useful when using `helm template`, because then helm will use the client version of kubectl as the Kubernetes version,

# which may or may not match your cluster's server version. Example: 'v1.24.4'. Set to null to use the version that helm

# devises.

kubeVersionOverride: ""

# -- Not used by this chart. Lets a parent chart use `<alias>.enabled` as the condition of its Loki dependency

# without failing schema validation.

enabled: true

global:

# @schema type:[string, null]

# -- Overrides the Docker registry globally for all images (standard format).

# This has the highest precedence and overrides every component-level image.registry value.

imageRegistry: null

image:

# @schema type:[string, null]

# -- Overrides the Docker registry globally for all images (deprecated, use global.imageRegistry).

# This has lower precedence than global.imageRegistry, but higher precedence than component-level image.registry values.

registry: null

# @schema type:[string, null]

# -- Overrides the priorityClassName for all pods

priorityClassName: null

# -- configures cluster domain ("cluster.local" by default)

clusterDomain: "cluster.local"

# -- configures DNS service name

dnsService: "kube-dns"

# -- configures DNS service namespace

dnsNamespace: "kube-system"

# -- Common additional CLI arguments for all jobs (that is, -log.level debug, -config.expand-env=true or -log-config-reverse-order)

# (deprecated, use defaults.extraArgs)

# scope: backend, bloom-builder, bloom-gateway, bloom-planner, compactor, distributor, index-gateway, ingester, overrides-exporter, pattern-ingester, querier, query-frontend, query-scheduler, read, ruler, write.

extraArgs: []

# -- Common environment variables to add to all pods directly managed by this chart.

# (deprecated, use defaults.extraEnv)

# scope: backend, bloom-builder, bloom-gateway, bloom-planner, compactor, distributor, index-gateway, ingester, overrides-exporter, pattern-ingester, querier, query-frontend, query-scheduler, read, ruler, write.

extraEnv: []

# -- Common source of environment injections to add to all pods directly managed by this chart.

# (deprecated, use defaults.extraEnvFrom)

# scope: backend, bloom-builder, bloom-gateway, bloom-planner, compactor, distributor, index-gateway, ingester, overrides-exporter, pattern-ingester, querier, query-frontend, query-scheduler, read, ruler, write.

# For example to inject values from a Secret, use:

# extraEnvFrom:

# - secretRef:

# name: mysecret

extraEnvFrom: []

# -- Common volumes to add to all pods directly managed by this chart.

# (deprecated, use defaults.extraVolumes)

# scope: backend, bloom-builder, bloom-gateway, bloom-planner, compactor, distributor, index-gateway, ingester, overrides-exporter, pattern-ingester, querier, query-frontend, query-scheduler, read, ruler, write.

extraVolumes: []

# -- Common mount points to add to all pods directly managed by this chart.

# (deprecated, use defaults.extraVolumeMounts)

# scope: backend, bloom-builder, bloom-gateway, bloom-planner, compactor, distributor, index-gateway, ingester, overrides-exporter, pattern-ingester, querier, query-frontend, query-scheduler, read, ruler, write.

extraVolumeMounts: []

# -- Overrides the chart's name

nameOverride: ""

# -- Overrides the chart's computed fullname

fullnameOverride: ""

# -- Overrides the chart's namespace

namespaceOverride: ""

# -- Image pull secrets for Docker images

imagePullSecrets: []

# -- Deployment mode lets you specify how to deploy Loki.

# There are 3 options:

# - Monolithic (deprecated: SingleBinary): Loki is deployed as a single binary, useful for small installs typically without HA, up to a few tens of GB/day.

# - SimpleScalable (deprecated, removed in Loki 4): Loki is deployed as 3 targets: read, write, and backend. Useful for medium installs easier to manage than distributed, up to a about 1TB/day.

# - Distributed: Loki is deployed as individual microservices. The most complicated but most capable, useful for large installs, typically over 1TB/day.

# There are also 2 additional modes used for migrating between deployment modes:

# - Monolithic<->SimpleScalable (deprecated: SingleBinary<->SimpleScalable): Migrate from SingleBinary to SimpleScalable (or vice versa)

# - SimpleScalable<->Distributed: Migrate from SimpleScalable to Distributed (or vice versa)

# Note: SimpleScalable and Distributed REQUIRE the use of object storage.

# Ref: https://grafana.com/docs/loki/latest/get-started/deployment-modes/

deploymentMode: Monolithic

# @schema additionalProperties:{"type":"string"}

# -- Labels to be added to resources

commonLabels: {}

######################################################################################################################

#

# Defaults applied to loki components only. Not applied to loki-canary, memcache, gateway/nginx or other components.

#

######################################################################################################################

defaults:

goSettings:

# -- Fraction of the container memory limit used to compute GOMEMLIMIT (e.g. 0.85 = 85%).

# Set to 0 to disable automatic GOMEMLIMIT injection.

goMemLimitFactor: 0.85

# -- Value to set for GOGC alongside GOMEMLIMIT. Lowering below the default of 100 reduces

# heap growth between GC cycles, working in tandem with GOMEMLIMIT to smooth memory usage.

# Set to 0 to disable automatic GOGC injection.

gogc: 80

# @schema additionalProperties:true

# -- DNSConfig for loki pods

dnsConfig: {}

# -- hostAliases for loki pods

hostAliases: []

# @schema type:[boolean, null]

# - ip: 1.2.3.4

# hostnames:

# - domain.tld

# -- Use the host's user namespace for loki pods

hostUsers: null

# @schema type:[string, null]

# -- The name of the PriorityClass for loki pods

priorityClassName: ""

# @schema skipProperties:true;additionalProperties:true

# -- The SecurityContext for loki pods

podSecurityContext: {}

# -- Grace period to allow the gateway to shutdown before it is killed

terminationGracePeriodSeconds: 30

# @schema type:[string, null]

# -- Command to execute instead of defined in Docker image

command: null

# -- Common additional CLI arguments for loki pods

extraArgs: []

# -- Common environment variables to add to all pods directly managed by this chart.

extraEnv: []

# -- Common source of environment injections to add to all pods directly managed by this chart.

# For example to inject values from a Secret, use:

# extraEnvFrom:

# - secretRef:

# name: mysecret

extraEnvFrom: []

# -- Common volumes to add to all pods directly managed by this chart.

extraVolumes: []

# -- Common mount points to add to all pods directly managed by this chart.

extraVolumeMounts: []

# @schema skipProperties:true;additionalProperties:true

# -- The SecurityContext for Loki containers for loki pods

containerSecurityContext: {}

# @schema skipProperties:true;additionalProperties:true

# -- Configures the liveness probe for loki pods

livenessProbe: {}

# @schema skipProperties:true;additionalProperties:true

# -- Configures the readiness probe for loki pods

readinessProbe: {}

# @schema skipProperties:true;additionalProperties:true

# -- Configures the startup probe for loki pods

startupProbe: {}

# @schema additionalProperties:true

# -- Node selector for loki pods

nodeSelector: {}

# -- Tolerations for loki pods

tolerations: []

# -- Set this toggle to false to opt out of automounting API credentials for the service account

automountServiceAccountToken: true

# @schema additionalProperties:{"type":"string"}

# -- Annotations for loki Deployments/StatefulSets

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Additional labels for loki Deployments/StatefulSets

labels: {}

# @schema additionalProperties:{"type":"string"}

# -- Annotations for loki pods

podAnnotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Additional labels for loki pod

podLabels: {}

# -- Should enableServiceLinks be enabled. Default to enable

enableServiceLinks: true

service:

# @schema additionalProperties:{"type":"string"}

# -- Common annotations for all non-headless services

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Common labels for all non-headless services

labels: {}

# -- trafficDistribution for services

# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-distribution

trafficDistribution: ""

# -- ipFamilyPolicy for all services

# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services

ipFamilyPolicy: ""

# -- ipFamilies for all services

# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services

ipFamilies: []

# -- publishNotReadyAddresses for all services. Set to false so a pod's Service endpoint is

# withdrawn as soon as it becomes unready, instead of staying routable for the full termination

# window. Overridable per component via <component>.service.publishNotReadyAddresses.

publishNotReadyAddresses: true

headlessService:

# @schema additionalProperties:{"type":"string"}

# -- Common annotations for all headless services

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Common labels for all headless services

labels: {}

# -- KEDA autoscaling shared configuration for all components that support KEDA

kedaAutoscaling:

# -- Prometheus server address for KEDA triggers

prometheusAddress: ""

# -- Whether to skip SSL verification when connecting to Prometheus

unsafeSsl: false

# -- Whether to ignore null values from Prometheus queries

ignoreNullValues: true

# -- Custom HTTP headers to include in Prometheus requests. Useful for multi-tenant setups (e.g. "X-Scope-OrgID=tenant1")

customHeaders: ""

# -- Interval (seconds) to poll each trigger. Overridable per component.

pollingInterval: 30

# -- Period (seconds) to wait after the last trigger reported active before scaling back to 0. Overridable per component.

cooldownPeriod: 300

# -- KEDA trigger authentication settings. Ref: https://keda.sh/docs/latest/concepts/authentication/

authentication:

# -- Enable TriggerAuthentication for KEDA triggers

enabled: false

# -- Authentication modes for the trigger (e.g. "bearer", "basic")

authModes: ""

# -- Secret key references for TriggerAuthentication

secretTargetRef: []

statefulSetRecreateJob:

# -- When a component sets `*.statefulSetRecreateJob.enabled`, the pre-upgrade Job can patch PVC storage requests and recreate the StatefulSet for podManagementPolicy, serviceName, or volumeClaimTemplates count/name/size changes. It does not migrate storageClass, accessModes, selectors, or VCT labels. See the chart README section StatefulSet immutability.

patchPVC: true

image:

registry: cgr.dev

repository: chainguard-private/kubectl

# -- Overrides the image tag. Defaults to .Capabilities.KubeVersion.Version

tag: 1.36.6-r0@sha256:ee39cb869edaeb20fe734b23733fb4ddd3f5d482a26c683554b1b4237f986663

######################################################################################################################

#

# Base Loki Configs including kubernetes configurations and configurations for Loki itself,

# see below for more specifics on Loki's configuration.

#

######################################################################################################################

# -- Configuration for running Loki

# @default -- See values.yaml

loki:

# @schema skipProperties:true;additionalProperties:true

# Configures the liveness probe for all of the Loki pods

livenessProbe:

httpGet:

path: /loki/api/v1/status/buildinfo

port: http-metrics

periodSeconds: 30

successThreshold: 1

failureThreshold: 10

timeoutSeconds: 1

# @schema skipProperties:true;additionalProperties:true

# Configures the readiness probe for all of the Loki pods

readinessProbe:

httpGet:

path: /ready

port: http-metrics

periodSeconds: 10

initialDelaySeconds: 15

successThreshold: 1

failureThreshold: 3

timeoutSeconds: 1

# @schema skipProperties:true;additionalProperties:true

# Configures the startup probe for all of the Loki pods

startupProbe: {}

image:

# -- The Docker registry

registry: cgr.dev

# -- Docker image repository

repository: chainguard-private/loki

# @schema type:[string, null]

# -- Overrides the image tag whose default is the chart's appVersion

tag: 3.7.9-r3

# @schema type:[string, null]

# -- Overrides the image tag with an image digest

digest: sha256:c939937ec7304c156c26ee9626ada59160ba089b7f5130196ae71cee07319697

# -- Docker image pull policy

pullPolicy: IfNotPresent

# @schema additionalProperties:{"type":"string"}

# -- Common annotations for all deployments/StatefulSets

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Common annotations for all pods

podAnnotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Common labels for all pods

podLabels: {}

# @schema additionalProperties:{"type":"string"}

# -- Common annotations for all non-headless services

serviceAnnotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Common labels for all non-headless services

serviceLabels: {}

# -- The number of old ReplicaSets to retain to allow rollback

revisionHistoryLimit: 10

# @schema skipProperties:true;additionalProperties:true

# -- The SecurityContext for Loki pods

podSecurityContext:

fsGroup: 10001

fsGroupChangePolicy: OnRootMismatch

runAsGroup: 10001

runAsNonRoot: true

runAsUser: 10001

seccompProfile:

type: RuntimeDefault

# @schema skipProperties:true;additionalProperties:true

# -- The SecurityContext for Loki containers

containerSecurityContext:

readOnlyRootFilesystem: true

capabilities:

drop:

- ALL

allowPrivilegeEscalation: false

seccompProfile:

type: RuntimeDefault

# -- Should enableServiceLinks be enabled. Default to enable

enableServiceLinks: true

# @schema additionalProperties:true

# -- DNS config for Loki pods

dnsConfig: {}

######################################################################################################################

#

# Loki Configuration

#

# There are several ways to pass configuration to Loki, listing them here in order of our preference for how

# you should use this chart.

# 1. Use the templated value of loki.config below and the corresponding override sections which follow.

# This allows us to set a lot of important Loki configurations and defaults and also allows us to maintain them

# over time as Loki changes and evolves.

# 2. Use the loki.structuredConfig section.

# This will completely override the templated value of loki.config, so you MUST provide the entire Loki config

# including any configuration that we set in loki.config unless you explicitly are trying to change one of those

# values and are not able to do so with the templated sections.

# If you choose this approach the burden is on you to maintain any changes we make to the templated config.

# 3. Use an existing secret or configmap to provide the configuration.

# This option is mostly provided for folks who have external processes which provide or modify the configuration.

# When using this option you can specify a different name for loki.generatedConfigObjectName and configObjectName

# if you have a process which takes the generated config and modifies it, or you can stop the chart from generating

# a config entirely by setting loki.generatedConfigObjectName to

#

######################################################################################################################

# -- Defines what kind of object stores the configuration, a ConfigMap or a Secret.

# In order to move sensitive information (such as credentials) from the ConfigMap/Secret to a more secure location (e.g. vault), it is possible to use [environment variables in the configuration](https://grafana.com/docs/loki/latest/configuration/#use-environment-variables-in-the-configuration).

# Such environment variables can be then stored in a separate Secret and injected via the global.extraEnvFrom value. For details about environment injection from a Secret please see [Secrets](https://kubernetes.io/docs/concepts/configuration/secret/#use-case-as-container-environment-variables).

configStorageType: ConfigMap

# -- The name of the object which Loki will mount as a volume containing the config.

# If the configStorageType is Secret, this will be the name of the Secret, if it is ConfigMap, this will be the name of the ConfigMap.

# The value will be passed through tpl.

configObjectName: '{{ include "loki.name" . }}'

# -- The name of the Secret or ConfigMap that will be created by this chart.

# If empty, no configmap or secret will be created.

# The value will be passed through tpl.

generatedConfigObjectName: '{{ include "loki.name" . }}'

# -- Config file contents for Loki

# @default -- See values.yaml

config: |

auth_enabled: {{ .Values.loki.auth_enabled }}

{{- with .Values.loki.server }}

server:

{{- toYaml . | nindent 2}}

{{- end}}

{{- with .Values.loki.pattern_ingester }}

pattern_ingester:

{{- tpl (. | toYaml) $ | nindent 4 }}

{{- end }}

memberlist:

{{- if .Values.loki.memberlistConfig }}

{{- toYaml .Values.loki.memberlistConfig | nindent 2 }}

{{- else }}

{{- if .Values.loki.extraMemberlistConfig}}

{{- toYaml .Values.loki.extraMemberlistConfig | nindent 2}}

{{- end }}

join_members:

- {{ include "loki.memberlist" . }}.{{ include "loki.namespace" $ }}.svc.{{ .Values.global.clusterDomain }}

{{- with .Values.migrate.fromDistributed }}

{{- if .enabled }}

- {{ .memberlistService }}

{{- end }}

{{- end }}

{{- end }}

{{- with .Values.loki.ingester }}

ingester:

{{- tpl (. | toYaml) $ | nindent 4 }}

{{- end }}

{{- with .Values.loki.ingester_client }}

ingester_client:

{{- tpl (. | toYaml) $ | nindent 4 }}

{{- end }}

{{- with .Values.loki.block_builder }}

block_builder:

{{- tpl (. | toYaml) $ | nindent 4 }}

{{- end }}

{{- if .Values.loki.commonConfig}}

common:

{{- toYaml .Values.loki.commonConfig | nindent 2}}

storage:

{{- include "loki.commonStorageConfig" . | nindent 4}}

{{- end}}

{{- with .Values.loki.limits_config }}

limits_config:

{{- tpl (. | toYaml) $ | nindent 4 }}

{{- end }}

runtime_config:

file: /etc/loki/runtime-config/runtime-config.yaml

{{- if .Values.chunksCache.enabled }}

{{- with .Values.chunksCache }}

chunk_store_config:

chunk_cache_config:

default_validity: {{ .defaultValidity }}

background:

writeback_goroutines: {{ .writebackParallelism }}

writeback_buffer: {{ .writebackBuffer }}

writeback_size_limit: {{ .writebackSizeLimit }}

memcached:

batch_size: {{ .batchSize }}

parallelism: {{ .parallelism }}

memcached_client:

addresses: {{ .addresses }}

consistent_hash: true

timeout: {{ .timeout }}

max_idle_conns: 72

{{- end }}

{{- with .Values.chunksCache.l2 }}

{{- if .enabled }}

l2_chunk_cache_handoff: {{ .l2ChunkCacheHandoff }}

chunk_cache_config_l2:

default_validity: {{ .defaultValidity }}

background:

writeback_goroutines: {{ .writebackParallelism }}

writeback_buffer: {{ .writebackBuffer }}

writeback_size_limit: {{ .writebackSizeLimit }}

memcached:

batch_size: {{ .batchSize }}

parallelism: {{ .parallelism }}

memcached_client:

addresses: {{ .addresses }}

consistent_hash: true

timeout: {{ .timeout }}

max_idle_conns: 72

{{- end }}

{{- end }}

{{- end }}

{{- if .Values.loki.schemaConfig }}

schema_config:

{{- toYaml .Values.loki.schemaConfig | nindent 2}}

{{- end }}

{{- if .Values.loki.useTestSchema }}

schema_config:

{{- toYaml .Values.loki.testSchemaConfig | nindent 2}}

{{- end }}

{{- if .Values.ruler.enabled }}

{{ include "loki.rulerConfig" . }}

{{- end }}

{{- if and .Values.loki.storage.use_thanos_objstore .Values.ruler.enabled}}

ruler_storage:

{{- include "loki.rulerThanosStorageConfig" . | nindent 2 }}

{{- end }}

{{- if or .Values.tableManager.retention_deletes_enabled .Values.tableManager.retention_period }}

table_manager:

retention_deletes_enabled: {{ .Values.tableManager.retention_deletes_enabled }}

retention_period: {{ .Values.tableManager.retention_period }}

{{- end }}

query_range:

align_queries_with_step: true

{{- with .Values.loki.query_range }}

{{- tpl (. | toYaml) $ | nindent 2 }}

{{- end }}

{{- if .Values.resultsCache.enabled }}

{{- with .Values.resultsCache }}

cache_results: true

results_cache:

cache:

default_validity: {{ .defaultValidity }}

background:

writeback_goroutines: {{ .writebackParallelism }}

writeback_buffer: {{ .writebackBuffer }}

writeback_size_limit: {{ .writebackSizeLimit }}

memcached_client:

addresses: {{ .addresses }}

consistent_hash: true

timeout: {{ .timeout }}

update_interval: 1m

{{- end }}

{{- end }}

{{- with .Values.loki.storage_config }}

storage_config:

{{- if not (hasKey $.Values.loki.storage_config "use_thanos_objstore") }}

use_thanos_objstore: {{ $.Values.loki.storage.use_thanos_objstore }}

{{- end }}

{{- tpl (. | toYaml) $ | nindent 4 }}

{{- end }}

{{- with .Values.loki.query_scheduler }}

query_scheduler:

{{- tpl (. | toYaml) $ | nindent 4 }}

{{- end }}

{{- with .Values.loki.compactor }}

compactor:

{{- tpl (. | toYaml) $ | nindent 4 }}

{{- end }}

{{- with .Values.loki.compactor_grpc_client }}

compactor_grpc_client:

{{- tpl (. | toYaml) $ | nindent 4 }}

{{- end }}

{{- with .Values.loki.analytics }}

analytics:

{{- tpl (. | toYaml) $ | nindent 4 }}

{{- end }}

{{- if .Values.loki.ui.enabled }}

ui:

enabled: true

{{- end }}

{{- with .Values.loki.querier }}

querier:

{{- tpl (. | toYaml) $ | nindent 4 }}

{{- end }}

{{- with .Values.loki.index_gateway }}

index_gateway:

{{- tpl (. | toYaml) $ | nindent 4 }}

{{- end }}

{{- with .Values.loki.frontend }}

frontend:

{{- tpl (. | toYaml) $ | nindent 4 }}

{{- end }}

{{- with .Values.loki.frontend_worker }}

frontend_worker:

{{- tpl (. | toYaml) $ | nindent 4 }}

{{- end }}

{{- with .Values.loki.distributor }}

distributor:

{{- tpl (. | toYaml) $ | nindent 4 }}

{{- end }}

tracing:

enabled: {{ .Values.loki.tracing.enabled }}

{{- with .Values.loki.bloom_build }}

bloom_build:

{{- tpl (. | toYaml) $ | nindent 4 }}

{{- end }}

{{- with .Values.loki.bloom_gateway }}

bloom_gateway:

{{- tpl (. | toYaml) $ | nindent 4 }}

{{- end }}

{{- with .Values.loki.operational_config }}

operational_config:

{{- tpl (. | toYaml) $ | nindent 4 }}

{{- end }}

# Should authentication be enabled

auth_enabled: true

# @schema skipProperties:true;additionalProperties:true

# -- memberlist configuration (overrides embedded default)

memberlistConfig: {}

# @schema skipProperties:true;additionalProperties:true

# -- Extra memberlist configuration

extraMemberlistConfig:

abort_if_cluster_join_fails: true

advertise_port: 7946

bind_port: 7946

max_join_backoff: 1m

max_join_retries: 10

min_join_backoff: 1s

rejoin_interval: 90s

# @schema item:object

# @schema itemProperties:{"name":{"type":"string","minLength":1},"password":{"type":["string","null"]},"passwordHash":{"type":["string","null"]},"basicAuthUsername":{"type":["string","null"]},"clientCertificateCN":{"type":"array","items":{"type":"string","minLength":1},"uniqueItems":true},"jwtSubClaim":{"type":"array","items":{"type":"string","minLength":1},"uniqueItems":true}}

# @schema allOf:[{"type":"array","items":{"required":["name"]}}]

# -- Tenants used by the gateway for authentication and `X-Scope-OrgID` mapping. Only `name`, `password`, and `passwordHash` are supported by both gateway implementations; `basicAuthUsername`, `clientCertificateCN`, and `jwtSubClaim` are supported only when `gateway.type` is `envoy`. `name` is the value assigned to `X-Scope-OrgID` and the default Basic Auth username. It can be a single Loki tenant ID or, when multi-tenant queries are enabled, a pipe-separated list of tenant IDs. `jwtSubClaim` entries are rendered with `tpl`, allowing values such as `system:serviceaccount:{{ .Release.Namespace }}:loki-canary`. Envoy Basic Auth accepts a `{SHA}` `passwordHash`, or derives one from `password`; JWT-only Envoy tenants do not need either.<br><br>

# Example:

# <pre>

# tenants:<br>

# - name: "test-user-1"<br>

# password: "test-password-1"<br>

# - name: "test-user-2"<br>

# passwordHash: "$2y$10$7O40CaY1yz7fu9O24k2/u.ct/wELYHRBsn25v/7AyuQ8E8hrLqpva" # NGINX: generated using `htpasswd -nbBC10 test-user-2 test-password-2`

# # Map requests authenticated as the dedicated user "grafana" to all three tenants by<br>

# # setting X-Scope-OrgID to "cluster1|cluster2|cluster3".<br>

# - name: "cluster1|cluster2|cluster3"<br>

# basicAuthUsername: "grafana"<br>

# clientCertificateCN:<br>

# - "grafana-client"<br>

# jwtSubClaim:<br>

# - "system:serviceaccount:grafana:grafana"

# </pre>

tenants: []

# @schema skipProperties:true;additionalProperties:true

# -- Check https://grafana.com/docs/loki/latest/configuration/#server for more info on the server configuration.

server:

graceful_shutdown_timeout: 5s

grpc_listen_port: 9095

grpc_server_min_time_between_pings: '10s'

grpc_server_ping_without_stream_allowed: true

grpc_server_max_concurrent_streams: 1000

grpc_server_max_recv_msg_size: 104857600

grpc_server_max_send_msg_size: 104857600

http_listen_port: 3100

http_server_idle_timeout: 30s

http_server_read_timeout: 10m0s

http_server_write_timeout: 10m0s

log_level: info

service:

# -- trafficDistribution for services

# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-distribution

trafficDistribution: ""

# -- ipFamilyPolicy for all services

# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services

ipFamilyPolicy: ""

# -- ipFamilies for all services

# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services

ipFamilies: []

headlessService:

# @schema additionalProperties:{"type":"string"}

# -- Additional annotations for headless Loki services

annotations: {}

# @schema skipProperties:true;additionalProperties:true

# -- Limits config

limits_config:

reject_old_samples: true

reject_old_samples_max_age: 168h

max_cache_freshness_per_query: 10m

split_queries_by_interval: 15m

query_timeout: 300s

volume_enabled: true

# -- Provides a reloadable runtime configuration file for some specific configuration

runtimeConfig: {}

# @schema skipProperties:true;additionalProperties:true

# -- Check https://grafana.com/docs/loki/latest/configuration/#common_config for more info on how to provide a common configuration

commonConfig:

path_prefix: /var/loki

replication_factor: 3

# -- The gRPC address of the compactor. The use of compactor_grpc_address is preferred over compactor_address.

# If a customized compactor_address is set, compactor_grpc_address should be set to an empty string.

compactor_grpc_address: '{{ include "loki.compactorAddress" . }}'

# @schema skipProperties:true;additionalProperties:true

# -- Storage config. Providing this will automatically populate all necessary storage configs in the templated config.

# -- In case of using thanos storage, enable use_thanos_objstore and the configuration should be done inside the object_store section.

storage:

# Loki requires a bucket for chunks and the ruler.

# Please provide these values if you are using object storage.

# bucketNames:

# chunks: FIXME

# ruler: FIXME

type: s3

s3:

# @schema type:[string, null]

s3: null

# @schema type:[string, null]

endpoint: null

# @schema type:[string, null]

region: null

# @schema type:[string, null]

secretAccessKey: null

# @schema type:[string, null]

accessKeyId: null

# @schema type:[string, null]

signatureVersion: null

s3ForcePathStyle: false

insecure: false

http_config: {}

# -- Check https://grafana.com/docs/loki/latest/configure/#s3_storage_config for more info on how to provide a backoff_config

backoff_config: {}

disable_dualstack: false

gcs:

chunkBufferSize: 0

requestTimeout: "0s"

enableHttp2: true

azure:

# @schema type:[string, null]

accountName: null

# @schema type:[string, null]

accountKey: null

# @schema type:[string, null]

connectionString: null

useManagedIdentity: false

useFederatedToken: false

# @schema type:[string, null]

userAssignedId: null

# @schema type:[string, null]

requestTimeout: null

# @schema type:[string, null]

endpointSuffix: null

# @schema type:[string, null]

chunkDelimiter: null

swift:

# @schema type:[string, null]

auth_version: null

# @schema type:[string, null]

auth_url: null

# @schema type:[string, null]

internal: null

# @schema type:[string, null]

username: null

# @schema type:[string, null]

user_domain_name: null

# @schema type:[string, null]

user_domain_id: null

# @schema type:[string, null]

user_id: null

# @schema type:[string, null]

password: null

# @schema type:[string, null]

domain_id: null

# @schema type:[string, null]

domain_name: null

# @schema type:[string, null]

project_id: null

# @schema type:[string, null]

project_name: null

# @schema type:[string, null]

project_domain_id: null

# @schema type:[string, null]

project_domain_name: null

# @schema type:[string, null]

region_name: null

# @schema type:[string, null]

container_name: null

# @schema type:[string, null]

max_retries: null

# @schema type:[string, null]

connect_timeout: null

# @schema type:[string, null]

request_timeout: null

filesystem:

chunks_directory: /var/loki/chunks

rules_directory: /var/loki/rules

# Loki now supports using thanos storage clients for connecting to object storage backend.

# This will become the default way to configure storage in a future releases.

use_thanos_objstore: false

# @schema skipProperties:true;additionalProperties:true

object_store:

# Type of object store. Valid options are: s3, gcs, azure

type: s3

# @schema type:[string, null]

# Optional prefix for storage keys

storage_prefix: null

# S3 configuration (when type is "s3")

s3:

# @schema type:[string, null]

# S3 endpoint URL

endpoint: null

# @schema type:[string, null]

# Optional region

region: null

# @schema type:[string, null]

# Optional access key

access_key_id: null

# @schema type:[string, null]

# Optional secret key

secret_access_key: null

# Optional. Enable if using self-signed TLS

insecure: false

# Optional server-side encryption configuration

sse: {}

# Optional HTTP client configuration

http: {}

# GCS configuration (when type is "gcs")

gcs:

# @schema type:[string, null]

# Name of the bucket

bucket_name: null

# @schema type:[string, null]

# Optional service account JSON

service_account: null

# Azure configuration (when type is "azure")

azure:

# @schema type:[string, null]

# Storage account name

account_name: null

# @schema type:[string, null]

# Optional storage account key

account_key: null

# -- Check https://grafana.com/docs/loki/latest/configuration/#schema_config for more info on how to configure schemas

schemaConfig: {}

# -- a real Loki install requires a proper schemaConfig defined above this, however for testing or playing around

# you can enable useTestSchema

useTestSchema: false

# @schema skipProperties:true;additionalProperties:true

testSchemaConfig:

configs:

- from: 2024-04-01

store: tsdb

object_store: filesystem

schema: v13

index:

prefix: index_

period: 24h

# @schema skipProperties:true;additionalProperties:true

## A separate loki ruler storage configuration can be provided via rulerStorage.storage section:

## rulerConfig:

## storage:

## type: local

# -- Check https://grafana.com/docs/loki/latest/configuration/#ruler for more info on configuring ruler

rulerConfig:

wal:

dir: /var/loki/ruler-wal

# -- Storage for the ruler. If defining rules in `ruler.directories`, this must be configured to use local storage as shown below.

# storage:

# type: local

# local:

# directory: /etc/loki/rules

# @schema skipProperties:true;additionalProperties:true

# -- Structured loki configuration, takes precedence over `loki.config`, `loki.schemaConfig`, `loki.storageConfig`

structuredConfig: {}

# @schema skipProperties:true;additionalProperties:true

# -- Additional query scheduler config

query_scheduler: {}

# @schema skipProperties:true;additionalProperties:true

# -- Additional storage config

storage_config:

boltdb_shipper:

index_gateway_client:

server_address: '{{ include "loki.indexGatewayAddress" . }}'

tsdb_shipper:

index_gateway_client:

server_address: '{{ include "loki.indexGatewayAddress" . }}'

bloom_shipper:

working_directory: /var/loki/data/bloomshipper

hedging:

at: "250ms"

max_per_second: 20

up_to: 3

# @schema skipProperties:true;additionalProperties:true

# -- Optional compactor configuration

compactor: {}

# @schema skipProperties:true;additionalProperties:true

# -- Optional compactor grpc client configuration

compactor_grpc_client: {}

# @schema skipProperties:true;additionalProperties:true

# -- Optional pattern ingester configuration

pattern_ingester:

enabled: false

# @schema skipProperties:true;additionalProperties:true

# -- Optional analytics configuration

analytics: {}

# @schema skipProperties:true;additionalProperties:true

# -- Optional Loki UI: Provides access to a operators UI for Loki distributed. When enabled UI will be available at /ui/ of loki-gateway

ui:

# Disabled by default for backwards compatibility. Enable to use the Loki UI.

enabled: false

gateway:

# enable gateway proxying to UI under /ui

enabled: true

# @schema skipProperties:true;additionalProperties:true

# -- Optional querier configuration

query_range: {}

# @schema skipProperties:true;additionalProperties:true

# -- Optional querier configuration

querier: {}

# @schema skipProperties:true;additionalProperties:true

# -- Optional ingester configuration

ingester:

wal:

flush_on_shutdown: true

# @schema skipProperties:true;additionalProperties:true

# -- Optional ingester client configuration

ingester_client: {}

# @schema skipProperties:true;additionalProperties:true

# -- Optional block builder configuration

block_builder: {}

# @schema skipProperties:true;additionalProperties:true

# -- Optional index gateway configuration

index_gateway:

mode: simple

# @schema skipProperties:true;additionalProperties:true

frontend:

scheduler_address: '{{ include "loki.querySchedulerAddress" . }}'

tail_proxy_url: '{{ include "loki.querierAddress" . }}'

# @schema skipProperties:true;additionalProperties:true

frontend_worker:

scheduler_address: '{{ include "loki.querySchedulerAddress" . }}'

# @schema skipProperties:true;additionalProperties:true

# -- Optional distributor configuration

distributor: {}

# @schema skipProperties:true;additionalProperties:true

# -- Enable tracing

tracing:

enabled: false

# @schema skipProperties:true;additionalProperties:true

bloom_build:

enabled: false

builder:

planner_address: '{{ include "loki.bloomPlannerAddress" . }}'

# @schema skipProperties:true;additionalProperties:true

bloom_gateway:

enabled: false

client:

addresses: '{{ include "loki.bloomGatewayAddresses" . }}'

# @schema skipProperties:true;additionalProperties:true

# -- Optional operational configuration

operational_config: {}

######################################################################################################################

#

# Chart Testing

#

######################################################################################################################

# -- Section for configuring optional Helm test

test:

enabled: true

# -- Used to directly query the metrics endpoint of the canary for testing, this approach avoids needing prometheus for testing.

# This in a newer approach to using prometheusAddress such that tests do not have a dependency on prometheus

canaryServiceAddress: 'http://{{ include "loki.resourceName" (dict "ctx" $ "component" "canary") }}.{{ include "loki.namespace" $ }}.svc.{{ .Values.global.clusterDomain }}:3500/metrics'

# -- Address of the prometheus server to query for the test. This overrides any value set for canaryServiceAddress.

# This is kept for backward compatibility and may be removed in future releases. Previous value was 'http://prometheus:9090'

prometheusAddress: ""

# -- Number of times to retry the test before failing

timeout: 1m

# @schema additionalProperties:{"type":"string"}

# -- Additional labels for the test pods

labels: {}

# @schema additionalProperties:{"type":"string"}

# -- Additional annotations for test pods

annotations: {}

# -- Image to use for loki canary

image:

# -- The Docker registry

registry: docker.io

# -- Docker image repository

repository: grafana/loki-helm-test

# -- Overrides the image tag whose default is the chart's appVersion

tag: "latest"

# @schema type:[string, null]

# -- Overrides the image tag with an image digest

digest: null

# -- Docker image pull policy

pullPolicy: IfNotPresent

# @schema type:[boolean, null]

# -- Use the host's user namespace in test pods

hostUsers: null

# The Loki canary pushes logs to and queries from this loki installation to test

# that it's working correctly

lokiCanary:

enabled: true

# -- The type of the loki canary k8s rollout. This can be a DaemonSet or Deployment.

kind: DaemonSet

# -- If true, the canary will send directly to Loki via the address configured for verification --

# -- If false, it will write to stdout and an Agent will be needed to scrape and send the logs --

push: true

# @schema type:[string, null]

# -- If set overwrites the default value set by loki.host helper function. Use this if gateway not enabled.

lokiurl: null

# -- The name of the label to look for at loki when doing the checks.

labelname: pod

# @schema additionalProperties:{"type":"string"}

# -- Additional annotations for the `loki-canary` Daemonset

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Additional labels for the `loki-canary` Daemonset

labels: {}

# @schema additionalProperties:{"type":"string"}

# -- Additional annotations for each `loki-canary` pod

podAnnotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Additional labels for each `loki-canary` pod

podLabels: {}

# -- The number of old ReplicaSets to retain to allow rollback

revisionHistoryLimit: 10

service:

# @schema additionalProperties:{"type":"string"}

# -- Annotations for loki-canary Service

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Additional labels for loki-canary Service

labels: {}

# -- Additional CLI arguments for the 'loki-canary' command

extraArgs: []

# -- Environment variables to add to the canary pods

extraEnv: []

# -- Environment variables from secrets or configmaps to add to the canary pods

extraEnvFrom: []

# -- Volume mounts to add to the canary pods

extraVolumeMounts: []

# -- Volumes to add to the canary pods

extraVolumes: []

# @schema additionalProperties:true

# -- Resource requests and limits for the canary

resources: {}

# -- Container resize policy for the canary

# Example:

# resizePolicy:

# - resourceName: cpu

# restartPolicy: NotRequired

# - resourceName: memory

# restartPolicy: RestartContainer

resizePolicy: []

# @schema additionalProperties:true

# -- DNS config for canary pods

dnsConfig: {}

# @schema additionalProperties:true

# -- Node selector for canary pods

nodeSelector: {}

# -- Tolerations for canary pods

tolerations: []

# @schema type:[object, null];skipProperties:true;additionalProperties:true

# -- Affinity for canary pods

affinity: {}

# -- Set this toggle to false to opt out of automounting API credentials for the service account

automountServiceAccountToken: false

# @schema type:[string, null]

# -- The name of the PriorityClass for loki-canary pods

priorityClassName: null

# @schema type:[boolean, null]

# -- Use the host's user namespace in loki-canary pods

hostUsers: null

podDisruptionBudget:

# -- Enable Pod Disruption Budget

enabled: true

# @schema additionalProperties:{"type":"string"}

# -- Annotations for Pod Disruption Budget

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Labels for Pod Disruption Budget

labels: {}

# @schema type:[string, integer, null]

# -- Pod Disruption Budget minAvailable

minAvailable: null

# @schema type:[string, integer, null]

# -- Pod Disruption Budget maxUnavailable

maxUnavailable: null

# @schema type:[string, null]

# -- Pod Disruption Budget unhealthyPodEvictionPolicy

unhealthyPodEvictionPolicy: null

# @schema skipProperties:true;additionalProperties:true

# -- The SecurityContext for loki-canary pods

podSecurityContext:

fsGroup: 10001

fsGroupChangePolicy: OnRootMismatch

runAsGroup: 10001

runAsNonRoot: true

runAsUser: 10001

seccompProfile:

type: RuntimeDefault

# @schema skipProperties:true;additionalProperties:true

# -- The SecurityContext for loki-canary containers

containerSecurityContext:

readOnlyRootFilesystem: true

capabilities:

drop:

- ALL

allowPrivilegeEscalation: false

seccompProfile:

type: RuntimeDefault

# -- Image to use for loki canary

image:

# -- The Docker registry

registry: cgr.dev

# -- Docker image repository

repository: chainguard-private/loki-canary

# @schema type:[string, null]

# -- Overrides the image tag whose default is the chart's appVersion

tag: 3.7.9-r3

# @schema type:[string, null]

# -- Overrides the image tag with an image digest

digest: sha256:6128b7c9910ec66864169ff1f2fa33d929600ae026a204f81403ff9cdfda52a1

# -- Docker image pull policy

pullPolicy: IfNotPresent

# @schema skipProperties:true;additionalProperties:true

# -- Liveness probe

livenessProbe:

httpGet:

path: /metrics

port: http-metrics

initialDelaySeconds: 15

timeoutSeconds: 1

# @schema skipProperties:true;additionalProperties:true

# -- Readiness probe

readinessProbe:

httpGet:

path: /metrics

port: http-metrics

initialDelaySeconds: 15

timeoutSeconds: 1

# @schema skipProperties:true;additionalProperties:true

# -- Startup probe

startupProbe: {}

# @schema skipProperties:true;additionalProperties:true

# -- Update strategy for the `loki-canary` Daemonset pods

updateStrategy:

type: RollingUpdate

rollingUpdate:

# @schema type:[string, integer, null]

# -- Pod Disruption Budget maxUnavailable

maxUnavailable: 1

# -- Replicas for `loki-canary` when using a Deployment

replicas: 1

# -- Tenant to use for loki-canary

tenant:

# -- Name of the tenant for loki-canary

name: "self-monitoring"

# @schema type:[string, null]

# -- Password of the gateway for Basic auth for loki-canary

password: null

bearerToken:

# -- Use a projected Kubernetes ServiceAccount token with loki-canary's `-bearer-token-file` option instead of Basic Auth. Requires a loki-canary build that supports this option.

enabled: false

# -- Requested audience for the projected ServiceAccount token. Rendered with `tpl`; this must match an Envoy JWT audience when audience validation is enabled.

audience: '{{ include "loki.name" . }}.{{ include "loki.namespace" . }}'

# @schema minimum:600;maximum:31536000

# -- Lifetime in seconds for the projected ServiceAccount token.

expirationSeconds: 3600

serviceAccount:

# -- Specifies whether a ServiceAccount should be created

create: true

# @schema type:[string, null]

# -- The name of the ServiceAccount to use.

# If not set and create is true, a name is generated using the fullname template

name: null

# @schema item:object;itemProperties:{"name": {"type": "string"}}

# -- Image pull secrets for the service account

imagePullSecrets: []

# @schema additionalProperties:{"type":"string"}

# -- Annotations for the service account

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Labels for the service account

labels: {}

# -- Set this toggle to false to opt out of automounting API credentials for the service account

automountServiceAccountToken: false

######################################################################################################################

#

# Service Accounts and Kubernetes RBAC

#

######################################################################################################################

serviceAccount:

# -- Specifies whether a ServiceAccount should be created

create: true

# @schema type:[string, null]

# -- The name of the ServiceAccount to use.

# If not set and create is true, a name is generated using the fullname template

name: null

# @schema item:object;itemProperties:{"name": {"type": "string"}}

# -- Image pull secrets for the service account

imagePullSecrets: []

# @schema additionalProperties:{"type":"string"}

# -- Annotations for the service account

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Labels for the service account

labels: {}

# -- Set this toggle to false to opt out of automounting API credentials for the service account

automountServiceAccountToken: true

# RBAC configuration

rbac:

# -- For OpenShift set sccEnabled to 'true' to use the SecurityContextConstraints.

sccEnabled: false

# -- Toggle this to true to allow the use of hostPath volumes on OpenShift

sccAllowHostDirVolumePlugin: false

# -- Whether to install RBAC in the namespace only or cluster-wide. Useful if you want to watch ConfigMap globally.

namespaced: false

######################################################################################################################

#

# Network Policy configuration

#

######################################################################################################################

networkPolicy:

# -- Specifies whether Network Policies should be created

enabled: false

gatewayJwks:

# @schema item:string

# -- CIDRs allowed for Envoy gateway JWKS egress in the standard NetworkPolicy. Empty permits the configured JWKS port to any destination because Kubernetes NetworkPolicy cannot select the API server Service by name.

cidrs: []

metrics:

# -- Specifies the Pods which are allowed to access the metrics port.

# As this is cross-namespace communication, you also need the namespaceSelector.

podSelector: {}

# -- Specifies the namespaces which are allowed to access the metrics port

namespaceSelector: {}

# -- Specifies specific network CIDRs which are allowed to access the metrics port.

# In case you use namespaceSelector, you also have to specify your kubelet networks here.

# The metrics ports are also used for probes.

cidrs: []

ingress:

# -- Specifies the Pods which are allowed to access the http port.

# As this is cross-namespace communication, you also need the namespaceSelector.

podSelector: {}

# -- Specifies the namespaces which are allowed to access the http port

namespaceSelector: {}

alertmanager:

# @schema type:[string, integer]

# -- Specify the Alertmanager port used for alerting

port: 9093

# -- Specifies the Alertmanager Pods.

# As this is cross-namespace communication, you also need the namespaceSelector.

podSelector: {}

# -- Specifies the namespace the Alertmanager is running in

namespaceSelector: {}

externalStorage:

# -- Specify the port used for external storage, e.g. AWS S3

ports: []

# -- Specifies specific network CIDRs you want to limit access to

cidrs: []

discovery:

# @schema type:[string, integer, null]

# -- (int) Specify the port used for discovery

port: null

# -- Specifies the Pods labels used for discovery.

# As this is cross-namespace communication, you also need the namespaceSelector.

podSelector: {}

# -- Specifies the namespace the discovery Pods are running in

namespaceSelector: {}

######################################################################################################################

#

# Global memberlist configuration

#

######################################################################################################################

# Configuration for the memberlist service

# The service selects pods labeled `app.kubernetes.io/part-of: memberlist` and is used as the seed list for

# `memberlist.join_members`. Only components that always run a memberlist listener get this label. Components that

# only use memberlist with some configurations (query-frontend, query-scheduler, index-gateway, bloom components,

# overrides-exporter; all of them when `loki.ui.enabled` is true) still join the cluster through these seed nodes.

memberlist:

service:

publishNotReadyAddresses: false

# @schema additionalProperties:{"type":"string"}

annotations: {}

######################################################################################################################

#

# Gateway and Ingress

#

# By default this chart will deploy a Nginx container to act as a gateway which handles routing of traffic

# and can also do auth.

#

# If you would prefer you can optionally disable this and enable using k8s ingress to do the incoming routing.

#

######################################################################################################################

# Configuration for the gateway

gateway:

# -- Specifies whether the gateway should be enabled

enabled: true

# @schema enum:[nginx, envoy]

# -- Selects the gateway proxy implementation. The Envoy implementation is EXPERIMENTAL and opt-in; its values under `gateway.envoyConfig` and the rendered Envoy configuration may change in minor releases.

type: nginx

# -- Number of replicas for the gateway

replicas: 1

# -- Default container port

containerPort: 8080

# -- Enable logging of 2xx and 3xx HTTP requests

verboseLogging: true

autoscaling:

# -- Enable autoscaling for the gateway

enabled: false

# -- Minimum autoscaling replicas for the gateway

minReplicas: 1

# -- Maximum autoscaling replicas for the gateway

maxReplicas: 3

# @schema type:[integer, null]

# -- Target CPU utilisation percentage for the gateway

targetCPUUtilizationPercentage: 60

# @schema type:[integer, null]

# -- Target memory utilisation percentage for the gateway

targetMemoryUtilizationPercentage: null

# @schema skipProperties:true;additionalProperties:true

# -- See `kubectl explain deployment.spec.strategy` for more

# -- ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy

# -- Behavior policies while scaling.

behavior: {}

# scaleUp:

# stabilizationWindowSeconds: 300

# policies:

# - type: Pods

# value: 1

# periodSeconds: 60

# scaleDown:

# stabilizationWindowSeconds: 300

# policies:

# - type: Pods

# value: 1

# periodSeconds: 180

kedaAutoscaling:

# -- Enable KEDA autoscaling for the gateway. Mutually exclusive with autoscaling.enabled

enabled: false

# @schema type:[integer, null]

# -- Interval (seconds) to poll each trigger. Defaults to defaults.kedaAutoscaling.pollingInterval if not set.

pollingInterval: null

# -- Minimum replicas for KEDA autoscaling

minReplicas: 1

# -- Maximum replicas for KEDA autoscaling

maxReplicas: 3

# @schema type:[integer, null]

# -- Period to wait after the last trigger reported active before scaling the resource back to 0 (seconds).

# Defaults to defaults.kedaAutoscaling.cooldownPeriod if not set.

cooldownPeriod: null

# @schema additionalProperties:true

# -- Fallback configuration for KEDA ScaledObject. Applied when the trigger metric cannot be retrieved.

# Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#fallback

fallback: {}

# @schema skipProperties:true;additionalProperties:true

# -- Behavior configuration for KEDA ScaledObject (horizontalPodAutoscalerConfig.behavior).

# Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#advanced

behavior: {}

# -- KEDA triggers for the gateway.

# Ref: https://keda.sh/docs/latest/scalers/

triggers: []

deploymentStrategy:

type: RollingUpdate

image:

# -- The Docker registry for the NGINX gateway image

registry: cgr.dev

# -- The NGINX gateway image repository

repository: chainguard-private/nginx

# -- The NGINX gateway image tag

tag: mainline

# @schema type:[string, null]

# -- Overrides the NGINX gateway image tag with an image digest

digest: sha256:3dc4aaa8f54b385a451239560f799418902e5e06c46468501e77b9835fb6f9ca

# -- The NGINX gateway image pull policy

pullPolicy: IfNotPresent

envoy:

image:

# -- The Docker registry for the Envoy gateway image

registry: docker.io

# -- The Envoy gateway image repository

repository: envoyproxy/envoy

# renovate: docker=docker.io/envoyproxy/envoy

# -- The Envoy gateway image tag. Uses the official distroless variant by default.

tag: distroless-v1.39.1

# @schema type:[string, null]

# -- Overrides the Envoy gateway image tag with an image digest

digest: null

# -- The Envoy gateway image pull policy

pullPolicy: IfNotPresent

# @schema type:[string, null]

# -- The name of the PriorityClass for gateway pods

priorityClassName: null

# @schema additionalProperties:{"type":"string"}

# -- Annotations for gateway deployment

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Annotations for gateway pods

podAnnotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Additional labels for gateway pods

podLabels: {}

# -- Additional CLI args for the gateway

extraArgs: []

# -- Environment variables to add to the gateway pods

extraEnv: []

# -- Environment variables from secrets or configmaps to add to the gateway pods

extraEnvFrom: []

# -- Lifecycle for the gateway container

lifecycle: {}

# -- Volumes to add to the gateway pods

extraVolumes: []

# -- Volume mounts to add to the gateway pods

extraVolumeMounts: []

# @schema skipProperties:true;additionalProperties:true

# -- The SecurityContext for gateway containers

podSecurityContext:

fsGroup: 101

runAsGroup: 101

runAsNonRoot: true

runAsUser: 101

seccompProfile:

type: RuntimeDefault

# @schema skipProperties:true;additionalProperties:true

# -- The SecurityContext for gateway containers

containerSecurityContext:

readOnlyRootFilesystem: true

capabilities:

drop: ["ALL"]

seccompProfile:

type: "RuntimeDefault"

allowPrivilegeEscalation: false

# @schema type:[boolean, null]

# -- Use the host's user namespace in the gateway

hostUsers: null

# @schema additionalProperties:true

# -- Resource requests and limits for the gateway

resources: {}

# -- Container resize policy for the gateway

# Example:

# resizePolicy:

# - resourceName: cpu

# restartPolicy: NotRequired

# - resourceName: memory

# restartPolicy: RestartContainer

resizePolicy: []

# @schema type:[array, null]

# -- Containers to add to the gateway pods

extraContainers: []

# -- Grace period to allow the gateway to shutdown before it is killed

terminationGracePeriodSeconds: 30

podDisruptionBudget:

# -- Enable Pod Disruption Budget

enabled: true

# @schema additionalProperties:{"type":"string"}

# -- Annotations for Pod Disruption Budget

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Labels for Pod Disruption Budget

labels: {}

# @schema type:[string, integer, null]

# -- Pod Disruption Budget minAvailable

minAvailable: null

# @schema type:[string, integer, null]

# -- Pod Disruption Budget maxUnavailable

maxUnavailable: null

# @schema type:[string, null]

# -- Pod Disruption Budget unhealthyPodEvictionPolicy

unhealthyPodEvictionPolicy: null

# @schema type:[object, null];skipProperties:true;additionalProperties:true

# -- Affinity for gateway pods.

# @default -- Hard node anti-affinity

# The value will be passed through tpl.

affinity:

podAntiAffinity:

requiredDuringSchedulingIgnoredDuringExecution:

- labelSelector:

matchLabels:

app.kubernetes.io/component: gateway

app.kubernetes.io/name: '{{ include "loki.name" . }}'

app.kubernetes.io/instance: '{{ .Release.Name }}'

topologyKey: kubernetes.io/hostname

# @schema additionalProperties:true

# -- DNS config for gateway pods

dnsConfig: {}

# @schema additionalProperties:true

# -- Node selector for gateway pods

nodeSelector: {}

# -- Set this toggle to false to opt out of automounting API credentials for the service account

automountServiceAccountToken: false

# @schema item:object

# -- Topology Spread Constraints for gateway pods

# The value will be passed through tpl.

topologySpreadConstraints: []

tolerations: []

# Gateway service configuration

service:

# -- Port of the gateway service

port: 80

# -- Type of the gateway service

type: ClusterIP

# @schema type:[string, null]

# -- ClusterIP of the gateway service

clusterIP: null

# @schema type:[integer, null]

# -- (int) Node port if service type is NodePort

nodePort: null

# @schema type:[string, null]

# -- Load balancer IPO address if service type is LoadBalancer

loadBalancerIP: null

# @schema additionalProperties:{"type":"string"}

# -- Annotations for the gateway service

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Labels for gateway service

labels: {}

# -- trafficDistribution for gateway Service

trafficDistribution: ""

# -- Session affinity for gateway Service

sessionAffinity: ""

# @schema additionalProperties:true

# -- Session affinity config for gateway Service

sessionAffinityConfig: {}

# -- ipFamilyPolicy for gateway Service

# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services

ipFamilyPolicy: ""

# -- ipFamilies for gateway Service

# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services

ipFamilies: []

serviceAccount:

# -- Specifies whether a ServiceAccount should be created

create: true

# @schema type:[string, null]

# -- The name of the ServiceAccount to use.

# If not set and create is true, a name is generated using the fullname template

name: null

# @schema item:object;itemProperties:{"name": {"type": "string"}}

# -- Image pull secrets for the service account

imagePullSecrets: []

# @schema additionalProperties:{"type":"string"}

# -- Annotations for the service account

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Labels for the service account

labels: {}

# -- Set this toggle to false to opt out of automounting API credentials for the service account

automountServiceAccountToken: false

# Gateway ingress configuration

ingress:

# -- Specifies whether an ingress for the gateway should be created

enabled: false

# -- Ingress Class Name. MAY be required for Kubernetes versions >= 1.18

ingressClassName: ""

# @schema additionalProperties:{"type":"string"}

# -- Annotations for the gateway ingress

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Labels for the gateway ingress

labels: {}

# -- Hosts configuration for the gateway ingress, passed through the `tpl` function to allow templating

hosts:

- host: gateway.loki.example.com

paths:

- path: /

# -- pathType (e.g. ImplementationSpecific, Prefix, .. etc.) might also be required by some Ingress Controllers

# pathType: Prefix

# -- TLS configuration for the gateway ingress. Hosts passed through the `tpl` function to allow templating

tls:

- secretName: loki-gateway-tls

hosts:

- gateway.loki.example.com

# Basic auth configuration

basicAuth:

# -- Enables basic authentication for the gateway

enabled: false

# @schema type:[string, null]

# -- The basic auth username for the gateway

username: null

# @schema type:[string, null]

# -- The basic auth password. The Envoy gateway derives its required `{SHA}` hash from this value.

password: null

# @schema type:[string, null]

# -- The `{SHA}` password hash for the Envoy gateway when `loki.tenants` is empty. This takes precedence over `password`. Generate it with `printf %s 'password' | openssl dgst -sha1 -binary | openssl base64 -A` and prefix the result with `{SHA}`.

passwordHash: null

# -- Uses the specified users from the `loki.tenants` list to create the htpasswd file.

# If `loki.tenants` is not set, the `gateway.basicAuth.username` and matching password value are used.

# The value is templated using `tpl`. Override this to use a custom htpasswd, e.g. in case the default causes

# high CPU load. The native Envoy Basic Auth filter requires `{SHA}` password hashes; NGINX supports

# the existing bcrypt hashes. Envoy derives `{SHA}` hashes from plaintext password inputs.

# @default -- Either `loki.tenants` or `gateway.basicAuth.username` and password or passwordHash.

htpasswd: |

{{- $isEnvoy := eq .Values.gateway.type "envoy" }}

{{- with $tenants := .Values.loki.tenants }}

{{- range $t := $tenants }}

{{- $tenantName := required "All tenants must have a 'name' set" $t.name }}

{{- $username := ternary ($t.basicAuthUsername | default $tenantName) $tenantName $isEnvoy }}

{{- if and $isEnvoy (or $t.passwordHash $t.password) }}

{{- $passwordHash := $t.passwordHash }}

{{- if not $passwordHash }}

{{- $passwordHash = include "loki.gatewayEnvoySHA1" (required "All tenants must have a 'password' or 'passwordHash' set" $t.password) }}

{{- end }}

{{- if not (regexMatch "^\\{SHA\\}[A-Za-z0-9+/]{27}=$" $passwordHash) }}

{{- fail "Envoy Basic Auth passwordHash values must contain a valid {SHA} Base64-encoded SHA-1 digest" }}

{{- end }}

{{- printf "%s:%s\n" $username $passwordHash }}

{{- else if $isEnvoy }}

{{- if not (or $t.jwtSubClaim $t.clientCertificateCN) }}

{{- fail (printf "Tenant %q must set 'password' or 'passwordHash', or an Envoy identity (jwtSubClaim or clientCertificateCN)" $tenantName) }}

{{- end }}

{{- else }}

{{- if $passwordHash := $t.passwordHash }}

{{- printf "%s:%s\n" $username $passwordHash }}

{{- else if $password := $t.password }}

{{- printf "%s\n" (htpasswd $username $password) }}

{{- else }}

{{- fail "All tenants must have a 'password' or 'passwordHash' set" }}

{{- end }}

{{- end }}

{{- end }}

{{- else }}

{{- $username := required "'gateway.basicAuth.username' is required" .Values.gateway.basicAuth.username }}

{{- if $isEnvoy }}

{{- $passwordHash := .Values.gateway.basicAuth.passwordHash }}

{{- if not $passwordHash }}

{{- $passwordHash = include "loki.gatewayEnvoySHA1" (required "'gateway.basicAuth.password' or 'gateway.basicAuth.passwordHash' is required for the Envoy gateway" .Values.gateway.basicAuth.password) }}

{{- end }}

{{- if not (regexMatch "^\\{SHA\\}[A-Za-z0-9+/]{27}=$" $passwordHash) }}

{{- fail "gateway.basicAuth.passwordHash must use the {SHA} format for the Envoy gateway" }}

{{- end }}

{{- printf "%s:%s\n" $username $passwordHash }}

{{- else }}

{{- printf "%s\n" (htpasswd $username (required "'gateway.basicAuth.password' is required" .Values.gateway.basicAuth.password)) }}

{{- end }}

{{- end }}

# @schema type:[string, null]

# -- Existing basic auth secret to use. Must contain `.htpasswd`; Envoy requires every entry to use the `{SHA}` format. Envoy reads this file at startup; after rotating an existing Secret, restart the gateway Deployment or change gateway.podAnnotations to trigger a rollout.

existingSecret: null

# -- Gateway API routes configuration. Mutually exclusive with gateway.ingress.

# Use either ingress or route, but not both at once.

# Each entry in the map creates a separate HTTPRoute resource. The key "main" produces

# a route named after the gateway fullname; any other key appends the key as a suffix.

# This allows defining multiple routes, e.g. one HTTPRoute and one GRPCRoute.

route:

main:

# -- Specifies whether this Gateway API route should be created

enabled: false

# -- Set the route apiVersion, e.g. gateway.networking.k8s.io/v1 or gateway.networking.k8s.io/v1beta1.

# If not set, the latest available version will be auto-detected.

apiVersion: ""

# -- Set the route kind. Valid options are GRPCRoute, HTTPRoute, TCPRoute, TLSRoute, UDPRoute

kind: HTTPRoute

# @schema additionalProperties:{"type":"string"}

# -- Additional annotations for the route

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Additional labels for the route

labels: {}

# -- Hostnames for the route. Optional: when empty, the route inherits the hostnames of the

# listeners it is attached to, e.g. the ones of a ListenerSet referenced in `parentRefs`.

hostnames: []

# - gateway.loki.example.com

# -- Parent references to attach the route to. A Gateway or a ListenerSet (see `listenerSet`).

parentRefs: []

# - name: my-gateway

# namespace: gateway-namespace

# -- Additional rules to prepend before the default catch-all rule.

# Each entry is rendered into spec.rules as written (templating is supported),

# so any HTTPRoute/GRPCRoute rule shape is accepted — including filter-only rules

# with no backendRefs (e.g. RequestRedirect, URLRewrite).

# Useful for advanced routing logic (e.g. header-based routing, auth policies, redirects).

# Note: the chart-generated rule that points at the gateway service is always rendered

# for this route — additionalRules are prepended, not a replacement.

# Example HTTP-to-HTTPS redirect:

# additionalRules:

# - filters:

# - type: RequestRedirect

# requestRedirect:

# scheme: https

# statusCode: 301

# matches:

# - path: { type: PathPrefix, value: / }

additionalRules: []

# -- Matches for the default rule. Defaults to match all paths.

matches:

- path:

type: PathPrefix

value: /

# -- Filters for the default rule

filters: []

# -- Timeouts for the default rule

timeouts: {}

# @schema skipProperties:true;additionalProperties:true

# -- Liveness probe for the selected gateway container. Envoy defaults to `/livez` on its HTTP listener when this is empty.

livenessProbe: {}

# @schema skipProperties:true;additionalProperties:true

# -- Readiness probe for the gateway. The default remains compatible with custom NGINX configurations. Envoy replaces this default with HTTP `/ready` on `gateway.envoyConfig.adminPort`; custom probes are preserved.

readinessProbe:

httpGet:

path: /

port: http

initialDelaySeconds: 15

timeoutSeconds: 1

# @schema skipProperties:true;additionalProperties:true

# -- Startup probe for the selected gateway container.

startupProbe: {}

nginxConfig:

# -- Which schema to be used when building upstream URLs. Can be `http` or `https`. Also used by the generated Envoy configuration.

schema: http

# -- Enable listener for IPv6, disable on IPv4-only systems

enableIPv6: true

# -- NGINX log format

logFormat: |-

main '$remote_addr - $remote_user [$time_local] $status '

'"$request" $body_bytes_sent "$http_referer" '

'"$http_user_agent" "$http_x_forwarded_for"';

# -- Allows appending custom configuration to the server block

serverSnippet: ""

# -- Allows appending custom configuration to the http block, passed through the `tpl` function to allow templating

httpSnippet: ""

# -- Allows appending custom configuration inside every location block, useful for authentication or setting headers that are not inherited from the server block, passed through the `tpl` function to allow templating.

locationSnippet: >-

{{ if .Values.loki.tenants }}proxy_set_header X-Scope-OrgID $remote_user;{{ end }}

# -- Allows customizing the `client_max_body_size` directive

clientMaxBodySize: 4M

# -- Whether ssl should be appended to the listen directive of the server block or not.

ssl: false

# @schema type:[string, null]

# -- Override Read URL. Also used by the generated Envoy configuration, which accepts scheme, host and port only (no path).

customReadUrl: null

# @schema type:[string, null]

# -- Override Write URL. Also used by the generated Envoy configuration, which accepts scheme, host and port only (no path).

customWriteUrl: null

# @schema type:[string, null]

# -- Override Backend URL. Also used by the generated Envoy configuration, which accepts scheme, host and port only (no path).

customBackendUrl: null

# -- Allows overriding the DNS resolver address nginx will use.

resolver: ""

# -- Config file contents for Nginx. Passed through the `tpl` function to allow templating

# @default -- See values.yaml

file: |

{{- include "loki.nginxFile" . -}}

# -- EXPERIMENTAL: Settings for the Envoy gateway implementation, used when `gateway.type` is `envoy`.

# @default -- See values.yaml

envoyConfig:

# -- Dual-stack Envoy administration port used by the readiness probe. Only `/ready` is accessible unless gateway metrics are enabled, which also allows `/stats/prometheus`.

adminPort: 9901

# -- Enable an IPv4-compatible IPv6 listener for dual-stack gateway pods.

enableIPv6: true

# -- Timeout for connections from Envoy to Loki components.

connectTimeout: 5s

# -- Request timeout. Use `0s` for streaming Loki requests.

requestTimeout: 0s

# -- Idle timeout for downstream HTTP streams.

streamIdleTimeout: 600s

# -- Enable TCP keep-alive on listener and upstream connections.

tcpKeepAlive: true

# -- Use HTTP/2 over cleartext (h2c) for Loki upstreams. WebSocket streams automatically use HTTP/1.1.

upstreamHTTP2: true

upstreamTLS:

# -- CA bundle for HTTPS Loki upstreams. The default is present in the Envoy distroless image. Mount a custom CA with gateway.extraVolumes and gateway.extraVolumeMounts when needed.

caCertificateFile: /etc/ssl/certs/ca-certificates.crt

# -- Disable certificate chain and hostname verification for HTTPS Loki upstreams. Use only when explicitly required.

insecureSkipVerify: false

# -- Envoy access log format. Logs are written to stdout; `/livez` is always excluded.

logFormat: |

[%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %UPSTREAM_HOST% "%REQ(USER-AGENT)%" "%REQ(X-FORWARDED-FOR)%"

tls:

# -- Terminate TLS at Envoy. Required when tenants define `clientCertificateCN`.

enabled: false

# @schema type:[string, null]

# -- Secret containing the server certificate/private key and, for client-certificate authentication, the client CA.

existingSecret: null

# -- Secret key containing the PEM server certificate.

certificateFile: tls.crt

# -- Secret key containing the PEM server private key.

privateKeyFile: tls.key

# -- Secret key containing the CA certificates used to verify client certificates.

clientCAFile: ca.crt

jwt:

# -- Verify bearer JWTs with a remote JWKS before mapping `jwtSubClaim` values to Loki tenants. Defaults target the Kubernetes ServiceAccount issuer.

enabled: false

# -- Expected JWT issuer (`iss`).

issuer: 'https://kubernetes.default.svc.{{ .Values.global.clusterDomain }}'

# @schema item:string

# -- Allowed JWT audiences (`aud`). Each value is rendered with `tpl`; the default matches the loki-canary projected ServiceAccount token. Leave empty to skip audience validation.

audiences:

- '{{ include "loki.name" . }}.{{ include "loki.namespace" . }}'

remoteJwks:

# -- HTTPS or HTTP URI used by Envoy to fetch the JWKS. The value is rendered with `tpl`. The default is the Kubernetes ServiceAccount JWKS endpoint, addressed by its absolute DNS name to skip resolver search-domain lookups.

uri: 'https://kubernetes.default.svc.{{ .Values.global.clusterDomain }}./openid/v1/jwks'

# @schema type:[string, null]

# -- File whose contents Envoy sends as `Authorization: Bearer` when fetching the JWKS, through a loopback credential-injector listener. The default path is a projected token of the gateway ServiceAccount that the chart mounts and Envoy reloads on rotation; the Kubernetes API accepts it for the JWKS endpoint without extra RBAC. Point this at another mounted file for a different credential, or set it to `null` to fetch the JWKS anonymously.

bearerTokenFile: /etc/envoy/kubernetes/token

# -- Loopback port of the Envoy listener that adds the bearer token to JWKS requests. Only bound on 127.0.0.1 inside the gateway pod. Used when `bearerTokenFile` is set.

credentialInjectorPort: 9902

# -- Timeout for each remote JWKS request.

requestTimeout: 5s

# @schema minimum:0

# -- Number of times Envoy retries a failed JWKS request (connection failure, reset or 5xx) with a short exponential backoff before giving up on that fetch. Retries during startup keep the listener from serving JWT requests until the JWKS arrives, which also covers the first fetch racing the loopback credential-injector listener. Set to `0` to disable retries.

retries: 3

# -- How long Envoy caches the fetched JWKS.

cacheDuration: 300s

# -- Fetch the JWKS asynchronously during listener initialization.

asyncFetch: true

# -- CA bundle used to validate an HTTPS JWKS endpoint. The Kubernetes root CA is mounted here when JWT verification is enabled. Override this for an external issuer.

caCertificateFile: /etc/envoy/kubernetes/ca.crt

# -- Config file contents for Envoy. Passed through the `tpl` function to allow templating.

# @default -- See values.yaml

file: |

{{- include "loki.envoyFile" . -}}

# @schema additionalProperties:{"type":"string"}

# -- Additional Envoy configuration files. Keys are mounted in `/etc/envoy` and values are passed through `tpl`. The name `envoy.yaml` is reserved.

configs: {}

metrics:

# -- Whether gateway metrics should be exposed. NGINX uses the exporter sidecar; Envoy exposes native Prometheus metrics.

enabled: true

image:

# -- NGINX access log exporter image registry. Not used by the Envoy gateway.

registry: cgr.dev

# -- NGINX access log exporter image repository. Not used by the Envoy gateway.

repository: chainguard-private/access-log-exporter

# -- NGINX access log exporter image tag. Not used by the Envoy gateway.

tag: 0.5.2-r2@sha256:6413f4948ce99637dc081e23ed476639b1c54e5d73b7734601382ac6636d3b80

# -- NGINX access log exporter image pull policy. Not used by the Envoy gateway.

pullPolicy: IfNotPresent

# @schema additionalProperties:true

# -- Resource requests and limits for the NGINX metrics exporter. Not used by the Envoy gateway.

resources:

requests: {}

limits: {}

# -- Container resize policy for the NGINX gateway metrics exporter. Not used by the Envoy gateway.

# Example:

# resizePolicy:

# - resourceName: cpu

# restartPolicy: NotRequired

# - resourceName: memory

# restartPolicy: RestartContainer

resizePolicy: []

# @schema skipProperties:true;additionalProperties:true

# -- The SecurityContext for the NGINX gateway metrics exporter. Not used by the Envoy gateway.

containerSecurityContext:

allowPrivilegeEscalation: false

readOnlyRootFilesystem: true

capabilities:

drop: ["ALL"]

seccompProfile:

type: RuntimeDefault

privileged: false

runAsNonRoot: true

runAsUser: 65532

runAsGroup: 65532

# -- Extra args to add to the NGINX gateway metrics exporter. Not used by the Envoy gateway.

extraArgs: []

# @schema skipProperties:true;additionalProperties:true

# -- Liveness probe for the NGINX gateway metrics exporter. Not used by the Envoy gateway.

livenessProbe:

httpGet:

path: /health

port: http-metrics

initialDelaySeconds: 30

periodSeconds: 10

timeoutSeconds: 5

failureThreshold: 3

# @schema skipProperties:true;additionalProperties:true

# -- Readiness probe for the NGINX gateway metrics exporter. Not used by the Envoy gateway.

readinessProbe:

httpGet:

path: /health

port: http-metrics

initialDelaySeconds: 5

periodSeconds: 5

timeoutSeconds: 3

failureThreshold: 3

# @schema skipProperties:true;additionalProperties:true

# -- Startup probe for the NGINX gateway metrics exporter. Not used by the Envoy gateway.

startupProbe: {}

service:

# @schema additionalProperties:{"type":"string"}

# -- Annotations for the gateway metrics exporter service.

# Use this instead of gateway.service.annotations to avoid propagating

# annotations (e.g. external-dns) to the exporter ClusterIP service.

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Labels for the gateway metrics exporter service.

labels: {}

# -- Ingress configuration Use either this ingress or the gateway, but not both at once.

# If you enable this, make sure to disable the gateway.

# You'll need to supply authn configuration for your ingress controller.

ingress:

enabled: false

ingressClassName: ""

# @schema additionalProperties:{"type":"string"}

annotations: {}

# @schema additionalProperties:{"type":"string"}

# nginx.ingress.kubernetes.io/auth-type: basic

# nginx.ingress.kubernetes.io/auth-secret: loki-distributed-basic-auth

# nginx.ingress.kubernetes.io/auth-secret-type: auth-map

# nginx.ingress.kubernetes.io/configuration-snippet: |

# proxy_set_header X-Scope-OrgID $remote_user;

labels: {}

# blackbox.monitoring.exclude: "true"

paths:

# -- Paths that are exposed by Loki Distributor.

# If deployment mode is Distributed, the requests are forwarded to the service:.

# If deployment mode is SimpleScalable, the requests are forwarded to write k8s service:.

# If deployment mode is SingleBinary, the requests are forwarded to the central/single k8s service:

distributor:

- /api/prom/push

- /loki/api/v1/push

- /otlp/v1/logs

# -- Paths that are exposed by Loki Query Frontend.

# If deployment mode is Distributed, the requests are forwarded to the service.

# If deployment mode is SimpleScalable, the requests are forwarded to write k8s service`.

# If deployment mode is SingleBinary, the requests are forwarded to the central/single k8s service`

queryFrontend:

- /api/prom/query

# this path covers labels and labelValues endpoints

- /api/prom/label

- /api/prom/series

- /api/prom/tail

- /loki/api/v1/query

- /loki/api/v1/query_range

- /loki/api/v1/tail

# this path covers labels and labelValues endpoints

- /loki/api/v1/label

- /loki/api/v1/labels

- /loki/api/v1/series

- /loki/api/v1/index/stats

- /loki/api/v1/index/volume

- /loki/api/v1/index/volume_range

- /loki/api/v1/format_query

- /loki/api/v1/detected_field

- /loki/api/v1/detected_fields

- /loki/api/v1/detected_labels

- /loki/api/v1/patterns

# this path covers UI API

- /ui

# -- Paths that are exposed by Loki Ruler.

# If deployment mode is Distributed, the requests are forwarded to the service.

# If deployment mode is SimpleScalable, the requests are forwarded to k8s service.

# If deployment mode is SingleBinary, the requests are forwarded to the central/single k8s service

ruler:

- /api/prom/rules

- /api/prom/api/v1/rules

- /api/prom/api/v1/alerts

- /loki/api/v1/rules

- /prometheus/api/v1/rules

- /prometheus/api/v1/alerts

# -- Paths that are exposed by Loki Compactor.

# If deployment mode is Distributed, the requests are forwarded to the service.

# If deployment mode is SimpleScalable, the requests are forwarded to k8s service.

# If deployment mode is SingleBinary, the requests are forwarded to the central/single k8s service`

compactor:

- /loki/api/v1/delete

# -- Hosts configuration for the ingress, passed through the `tpl` function to allow templating

hosts:

- loki.example.com

# -- TLS configuration for the ingress. Hosts passed through the `tpl` function to allow templating

tls: []

# - hosts:

# - loki.example.com

# secretName: loki-distributed-tls

# -- Gateway API routes for direct routing to Loki services, bypassing the nginx gateway.

# Use either this or the top-level ingress, but not both at once.

# Each entry in the map creates a separate HTTPRoute resource. The key "main" produces

# a route named after the loki fullname; any other key appends the key as a suffix.

# This allows defining multiple routes, e.g. one HTTPRoute and one GRPCRoute.

route:

main:

# -- Specifies whether this Gateway API route should be created

enabled: false

# -- Gateway API version to use. Auto-detected from cluster capabilities if empty.

apiVersion: ""

# -- Kind of the route resource. Valid options are GRPCRoute, HTTPRoute, TCPRoute, TLSRoute, UDPRoute

kind: HTTPRoute

# @schema additionalProperties:{"type":"string"}

# -- Annotations for the route

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Labels for the route

labels: {}

# -- Hostnames for the route. Optional: when empty, the route inherits the hostnames of the

# listeners it is attached to, e.g. the ones of a ListenerSet referenced in `parentRefs`.

hostnames: []

# -- Parent references for the route (required for Gateway API). A Gateway or a ListenerSet (see `listenerSet`).

parentRefs: []

# - name: my-gateway

# namespace: gateway-namespace

# -- Additional rules to prepend before the generated path-routing rules.

# Each entry is rendered into spec.rules as written (templating is supported),

# so any HTTPRoute/GRPCRoute rule shape is accepted — including filter-only rules

# with no backendRefs (e.g. RequestRedirect, URLRewrite).

additionalRules: []

# @schema type:[integer, null]

# -- Backend port override for all generated rules.

# When unset, GRPCRoute automatically uses loki.server.grpc_listen_port (default 9095)

# and all other kinds use loki.server.http_listen_port (default 3100).

backendPort: null

# -- Paths routed to each Loki service group. The target service depends on the deployment mode.

# To produce a route that contains only `additionalRules` and no chart-generated path rules

# (for example, a dedicated HTTP-to-HTTPS redirect route), set every entry below to an empty

# list — e.g. `distributor: []`, `queryFrontend: []`, `ruler: []`, `compactor: []`.

paths:

# -- Paths that are exposed by Loki Distributor.

# If deployment mode is Distributed, the requests are forwarded to the service: `{{"loki.distributorFullname"}}`.

# If deployment mode is SimpleScalable, the requests are forwarded to write k8s service: `{{"loki.writeFullname"}}`.

# If deployment mode is SingleBinary, the requests are forwarded to the central/single k8s service: `{{"loki.fullname"}}`

distributor:

- /api/prom/push

- /loki/api/v1/push

- /otlp/v1/logs

# -- Paths that are exposed by Loki Query Frontend.

# If deployment mode is Distributed, the requests are forwarded to the service.

# If deployment mode is SimpleScalable, the requests are forwarded to read k8s service.

# If deployment mode is SingleBinary, the requests are forwarded to the central/single k8s service`

queryFrontend:

- /api/prom/query

# this path covers labels and labelValues endpoints

- /api/prom/label

- /api/prom/series

- /api/prom/tail

- /loki/api/v1/query

- /loki/api/v1/query_range

- /loki/api/v1/tail

# this path covers labels and labelValues endpoints

- /loki/api/v1/label

- /loki/api/v1/labels

- /loki/api/v1/series

- /loki/api/v1/index/stats

- /loki/api/v1/index/volume

- /loki/api/v1/index/volume_range

- /loki/api/v1/format_query

- /loki/api/v1/detected_field

- /loki/api/v1/detected_fields

- /loki/api/v1/detected_labels

- /loki/api/v1/patterns

# this path covers UI API

- /ui

# -- Paths that are exposed by Loki Ruler.

# If deployment mode is Distributed, the requests are forwarded to the service.

# If deployment mode is SimpleScalable, the requests are forwarded to k8s service.

# If deployment mode is SingleBinary, the requests are forwarded to the central/single k8s service.

ruler:

- /api/prom/rules

- /api/prom/api/v1/rules

- /api/prom/api/v1/alerts

- /loki/api/v1/rules

- /prometheus/api/v1/rules

- /prometheus/api/v1/alerts

# -- Paths that are exposed by Loki Compactor.

# If deployment mode is Distributed, the requests are forwarded to the service.

# If deployment mode is SimpleScalable, the requests are forwarded to k8s service.

# If deployment mode is SingleBinary, the requests are forwarded to the central/single k8s service.

compactor:

- /loki/api/v1/delete

# -- BETA: Configure Gateway API ListenerSet resources for the chart here.

# ListenerSet allows attaching additional listeners to an existing Gateway.

# More listener sets can be added by adding a dictionary key like the 'main' entry.

# The key "main" produces a ListenerSet named after the loki fullname; any other key appends the key as a suffix.

# Attach a route to it with a parentRef of `kind: ListenerSet` in `route.*.parentRefs` or `gateway.route.*.parentRefs`.

# The parent Gateway must allow ListenerSets via `spec.allowedListeners`.

# Being BETA this can/will change in the future without notice, do not use unless you want to take that risk

# [[ref]](https://gateway-api.sigs.k8s.io/reference/api-spec/main/spec/#listenerset)

listenerSet:

main:

# -- Enables or disables the listener set

enabled: false

# -- Set the ListenerSet apiVersion, e.g. gateway.networking.k8s.io/v1

apiVersion: gateway.networking.k8s.io/v1

# @schema additionalProperties:{"type":"string"}

# -- Annotations for the ListenerSet

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Labels for the ListenerSet

labels: {}

# -- Reference to the parent Gateway this ListenerSet attaches to

parentRef: {}

# name: my-gateway

# namespace: default

# group: gateway.networking.k8s.io

# kind: Gateway

# -- List of listeners to attach to the parent Gateway (templating is supported)

listeners: []

# - name: https

# port: 443

# protocol: HTTPS

# hostname: loki.example.com

# tls:

# mode: Terminate

# certificateRefs:

# - name: loki-tls

# allowedRoutes:

# namespaces:

# from: Same

######################################################################################################################

#

# Migration

#

######################################################################################################################

# -- Options that may be necessary when performing a migration from another helm chart

migrate:

# -- When migrating from a distributed chart like loki-distributed or enterprise-logs

fromDistributed:

# -- Set to true if migrating from a distributed helm chart

enabled: false

# -- If migrating from a distributed service, provide the distributed deployment's

# memberlist service DNS so the new deployment can join its ring.

memberlistService: ""

######################################################################################################################

#

# Single Binary Deployment

#

# For small Loki installations up to a few 10's of GB per day, or for testing and development.

#

######################################################################################################################

# -- Pod Disruption Budget for single binary deployment. Deprecated in favor of `singleBinary.podDisruptionBudget`

podDisruptionBudget:

enabled: true

# Configuration for the single binary node(s)

singleBinary:

# -- Enable the single binary component. Requires `loki.deploymentMode` to be set to `SingleBinary`.

enabled: true

# -- Kind of read deployment. StatefulSet and Deployment are supported.

kind: StatefulSet

# @schema type:[integer, null]

# -- Number of replicas for the single binary. Set to null to omit spec.replicas from the workload,

# allowing an external controller (e.g. HPA, KEDA, rollout-operator) to manage replica counts without Helm resetting them.

replicas: 0

# -- EXPERIMENTAL: Enable creating a Job to recreate the write StatefulSet when the compactor configuration is changed.

## Only applicable if `compactor.kind` is StatefulSet. Useful for PVC size changes, which require recreating the StatefulSet.

statefulSetRecreateJob:

enabled: false

# @schema skipProperties:true;additionalProperties:true

# -- UpdateStrategy or Strategy for single binary.

strategy:

rollingUpdate:

partition: 0

# -- Whether to enable the rules sidecar

sidecar: true

autoscaling:

# -- Enable autoscaling

enabled: false

# -- Minimum autoscaling replicas for the single binary

minReplicas: 1

# -- Maximum autoscaling replicas for the single binary

maxReplicas: 3

# @schema type:[integer, null]

# -- Target CPU utilisation percentage for the single binary

targetCPUUtilizationPercentage: 60

# @schema type:[integer, null]

# -- Target memory utilisation percentage for the single binary

targetMemoryUtilizationPercentage: null

# -- Allows one to define custom metrics using the HPA/v2 schema (for example, Pods, Object or External metrics)

customMetrics: []

# - type: Pods

# pods:

# metric:

# name: loki_lines_total

# target:

# type: AverageValue

# averageValue: 10k

# @schema skipProperties:true;additionalProperties:true

# -- HPA behavior configuration, passed directly as a K8s HPA behavior object.

behavior:

# -- Enable autoscaling behaviours

enabled: false

# -- define scale down policies, must conform to HPAScalingRules

scaleDown: {}

# -- define scale up policies, must conform to HPAScalingRules

scaleUp: {}

kedaAutoscaling:

# -- Enable KEDA autoscaling for the single binary. Mutually exclusive with autoscaling.enabled

enabled: false

# @schema type:[integer, null]

# -- Interval (seconds) to poll each trigger. Defaults to defaults.kedaAutoscaling.pollingInterval if not set.

pollingInterval: null

# -- Minimum replicas for KEDA autoscaling

minReplicas: 1

# -- Maximum replicas for KEDA autoscaling

maxReplicas: 3

# @schema type:[integer, null]

# -- Period to wait after the last trigger reported active before scaling the resource back to 0 (seconds).

# Defaults to defaults.kedaAutoscaling.cooldownPeriod if not set.

cooldownPeriod: null

# @schema additionalProperties:true

# -- Fallback configuration for KEDA ScaledObject. Applied when the trigger metric cannot be retrieved.

# Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#fallback

fallback: {}

# @schema skipProperties:true;additionalProperties:true

# -- Behavior configuration for KEDA ScaledObject (horizontalPodAutoscalerConfig.behavior).

# Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#advanced

behavior: {}

# -- KEDA triggers for the single binary.

# Ref: https://keda.sh/docs/latest/scalers/

triggers: []

image:

# @schema type:[string, null]

# -- The Docker registry for the single binary image. Overrides `loki.image.registry`

registry: null

# @schema type:[string, null]

# -- Docker image repository for the single binary image. Overrides `loki.image.repository`

repository: null

# @schema type:[string, null]

# -- Docker image tag for the single binary image. Overrides `loki.image.tag`

tag: null

# @schema type:[string, null]

# -- The name of the PriorityClass for single binary pods

priorityClassName: null

# @schema additionalProperties:{"type":"string"}

# -- Annotations for single binary StatefulSet

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Additional labels for single binary StatefulSet

labels: {}

# @schema additionalProperties:{"type":"string"}

# -- Annotations for single binary pods

podAnnotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Additional labels for each `single binary` pod

podLabels: {}

# @schema additionalProperties:{"type":"string"}

# -- Additional selector labels for each `single binary` pod

selectorLabels: {}

podDisruptionBudget:

# -- Enable Pod Disruption Budget

enabled: true

# @schema additionalProperties:{"type":"string"}

# -- Annotations for Pod Disruption Budget

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Labels for Pod Disruption Budget

labels: {}

# @schema type:[string, integer, null]

# -- Pod Disruption Budget minAvailable

minAvailable: null

# @schema type:[string, integer, null]

# -- Pod Disruption Budget maxUnavailable

maxUnavailable: null

# @schema type:[string, null]

# -- Pod Disruption Budget unhealthyPodEvictionPolicy

unhealthyPodEvictionPolicy: null

service:

# @schema additionalProperties:{"type":"string"}

# -- Annotations for single binary Service

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Additional labels for single binary Service

labels: {}

# -- Service Type for single binary Service

type: "ClusterIP"

# -- trafficDistribution single binary Service

trafficDistribution: ""

# -- Session affinity for single binary Service

sessionAffinity: ""

# @schema additionalProperties:true

# -- Session affinity config for single binary Service

sessionAffinityConfig: {}

# -- ipFamilyPolicy for single binary Service

# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services

ipFamilyPolicy: ""

# -- ipFamilies for single binary Service

# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services

ipFamilies: []

# -- Adds the appProtocol field to the single binary service. This allows single binary to work with istio protocol selection.

appProtocol:

# -- Set the optional grpc service protocol. Ex: "grpc", "http2" or "https"

grpc: ""

headlessService:

# @schema additionalProperties:{"type":"string"}

# -- Additional annotations for headless single binary Service

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Additional labels for single binary Service

labels: {}

# -- Comma-separated list of Loki modules to load for the single binary

targetModule: "all"

# -- Labels for single binary service

extraArgs: []

# -- Environment variables to add to the single binary pods

extraEnv: []

# -- Environment variables from secrets or configmaps to add to the single binary pods

extraEnvFrom: []

# @schema type:[string, array, null]

# -- Extra containers to add to the single binary loki pod

extraContainers: []

# @schema type:[string, array, null]

# -- Init containers to add to the single binary pods

initContainers: []

# -- Volume mounts to add to the single binary pods

extraVolumeMounts: []

# -- Volumes to add to the single binary pods

extraVolumes: []

# @schema additionalProperties:true

# -- Resource requests and limits for the single binary

resources: {}

# -- Container resize policy for the single binary

# Example:

# resizePolicy:

# - resourceName: cpu

# restartPolicy: NotRequired

# - resourceName: memory

# restartPolicy: RestartContainer

resizePolicy: []

# -- Grace period to allow the single binary to shutdown before it is killed

terminationGracePeriodSeconds: 30

# @schema type:[boolean, null]

# -- Use the host's user namespace in the single binary pods

hostUsers: null

# @schema type:[object, null];skipProperties:true;additionalProperties:true

# -- Affinity for single binary pods.

# @default -- Hard node anti-affinity

# The value will be passed through tpl.

affinity:

podAntiAffinity:

requiredDuringSchedulingIgnoredDuringExecution:

- labelSelector:

matchLabels:

app.kubernetes.io/component: single-binary

app.kubernetes.io/name: '{{ include "loki.name" . }}'

app.kubernetes.io/instance: '{{ .Release.Name }}'

topologyKey: kubernetes.io/hostname

# @schema item:object

# -- Topology Spread Constraints for single binary pods

# The value will be passed through tpl.

topologySpreadConstraints: []

# @schema additionalProperties:true

dnsConfig: {}

# @schema additionalProperties:true

# -- Node selector for single binary pods

nodeSelector: {}

# -- Tolerations for single binary pods

tolerations: []

# -- The default is to deploy all pods in parallel.

podManagementPolicy: "Parallel"

persistence:

# -- What to do with the volume when the StatefulSet is scaled down.

whenScaled: Delete

# -- What to do with the volumes when the StatefulSet is deleted.

whenDeleted: Delete

# -- Enable StatefulSetAutoDeletePVC feature

enableStatefulSetAutoDeletePVC: false

# -- Enable persistent disk

enabled: true

# -- Set access modes on the PersistentVolumeClaim

accessModes:

- ReadWriteOnce

# -- Size of persistent disk

size: 10Gi

# @schema type:[string, null]

# -- Storage class to be used.

# If defined, storageClassName: <storageClass>.

# If set to "-", storageClassName: "", which disables dynamic provisioning.

# If empty or set to null, no storageClassName spec is

# set, choosing the default provisioner (gp2 on AWS, standard on GKE, AWS, and OpenStack).

storageClass: null

# @schema type:[object, null]

# -- Selector for persistent disk

selector: null

# @schema additionalProperties:{"type":"string"}

# -- Annotations for volume claim

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Labels for volume claim

labels: {}

# @schema skipProperties:true;additionalProperties:true

# -- Parameters used for the `storage` volume when persistence.enabled is false.

# Allows replacing the default emptyDir volume with a custom volume definition.

# For example, to use an existing PVC:

# dataVolumeParameters:

# persistentVolumeClaim:

# claimName: my-existing-pvc

dataVolumeParameters: {}

######################################################################################################################

#

# Simple Scalable Deployment (SSD) Mode

#

# For small to medium size Loki deployments up to around 1 TB/day, this is the default mode for this helm chart

#

######################################################################################################################

# Configuration for the write pod(s)

write:

# -- Enable the component. Requires `loki.deploymentMode` to be set to `SimpleScalable`.

enabled: true

# -- Kind of write workload. StatefulSet and Deployment are supported.

kind: StatefulSet

# -- Override for the write fullname. By default, this is generated using the fullname template with "-backend"

fullnameOverride: '{{ include "loki.name" . }}-write'

# -- EXPERIMENTAL: Enable creating a Job to recreate the write StatefulSet when the compactor configuration is changed.

## Only applicable if `compactor.kind` is StatefulSet. Useful for PVC size changes, which require recreating the StatefulSet.

statefulSetRecreateJob:

enabled: false

# @schema type:[integer, null]

# -- Number of replicas for the write. Set to null to omit spec.replicas from the workload,

# allowing an external controller (e.g. HPA, KEDA, rollout-operator) to manage replica counts without Helm resetting them.

replicas: 3

# @schema skipProperties:true;additionalProperties:true

# -- UpdateStrategy or Strategy for the write.

strategy:

rollingUpdate:

partition: 0

autoscaling:

# -- Enable autoscaling for the write.

enabled: false

# -- Minimum autoscaling replicas for the write.

minReplicas: 2

# -- Maximum autoscaling replicas for the write.

maxReplicas: 6

# @schema type:[integer, null]

# -- Target CPU utilisation percentage for the write.

targetCPUUtilizationPercentage: 60

# @schema type:[integer, null]

# -- Target memory utilization percentage for the write.

targetMemoryUtilizationPercentage: null

# @schema skipProperties:true;additionalProperties:true

# -- Behavior policies while scaling.

behavior:

# -- see https://github.com/grafana/loki/blob/main/docs/sources/operations/storage/wal.md#how-to-scale-updown for scaledown details

scaleUp:

policies:

- type: Pods

value: 1

periodSeconds: 900

scaleDown:

policies:

- type: Pods

value: 1

periodSeconds: 1800

stabilizationWindowSeconds: 3600

kedaAutoscaling:

# -- Enable KEDA autoscaling for the write. Mutually exclusive with autoscaling.enabled

enabled: false

# @schema type:[integer, null]

# -- Interval (seconds) to poll each trigger. Defaults to defaults.kedaAutoscaling.pollingInterval if not set.

pollingInterval: null

# -- Minimum replicas for KEDA autoscaling

minReplicas: 2

# -- Maximum replicas for KEDA autoscaling

maxReplicas: 6

# @schema type:[integer, null]

# -- Period to wait after the last trigger reported active before scaling the resource back to 0 (seconds).

# Defaults to defaults.kedaAutoscaling.cooldownPeriod if not set.

cooldownPeriod: null

# @schema additionalProperties:true

# -- Fallback configuration for KEDA ScaledObject. Applied when the trigger metric cannot be retrieved.

# Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#fallback

fallback: {}

# @schema skipProperties:true;additionalProperties:true

# -- Behavior configuration for KEDA ScaledObject (horizontalPodAutoscalerConfig.behavior).

# Ref: https://keda.sh/docs/latest/reference/scaledobject-spec/#advanced

behavior: {}

# -- KEDA triggers for the write.

# Ref: https://keda.sh/docs/latest/scalers/

triggers: []

image:

# @schema type:[string, null]

# -- The Docker registry for the write image. Overrides `loki.image.registry`

registry: null

# @schema type:[string, null]

# -- Docker image repository for the write image. Overrides `loki.image.repository`

repository: null

# @schema type:[string, null]

# -- Docker image tag for the write image. Overrides `loki.image.tag`

tag: null

# @schema type:[string, null]

# -- The name of the PriorityClass for write pods

priorityClassName: null

# @schema additionalProperties:{"type":"string"}

# -- Annotations for write StatefulSet

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Additional labels for write StatefulSet

labels: {}

# @schema additionalProperties:{"type":"string"}

# -- Annotations for write pods

podAnnotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Additional labels for each `write` pod

podLabels: {}

# @schema additionalProperties:{"type":"string"}

# -- Additional selector labels for each `write` pod

selectorLabels: {}

service:

# @schema additionalProperties:{"type":"string"}

# -- Annotations for write Service

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Additional labels for write Service

labels: {}

# -- Service Type for write Service

type: "ClusterIP"

# -- trafficDistribution for write Service

trafficDistribution: ""

# -- Session affinity for write Service

sessionAffinity: ""

# @schema additionalProperties:true

# -- Session affinity config for write Service

sessionAffinityConfig: {}

# -- ipFamilyPolicy for write Service

# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services

ipFamilyPolicy: ""

# -- ipFamilies for write Service

# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services

ipFamilies: []

# -- Adds the appProtocol field to the write service. This allows write to work with istio protocol selection.

appProtocol:

# -- Set the optional grpc service protocol. Ex: "grpc", "http2" or "https"

grpc: ""

headlessService:

# @schema additionalProperties:{"type":"string"}

# -- Additional annotations for headless SimpleScalable write Service

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Additional labels for headless SimpleScalable write Service

labels: {}

# -- Additional CLI args for the write

extraArgs: []

# -- Environment variables to add to the write pods

extraEnv: []

# -- Environment variables from secrets or configmaps to add to the write pods

extraEnvFrom: []

# -- Lifecycle for the write container

lifecycle: {}

# @schema type:[string, array, null]

# -- Init containers to add to the write pods

initContainers: []

# @schema type:[string, array, null]

# -- Containers to add to the write pods

extraContainers: []

# -- Volume mounts to add to the write pods

extraVolumeMounts: []

# -- Volumes to add to the write pods

extraVolumes: []

# -- volumeClaimTemplates to add to StatefulSet

extraVolumeClaimTemplates: []

# @schema additionalProperties:true

# -- Resource requests and limits for the write

resources: {}

# -- Container resize policy for the write

# Example:

# resizePolicy:

# - resourceName: cpu

# restartPolicy: NotRequired

# - resourceName: memory

# restartPolicy: RestartContainer

resizePolicy: []

# -- Grace period to allow the write to shutdown before it is killed. Especially for the ingester,

# this must be increased. It must be long enough so writes can be gracefully shutdown flushing/transferring

# all data and to successfully leave the member ring on shutdown.

terminationGracePeriodSeconds: 300

# @schema type:[boolean, null]

# -- Use the host's user namespace in the write pods.

hostUsers: null

# @schema type:[object, null];skipProperties:true;additionalProperties:true

# -- Affinity for write pods.

# @default -- Hard node anti-affinity

# The value will be passed through tpl.

affinity:

podAntiAffinity:

requiredDuringSchedulingIgnoredDuringExecution:

- labelSelector:

matchLabels:

app.kubernetes.io/component: write

app.kubernetes.io/name: '{{ include "loki.name" . }}'

app.kubernetes.io/instance: '{{ .Release.Name }}'

topologyKey: kubernetes.io/hostname

# @schema additionalProperties:true

# -- DNS config for write pods

dnsConfig: {}

# @schema type:[string, integer, null];deprecated:true

# -- Pod Disruption Budget maxUnavailable

# @deprecated -- This is deprecated in favor of `podDisruptionBudget.maxUnavailable`.

maxUnavailable: 1

podDisruptionBudget:

# -- Enable Pod Disruption Budget

enabled: true

# @schema additionalProperties:{"type":"string"}

# -- Annotations for Pod Disruption Budget

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Labels for Pod Disruption Budget

labels: {}

# @schema type:[string, integer, null]

# -- Pod Disruption Budget minAvailable

minAvailable: null

# @schema type:[string, integer, null]

# -- Pod Disruption Budget maxUnavailable

maxUnavailable: null

# @schema type:[string, null]

# -- Pod Disruption Budget unhealthyPodEvictionPolicy

unhealthyPodEvictionPolicy: null

# @schema additionalProperties:true

# -- Node selector for write pods

nodeSelector: {}

# @schema item:object

# -- Topology Spread Constraints for write pods

# The value will be passed through tpl.

topologySpreadConstraints: []

tolerations: []

# -- The default is to deploy all pods in parallel.

podManagementPolicy: "Parallel"

persistence:

# -- Enable volume claims in pod spec

volumeClaimsEnabled: true

# -- Set access modes on the PersistentVolumeClaim

accessModes:

- ReadWriteOnce

# @schema skipProperties:true;additionalProperties:true

# -- Parameters used for the `data` volume when volumeClaimEnabled if false

dataVolumeParameters:

emptyDir: {}

# -- What to do with the volume when the StatefulSet is scaled down.

whenScaled: Delete

# -- What to do with the volumes when the StatefulSet is deleted.

whenDeleted: Delete

# -- Enable StatefulSetAutoDeletePVC feature

enableStatefulSetAutoDeletePVC: false

# -- Size of persistent disk

size: 10Gi

# @schema type:[string, null]

# -- Storage class to be used.

# If defined, storageClassName: <storageClass>.

# If set to "-", storageClassName: "", which disables dynamic provisioning.

# If empty or set to null, no storageClassName spec is

# set, choosing the default provisioner (gp2 on AWS, standard on GKE, AWS, and OpenStack).

storageClass: null

# @schema type:[string, null]

# -- Volume attributes class name to be used.

# If empty or set to null, no volumeAttributesClassName spec is set.

# Requires Kubernetes 1.31

volumeAttributesClassName: null

# @schema type:[object, null]

# -- Selector for persistent disk

selector: null

# @schema additionalProperties:{"type":"string"}

# -- Annotations for volume claim

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Labels for volume claim

labels: {}

serviceAccount:

# -- Specifies whether a ServiceAccount should be created

create: false

# @schema type:[string, null]

# -- The name of the ServiceAccount to use.

# If not set and create is true, a name is generated using the fullname template

name: null

# @schema item:object;itemProperties:{"name": {"type": "string"}}

# -- Image pull secrets for the service account

imagePullSecrets: []

# @schema additionalProperties:{"type":"string"}

# -- Annotations for the service account

annotations: {}

# @schema additionalProperties:{"type":"string"}

# -- Labels for the service account

labels: {}

# -- Set this toggle to false to opt out of automounting API credentials for the service account

automountServiceAccountToken: true

# -- Configuration for the read pod(s)

read:

# -- Enable the component. Requires `loki.deploymentMode` to be set to `SimpleScalable`.

enabled: true

# -- Kind of read deployment. StatefulSet and Deployment are supported.

kind: Deployment

# -- Override for the read fullname. By default, this is generated using the fullname template with "-backend"

fullnameOverride: '{{ include "loki.name" . }}-read'

# @schema type:[integer, null]

# -- Number of replicas for the read. Set to null to omit spec.replicas from the workload,

# allowing an external controller (e.g. HPA, KEDA, rollout-operator) to manage replica counts without Helm resetting them.

replicas: 3

# @schema skipProperties:true;additionalProperties:true

# -- UpdateStrategy or Strategy for the read.

strategy: