Skip to content

Loki setup

Loki stores logs shipped by Alloy. Not required unless log aggregation is needed.

Requires cert-manager for the gateway's TLS certificate, and an S3-compatible bucket (see dw_requirements.md).

1. Issue the gateway certificate

kubectl create namespace loki

Apply the gateway certificate with kubectl apply -f -:

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: loki-gateway-tls
  namespace: loki
spec:
  secretName: loki-gateway-tls
  issuerRef:
    name: cluster-ca
    kind: ClusterIssuer
  dnsNames:
    - loki-gateway
    - loki-gateway.loki
    - loki-gateway.loki.svc
    - loki-gateway.loki.svc.cluster.local

2. Install

helm repo add grafana https://grafana.github.io/helm-charts
helm repo update

Create loki-values.yaml with the following content:

deploymentMode: SimpleScalable

loki:
  auth_enabled: false

  schemaConfig:
    configs:
      - from: 2024-01-01
        store: tsdb
        object_store: s3
        schema: v13
        index:
          prefix: loki_index_
          period: 24h

  storage:
    type: s3
    bucketNames:
      chunks: <bucket-name>
      ruler: <bucket-name>
      admin: <bucket-name>
    s3:
      # endpoint, region, bucket names and the two keys all come from the
      # object-storage provider hosting the bucket (see dw_requirements.md).
      endpoint: <s3-endpoint>
      region: <s3-region>
      secretAccessKey: <s3-secret-key>
      accessKeyId: <s3-access-key-id>
      s3ForcePathStyle: true

  # retention_period below only takes effect with compactor retention enabled
  compactor:
    working_directory: /var/loki/compactor
    retention_enabled: true
    delete_request_store: s3
    compaction_interval: 10m

  limits_config:
    retention_period: 720h  # 30d — adjust to the desired retention

write:
  persistence:
    size: 2Gi
    storageClass: <storage-class>

backend:
  persistence:
    size: 2Gi
    storageClass: <storage-class>

# TLS-enabled gateway; certificate issued by cert-manager (see cert-manager.md)
gateway:
  service:
    port: 443
  extraVolumes:
    - name: tls
      secret:
        secretName: loki-gateway-tls
  extraVolumeMounts:
    - name: tls
      mountPath: /etc/loki-tls
      readOnly: true
  nginxConfig:
    ssl: true
    serverSnippet: |
      ssl_certificate     /etc/loki-tls/tls.crt;
      ssl_certificate_key /etc/loki-tls/tls.key;

helm upgrade --install loki grafana/loki \
  --namespace loki \
  -f loki-values.yaml

If running on RKE2, also add global.dnsService: "rke2-coredns-rke2-coredns" to loki-values.yaml and re-run the helm upgrade — RKE2's CoreDNS Service name differs from the standard kube-dns.

See the official installation guide for other deployment modes and storage backends.

Verify

kubectl get pods -n loki