cluster

commit 3bccc57e886b39697146a2b91763353645effa5a
parent 84de77d8f73e420dbeda1bfb967f2c48d3844ad9
Author: MTRNord <MTRNord@users.noreply.github.com>
Date:   Fri,  6 Mar 2026 11:30:26 +0100

deploy loki

Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>

Diffstat:
M
apps/talos_cluster/kustomization.yaml
 | 
1
+
A
apps/talos_cluster/loki/kustomization.yaml
 | 
8
++++++++
A
apps/talos_cluster/loki/loki-s3-secret.yaml
 | 
29
+++++++++++++++++++++++++++++
A
apps/talos_cluster/loki/namespace.yaml
 | 
4
++++
A
apps/talos_cluster/loki/release.yaml
 | 
129
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
A
apps/talos_cluster/loki/repository.yaml
 | 
8
++++++++

6 files changed, 179 insertions(+), 0 deletions(-)
diff --git a/apps/talos_cluster/kustomization.yaml b/apps/talos_cluster/kustomization.yaml
@@ -3,6 +3,7 @@ kind: Kustomization
 resources:
   - ./envoy-gateway
   - ./monitoring-stack
+  - ./loki
   - ./externaldns
   - ./authentik
   - ./draupnir4all
diff --git a/apps/talos_cluster/loki/kustomization.yaml b/apps/talos_cluster/loki/kustomization.yaml
@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: loki
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - loki-s3-secret.yaml
+  - release.yaml
diff --git a/apps/talos_cluster/loki/loki-s3-secret.yaml b/apps/talos_cluster/loki/loki-s3-secret.yaml
@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: loki-s3-credentials
+    namespace: loki
+type: Opaque
+stringData:
+    access_key: ENC[AES256_GCM,data:gwTyR1GsgApjXGkjbjuUGA35CO0=,iv:7XbpfdtSNBsWfAs0lJ0EuNq1LMZkTfd9KtJmh591hVw=,tag:QhbbxRGB1VHiW2bXTtadEw==,type:str]
+    secret_key: ENC[AES256_GCM,data:vXuOwuI2vc9UXVzmCE4LAQfYLLQDw60USSX6zNAjC6C4Xc9bdUQ8qA==,iv:yZBW57ZlleePqLm93bkb1YqBQvDKt9eD+g/7NNPzOYE=,tag:3jcpnbl/UGxUO2cNXoJJ1Q==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYOHg1NFQwNFhjU1dYUWJY
+            R0o2SnN3OWZHYUtacXF3dHcxNnRFT2ZpbmtjCkFwQk5lM1U4NVBuOGVNYzVvUE5k
+            TWU0TjZwTUUrdUxtZ3I0empEM1dOcG8KLS0tIEJma3ZraDRCd1BwU1czVWZYSVVj
+            eEJCaTlwN0tBUkhIeXowODBEUDFoNTgKAo5DQ8gKTtJpwXWBcm4n3drZW93sbpfE
+            Goucy010AZgqs9OnQZeS3q8bH78elDBEgBTtKGYz1v7EInqQwLvtcg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-06T10:28:34Z"
+    mac: ENC[AES256_GCM,data:XlknnDfnsl2P/mqEQNU4FIueRX3o4na1ooiNgd/E6iABePZoawPletfYQSjsd2w6t1oJdzt/JqYYNcXKSdUT9b8kOqRKYfhXCuaX2RWxH8gwei6uPH+RGHyBnhFKhPihX1dEcEB3kgieQUjQS9b1JX9l8YX2ahqZq/9f5qvAR/Y=,iv:9r++6TEf9efcQNoWrI5xVH1R5txby7vME2Omy212IdE=,tag:BBj5GPEVrCZ/W2+6/3ilmw==,type:str]
+    pgp: []
+    encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|integration_key|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+    version: 3.9.1
diff --git a/apps/talos_cluster/loki/namespace.yaml b/apps/talos_cluster/loki/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: loki
diff --git a/apps/talos_cluster/loki/release.yaml b/apps/talos_cluster/loki/release.yaml
@@ -0,0 +1,129 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: loki
+  namespace: loki
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: loki
+      version: "6.x.x"
+      sourceRef:
+        kind: HelmRepository
+        name: grafana
+        namespace: loki
+      interval: 24h
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    deploymentMode: SingleBinary
+
+    loki:
+      auth_enabled: false
+      commonConfig:
+        replication_factor: 1
+      storage:
+        type: s3
+        s3:
+          endpoint: hel1.your-objectstorage.com
+          region: hel1
+          bucketnames: midnightthoughts-loki
+          s3forcepathstyle: true
+          insecure: false
+      schemaConfig:
+        configs:
+          - from: "2024-01-01"
+            store: tsdb
+            object_store: s3
+            schema: v13
+            index:
+              prefix: loki_index_
+              period: 24h
+      limits_config:
+        retention_period: 720h
+      compactor:
+        retention_enabled: true
+        delete_request_store: s3
+
+    singleBinary:
+      replicas: 1
+      persistence:
+        enabled: true
+        storageClass: longhorn
+        size: 256Mi
+      extraEnv:
+        - name: AWS_ACCESS_KEY_ID
+          valueFrom:
+            secretKeyRef:
+              name: loki-s3-credentials
+              key: access_key
+        - name: AWS_SECRET_ACCESS_KEY
+          valueFrom:
+            secretKeyRef:
+              name: loki-s3-credentials
+              key: secret_key
+
+    # Disable components not needed in SingleBinary mode
+    read:
+      replicas: 0
+    write:
+      replicas: 0
+    backend:
+      replicas: 0
+
+    gateway:
+      enabled: false
+
+    monitoring:
+      serviceMonitor:
+        enabled: true
+        labels:
+          release: prometheus-stack
+      selfMonitoring:
+        enabled: false
+        grafanaAgent:
+          installOperator: false
+      lokiCanary:
+        enabled: false
+
+    test:
+      enabled: false
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: promtail
+  namespace: loki
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: promtail
+      version: "6.x.x"
+      sourceRef:
+        kind: HelmRepository
+        name: grafana
+        namespace: loki
+      interval: 24h
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    config:
+      logLevel: info
+      clients:
+        - url: http://loki-singleBinary.loki.svc.cluster.local:3100/loki/api/v1/push
+    tolerations:
+      - operator: Exists
+    serviceMonitor:
+      enabled: true
+      labels:
+        release: prometheus-stack
diff --git a/apps/talos_cluster/loki/repository.yaml b/apps/talos_cluster/loki/repository.yaml
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: grafana
+  namespace: loki
+spec:
+  interval: 24h
+  url: https://grafana.github.io/helm-charts