Setting Up LokiStack on OpenShift: A Step-by-Step Guide

techhadoop OCP

Deploying the LokiStack Operator in OpenShift requires establishing an S3-compatible Object Storage bucket (such as AWS S3, MinIO, or OpenShift Data Foundation NooBaa), storing the bucket credentials in a Kubernetes Secret, and defining a LokiStack Custom Resource.

Step 1: Install the Loki Operator via OLM

Before creating the LokiStack instance, install the Loki Operator from OperatorHub into the openshift-operators-redhat namespace.

YAML

apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: loki-operator
  namespace: openshift-operators-redhat
spec:
  channel: stable-5.x # Or the matching channel for your OCP release
  name: loki-operator
  source: redhat-operators
  sourceNamespace: openshift-marketplace

Step 2: Create the Object Storage Credentials Secret

Loki requires access to an S3-compatible object storage bucket to store chunked log data and index files.

  1. Create a Secret in the openshift-logging namespace containing your S3 bucket access keys and endpoint configuration:

YAML

apiVersion: v1
kind: Secret
metadata:
  name: logging-loki-s3
  namespace: openshift-logging
stringData:
  access_key_id: "YOUR_S3_ACCESS_KEY"
  access_key_secret: "YOUR_S3_SECRET_KEY"
  bucketnames: "ocp-loki-logs-bucket"
  endpoint: "https://s3.us-east-1.amazonaws.com" # Or internal MinIO/NooBaa endpoint URL
  region: "us-east-1"
type: Opaque

Note for AWS IAM Roles for Service Accounts (IRSA) / STS: If using AWS IRSA or ROSA with STS, you can omit access_key_id and access_key_secret in favor of an AWS IAM role annotation on the service account.

Step 3: Deploy the LokiStack Custom Resource

Define the size and replication footprint of your Loki cluster using the LokiStack CRD. Red Hat provides pre-tuned size profiles (1x.extra-small, 1x.small, 1x.medium, etc.) to automatically calculate resource limits and replica counts.

YAML

apiVersion: loki.grafana.com/v1
kind: LokiStack
metadata:
  name: logging-loki
  namespace: openshift-logging
spec:
  size: 1x.small # Pre-tuned production profile (extra-small, small, medium)
  storage:
    schemas:
      - version: v13
        effectiveDate: "2024-01-01"
    secret:
      name: logging-loki-s3
      type: s3
  storageClassName: fast-ssd # Fast block storage PVCs for Loki write-ahead logs (WAL)
  managementState: Managed
  replication:
    factor: 2 # Number of chunk replicas across Loki ingesters

Apply the manifest:

oc apply -f lokistack.yaml

Step 4: Verify Deployment Health

Check that the Loki components (Ingester, Querier, Query-Frontend, Distributor, Compactor, Gateway) are fully provisioned and healthy:

  1. Verify Pod Readiness:
    Bashoc get pods -n openshift-logging -l app.kubernetes.io/name=loki
  2. Verify LokiStack CR Status:
    Bashoc get lokistack logging-loki -n openshift-logging -o jsonpath='{.status.conditions}' | jq Ensure all conditions (such as Pending, Ready) transition to Status: "True".

Step 5: Connect Vector to Loki (ClusterLogForwarder)

Now that LokiStack is running, configure the ClusterLogForwarder to collect and stream logs into your new Loki instance using the internal Gateway route.

YAML

apiVersion: logging.openshift.io/v1
kind: ClusterLogForwarder
metadata:
  name: instance
  namespace: openshift-logging
spec:
  outputs:
    - name: default-loki-stack
      type: lokiStack
      lokiStack:
        target:
          name: logging-loki
          namespace: openshift-logging
        authentication:
          token:
            from: serviceAccount
      url: 'https://logging-loki-gateway.openshift-logging.svc:8080'
  pipelines:
    - name: all-logs-to-loki
      inputRefs:
        - application
        - infrastructure
        - audit
      outputRefs:
        - default-loki-stack

Leave a Reply