Red Hat OpenShift Container Platform

Creating a secret for Loki storage

Create a secret with cloud storage credentials, such as for Amazon Web Services (AWS), to allow the Loki Operator to access the necessary object store for log persistence.

The Loki Operator supports a few log storage options, such as AWS S3, Google Cloud Storage, Azure, Swift, Minio, OpenShift Data Foundation. The following example shows how to create a secret for AWS S3 storage. The secret created in this example, loki-s3, is referenced in "Creating a LokiStack custom resource". You can create this secret in the web console or CLI.

Procedure

Using the web console, navigate to the Project → All Projects dropdown and select Create Project.
Name the project netobserv-loki and click Create.
Navigate to the Import icon, +, in the top right corner. Paste your YAML file into the editor.

The following shows an example secret YAML file for S3 storage:
```
apiVersion: v1
kind: Secret
metadata:
  name: loki-s3
  namespace: netobserv-loki
stringData:
  access_key_id: QUtJQUlPU0ZPRE5ON0VYQU1QTEUK
  access_key_secret: d0phbHJYVXRuRkVNSS9LN01ERU5HL2JQeFJmaUNZRVhBTVBMRUtFWQo=
  bucketnames: s3-bucket-name
  endpoint: https://s3.eu-central-1.amazonaws.com
  region: eu-central-1
```
where:

metadata.namespace

Specifies the namespace for the Loki S3 secret. While this example uses netobserv-loki, you can use a different namespace for different components.

stringData.access_key_id

Specifies the access key ID for the S3 bucket.

stringData.access_key_secret

Specifies the secret access key for the S3 bucket.

stringData.bucketnames

Specifies the name of the S3 bucket.

stringData.endpoint

Specifies the endpoint URL for the S3 service.

stringData.region

Specifies the AWS region where the bucket is located.

Verification

After you create the secret, you view the secret listed under Workloads → Secrets in the web console.

Role-based access control for Loki logs

Configure role-based access control to grant users permission to view application, infrastructure, or audit logs in Loki.

By default, logging 5.8 and later does not grant users access to logs. You must configure role-based access control to grant users permission to view specific log types.

For more information on access control for Loki logs, see: "Fine grained access for Loki logs" in the Red Hat OpenShift Logging Operator documentation.

Grant non-admin users cluster-wide log access

Add users to a custom admin group to grant cluster-wide log access without making them cluster administrators. This is useful for senior engineers who need full log visibility but should not have cluster modification privileges.

Users who are members of any group specified in the adminGroups field of the LokiStack custom resource (CR) have the same read access to logs as administrators.

Example LokiStack CR

apiVersion: loki.grafana.com/v1
kind: LokiStack
metadata:
  name: loki
  namespace: netobserv-loki
spec:
  tenants:
    mode: openshift-network
    openshift:
      adminGroups:
      - cluster-admin
      - custom-admin-group

where:

spec.tenants.mode: Specifies the tenant mode. Must be openshift-network for network observability.
spec.tenants.openshift.adminGroups: Specifies the list of groups whose members have cluster-wide log access. Defaults to system:cluster-admins, cluster-admin, and dedicated-admin. Set to [] to disable.