---
apiVersion: v1
kind: Pod
metadata:
  annotations:
    alm-examples: |-
      [
        {
          "apiVersion": "loki.grafana.com/v1",
          "kind": "AlertingRule",
          "metadata": {
            "name": "alertingrule-sample"
          },
          "spec": {
            "groups": [
              {
                "interval": "10m",
                "name": "alerting-rules-group",
                "rules": [
                  {
                    "alert": "HighPercentageError",
                    "annotations": {
                      "description": "Application {{ $labels.job }} in namespace example-namespace has an error rate above 5% for more than 10 minutes.",
                      "summary": "High error rate detected"
                    },
                    "expr": "sum(rate({app=\"foo\", env=\"production\", kubernetes_namespace_name=\"example-namespace\"} |= \"error\" [5m])) by (job)\n  /\nsum(rate({app=\"foo\", env=\"production\", kubernetes_namespace_name=\"example-namespace\"}[5m])) by (job)\n  \u003e 0.05\n",
                    "for": "10m",
                    "labels": {
                      "severity": "warning"
                    }
                  },
                  {
                    "alert": "HttpCredentialsLeaked",
                    "annotations": {
                      "description": "Application {{ $labels.job }} in pod {{ $labels.pod }} is leaking HTTP basic auth credentials in logs.",
                      "summary": "HTTP credentials leaked in logs"
                    },
                    "expr": "sum by (cluster, job, pod) (count_over_time({kubernetes_namespace_name=\"example-namespace\"} |~ \"http(s?)://(\\\\w+):(\\\\w+)@\" [5m]) \u003e 0)",
                    "for": "10m",
                    "labels": {
                      "severity": "critical"
                    }
                  }
                ]
              }
            ],
            "tenantID": "application"
          }
        },
        {
          "apiVersion": "loki.grafana.com/v1",
          "kind": "LokiStack",
          "metadata": {
            "name": "lokistack-sample"
          },
          "spec": {
            "size": "1x.small",
            "storage": {
              "secret": {
                "name": "test"
              }
            },
            "storageClassName": "standard"
          }
        },
        {
          "apiVersion": "loki.grafana.com/v1",
          "kind": "RecordingRule",
          "metadata": {
            "name": "recordingrule-sample"
          },
          "spec": {
            "groups": [
              {
                "interval": "10m",
                "name": "recording-rules-group",
                "rules": [
                  {
                    "expr": "sum(rate({container=\"myservice\"}[10m]))\n",
                    "record": "myservice:requests:rate10m"
                  },
                  {
                    "expr": "sum(rate({container=\"otherservice\"}[1m]))\n",
                    "record": "otherservice:requests:rate1m"
                  }
                ]
              }
            ],
            "tenantID": "test-tenant"
          }
        },
        {
          "apiVersion": "loki.grafana.com/v1",
          "kind": "RulerConfig",
          "metadata": {
            "name": "rulerconfig-sample"
          },
          "spec": {
            "alertmanager": {
              "discovery": {
                "enableSRV": true,
                "refreshInterval": "1m"
              },
              "enableV2": true,
              "endpoints": [
                "http://alertmanager-host1.mycompany.org",
                "http://alertmanager-host2.mycompany.org"
              ],
              "externalLabels": {
                "environment": "production",
                "region": "us-east-2"
              },
              "externalUrl": "http://www.mycompany.org/alerts",
              "notificationQueue": {
                "capacity": 1000,
                "forGracePeriod": "10m",
                "forOutageTolerance": "1h",
                "resendDelay": "1m",
                "timeout": "30s"
              }
            },
            "evaluationInterval": "1m",
            "pollInterval": "1m",
            "remoteWrite": {
              "client": {
                "authorization": "basic",
                "authorizationSecretName": "my-secret-resource",
                "name": "remote-write-log-metrics",
                "proxyUrl": "http://proxy-host.mycompany.org",
                "relabelConfigs": [
                  {
                    "action": "replace",
                    "regex": "ALERTS.*",
                    "replacement": "$1",
                    "separator": "",
                    "sourceLabels": [
                      "labelc",
                      "labeld"
                    ],
                    "targetLabel": "labelnew"
                  }
                ],
                "timeout": "30s",
                "url": "http://remote-write-host.mycompany.org"
              },
              "enabled": true,
              "refreshPeriod": "10s"
            }
          }
        }
      ]
    capabilities: Full Lifecycle
    categories: OpenShift Optional, Logging & Tracing, Observability
    certified: "false"
    containerImage: registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8ae8018c3e010408bcfaedc2647c9f5fb0e1f8b2418cb7210e56b62d397dd36b
    createdAt: "2026-06-30T11:12:06Z"
    description: |
      The Loki Operator for OCP provides a means for configuring and managing a Loki stack for cluster logging.
      ## Prerequisites and Requirements
      ### Loki Operator Namespace
      The Loki Operator must be deployed to the global operator group namespace `openshift-operators-redhat`.
      ### Memory Considerations
      Loki is a memory intensive application.  The initial
      set of OCP nodes may not be large enough to support the Loki stack.  Additional OCP nodes must be added
      to the OCP cluster if you desire to run with the recommended (or better) memory.
    features.operators.openshift.io/disconnected: "true"
    features.operators.openshift.io/fips-compliant: "true"
    features.operators.openshift.io/proxy-aware: "true"
    features.operators.openshift.io/tls-profiles: "true"
    features.operators.openshift.io/token-auth-aws: "true"
    features.operators.openshift.io/token-auth-azure: "true"
    features.operators.openshift.io/token-auth-gcp: "true"
    k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.134.0.22/23"],"mac_address":"0a:58:0a:86:00:16","gateway_ips":["10.134.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.134.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.134.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.134.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.134.0.1"}],"ip_address":"10.134.0.22/23","gateway_ip":"10.134.0.1","role":"primary"}}'
    k8s.v1.cni.cncf.io/network-status: |-
      [{
          "name": "ovn-kubernetes",
          "interface": "eth0",
          "ips": [
              "10.134.0.22"
          ],
          "mac": "0a:58:0a:86:00:16",
          "default": true,
          "dns": {}
      }]
    kubectl.kubernetes.io/default-container: manager
    olm.operatorGroup: loki-operator
    olm.operatorNamespace: openshift-operators-redhat
    olm.skipRange: '>=6.2.0-0 <6.6.2'
    olm.targetNamespaces: ""
    olmcahash: 4d113596fdc4259b61c90563d8823496451c9bde2f653bfc3464edaceddc51b5
    openshift.io/scc: restricted-v2
    operatorframework.io/cluster-monitoring: "true"
    operatorframework.io/properties: '{"properties":[{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"AlertingRule","version":"v1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"AlertingRule","version":"v1beta1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"LokiStack","version":"v1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"LokiStack","version":"v1beta1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"RecordingRule","version":"v1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"RecordingRule","version":"v1beta1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"RulerConfig","version":"v1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"RulerConfig","version":"v1beta1"}},{"type":"olm.maxOpenShiftVersion","value":"4.23"},{"type":"olm.package","value":{"packageName":"loki-operator","version":"6.6.2"}}]}'
    operatorframework.io/suggested-namespace: openshift-operators-redhat
    operators.openshift.io/valid-subscription: '["OpenShift Kubernetes Engine", "OpenShift
      Container Platform", "OpenShift Platform Plus"]'
    operators.operatorframework.io/builder: operator-sdk-unknown
    operators.operatorframework.io/project_layout: go.kubebuilder.io/v4
    seccomp.security.alpha.kubernetes.io/pod: runtime/default
    security.openshift.io/validated-scc-subject-type: user
    support: AOS Cluster Logging
  creationTimestamp: "2026-10-30T03:12:15Z"
  generateName: loki-operator-controller-manager-75cc486f67-
  generation: 1
  labels:
    app.kubernetes.io/managed-by: operator-lifecycle-manager
    app.kubernetes.io/name: loki-operator
    app.kubernetes.io/part-of: cluster-logging
    name: loki-operator-controller-manager
    pod-template-hash: 75cc486f67
    topology.kubernetes.io/region: us-east-1
    topology.kubernetes.io/zone: us-east-1a
  managedFields:
  - apiVersion: v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          f:k8s.ovn.org/pod-networks: {}
    manager: ip-10-0-128-202
    operation: Update
    subresource: status
    time: "2026-10-30T03:12:15Z"
  - apiVersion: v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .: {}
          f:alm-examples: {}
          f:capabilities: {}
          f:categories: {}
          f:certified: {}
          f:containerImage: {}
          f:createdAt: {}
          f:description: {}
          f:features.operators.openshift.io/disconnected: {}
          f:features.operators.openshift.io/fips-compliant: {}
          f:features.operators.openshift.io/proxy-aware: {}
          f:features.operators.openshift.io/tls-profiles: {}
          f:features.operators.openshift.io/token-auth-aws: {}
          f:features.operators.openshift.io/token-auth-azure: {}
          f:features.operators.openshift.io/token-auth-gcp: {}
          f:kubectl.kubernetes.io/default-container: {}
          f:olm.operatorGroup: {}
          f:olm.operatorNamespace: {}
          f:olm.skipRange: {}
          f:olm.targetNamespaces: {}
          f:olmcahash: {}
          f:operatorframework.io/cluster-monitoring: {}
          f:operatorframework.io/properties: {}
          f:operatorframework.io/suggested-namespace: {}
          f:operators.openshift.io/valid-subscription: {}
          f:operators.operatorframework.io/builder: {}
          f:operators.operatorframework.io/project_layout: {}
          f:support: {}
        f:generateName: {}
        f:labels:
          .: {}
          f:app.kubernetes.io/managed-by: {}
          f:app.kubernetes.io/name: {}
          f:app.kubernetes.io/part-of: {}
          f:name: {}
          f:pod-template-hash: {}
        f:ownerReferences:
          .: {}
          k:{"uid":"78b2a363-7f01-429b-aec2-864cd23e8ee2"}: {}
      f:spec:
        f:containers:
          k:{"name":"manager"}:
            .: {}
            f:args: {}
            f:command: {}
            f:env:
              .: {}
              k:{"name":"OPERATOR_CONDITION_NAME"}:
                .: {}
                f:name: {}
                f:value: {}
              k:{"name":"RELATED_IMAGE_GATEWAY"}:
                .: {}
                f:name: {}
                f:value: {}
              k:{"name":"RELATED_IMAGE_LOKI"}:
                .: {}
                f:name: {}
                f:value: {}
              k:{"name":"RELATED_IMAGE_OPA"}:
                .: {}
                f:name: {}
                f:value: {}
              k:{"name":"RELATED_IMAGE_PASSTHROUGH_GATEWAY"}:
                .: {}
                f:name: {}
                f:value: {}
            f:image: {}
            f:imagePullPolicy: {}
            f:livenessProbe:
              .: {}
              f:failureThreshold: {}
              f:httpGet:
                .: {}
                f:path: {}
                f:port: {}
                f:scheme: {}
              f:initialDelaySeconds: {}
              f:periodSeconds: {}
              f:successThreshold: {}
              f:timeoutSeconds: {}
            f:name: {}
            f:ports:
              .: {}
              k:{"containerPort":8443,"protocol":"TCP"}:
                .: {}
                f:containerPort: {}
                f:name: {}
                f:protocol: {}
              k:{"containerPort":9443,"protocol":"TCP"}:
                .: {}
                f:containerPort: {}
                f:name: {}
                f:protocol: {}
            f:readinessProbe:
              .: {}
              f:failureThreshold: {}
              f:httpGet:
                .: {}
                f:path: {}
                f:port: {}
                f:scheme: {}
              f:initialDelaySeconds: {}
              f:periodSeconds: {}
              f:successThreshold: {}
              f:timeoutSeconds: {}
            f:resources: {}
            f:securityContext:
              .: {}
              f:allowPrivilegeEscalation: {}
              f:capabilities:
                .: {}
                f:drop: {}
            f:terminationMessagePath: {}
            f:terminationMessagePolicy: {}
            f:volumeMounts:
              .: {}
              k:{"mountPath":"/apiserver.local.config/certificates"}:
                .: {}
                f:mountPath: {}
                f:name: {}
              k:{"mountPath":"/controller_manager_config.yaml"}:
                .: {}
                f:mountPath: {}
                f:name: {}
                f:subPath: {}
              k:{"mountPath":"/tmp/k8s-metrics-server/serving-certs"}:
                .: {}
                f:mountPath: {}
                f:name: {}
                f:readOnly: {}
              k:{"mountPath":"/tmp/k8s-webhook-server/serving-certs"}:
                .: {}
                f:mountPath: {}
                f:name: {}
        f:dnsPolicy: {}
        f:enableServiceLinks: {}
        f:nodeSelector: {}
        f:restartPolicy: {}
        f:schedulerName: {}
        f:securityContext:
          .: {}
          f:runAsNonRoot: {}
          f:seccompProfile:
            .: {}
            f:type: {}
        f:serviceAccount: {}
        f:serviceAccountName: {}
        f:terminationGracePeriodSeconds: {}
        f:volumes:
          .: {}
          k:{"name":"apiservice-cert"}:
            .: {}
            f:name: {}
            f:secret:
              .: {}
              f:defaultMode: {}
              f:items: {}
              f:secretName: {}
          k:{"name":"loki-operator-metrics-cert"}:
            .: {}
            f:name: {}
            f:secret:
              .: {}
              f:defaultMode: {}
              f:optional: {}
              f:secretName: {}
          k:{"name":"manager-config"}:
            .: {}
            f:configMap:
              .: {}
              f:defaultMode: {}
              f:name: {}
            f:name: {}
          k:{"name":"webhook-cert"}:
            .: {}
            f:name: {}
            f:secret:
              .: {}
              f:defaultMode: {}
              f:items: {}
              f:secretName: {}
    manager: kube-controller-manager
    operation: Update
    time: "2026-10-30T03:12:15Z"
  - apiVersion: v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          f:k8s.v1.cni.cncf.io/network-status: {}
    manager: multus-daemon
    operation: Update
    subresource: status
    time: "2026-10-30T03:12:16Z"
  - apiVersion: v1
    fieldsType: FieldsV1
    fieldsV1:
      f:status:
        f:conditions:
          k:{"type":"ContainersReady"}:
            .: {}
            f:lastProbeTime: {}
            f:lastTransitionTime: {}
            f:observedGeneration: {}
            f:status: {}
            f:type: {}
          k:{"type":"Initialized"}:
            .: {}
            f:lastProbeTime: {}
            f:lastTransitionTime: {}
            f:observedGeneration: {}
            f:status: {}
            f:type: {}
          k:{"type":"PodReadyToStartContainers"}:
            .: {}
            f:lastProbeTime: {}
            f:lastTransitionTime: {}
            f:observedGeneration: {}
            f:status: {}
            f:type: {}
          k:{"type":"PodScheduled"}:
            f:observedGeneration: {}
          k:{"type":"Ready"}:
            .: {}
            f:lastProbeTime: {}
            f:lastTransitionTime: {}
            f:observedGeneration: {}
            f:status: {}
            f:type: {}
        f:containerStatuses: {}
        f:hostIP: {}
        f:hostIPs: {}
        f:observedGeneration: {}
        f:phase: {}
        f:podIP: {}
        f:podIPs:
          .: {}
          k:{"ip":"10.134.0.22"}:
            .: {}
            f:ip: {}
        f:startTime: {}
    manager: kubelet
    operation: Update
    subresource: status
    time: "2026-10-30T03:12:30Z"
  name: loki-operator-controller-manager-75cc486f67-ld99t
  namespace: openshift-operators-redhat
  ownerReferences:
  - apiVersion: apps/v1
    blockOwnerDeletion: true
    controller: true
    kind: ReplicaSet
    name: loki-operator-controller-manager-75cc486f67
    uid: 78b2a363-7f01-429b-aec2-864cd23e8ee2
  resourceVersion: "18644"
  uid: e7c51bfa-baa7-479b-97a2-dd16bb9b4032
spec:
  containers:
  - args:
    - --config=controller_manager_config.yaml
    command:
    - /manager
    env:
    - name: RELATED_IMAGE_LOKI
      value: registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:bd1c5e899f48daac4397d5c77cc85bc87d400f4fd32f71f2581c3a5dd35e5380
    - name: RELATED_IMAGE_GATEWAY
      value: registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:081651d6a92c9832db42e1fcf595e15891de2b311128557015b7404203639400
    - name: RELATED_IMAGE_OPA
      value: registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:18a8f259ecf962521de146aff2486f5cf792f6a5e232766f5c7250d757bd6ce6
    - name: RELATED_IMAGE_PASSTHROUGH_GATEWAY
      value: registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8ae8018c3e010408bcfaedc2647c9f5fb0e1f8b2418cb7210e56b62d397dd36b
    - name: OPERATOR_CONDITION_NAME
      value: loki-operator.v6.6.2
    image: registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8ae8018c3e010408bcfaedc2647c9f5fb0e1f8b2418cb7210e56b62d397dd36b
    imagePullPolicy: IfNotPresent
    livenessProbe:
      failureThreshold: 3
      httpGet:
        path: /healthz
        port: 8081
        scheme: HTTP
      initialDelaySeconds: 15
      periodSeconds: 20
      successThreshold: 1
      timeoutSeconds: 1
    name: manager
    ports:
    - containerPort: 9443
      name: webhook-server
      protocol: TCP
    - containerPort: 8443
      name: metrics
      protocol: TCP
    readinessProbe:
      failureThreshold: 3
      httpGet:
        path: /readyz
        port: 8081
        scheme: HTTP
      initialDelaySeconds: 5
      periodSeconds: 10
      successThreshold: 1
      timeoutSeconds: 1
    resources: {}
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      runAsUser: 1000690000
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /controller_manager_config.yaml
      name: manager-config
      subPath: controller_manager_config.yaml
    - mountPath: /tmp/k8s-metrics-server/serving-certs
      name: loki-operator-metrics-cert
      readOnly: true
    - mountPath: /apiserver.local.config/certificates
      name: apiservice-cert
    - mountPath: /tmp/k8s-webhook-server/serving-certs
      name: webhook-cert
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: kube-api-access-jjrnn
      readOnly: true
  dnsPolicy: ClusterFirst
  enableServiceLinks: true
  imagePullSecrets:
  - name: loki-operator-controller-manager-dockercfg-jwh2d
  nodeName: ip-10-0-128-202.ec2.internal
  nodeSelector:
    kubernetes.io/os: linux
  preemptionPolicy: PreemptLowerPriority
  priority: 0
  restartPolicy: Always
  schedulerName: default-scheduler
  securityContext:
    fsGroup: 1000690000
    runAsNonRoot: true
    seLinuxOptions:
      level: s0:c26,c20
    seccompProfile:
      type: RuntimeDefault
  serviceAccount: loki-operator-controller-manager
  serviceAccountName: loki-operator-controller-manager
  terminationGracePeriodSeconds: 10
  tolerations:
  - effect: NoExecute
    key: node.kubernetes.io/not-ready
    operator: Exists
    tolerationSeconds: 300
  - effect: NoExecute
    key: node.kubernetes.io/unreachable
    operator: Exists
    tolerationSeconds: 300
  volumes:
  - configMap:
      defaultMode: 420
      name: loki-operator-manager-config
    name: manager-config
  - name: loki-operator-metrics-cert
    secret:
      defaultMode: 420
      optional: true
      secretName: loki-operator-metrics
  - name: apiservice-cert
    secret:
      defaultMode: 420
      items:
      - key: tls.crt
        path: apiserver.crt
      - key: tls.key
        path: apiserver.key
      secretName: loki-operator-controller-manager-service-cert
  - name: webhook-cert
    secret:
      defaultMode: 420
      items:
      - key: tls.crt
        path: tls.crt
      - key: tls.key
        path: tls.key
      secretName: loki-operator-controller-manager-service-cert
  - name: kube-api-access-jjrnn
    projected:
      defaultMode: 420
      sources:
      - serviceAccountToken:
          expirationSeconds: 3607
          path: token
      - configMap:
          items:
          - key: ca.crt
            path: ca.crt
          name: kube-root-ca.crt
      - downwardAPI:
          items:
          - fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
            path: namespace
      - configMap:
          items:
          - key: service-ca.crt
            path: service-ca.crt
          name: openshift-service-ca.crt
status:
  conditions:
  - lastProbeTime: null
    lastTransitionTime: "2026-10-30T03:12:19Z"
    observedGeneration: 1
    status: "True"
    type: PodReadyToStartContainers
  - lastProbeTime: null
    lastTransitionTime: "2026-10-30T03:12:15Z"
    observedGeneration: 1
    status: "True"
    type: Initialized
  - lastProbeTime: null
    lastTransitionTime: "2026-10-30T03:12:30Z"
    observedGeneration: 1
    status: "True"
    type: Ready
  - lastProbeTime: null
    lastTransitionTime: "2026-10-30T03:12:30Z"
    observedGeneration: 1
    status: "True"
    type: ContainersReady
  - lastProbeTime: null
    lastTransitionTime: "2026-10-30T03:12:15Z"
    observedGeneration: 1
    status: "True"
    type: PodScheduled
  containerStatuses:
  - containerID: cri-o://24f760eb2410b2c16dd803c231b86afa17e63b91df29beb9bf4de1c5fb1df928
    image: registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8ae8018c3e010408bcfaedc2647c9f5fb0e1f8b2418cb7210e56b62d397dd36b
    imageID: registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8ae8018c3e010408bcfaedc2647c9f5fb0e1f8b2418cb7210e56b62d397dd36b
    lastState: {}
    name: manager
    ready: true
    resources: {}
    restartCount: 0
    started: true
    state:
      running:
        startedAt: "2026-10-30T03:12:19Z"
    user:
      linux:
        gid: 0
        supplementalGroups:
        - 0
        - 1000690000
        uid: 1000690000
    volumeMounts:
    - mountPath: /controller_manager_config.yaml
      name: manager-config
    - mountPath: /tmp/k8s-metrics-server/serving-certs
      name: loki-operator-metrics-cert
      readOnly: true
      recursiveReadOnly: Disabled
    - mountPath: /apiserver.local.config/certificates
      name: apiservice-cert
    - mountPath: /tmp/k8s-webhook-server/serving-certs
      name: webhook-cert
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: kube-api-access-jjrnn
      readOnly: true
      recursiveReadOnly: Disabled
  hostIP: 10.0.128.202
  hostIPs:
  - ip: 10.0.128.202
  observedGeneration: 1
  phase: Running
  podIP: 10.134.0.22
  podIPs:
  - ip: 10.134.0.22
  qosClass: BestEffort
  startTime: "2026-10-30T03:12:15Z"