--- apiVersion: v1 items: - apiVersion: v1 kind: Pod metadata: annotations: alm-examples: |- [ { "apiVersion": "loki.grafana.com/v1", "kind": "AlertingRule", "metadata": { "name": "alertingrule-sample" }, "spec": { "groups": [ { "interval": "10m", "name": "alerting-rules-group", "rules": [ { "alert": "HighPercentageError", "annotations": { "description": "Application {{ $labels.job }} in namespace example-namespace has an error rate above 5% for more than 10 minutes.", "summary": "High error rate detected" }, "expr": "sum(rate({app=\"foo\", env=\"production\", kubernetes_namespace_name=\"example-namespace\"} |= \"error\" [5m])) by (job)\n /\nsum(rate({app=\"foo\", env=\"production\", kubernetes_namespace_name=\"example-namespace\"}[5m])) by (job)\n \u003e 0.05\n", "for": "10m", "labels": { "severity": "warning" } }, { "alert": "HttpCredentialsLeaked", "annotations": { "description": "Application {{ $labels.job }} in pod {{ $labels.pod }} is leaking HTTP basic auth credentials in logs.", "summary": "HTTP credentials leaked in logs" }, "expr": "sum by (cluster, job, pod) (count_over_time({kubernetes_namespace_name=\"example-namespace\"} |~ \"http(s?)://(\\\\w+):(\\\\w+)@\" [5m]) \u003e 0)", "for": "10m", "labels": { "severity": "critical" } } ] } ], "tenantID": "application" } }, { "apiVersion": "loki.grafana.com/v1", "kind": "LokiStack", "metadata": { "name": "lokistack-sample" }, "spec": { "size": "1x.small", "storage": { "secret": { "name": "test" } }, "storageClassName": "standard" } }, { "apiVersion": "loki.grafana.com/v1", "kind": "RecordingRule", "metadata": { "name": "recordingrule-sample" }, "spec": { "groups": [ { "interval": "10m", "name": "recording-rules-group", "rules": [ { "expr": "sum(rate({container=\"myservice\"}[10m]))\n", "record": "myservice:requests:rate10m" }, { "expr": "sum(rate({container=\"otherservice\"}[1m]))\n", "record": "otherservice:requests:rate1m" } ] } ], "tenantID": "test-tenant" } }, { "apiVersion": "loki.grafana.com/v1", "kind": "RulerConfig", "metadata": { "name": "rulerconfig-sample" }, "spec": { "alertmanager": { "discovery": { "enableSRV": true, "refreshInterval": "1m" }, "enableV2": true, "endpoints": [ "http://alertmanager-host1.mycompany.org", "http://alertmanager-host2.mycompany.org" ], "externalLabels": { "environment": "production", "region": "us-east-2" }, "externalUrl": "http://www.mycompany.org/alerts", "notificationQueue": { "capacity": 1000, "forGracePeriod": "10m", "forOutageTolerance": "1h", "resendDelay": "1m", "timeout": "30s" } }, "evaluationInterval": "1m", "pollInterval": "1m", "remoteWrite": { "client": { "authorization": "basic", "authorizationSecretName": "my-secret-resource", "name": "remote-write-log-metrics", "proxyUrl": "http://proxy-host.mycompany.org", "relabelConfigs": [ { "action": "replace", "regex": "ALERTS.*", "replacement": "$1", "separator": "", "sourceLabels": [ "labelc", "labeld" ], "targetLabel": "labelnew" } ], "timeout": "30s", "url": "http://remote-write-host.mycompany.org" }, "enabled": true, "refreshPeriod": "10s" } } } ] capabilities: Full Lifecycle categories: OpenShift Optional, Logging & Tracing, Observability certified: "false" containerImage: registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8ae8018c3e010408bcfaedc2647c9f5fb0e1f8b2418cb7210e56b62d397dd36b createdAt: "2026-06-30T11:12:06Z" description: | The Loki Operator for OCP provides a means for configuring and managing a Loki stack for cluster logging. ## Prerequisites and Requirements ### Loki Operator Namespace The Loki Operator must be deployed to the global operator group namespace `openshift-operators-redhat`. ### Memory Considerations Loki is a memory intensive application. The initial set of OCP nodes may not be large enough to support the Loki stack. Additional OCP nodes must be added to the OCP cluster if you desire to run with the recommended (or better) memory. features.operators.openshift.io/disconnected: "true" features.operators.openshift.io/fips-compliant: "true" features.operators.openshift.io/proxy-aware: "true" features.operators.openshift.io/tls-profiles: "true" features.operators.openshift.io/token-auth-aws: "true" features.operators.openshift.io/token-auth-azure: "true" features.operators.openshift.io/token-auth-gcp: "true" k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.132.0.39/23"],"mac_address":"0a:58:0a:84:00:27","gateway_ips":["10.132.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.132.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.132.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.132.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.132.0.1"}],"ip_address":"10.132.0.39/23","gateway_ip":"10.132.0.1","role":"primary"}}' k8s.v1.cni.cncf.io/network-status: |- [{ "name": "ovn-kubernetes", "interface": "eth0", "ips": [ "10.132.0.39" ], "mac": "0a:58:0a:84:00:27", "default": true, "dns": {} }] kubectl.kubernetes.io/default-container: manager olm.operatorGroup: loki-operator olm.operatorNamespace: openshift-operators-redhat olm.skipRange: '>=6.2.0-0 <6.6.2' olm.targetNamespaces: "" olmcahash: 6603fee3cfd87ca23e154edfb53fae9d4ba6907a5ec5dff6ec0b6baf0bc4a735 openshift.io/scc: restricted-v2 operatorframework.io/cluster-monitoring: "true" operatorframework.io/properties: '{"properties":[{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"AlertingRule","version":"v1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"AlertingRule","version":"v1beta1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"LokiStack","version":"v1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"LokiStack","version":"v1beta1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"RecordingRule","version":"v1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"RecordingRule","version":"v1beta1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"RulerConfig","version":"v1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"RulerConfig","version":"v1beta1"}},{"type":"olm.maxOpenShiftVersion","value":"4.23"},{"type":"olm.package","value":{"packageName":"loki-operator","version":"6.6.2"}}]}' operatorframework.io/suggested-namespace: openshift-operators-redhat operators.openshift.io/valid-subscription: '["OpenShift Kubernetes Engine", "OpenShift Container Platform", "OpenShift Platform Plus"]' operators.operatorframework.io/builder: operator-sdk-unknown operators.operatorframework.io/project_layout: go.kubebuilder.io/v4 seccomp.security.alpha.kubernetes.io/pod: runtime/default security.openshift.io/validated-scc-subject-type: user support: AOS Cluster Logging creationTimestamp: "2026-10-31T00:05:11Z" generateName: loki-operator-controller-manager-5666dc7fd5- generation: 1 labels: app.kubernetes.io/managed-by: operator-lifecycle-manager app.kubernetes.io/name: loki-operator app.kubernetes.io/part-of: cluster-logging name: loki-operator-controller-manager pod-template-hash: 5666dc7fd5 topology.kubernetes.io/region: us-east-2 topology.kubernetes.io/zone: us-east-2a managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:metadata: f:annotations: f:k8s.ovn.org/pod-networks: {} manager: ip-10-0-140-246 operation: Update subresource: status time: "2026-10-31T00:05:11Z" - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:metadata: f:annotations: .: {} f:alm-examples: {} f:capabilities: {} f:categories: {} f:certified: {} f:containerImage: {} f:createdAt: {} f:description: {} f:features.operators.openshift.io/disconnected: {} f:features.operators.openshift.io/fips-compliant: {} f:features.operators.openshift.io/proxy-aware: {} f:features.operators.openshift.io/tls-profiles: {} f:features.operators.openshift.io/token-auth-aws: {} f:features.operators.openshift.io/token-auth-azure: {} f:features.operators.openshift.io/token-auth-gcp: {} f:kubectl.kubernetes.io/default-container: {} f:olm.operatorGroup: {} f:olm.operatorNamespace: {} f:olm.skipRange: {} f:olm.targetNamespaces: {} f:olmcahash: {} f:operatorframework.io/cluster-monitoring: {} f:operatorframework.io/properties: {} f:operatorframework.io/suggested-namespace: {} f:operators.openshift.io/valid-subscription: {} f:operators.operatorframework.io/builder: {} f:operators.operatorframework.io/project_layout: {} f:support: {} f:generateName: {} f:labels: .: {} f:app.kubernetes.io/managed-by: {} f:app.kubernetes.io/name: {} f:app.kubernetes.io/part-of: {} f:name: {} f:pod-template-hash: {} f:ownerReferences: .: {} k:{"uid":"f268d587-4ceb-4ede-a8b1-32a104a3d676"}: {} f:spec: f:containers: k:{"name":"manager"}: .: {} f:args: {} f:command: {} f:env: .: {} k:{"name":"OPERATOR_CONDITION_NAME"}: .: {} f:name: {} f:value: {} k:{"name":"RELATED_IMAGE_GATEWAY"}: .: {} f:name: {} f:value: {} k:{"name":"RELATED_IMAGE_LOKI"}: .: {} f:name: {} f:value: {} k:{"name":"RELATED_IMAGE_OPA"}: .: {} f:name: {} f:value: {} k:{"name":"RELATED_IMAGE_PASSTHROUGH_GATEWAY"}: .: {} f:name: {} f:value: {} f:image: {} f:imagePullPolicy: {} f:livenessProbe: .: {} f:failureThreshold: {} f:httpGet: .: {} f:path: {} f:port: {} f:scheme: {} f:initialDelaySeconds: {} f:periodSeconds: {} f:successThreshold: {} f:timeoutSeconds: {} f:name: {} f:ports: .: {} k:{"containerPort":8443,"protocol":"TCP"}: .: {} f:containerPort: {} f:name: {} f:protocol: {} k:{"containerPort":9443,"protocol":"TCP"}: .: {} f:containerPort: {} f:name: {} f:protocol: {} f:readinessProbe: .: {} f:failureThreshold: {} f:httpGet: .: {} f:path: {} f:port: {} f:scheme: {} f:initialDelaySeconds: {} f:periodSeconds: {} f:successThreshold: {} f:timeoutSeconds: {} f:resources: {} f:securityContext: .: {} f:allowPrivilegeEscalation: {} f:capabilities: .: {} f:drop: {} f:terminationMessagePath: {} f:terminationMessagePolicy: {} f:volumeMounts: .: {} k:{"mountPath":"/apiserver.local.config/certificates"}: .: {} f:mountPath: {} f:name: {} k:{"mountPath":"/controller_manager_config.yaml"}: .: {} f:mountPath: {} f:name: {} f:subPath: {} k:{"mountPath":"/tmp/k8s-metrics-server/serving-certs"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/tmp/k8s-webhook-server/serving-certs"}: .: {} f:mountPath: {} f:name: {} f:dnsPolicy: {} f:enableServiceLinks: {} f:nodeSelector: {} f:restartPolicy: {} f:schedulerName: {} f:securityContext: .: {} f:runAsNonRoot: {} f:seccompProfile: .: {} f:type: {} f:serviceAccount: {} f:serviceAccountName: {} f:terminationGracePeriodSeconds: {} f:volumes: .: {} k:{"name":"apiservice-cert"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:items: {} f:secretName: {} k:{"name":"loki-operator-metrics-cert"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:optional: {} f:secretName: {} k:{"name":"manager-config"}: .: {} f:configMap: .: {} f:defaultMode: {} f:name: {} f:name: {} k:{"name":"webhook-cert"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:items: {} f:secretName: {} manager: kube-controller-manager operation: Update time: "2026-10-31T00:05:11Z" - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:metadata: f:annotations: f:k8s.v1.cni.cncf.io/network-status: {} manager: multus-daemon operation: Update subresource: status time: "2026-10-31T00:05:11Z" - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:status: f:conditions: k:{"type":"ContainersReady"}: .: {} f:lastProbeTime: {} f:lastTransitionTime: {} f:observedGeneration: {} f:status: {} f:type: {} k:{"type":"Initialized"}: .: {} f:lastProbeTime: {} f:lastTransitionTime: {} f:observedGeneration: {} f:status: {} f:type: {} k:{"type":"PodReadyToStartContainers"}: .: {} f:lastProbeTime: {} f:lastTransitionTime: {} f:observedGeneration: {} f:status: {} f:type: {} k:{"type":"PodScheduled"}: f:observedGeneration: {} k:{"type":"Ready"}: .: {} f:lastProbeTime: {} f:lastTransitionTime: {} f:observedGeneration: {} f:status: {} f:type: {} f:containerStatuses: {} f:hostIP: {} f:hostIPs: {} f:observedGeneration: {} f:phase: {} f:podIP: {} f:podIPs: .: {} k:{"ip":"10.132.0.39"}: .: {} f:ip: {} f:startTime: {} manager: kubelet operation: Update subresource: status time: "2026-10-31T00:05:32Z" name: loki-operator-controller-manager-5666dc7fd5-lfnkl namespace: openshift-operators-redhat ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: loki-operator-controller-manager-5666dc7fd5 uid: f268d587-4ceb-4ede-a8b1-32a104a3d676 resourceVersion: "15475" uid: c8f643e2-9c77-4eb6-a0bd-bc9c99033732 spec: containers: - args: - --config=controller_manager_config.yaml command: - /manager env: - name: RELATED_IMAGE_LOKI value: registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:bd1c5e899f48daac4397d5c77cc85bc87d400f4fd32f71f2581c3a5dd35e5380 - name: RELATED_IMAGE_GATEWAY value: registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:081651d6a92c9832db42e1fcf595e15891de2b311128557015b7404203639400 - name: RELATED_IMAGE_OPA value: registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:18a8f259ecf962521de146aff2486f5cf792f6a5e232766f5c7250d757bd6ce6 - name: RELATED_IMAGE_PASSTHROUGH_GATEWAY value: registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8ae8018c3e010408bcfaedc2647c9f5fb0e1f8b2418cb7210e56b62d397dd36b - name: OPERATOR_CONDITION_NAME value: loki-operator.v6.6.2 image: registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8ae8018c3e010408bcfaedc2647c9f5fb0e1f8b2418cb7210e56b62d397dd36b imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 8081 scheme: HTTP initialDelaySeconds: 15 periodSeconds: 20 successThreshold: 1 timeoutSeconds: 1 name: manager ports: - containerPort: 9443 name: webhook-server protocol: TCP - containerPort: 8443 name: metrics protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 8081 scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsUser: 1000680000 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /controller_manager_config.yaml name: manager-config subPath: controller_manager_config.yaml - mountPath: /tmp/k8s-metrics-server/serving-certs name: loki-operator-metrics-cert readOnly: true - mountPath: /apiserver.local.config/certificates name: apiservice-cert - mountPath: /tmp/k8s-webhook-server/serving-certs name: webhook-cert - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-xh24h readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true imagePullSecrets: - name: loki-operator-controller-manager-dockercfg-wvw8q nodeName: ip-10-0-140-246.us-east-2.compute.internal nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 0 restartPolicy: Always schedulerName: default-scheduler securityContext: fsGroup: 1000680000 runAsNonRoot: true seLinuxOptions: level: s0:c26,c15 seccompProfile: type: RuntimeDefault serviceAccount: loki-operator-controller-manager serviceAccountName: loki-operator-controller-manager terminationGracePeriodSeconds: 10 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - configMap: defaultMode: 420 name: loki-operator-manager-config name: manager-config - name: loki-operator-metrics-cert secret: defaultMode: 420 optional: true secretName: loki-operator-metrics - name: apiservice-cert secret: defaultMode: 420 items: - key: tls.crt path: apiserver.crt - key: tls.key path: apiserver.key secretName: loki-operator-controller-manager-service-cert - name: webhook-cert secret: defaultMode: 420 items: - key: tls.crt path: tls.crt - key: tls.key path: tls.key secretName: loki-operator-controller-manager-service-cert - name: kube-api-access-xh24h projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace - configMap: items: - key: service-ca.crt path: service-ca.crt name: openshift-service-ca.crt status: conditions: - lastProbeTime: null lastTransitionTime: "2026-10-31T00:05:21Z" observedGeneration: 1 status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-10-31T00:05:11Z" observedGeneration: 1 status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-10-31T00:05:32Z" observedGeneration: 1 status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-10-31T00:05:32Z" observedGeneration: 1 status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-10-31T00:05:11Z" observedGeneration: 1 status: "True" type: PodScheduled containerStatuses: - containerID: cri-o://fb29696b629384114c4935e1bc123dfdc160fcfc86de574d7833a23f322810c3 image: registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8ae8018c3e010408bcfaedc2647c9f5fb0e1f8b2418cb7210e56b62d397dd36b imageID: registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8ae8018c3e010408bcfaedc2647c9f5fb0e1f8b2418cb7210e56b62d397dd36b lastState: {} name: manager ready: true resources: {} restartCount: 0 started: true state: running: startedAt: "2026-10-31T00:05:20Z" user: linux: gid: 0 supplementalGroups: - 0 - 1000680000 uid: 1000680000 volumeMounts: - mountPath: /controller_manager_config.yaml name: manager-config - mountPath: /tmp/k8s-metrics-server/serving-certs name: loki-operator-metrics-cert readOnly: true recursiveReadOnly: Disabled - mountPath: /apiserver.local.config/certificates name: apiservice-cert - mountPath: /tmp/k8s-webhook-server/serving-certs name: webhook-cert - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-xh24h readOnly: true recursiveReadOnly: Disabled hostIP: 10.0.140.246 hostIPs: - ip: 10.0.140.246 observedGeneration: 1 phase: Running podIP: 10.132.0.39 podIPs: - ip: 10.132.0.39 qosClass: BestEffort startTime: "2026-10-31T00:05:11Z" kind: PodList metadata: resourceVersion: "56998"