--- apiVersion: v1 items: - apiVersion: v1 kind: Pod metadata: annotations: alm-examples: |- [ { "apiVersion": "loki.grafana.com/v1", "kind": "AlertingRule", "metadata": { "name": "alertingrule-sample" }, "spec": { "groups": [ { "interval": "10m", "name": "alerting-rules-group", "rules": [ { "alert": "HighPercentageError", "annotations": { "description": "Application {{ $labels.job }} in namespace example-namespace has an error rate above 5% for more than 10 minutes.", "summary": "High error rate detected" }, "expr": "sum(rate({app=\"foo\", env=\"production\", kubernetes_namespace_name=\"example-namespace\"} |= \"error\" [5m])) by (job)\n /\nsum(rate({app=\"foo\", env=\"production\", kubernetes_namespace_name=\"example-namespace\"}[5m])) by (job)\n \u003e 0.05\n", "for": "10m", "labels": { "severity": "warning" } }, { "alert": "HttpCredentialsLeaked", "annotations": { "description": "Application {{ $labels.job }} in pod {{ $labels.pod }} is leaking HTTP basic auth credentials in logs.", "summary": "HTTP credentials leaked in logs" }, "expr": "sum by (cluster, job, pod) (count_over_time({kubernetes_namespace_name=\"example-namespace\"} |~ \"http(s?)://(\\\\w+):(\\\\w+)@\" [5m]) \u003e 0)", "for": "10m", "labels": { "severity": "critical" } } ] } ], "tenantID": "application" } }, { "apiVersion": "loki.grafana.com/v1", "kind": "LokiStack", "metadata": { "name": "lokistack-sample" }, "spec": { "size": "1x.small", "storage": { "secret": { "name": "test" } }, "storageClassName": "standard" } }, { "apiVersion": "loki.grafana.com/v1", "kind": "RecordingRule", "metadata": { "name": "recordingrule-sample" }, "spec": { "groups": [ { "interval": "10m", "name": "recording-rules-group", "rules": [ { "expr": "sum(rate({container=\"myservice\"}[10m]))\n", "record": "myservice:requests:rate10m" }, { "expr": "sum(rate({container=\"otherservice\"}[1m]))\n", "record": "otherservice:requests:rate1m" } ] } ], "tenantID": "test-tenant" } }, { "apiVersion": "loki.grafana.com/v1", "kind": "RulerConfig", "metadata": { "name": "rulerconfig-sample" }, "spec": { "alertmanager": { "discovery": { "enableSRV": true, "refreshInterval": "1m" }, "enableV2": true, "endpoints": [ "http://alertmanager-host1.mycompany.org", "http://alertmanager-host2.mycompany.org" ], "externalLabels": { "environment": "production", "region": "us-east-2" }, "externalUrl": "http://www.mycompany.org/alerts", "notificationQueue": { "capacity": 1000, "forGracePeriod": "10m", "forOutageTolerance": "1h", "resendDelay": "1m", "timeout": "30s" } }, "evaluationInterval": "1m", "pollInterval": "1m", "remoteWrite": { "client": { "authorization": "basic", "authorizationSecretName": "my-secret-resource", "name": "remote-write-log-metrics", "proxyUrl": "http://proxy-host.mycompany.org", "relabelConfigs": [ { "action": "replace", "regex": "ALERTS.*", "replacement": "$1", "separator": "", "sourceLabels": [ "labelc", "labeld" ], "targetLabel": "labelnew" } ], "timeout": "30s", "url": "http://remote-write-host.mycompany.org" }, "enabled": true, "refreshPeriod": "10s" } } } ] capabilities: Full Lifecycle categories: OpenShift Optional, Logging & Tracing, Observability certified: "false" containerImage: registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8ae8018c3e010408bcfaedc2647c9f5fb0e1f8b2418cb7210e56b62d397dd36b createdAt: "2026-06-30T11:12:06Z" description: | The Loki Operator for OCP provides a means for configuring and managing a Loki stack for cluster logging. ## Prerequisites and Requirements ### Loki Operator Namespace The Loki Operator must be deployed to the global operator group namespace `openshift-operators-redhat`. ### Memory Considerations Loki is a memory intensive application. The initial set of OCP nodes may not be large enough to support the Loki stack. Additional OCP nodes must be added to the OCP cluster if you desire to run with the recommended (or better) memory. features.operators.openshift.io/disconnected: "true" features.operators.openshift.io/fips-compliant: "true" features.operators.openshift.io/proxy-aware: "true" features.operators.openshift.io/tls-profiles: "true" features.operators.openshift.io/token-auth-aws: "true" features.operators.openshift.io/token-auth-azure: "true" features.operators.openshift.io/token-auth-gcp: "true" k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.133.0.20/23"],"mac_address":"0a:58:0a:85:00:14","gateway_ips":["10.133.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.133.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.133.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.133.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.133.0.1"}],"ip_address":"10.133.0.20/23","gateway_ip":"10.133.0.1","role":"primary"}}' k8s.v1.cni.cncf.io/network-status: |- [{ "name": "ovn-kubernetes", "interface": "eth0", "ips": [ "10.133.0.20" ], "mac": "0a:58:0a:85:00:14", "default": true, "dns": {} }] kubectl.kubernetes.io/default-container: manager olm.operatorGroup: loki-operator olm.operatorNamespace: openshift-operators-redhat olm.skipRange: '>=6.2.0-0 <6.6.2' olm.targetNamespaces: "" olmcahash: a5a018661d649984d21a229bb96e8ae4b959794e87a3354ba5f8f1c6a7c5059f openshift.io/scc: restricted-v2 operatorframework.io/cluster-monitoring: "true" operatorframework.io/properties: '{"properties":[{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"AlertingRule","version":"v1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"AlertingRule","version":"v1beta1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"LokiStack","version":"v1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"LokiStack","version":"v1beta1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"RecordingRule","version":"v1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"RecordingRule","version":"v1beta1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"RulerConfig","version":"v1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"RulerConfig","version":"v1beta1"}},{"type":"olm.maxOpenShiftVersion","value":"4.23"},{"type":"olm.package","value":{"packageName":"loki-operator","version":"6.6.2"}}]}' operatorframework.io/suggested-namespace: openshift-operators-redhat operators.openshift.io/valid-subscription: '["OpenShift Kubernetes Engine", "OpenShift Container Platform", "OpenShift Platform Plus"]' operators.operatorframework.io/builder: operator-sdk-unknown operators.operatorframework.io/project_layout: go.kubebuilder.io/v4 seccomp.security.alpha.kubernetes.io/pod: runtime/default security.openshift.io/validated-scc-subject-type: user support: AOS Cluster Logging creationTimestamp: "2026-10-30T10:53:55Z" generateName: loki-operator-controller-manager-6d9d597c9b- generation: 1 labels: app.kubernetes.io/managed-by: operator-lifecycle-manager app.kubernetes.io/name: loki-operator app.kubernetes.io/part-of: cluster-logging name: loki-operator-controller-manager pod-template-hash: 6d9d597c9b topology.kubernetes.io/region: us-east-1 topology.kubernetes.io/zone: us-east-1a managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:metadata: f:annotations: f:k8s.ovn.org/pod-networks: {} manager: ip-10-0-132-202 operation: Update subresource: status time: "2026-10-30T10:53:55Z" - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:metadata: f:annotations: .: {} f:alm-examples: {} f:capabilities: {} f:categories: {} f:certified: {} f:containerImage: {} f:createdAt: {} f:description: {} f:features.operators.openshift.io/disconnected: {} f:features.operators.openshift.io/fips-compliant: {} f:features.operators.openshift.io/proxy-aware: {} f:features.operators.openshift.io/tls-profiles: {} f:features.operators.openshift.io/token-auth-aws: {} f:features.operators.openshift.io/token-auth-azure: {} f:features.operators.openshift.io/token-auth-gcp: {} f:kubectl.kubernetes.io/default-container: {} f:olm.operatorGroup: {} f:olm.operatorNamespace: {} f:olm.skipRange: {} f:olm.targetNamespaces: {} f:olmcahash: {} f:operatorframework.io/cluster-monitoring: {} f:operatorframework.io/properties: {} f:operatorframework.io/suggested-namespace: {} f:operators.openshift.io/valid-subscription: {} f:operators.operatorframework.io/builder: {} f:operators.operatorframework.io/project_layout: {} f:support: {} f:generateName: {} f:labels: .: {} f:app.kubernetes.io/managed-by: {} f:app.kubernetes.io/name: {} f:app.kubernetes.io/part-of: {} f:name: {} f:pod-template-hash: {} f:ownerReferences: .: {} k:{"uid":"7ebdc26f-80de-4e21-b389-d624d7be1c78"}: {} f:spec: f:containers: k:{"name":"manager"}: .: {} f:args: {} f:command: {} f:env: .: {} k:{"name":"OPERATOR_CONDITION_NAME"}: .: {} f:name: {} f:value: {} k:{"name":"RELATED_IMAGE_GATEWAY"}: .: {} f:name: {} f:value: {} k:{"name":"RELATED_IMAGE_LOKI"}: .: {} f:name: {} f:value: {} k:{"name":"RELATED_IMAGE_OPA"}: .: {} f:name: {} f:value: {} k:{"name":"RELATED_IMAGE_PASSTHROUGH_GATEWAY"}: .: {} f:name: {} f:value: {} f:image: {} f:imagePullPolicy: {} f:livenessProbe: .: {} f:failureThreshold: {} f:httpGet: .: {} f:path: {} f:port: {} f:scheme: {} f:initialDelaySeconds: {} f:periodSeconds: {} f:successThreshold: {} f:timeoutSeconds: {} f:name: {} f:ports: .: {} k:{"containerPort":8443,"protocol":"TCP"}: .: {} f:containerPort: {} f:name: {} f:protocol: {} k:{"containerPort":9443,"protocol":"TCP"}: .: {} f:containerPort: {} f:name: {} f:protocol: {} f:readinessProbe: .: {} f:failureThreshold: {} f:httpGet: .: {} f:path: {} f:port: {} f:scheme: {} f:initialDelaySeconds: {} f:periodSeconds: {} f:successThreshold: {} f:timeoutSeconds: {} f:resources: {} f:securityContext: .: {} f:allowPrivilegeEscalation: {} f:capabilities: .: {} f:drop: {} f:terminationMessagePath: {} f:terminationMessagePolicy: {} f:volumeMounts: .: {} k:{"mountPath":"/apiserver.local.config/certificates"}: .: {} f:mountPath: {} f:name: {} k:{"mountPath":"/controller_manager_config.yaml"}: .: {} f:mountPath: {} f:name: {} f:subPath: {} k:{"mountPath":"/tmp/k8s-metrics-server/serving-certs"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"mountPath":"/tmp/k8s-webhook-server/serving-certs"}: .: {} f:mountPath: {} f:name: {} f:dnsPolicy: {} f:enableServiceLinks: {} f:nodeSelector: {} f:restartPolicy: {} f:schedulerName: {} f:securityContext: .: {} f:runAsNonRoot: {} f:seccompProfile: .: {} f:type: {} f:serviceAccount: {} f:serviceAccountName: {} f:terminationGracePeriodSeconds: {} f:volumes: .: {} k:{"name":"apiservice-cert"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:items: {} f:secretName: {} k:{"name":"loki-operator-metrics-cert"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:optional: {} f:secretName: {} k:{"name":"manager-config"}: .: {} f:configMap: .: {} f:defaultMode: {} f:name: {} f:name: {} k:{"name":"webhook-cert"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:items: {} f:secretName: {} manager: kube-controller-manager operation: Update time: "2026-10-30T10:53:55Z" - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:metadata: f:annotations: f:k8s.v1.cni.cncf.io/network-status: {} manager: multus-daemon operation: Update subresource: status time: "2026-10-30T10:53:56Z" - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:status: f:conditions: k:{"type":"ContainersReady"}: .: {} f:lastProbeTime: {} f:lastTransitionTime: {} f:observedGeneration: {} f:status: {} f:type: {} k:{"type":"Initialized"}: .: {} f:lastProbeTime: {} f:lastTransitionTime: {} f:observedGeneration: {} f:status: {} f:type: {} k:{"type":"PodReadyToStartContainers"}: .: {} f:lastProbeTime: {} f:lastTransitionTime: {} f:observedGeneration: {} f:status: {} f:type: {} k:{"type":"PodScheduled"}: f:observedGeneration: {} k:{"type":"Ready"}: .: {} f:lastProbeTime: {} f:lastTransitionTime: {} f:observedGeneration: {} f:status: {} f:type: {} f:containerStatuses: {} f:hostIP: {} f:hostIPs: {} f:observedGeneration: {} f:phase: {} f:podIP: {} f:podIPs: .: {} k:{"ip":"10.133.0.20"}: .: {} f:ip: {} f:startTime: {} manager: kubelet operation: Update subresource: status time: "2026-10-30T10:54:11Z" name: loki-operator-controller-manager-6d9d597c9b-l65gv namespace: openshift-operators-redhat ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: loki-operator-controller-manager-6d9d597c9b uid: 7ebdc26f-80de-4e21-b389-d624d7be1c78 resourceVersion: "15485" uid: b6c48581-92bb-49f8-9394-2ae86298161b spec: containers: - args: - --config=controller_manager_config.yaml command: - /manager env: - name: RELATED_IMAGE_LOKI value: registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:bd1c5e899f48daac4397d5c77cc85bc87d400f4fd32f71f2581c3a5dd35e5380 - name: RELATED_IMAGE_GATEWAY value: registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:081651d6a92c9832db42e1fcf595e15891de2b311128557015b7404203639400 - name: RELATED_IMAGE_OPA value: registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:18a8f259ecf962521de146aff2486f5cf792f6a5e232766f5c7250d757bd6ce6 - name: RELATED_IMAGE_PASSTHROUGH_GATEWAY value: registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8ae8018c3e010408bcfaedc2647c9f5fb0e1f8b2418cb7210e56b62d397dd36b - name: OPERATOR_CONDITION_NAME value: loki-operator.v6.6.2 image: registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8ae8018c3e010408bcfaedc2647c9f5fb0e1f8b2418cb7210e56b62d397dd36b imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 8081 scheme: HTTP initialDelaySeconds: 15 periodSeconds: 20 successThreshold: 1 timeoutSeconds: 1 name: manager ports: - containerPort: 9443 name: webhook-server protocol: TCP - containerPort: 8443 name: metrics protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 8081 scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: {} securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsUser: 1000680000 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /controller_manager_config.yaml name: manager-config subPath: controller_manager_config.yaml - mountPath: /tmp/k8s-metrics-server/serving-certs name: loki-operator-metrics-cert readOnly: true - mountPath: /apiserver.local.config/certificates name: apiservice-cert - mountPath: /tmp/k8s-webhook-server/serving-certs name: webhook-cert - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-tk4qm readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true imagePullSecrets: - name: loki-operator-controller-manager-dockercfg-g9lx5 nodeName: ip-10-0-132-202.ec2.internal nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 0 restartPolicy: Always schedulerName: default-scheduler securityContext: fsGroup: 1000680000 runAsNonRoot: true seLinuxOptions: level: s0:c26,c15 seccompProfile: type: RuntimeDefault serviceAccount: loki-operator-controller-manager serviceAccountName: loki-operator-controller-manager terminationGracePeriodSeconds: 10 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - configMap: defaultMode: 420 name: loki-operator-manager-config name: manager-config - name: loki-operator-metrics-cert secret: defaultMode: 420 optional: true secretName: loki-operator-metrics - name: apiservice-cert secret: defaultMode: 420 items: - key: tls.crt path: apiserver.crt - key: tls.key path: apiserver.key secretName: loki-operator-controller-manager-service-cert - name: webhook-cert secret: defaultMode: 420 items: - key: tls.crt path: tls.crt - key: tls.key path: tls.key secretName: loki-operator-controller-manager-service-cert - name: kube-api-access-tk4qm projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace - configMap: items: - key: service-ca.crt path: service-ca.crt name: openshift-service-ca.crt status: conditions: - lastProbeTime: null lastTransitionTime: "2026-10-30T10:54:00Z" observedGeneration: 1 status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-10-30T10:53:55Z" observedGeneration: 1 status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-10-30T10:54:11Z" observedGeneration: 1 status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-10-30T10:54:11Z" observedGeneration: 1 status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-10-30T10:53:55Z" observedGeneration: 1 status: "True" type: PodScheduled containerStatuses: - containerID: cri-o://78c9b43959140b2607bacda7f1483efdb2dad5df601ce7b8e6658e4c12ff0e18 image: registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8ae8018c3e010408bcfaedc2647c9f5fb0e1f8b2418cb7210e56b62d397dd36b imageID: registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8ae8018c3e010408bcfaedc2647c9f5fb0e1f8b2418cb7210e56b62d397dd36b lastState: {} name: manager ready: true resources: {} restartCount: 0 started: true state: running: startedAt: "2026-10-30T10:54:00Z" user: linux: gid: 0 supplementalGroups: - 0 - 1000680000 uid: 1000680000 volumeMounts: - mountPath: /controller_manager_config.yaml name: manager-config - mountPath: /tmp/k8s-metrics-server/serving-certs name: loki-operator-metrics-cert readOnly: true recursiveReadOnly: Disabled - mountPath: /apiserver.local.config/certificates name: apiservice-cert - mountPath: /tmp/k8s-webhook-server/serving-certs name: webhook-cert - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-tk4qm readOnly: true recursiveReadOnly: Disabled hostIP: 10.0.132.202 hostIPs: - ip: 10.0.132.202 observedGeneration: 1 phase: Running podIP: 10.133.0.20 podIPs: - ip: 10.133.0.20 qosClass: BestEffort startTime: "2026-10-30T10:53:55Z" kind: PodList metadata: resourceVersion: "51816"