---
apiVersion: v1
kind: Pod
metadata:
  annotations:
    alm-examples: |-
      [
        {
          "apiVersion": "loki.grafana.com/v1",
          "kind": "AlertingRule",
          "metadata": {
            "name": "alertingrule-sample"
          },
          "spec": {
            "groups": [
              {
                "interval": "10m",
                "name": "alerting-rules-group",
                "rules": [
                  {
                    "alert": "HighPercentageError",
                    "annotations": {
                      "description": "Application {{ $labels.job }} in namespace example-namespace has an error rate above 5% for more than 10 minutes.",
                      "summary": "High error rate detected"
                    },
                    "expr": "sum(rate({app=\"foo\", env=\"production\", kubernetes_namespace_name=\"example-namespace\"} |= \"error\" [5m])) by (job)\n  /\nsum(rate({app=\"foo\", env=\"production\", kubernetes_namespace_name=\"example-namespace\"}[5m])) by (job)\n  \u003e 0.05\n",
                    "for": "10m",
                    "labels": {
                      "severity": "warning"
                    }
                  },
                  {
                    "alert": "HttpCredentialsLeaked",
                    "annotations": {
                      "description": "Application {{ $labels.job }} in pod {{ $labels.pod }} is leaking HTTP basic auth credentials in logs.",
                      "summary": "HTTP credentials leaked in logs"
                    },
                    "expr": "sum by (cluster, job, pod) (count_over_time({kubernetes_namespace_name=\"example-namespace\"} |~ \"http(s?)://(\\\\w+):(\\\\w+)@\" [5m]) \u003e 0)",
                    "for": "10m",
                    "labels": {
                      "severity": "critical"
                    }
                  }
                ]
              }
            ],
            "tenantID": "application"
          }
        },
        {
          "apiVersion": "loki.grafana.com/v1",
          "kind": "LokiStack",
          "metadata": {
            "name": "lokistack-sample"
          },
          "spec": {
            "size": "1x.small",
            "storage": {
              "secret": {
                "name": "test"
              }
            },
            "storageClassName": "standard"
          }
        },
        {
          "apiVersion": "loki.grafana.com/v1",
          "kind": "RecordingRule",
          "metadata": {
            "name": "recordingrule-sample"
          },
          "spec": {
            "groups": [
              {
                "interval": "10m",
                "name": "recording-rules-group",
                "rules": [
                  {
                    "expr": "sum(rate({container=\"myservice\"}[10m]))\n",
                    "record": "myservice:requests:rate10m"
                  },
                  {
                    "expr": "sum(rate({container=\"otherservice\"}[1m]))\n",
                    "record": "otherservice:requests:rate1m"
                  }
                ]
              }
            ],
            "tenantID": "test-tenant"
          }
        },
        {
          "apiVersion": "loki.grafana.com/v1",
          "kind": "RulerConfig",
          "metadata": {
            "name": "rulerconfig-sample"
          },
          "spec": {
            "alertmanager": {
              "discovery": {
                "enableSRV": true,
                "refreshInterval": "1m"
              },
              "enableV2": true,
              "endpoints": [
                "http://alertmanager-host1.mycompany.org",
                "http://alertmanager-host2.mycompany.org"
              ],
              "externalLabels": {
                "environment": "production",
                "region": "us-east-2"
              },
              "externalUrl": "http://www.mycompany.org/alerts",
              "notificationQueue": {
                "capacity": 1000,
                "forGracePeriod": "10m",
                "forOutageTolerance": "1h",
                "resendDelay": "1m",
                "timeout": "30s"
              }
            },
            "evaluationInterval": "1m",
            "pollInterval": "1m",
            "remoteWrite": {
              "client": {
                "authorization": "basic",
                "authorizationSecretName": "my-secret-resource",
                "name": "remote-write-log-metrics",
                "proxyUrl": "http://proxy-host.mycompany.org",
                "relabelConfigs": [
                  {
                    "action": "replace",
                    "regex": "ALERTS.*",
                    "replacement": "$1",
                    "separator": "",
                    "sourceLabels": [
                      "labelc",
                      "labeld"
                    ],
                    "targetLabel": "labelnew"
                  }
                ],
                "timeout": "30s",
                "url": "http://remote-write-host.mycompany.org"
              },
              "enabled": true,
              "refreshPeriod": "10s"
            }
          }
        }
      ]
    capabilities: Full Lifecycle
    categories: OpenShift Optional, Logging & Tracing, Observability
    certified: "false"
    containerImage: registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8ae8018c3e010408bcfaedc2647c9f5fb0e1f8b2418cb7210e56b62d397dd36b
    createdAt: "2026-06-30T11:12:06Z"
    description: |
      The Loki Operator for OCP provides a means for configuring and managing a Loki stack for cluster logging.
      ## Prerequisites and Requirements
      ### Loki Operator Namespace
      The Loki Operator must be deployed to the global operator group namespace `openshift-operators-redhat`.
      ### Memory Considerations
      Loki is a memory intensive application.  The initial
      set of OCP nodes may not be large enough to support the Loki stack.  Additional OCP nodes must be added
      to the OCP cluster if you desire to run with the recommended (or better) memory.
    features.operators.openshift.io/disconnected: "true"
    features.operators.openshift.io/fips-compliant: "true"
    features.operators.openshift.io/proxy-aware: "true"
    features.operators.openshift.io/tls-profiles: "true"
    features.operators.openshift.io/token-auth-aws: "true"
    features.operators.openshift.io/token-auth-azure: "true"
    features.operators.openshift.io/token-auth-gcp: "true"
    k8s.ovn.org/pod-networks: '{"default":{"ip_addresses":["10.133.0.25/23"],"mac_address":"0a:58:0a:85:00:19","gateway_ips":["10.133.0.1"],"routes":[{"dest":"10.132.0.0/14","nextHop":"10.133.0.1"},{"dest":"172.31.0.0/16","nextHop":"10.133.0.1"},{"dest":"169.254.0.5/32","nextHop":"10.133.0.1"},{"dest":"100.64.0.0/16","nextHop":"10.133.0.1"}],"ip_address":"10.133.0.25/23","gateway_ip":"10.133.0.1","role":"primary"}}'
    k8s.v1.cni.cncf.io/network-status: |-
      [{
          "name": "ovn-kubernetes",
          "interface": "eth0",
          "ips": [
              "10.133.0.25"
          ],
          "mac": "0a:58:0a:85:00:19",
          "default": true,
          "dns": {}
      }]
    kubectl.kubernetes.io/default-container: manager
    olm.operatorGroup: loki-operator
    olm.operatorNamespace: openshift-operators-redhat
    olm.skipRange: '>=6.2.0-0 <6.6.2'
    olm.targetNamespaces: ""
    olmcahash: e660ae0552199e6ce8331b5c04b234fa062c2fbb500e6e1ac104a2a134786ba3
    openshift.io/scc: restricted-v2
    operatorframework.io/cluster-monitoring: "true"
    operatorframework.io/properties: '{"properties":[{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"AlertingRule","version":"v1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"AlertingRule","version":"v1beta1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"LokiStack","version":"v1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"LokiStack","version":"v1beta1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"RecordingRule","version":"v1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"RecordingRule","version":"v1beta1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"RulerConfig","version":"v1"}},{"type":"olm.gvk","value":{"group":"loki.grafana.com","kind":"RulerConfig","version":"v1beta1"}},{"type":"olm.maxOpenShiftVersion","value":"4.23"},{"type":"olm.package","value":{"packageName":"loki-operator","version":"6.6.2"}}]}'
    operatorframework.io/suggested-namespace: openshift-operators-redhat
    operators.openshift.io/valid-subscription: '["OpenShift Kubernetes Engine", "OpenShift
      Container Platform", "OpenShift Platform Plus"]'
    operators.operatorframework.io/builder: operator-sdk-unknown
    operators.operatorframework.io/project_layout: go.kubebuilder.io/v4
    seccomp.security.alpha.kubernetes.io/pod: runtime/default
    security.openshift.io/validated-scc-subject-type: user
    support: AOS Cluster Logging
  creationTimestamp: "2026-10-30T02:56:58Z"
  generateName: loki-operator-controller-manager-c4d497f54-
  generation: 1
  labels:
    app.kubernetes.io/managed-by: operator-lifecycle-manager
    app.kubernetes.io/name: loki-operator
    app.kubernetes.io/part-of: cluster-logging
    name: loki-operator-controller-manager
    pod-template-hash: c4d497f54
    topology.kubernetes.io/region: us-east-1
    topology.kubernetes.io/zone: us-east-1a
  managedFields:
  - apiVersion: v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          f:k8s.ovn.org/pod-networks: {}
    manager: ip-10-0-134-164
    operation: Update
    subresource: status
    time: "2026-10-30T02:56:58Z"
  - apiVersion: v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .: {}
          f:alm-examples: {}
          f:capabilities: {}
          f:categories: {}
          f:certified: {}
          f:containerImage: {}
          f:createdAt: {}
          f:description: {}
          f:features.operators.openshift.io/disconnected: {}
          f:features.operators.openshift.io/fips-compliant: {}
          f:features.operators.openshift.io/proxy-aware: {}
          f:features.operators.openshift.io/tls-profiles: {}
          f:features.operators.openshift.io/token-auth-aws: {}
          f:features.operators.openshift.io/token-auth-azure: {}
          f:features.operators.openshift.io/token-auth-gcp: {}
          f:kubectl.kubernetes.io/default-container: {}
          f:olm.operatorGroup: {}
          f:olm.operatorNamespace: {}
          f:olm.skipRange: {}
          f:olm.targetNamespaces: {}
          f:olmcahash: {}
          f:operatorframework.io/cluster-monitoring: {}
          f:operatorframework.io/properties: {}
          f:operatorframework.io/suggested-namespace: {}
          f:operators.openshift.io/valid-subscription: {}
          f:operators.operatorframework.io/builder: {}
          f:operators.operatorframework.io/project_layout: {}
          f:support: {}
        f:generateName: {}
        f:labels:
          .: {}
          f:app.kubernetes.io/managed-by: {}
          f:app.kubernetes.io/name: {}
          f:app.kubernetes.io/part-of: {}
          f:name: {}
          f:pod-template-hash: {}
        f:ownerReferences:
          .: {}
          k:{"uid":"dfb17aa0-bbb3-43e9-9e39-3fdf26ba09d9"}: {}
      f:spec:
        f:containers:
          k:{"name":"manager"}:
            .: {}
            f:args: {}
            f:command: {}
            f:env:
              .: {}
              k:{"name":"OPERATOR_CONDITION_NAME"}:
                .: {}
                f:name: {}
                f:value: {}
              k:{"name":"RELATED_IMAGE_GATEWAY"}:
                .: {}
                f:name: {}
                f:value: {}
              k:{"name":"RELATED_IMAGE_LOKI"}:
                .: {}
                f:name: {}
                f:value: {}
              k:{"name":"RELATED_IMAGE_OPA"}:
                .: {}
                f:name: {}
                f:value: {}
              k:{"name":"RELATED_IMAGE_PASSTHROUGH_GATEWAY"}:
                .: {}
                f:name: {}
                f:value: {}
            f:image: {}
            f:imagePullPolicy: {}
            f:livenessProbe:
              .: {}
              f:failureThreshold: {}
              f:httpGet:
                .: {}
                f:path: {}
                f:port: {}
                f:scheme: {}
              f:initialDelaySeconds: {}
              f:periodSeconds: {}
              f:successThreshold: {}
              f:timeoutSeconds: {}
            f:name: {}
            f:ports:
              .: {}
              k:{"containerPort":8443,"protocol":"TCP"}:
                .: {}
                f:containerPort: {}
                f:name: {}
                f:protocol: {}
              k:{"containerPort":9443,"protocol":"TCP"}:
                .: {}
                f:containerPort: {}
                f:name: {}
                f:protocol: {}
            f:readinessProbe:
              .: {}
              f:failureThreshold: {}
              f:httpGet:
                .: {}
                f:path: {}
                f:port: {}
                f:scheme: {}
              f:initialDelaySeconds: {}
              f:periodSeconds: {}
              f:successThreshold: {}
              f:timeoutSeconds: {}
            f:resources: {}
            f:securityContext:
              .: {}
              f:allowPrivilegeEscalation: {}
              f:capabilities:
                .: {}
                f:drop: {}
            f:terminationMessagePath: {}
            f:terminationMessagePolicy: {}
            f:volumeMounts:
              .: {}
              k:{"mountPath":"/apiserver.local.config/certificates"}:
                .: {}
                f:mountPath: {}
                f:name: {}
              k:{"mountPath":"/controller_manager_config.yaml"}:
                .: {}
                f:mountPath: {}
                f:name: {}
                f:subPath: {}
              k:{"mountPath":"/tmp/k8s-metrics-server/serving-certs"}:
                .: {}
                f:mountPath: {}
                f:name: {}
                f:readOnly: {}
              k:{"mountPath":"/tmp/k8s-webhook-server/serving-certs"}:
                .: {}
                f:mountPath: {}
                f:name: {}
        f:dnsPolicy: {}
        f:enableServiceLinks: {}
        f:nodeSelector: {}
        f:restartPolicy: {}
        f:schedulerName: {}
        f:securityContext:
          .: {}
          f:runAsNonRoot: {}
          f:seccompProfile:
            .: {}
            f:type: {}
        f:serviceAccount: {}
        f:serviceAccountName: {}
        f:terminationGracePeriodSeconds: {}
        f:volumes:
          .: {}
          k:{"name":"apiservice-cert"}:
            .: {}
            f:name: {}
            f:secret:
              .: {}
              f:defaultMode: {}
              f:items: {}
              f:secretName: {}
          k:{"name":"loki-operator-metrics-cert"}:
            .: {}
            f:name: {}
            f:secret:
              .: {}
              f:defaultMode: {}
              f:optional: {}
              f:secretName: {}
          k:{"name":"manager-config"}:
            .: {}
            f:configMap:
              .: {}
              f:defaultMode: {}
              f:name: {}
            f:name: {}
          k:{"name":"webhook-cert"}:
            .: {}
            f:name: {}
            f:secret:
              .: {}
              f:defaultMode: {}
              f:items: {}
              f:secretName: {}
    manager: kube-controller-manager
    operation: Update
    time: "2026-10-30T02:56:58Z"
  - apiVersion: v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          f:k8s.v1.cni.cncf.io/network-status: {}
    manager: multus-daemon
    operation: Update
    subresource: status
    time: "2026-10-30T02:56:59Z"
  - apiVersion: v1
    fieldsType: FieldsV1
    fieldsV1:
      f:status:
        f:conditions:
          k:{"type":"ContainersReady"}:
            .: {}
            f:lastProbeTime: {}
            f:lastTransitionTime: {}
            f:observedGeneration: {}
            f:status: {}
            f:type: {}
          k:{"type":"Initialized"}:
            .: {}
            f:lastProbeTime: {}
            f:lastTransitionTime: {}
            f:observedGeneration: {}
            f:status: {}
            f:type: {}
          k:{"type":"PodReadyToStartContainers"}:
            .: {}
            f:lastProbeTime: {}
            f:lastTransitionTime: {}
            f:observedGeneration: {}
            f:status: {}
            f:type: {}
          k:{"type":"PodScheduled"}:
            f:observedGeneration: {}
          k:{"type":"Ready"}:
            .: {}
            f:lastProbeTime: {}
            f:lastTransitionTime: {}
            f:observedGeneration: {}
            f:status: {}
            f:type: {}
        f:containerStatuses: {}
        f:hostIP: {}
        f:hostIPs: {}
        f:observedGeneration: {}
        f:phase: {}
        f:podIP: {}
        f:podIPs:
          .: {}
          k:{"ip":"10.133.0.25"}:
            .: {}
            f:ip: {}
        f:startTime: {}
    manager: kubelet
    operation: Update
    subresource: status
    time: "2026-10-30T02:57:14Z"
  name: loki-operator-controller-manager-c4d497f54-2dt62
  namespace: openshift-operators-redhat
  ownerReferences:
  - apiVersion: apps/v1
    blockOwnerDeletion: true
    controller: true
    kind: ReplicaSet
    name: loki-operator-controller-manager-c4d497f54
    uid: dfb17aa0-bbb3-43e9-9e39-3fdf26ba09d9
  resourceVersion: "21095"
  uid: 58fa468d-4152-4a8e-ac79-e515e9ee2e0a
spec:
  containers:
  - args:
    - --config=controller_manager_config.yaml
    command:
    - /manager
    env:
    - name: RELATED_IMAGE_LOKI
      value: registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:bd1c5e899f48daac4397d5c77cc85bc87d400f4fd32f71f2581c3a5dd35e5380
    - name: RELATED_IMAGE_GATEWAY
      value: registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:081651d6a92c9832db42e1fcf595e15891de2b311128557015b7404203639400
    - name: RELATED_IMAGE_OPA
      value: registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:18a8f259ecf962521de146aff2486f5cf792f6a5e232766f5c7250d757bd6ce6
    - name: RELATED_IMAGE_PASSTHROUGH_GATEWAY
      value: registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8ae8018c3e010408bcfaedc2647c9f5fb0e1f8b2418cb7210e56b62d397dd36b
    - name: OPERATOR_CONDITION_NAME
      value: loki-operator.v6.6.2
    image: registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8ae8018c3e010408bcfaedc2647c9f5fb0e1f8b2418cb7210e56b62d397dd36b
    imagePullPolicy: IfNotPresent
    livenessProbe:
      failureThreshold: 3
      httpGet:
        path: /healthz
        port: 8081
        scheme: HTTP
      initialDelaySeconds: 15
      periodSeconds: 20
      successThreshold: 1
      timeoutSeconds: 1
    name: manager
    ports:
    - containerPort: 9443
      name: webhook-server
      protocol: TCP
    - containerPort: 8443
      name: metrics
      protocol: TCP
    readinessProbe:
      failureThreshold: 3
      httpGet:
        path: /readyz
        port: 8081
        scheme: HTTP
      initialDelaySeconds: 5
      periodSeconds: 10
      successThreshold: 1
      timeoutSeconds: 1
    resources: {}
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      runAsUser: 1000680000
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /controller_manager_config.yaml
      name: manager-config
      subPath: controller_manager_config.yaml
    - mountPath: /tmp/k8s-metrics-server/serving-certs
      name: loki-operator-metrics-cert
      readOnly: true
    - mountPath: /apiserver.local.config/certificates
      name: apiservice-cert
    - mountPath: /tmp/k8s-webhook-server/serving-certs
      name: webhook-cert
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: kube-api-access-cp2jt
      readOnly: true
  dnsPolicy: ClusterFirst
  enableServiceLinks: true
  imagePullSecrets:
  - name: loki-operator-controller-manager-dockercfg-kxg9m
  nodeName: ip-10-0-134-164.ec2.internal
  nodeSelector:
    kubernetes.io/os: linux
  preemptionPolicy: PreemptLowerPriority
  priority: 0
  restartPolicy: Always
  schedulerName: default-scheduler
  securityContext:
    fsGroup: 1000680000
    runAsNonRoot: true
    seLinuxOptions:
      level: s0:c26,c15
    seccompProfile:
      type: RuntimeDefault
  serviceAccount: loki-operator-controller-manager
  serviceAccountName: loki-operator-controller-manager
  terminationGracePeriodSeconds: 10
  tolerations:
  - effect: NoExecute
    key: node.kubernetes.io/not-ready
    operator: Exists
    tolerationSeconds: 300
  - effect: NoExecute
    key: node.kubernetes.io/unreachable
    operator: Exists
    tolerationSeconds: 300
  volumes:
  - configMap:
      defaultMode: 420
      name: loki-operator-manager-config
    name: manager-config
  - name: loki-operator-metrics-cert
    secret:
      defaultMode: 420
      optional: true
      secretName: loki-operator-metrics
  - name: apiservice-cert
    secret:
      defaultMode: 420
      items:
      - key: tls.crt
        path: apiserver.crt
      - key: tls.key
        path: apiserver.key
      secretName: loki-operator-controller-manager-service-cert
  - name: webhook-cert
    secret:
      defaultMode: 420
      items:
      - key: tls.crt
        path: tls.crt
      - key: tls.key
        path: tls.key
      secretName: loki-operator-controller-manager-service-cert
  - name: kube-api-access-cp2jt
    projected:
      defaultMode: 420
      sources:
      - serviceAccountToken:
          expirationSeconds: 3607
          path: token
      - configMap:
          items:
          - key: ca.crt
            path: ca.crt
          name: kube-root-ca.crt
      - downwardAPI:
          items:
          - fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
            path: namespace
      - configMap:
          items:
          - key: service-ca.crt
            path: service-ca.crt
          name: openshift-service-ca.crt
status:
  conditions:
  - lastProbeTime: null
    lastTransitionTime: "2026-10-30T02:57:03Z"
    observedGeneration: 1
    status: "True"
    type: PodReadyToStartContainers
  - lastProbeTime: null
    lastTransitionTime: "2026-10-30T02:56:58Z"
    observedGeneration: 1
    status: "True"
    type: Initialized
  - lastProbeTime: null
    lastTransitionTime: "2026-10-30T02:57:14Z"
    observedGeneration: 1
    status: "True"
    type: Ready
  - lastProbeTime: null
    lastTransitionTime: "2026-10-30T02:57:14Z"
    observedGeneration: 1
    status: "True"
    type: ContainersReady
  - lastProbeTime: null
    lastTransitionTime: "2026-10-30T02:56:58Z"
    observedGeneration: 1
    status: "True"
    type: PodScheduled
  containerStatuses:
  - containerID: cri-o://a97308b8d5ce62c9421412724f5bc76883309d2592fa5bfbca99409a66bf74c4
    image: registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8ae8018c3e010408bcfaedc2647c9f5fb0e1f8b2418cb7210e56b62d397dd36b
    imageID: registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8ae8018c3e010408bcfaedc2647c9f5fb0e1f8b2418cb7210e56b62d397dd36b
    lastState: {}
    name: manager
    ready: true
    resources: {}
    restartCount: 0
    started: true
    state:
      running:
        startedAt: "2026-10-30T02:57:02Z"
    user:
      linux:
        gid: 0
        supplementalGroups:
        - 0
        - 1000680000
        uid: 1000680000
    volumeMounts:
    - mountPath: /controller_manager_config.yaml
      name: manager-config
    - mountPath: /tmp/k8s-metrics-server/serving-certs
      name: loki-operator-metrics-cert
      readOnly: true
      recursiveReadOnly: Disabled
    - mountPath: /apiserver.local.config/certificates
      name: apiservice-cert
    - mountPath: /tmp/k8s-webhook-server/serving-certs
      name: webhook-cert
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: kube-api-access-cp2jt
      readOnly: true
      recursiveReadOnly: Disabled
  hostIP: 10.0.134.164
  hostIPs:
  - ip: 10.0.134.164
  observedGeneration: 1
  phase: Running
  podIP: 10.133.0.25
  podIPs:
  - ip: 10.133.0.25
  qosClass: BestEffort
  startTime: "2026-10-30T02:56:58Z"