Skip to content

Loki Logging Install

General Outline

  1. Get ODF/S3 Object storage working
  2. Install Loki Operator
  3. Setup Loki Operator
    1. Create ObjectBucketClaim in openshift-logging
    2. Create logging-loki-s3 secret
    3. Create LokiStack
  4. Install OpenShift Logging Operator with the same minor/major version as Loki
  5. Create UIPlugin for Observability>Logging on the Web Console

Installing Loki

Note

Object storage has to be up prior to setting up Loki/Logging.

Loki Operator can be installed using the Web Console: 1. Ecosystem > Software Catalog > Loki Operator

Note

The Loki Operator must be deployed to the global Operator group namespace openshift-operators-redhat, so the Installation mode and Installed Namespace are already selected. If this namespace does not already exist, it will be created for you.

Setting up Loki Operator (ODF)

1. Create the odf claim:

apiVersion: objectbucket.io/v1alpha1
kind: ObjectBucketClaim
metadata:
  name: loki-bucket-odf
  namespace: openshift-logging
spec:
  generateBucketName: loki-bucket-odf
  storageClassName: openshift-storage.noobaa.io

2. Extract the s3 bucket host, port, name, access key, secret and create the logging-loki-odf secret:

BUCKET_HOST=$(oc get -n openshift-logging cm loki-bucket-odf -o jsonpath='{.data.BUCKET_HOST}')
BUCKET_PORT=$(oc get -n openshift-logging cm loki-bucket-odf -o jsonpath='{.data.BUCKET_PORT}')
BUCKET_NAME=$(oc get -n openshift-logging cm loki-bucket-odf -o jsonpath='{.data.BUCKET_NAME}')
ACCESS_KEY_ID=$(oc get -n openshift-logging secret loki-bucket-odf -o jsonpath='{.data.AWS_ACCESS_KEY_ID}' | base64 -d)
SECRET_ACCESS_KEY=$(oc get -n openshift-logging secret loki-bucket-odf -o jsonpath='{.data.AWS_SECRET_ACCESS_KEY}' | base64 -d)

oc -n openshift-logging create secret generic logging-loki-odf \
  --from-literal=access_key_id="$ACCESS_KEY_ID" \
  --from-literal=access_key_secret="$SECRET_ACCESS_KEY" \
  --from-literal=bucketnames="$BUCKET_NAME" \
  --from-literal=endpoint="https://$BUCKET_HOST:$BUCKET_PORT"

3. Prepare the CA cert for Loki to access S3:

Note

Edit the configMap with the correct CA cert used to reach ingress.

oc -n openshift-logging create configmap loki-odf-ca --from-literal=service-ca.crt='' --dry-run=client -o yaml | oc apply -f -
oc -n openshift-logging annotate configmap loki-odf-ca service.beta.openshift.io/inject-cabundle=true --overwrite

4. Create the Loki Stack

apiVersion: loki.grafana.com/v1
kind: LokiStack
metadata:
  name: logging-loki
  namespace: openshift-logging
spec:
  managementState: Managed
  limits:
    global:
      retention:
        days: 20
  size: 1x.small
  storage:
    schemas:
      - effectiveDate: "2026-01-01" ## Set 2 months before date of setup.
        version: v13
    secret:
      name: logging-loki-odf
      type: s3
    tls:
      caName: loki-odf-ca
  storageClassName: ocs-storagecluster-ceph-rbd
  tenants:
    mode: openshift-logging

5. Verification

Run oc get pods -n openshift-logging and ensure that no pods are in a pending/CrashLoopBackOff state.

Installing OpenShift Logging Operator

Note

The OpenShift Logging Operator needs to be the same major/minor version as the Loki Operator.

  1. In the OpenShift Container Platform web console Administrator perspective, go to Operators OperatorHub.
  2. Type Red Hat OpenShift Logging Operator in the Filter by keyword field. Click Red Hat OpenShift Logging Operator in the list of available Operators, and then click Install.
  3. Select stable-x.y as the Update channel. The latest version is already selected in the Version field.

  4. The Red Hat OpenShift Logging Operator must be deployed to the logging namespace openshift-logging, so the Installation mode and Installed Namespace are already selected. If this namespace does not already exist, it will be created for you.

  5. Select Enable Operator-recommended cluster monitoring on this namespace. This option sets the openshift.io/cluster-monitoring: "true" label in the Namespace object. You must select this option to ensure that cluster monitoring scrapes the openshift-logging namespace.

Setting up OpenShift Logging

1. Create the serviceAccount that will be used by the log collector to collect the logs:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: logging-collector 
  namespace: openshift-logging

2. Create the Cluster Role Bindings for the SA

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: logging-collector:write-logs
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: logging-collector-logs-writer 
subjects:
- kind: ServiceAccount
  name: logging-collector
  namespace: openshift-logging
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: logging-collector:collect-application
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: collect-application-logs 
subjects:
- kind: ServiceAccount
  name: logging-collector
  namespace: openshift-logging
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: logging-collector:collect-infrastructure
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: collect-infrastructure-logs 
subjects:
- kind: ServiceAccount
  name: logging-collector
  namespace: openshift-logging

Create the ClusterLogForwarder

apiVersion: observability.openshift.io/v1
kind: ClusterLogForwarder
metadata:
  name: instance
  namespace: openshift-logging 
spec:
  serviceAccount:
    name: logging-collector 
  outputs:
  - name: lokistack-out
    type: lokiStack 
    lokiStack:
      target: 
        name: logging-loki
        namespace: openshift-logging
      authentication:
        token:
          from: serviceAccount
    tls:
      ca:
        key: service-ca.crt
        configMapName: openshift-service-ca.crt
  pipelines:
  - name: infra-app-logs
    inputRefs: 
    - application
    - infrastructure
    outputRefs:
    - lokistack-out

To verify: 1. In the ClusterLogForwarder tab verify that you see your ClusterLogForwarder instance. 2. In the Status column, verify that you see the messages:

- `Condition: observability.openshift.io/Authorized`
- `observability.openshift.io/Valid, Ready`

Create the logging UI plugin

apiVersion: observability.openshift.io/v1alpha1
kind: UIPlugin
metadata:
  name: logging  
spec:
  type: Logging  
  logging:
    lokiStack:
      name: logging-loki  
    logsLimit: 50
    timeout: 30s
    schema: otel

Verification

Loki/Logging should be setup after following the steps above. To verify, head over the the Web Console and check that there are log outputs in the Observability > Logging tab.