Skip to content

Commit ec43fa1

Browse files
briandooleybriandooley
authored
Merge pull request #100718 from theashiot/OBSDOCS-1806
OBSDOCS-1806: Tailored Network Policies for Loki Operator
2 parents af16cba + 87d2729 commit ec43fa1

File tree

5 files changed

+189
-0
lines changed

5 files changed

+189
-0
lines changed

‎configuring/configuring-the-log-store.adoc‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,19 @@ include::modules/loki-zone-aware-replication.adoc[leveloffset=+2]
6666
include::modules/loki-zone-fail-recovery.adoc[leveloffset=+2]
6767
include::modules/loki-rate-limit-errors.adoc[leveloffset=+2]
6868

69+
[id="loki-network-policies-for-added-security_{context}"]
70+
== Loki network policies for added security
71+
72+
{loki-op} can deploy and manage a set of network policies that restrict the communications to and from the Loki components to enhance security.
73+
74+
include::modules/loki-network-policies.adoc[leveloffset=+2]
75+
76+
include::modules/configuring-a-network-policy-for-loki.adoc[leveloffset=+2]
77+
78+
include::modules/loki-networkpolicy-resources.adoc[leveloffset=+2]
79+
80+
include::modules/integrating-loki-network-policy-with-external-systems.adoc[leveloffset=+2]
81+
6982
//log based alerts
7083
[id="log-based-alerts_{context}"]
7184
== Log-based alerts for Loki

‎modules/configuring-a-network-policy-for-loki.adoc‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
:_newdoc-version: 2.18.4
2+
:_template-generated: 2025-10-17
3+
:_mod-docs-content-type: PROCEDURE
4+
5+
[id="configuring-a-network-policy-for-loki_{context}"]
6+
= Configuring a network policy for Loki
7+
8+
Enable or disable the deployment of `NetworkPolicies` per LokiStack by setting the `networkPolicies` field.
9+
10+
.Prerequisites
11+
* You have administrator permissions.
12+
* You have installed the {oc-first}.
13+
* You have installed the {loki-op}.
14+
* You have created a `LokiStack` custom resource (CR).
15+
16+
.Procedure
17+
. Update the `LokiStack` CR:
18+
+
19+
[source,yaml]
20+
----
21+
apiVersion: loki.grafana.com/v1
22+
kind: LokiStack
23+
metadata:
24+
name: logging-loki
25+
namespace: openshift-logging
26+
spec:
27+
size: 1x.small
28+
storage:
29+
schemas:
30+
- version: v13
31+
effectiveDate: "<yyyy>-<mm>-<dd>"
32+
secret:
33+
name: logging-loki-s3
34+
type: s3
35+
storageClassName: <storage_class_name>
36+
tenants:
37+
mode: openshift-logging
38+
networkPolicies:
39+
ruleSet: RestrictIngressEgress
40+
----
41+
+
42+
You can set one of the following values for the `spec.networkPolicies.ruleSet` field:
43+
+
44+
`None`::
45+
{loki-op} will not deploy any network policy.
46+
`RestrictIngressEgress`::
47+
{loki-op} will deploy a set of network policies that restrict the communications to and from the Loki components.
48+
+
49+
If you do not define a `spec.networkPolicies.ruleSet` value, the platform and operator default values are inherited and full network access is allowed.
50+
51+
. Apply the `LokiStack` CR object by running the following command:
52+
+
53+
[source,terminal]
54+
----
55+
$ oc apply -f <filename>.yaml
56+
----

‎modules/integrating-loki-network-policy-with-external-systems.adoc‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
:_newdoc-version: 2.18.4
2+
:_template-generated: 2025-10-17
3+
:_mod-docs-content-type: PROCEDURE
4+
5+
[id="integrating-loki-network-policy-with-external-systems_{context}"]
6+
= Integrating Loki network policy with external systems
7+
8+
To integrate Loki with external systems such as custom dashboards, or external alerting, create additional network policies.
9+
You can select specific components by using the label `app.kubernetes.io/component`.
10+
Always include the labels `app.kubernetes.io/name=lokistack` and `app.kubernetes.io/instance={name}` to avoid collision with other pods deployed in the namespace.
11+
12+
.Prerequisites
13+
* You have administrator permissions.
14+
* You have installed the {oc-first}.
15+
* You have installed the {loki-op}.
16+
* You have created a `LokiStack` custom resource (CR).
17+
18+
.Procedure
19+
. Create a network policy:
20+
+
21+
[source,yaml]
22+
----
23+
apiVersion: networking.k8s.io/v1
24+
kind: NetworkPolicy
25+
metadata:
26+
name: <name>
27+
spec:
28+
podSelector:
29+
matchLabels:
30+
app.kubernetes.io/name: lokistack
31+
app.kubernetes.io/instance: <instance_name>
32+
app.kubernetes.io/component: <loki_component>
33+
policyTypes:
34+
- Egress
35+
egress:
36+
- to:
37+
- namespaceSelector:
38+
matchLabels:
39+
kubernetes.io/metadata.name: <namespace_name>
40+
ports:
41+
- protocol: TCP
42+
port: <port_number>
43+
----
44+
+
45+
Replace <component_name> with the component you want to integrate with.
46+
47+
. Apply the network policy:
48+
+
49+
[source,terminal]
50+
----
51+
$ oc apply -f <file_name>.yaml
52+
----

‎modules/loki-network-policies.adoc‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
:_newdoc-version: 2.18.4
2+
:_template-generated: 2025-10-17
3+
:_mod-docs-content-type: CONCEPT
4+
5+
[id="loki-network-policies_{context}"]
6+
= Loki network policies
7+
8+
You can enable the {loki-op} to automatically create a `NetworkPolicy` resource that implements a "default deny" security model with explicit allow rules for required communications.
9+
Network policies provide network segmentation for your LokiStack deployment by controlling ingress and egress traffic between Loki components and external services.
10+
The network policies in {loki-op} are designed to be secure by default while maintaining compatibility across diverse environments.
11+
12+
Network policies for Loki on {ocp-product-title} include the following additional integrations:
13+
14+
* Monitoring: Automatic integration with the {ocp-product-title} monitoring stack.
15+
* DNS: Support for both standard and {ocp-product-title} DNS services (port 5353).

‎modules/loki-networkpolicy-resources.adoc‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
:_newdoc-version: 2.18.4
2+
:_template-generated: 2025-10-17
3+
:_mod-docs-content-type: REFERENCE
4+
5+
[id="loki-networkpolicy-resources_{context}"]
6+
= Loki NetworkPolicy resources
7+
8+
When network policies are enabled, the {loki-op} creates several NetworkPolicy resources to secure different aspects of your `LokiStack` deployment.
9+
10+
[cols="1,1,1"]
11+
|====
12+
|Policy name
13+
|Purpose
14+
|Components affected
15+
16+
|{name}-default-deny
17+
|A baseline deny-all policy
18+
|All LokiStack pods
19+
20+
|{name}-loki-allow
21+
|Inter-component communication allowed
22+
|All Loki components
23+
24+
|{name}-loki-allow-metrics
25+
|Allow metric scraping on the prometheus endpoint
26+
|All Loki components
27+
28+
29+
|{name}-loki-allow-bucket-egress
30+
|Policy for object storage access
31+
|ingester, querier, index-gateway, compactor, ruler
32+
33+
|{name}-loki-allow-gateway-ingress
34+
|Allow gateway access to Loki components
35+
|distributor, query-frontend, ruler
36+
37+
|{name}-gateway-allow
38+
|Gateway external and monitoring access
39+
|LokiStack-gateway
40+
41+
|{name}-gateway-allow-metrics
42+
|Allow metric scraping on the prometheus endpoint
43+
|LokiStack-gateway
44+
45+
|{name}-ruler-allow-alert-egress
46+
|Allow ruler egress to AlertManager
47+
|ruler
48+
49+
|{name}-loki-allow-query-frontend
50+
|Query frontend external access
51+
|query-frontend (OpenShift network mode)
52+
53+
|====

0 commit comments

Comments
 (0)