---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app: loki
  name: default-loki
  namespace: onecloud
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app: loki
  name: default-loki
  namespace: onecloud
rules:
- apiGroups:
  - extensions
  resourceNames:
  - loki
  resources:
  - podsecuritypolicies
  verbs:
  - use
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app: loki
  name: default-loki
  namespace: onecloud
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: loki
subjects:
- kind: ServiceAccount
  name: loki
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: default-loki
  namespace: onecloud
  labels:
    app: loki
data:
  loki.yaml: |
    auth_enabled: false
    chunk_store_config:
      max_look_back_period: 0
    ingester:
      chunk_block_size: 262144
      chunk_idle_period: 3m
      chunk_retain_period: 1m
      lifecycler:
        ring:
          kvstore:
            store: inmemory
          replication_factor: 1
    limits_config:
      enforce_metric_name: false
      reject_old_samples: true
      reject_old_samples_max_age: 168h
    schema_config:
      configs:
      - from: "2018-04-15"
        index:
          period: 168h
          prefix: index_
        object_store: filesystem
        schema: v9
        store: boltdb
    server:
      http_listen_port: 3100
    storage_config:
      boltdb:
        directory: /data/loki/index
      filesystem:
        directory: /data/loki/chunks
    table_manager:
      retention_deletes_enabled: false
      retention_period: 0
---
apiVersion: v1
kind: Service
metadata:
  name: default-loki-headless
  namespace: onecloud
spec:
  clusterIP: None
  ports:
  - name: http-metrics
    port: 3100
    protocol: TCP
    targetPort: http-metrics
  selector:
    app: loki
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  name: default-loki
  namespace: onecloud
spec:
  ports:
  - name: http-metrics
    port: 3100
    protocol: TCP
    targetPort: http-metrics
  selector:
    app: loki
  type: ClusterIP
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: default-loki
  namespace: onecloud
  labels:
    app: loki
spec:
  podManagementPolicy: OrderedReady
  replicas: 1
  selector:
    matchLabels:
      app: loki
  serviceName: default-loki-headless
  updateStrategy:
    type: RollingUpdate
  volumeClaimTemplates:
  - metadata:
      name: storage
    spec:
      accessModes:
      - ReadWriteOnce
      resources:
        requests:
          storage: 100Gi
      storageClassName: local-path
      volumeMode: Filesystem
  template:
    metadata:
      labels:
        app: loki
      annotations:
        prometheus.io/port: http-metrics
        prometheus.io/scrape: "true"
    spec:
      serviceAccount: default-loki
      serviceAccountName: default-loki
      terminationGracePeriodSeconds: 4800
      securityContext:
        fsGroup: 10001
        runAsGroup: 10001
        runAsNonRoot: true
        runAsUser: 10001
      volumes:
      - name: config
        configMap:
          defaultMode: 420
          name: default-loki
      containers:
      - name: loki
        image: grafana/loki:v1.2.0
        imagePullPolicy: IfNotPresent
        args:
        - -config.file=/etc/loki/loki.yaml
        volumeMounts:
        - mountPath: /etc/loki
          name: config
        - mountPath: /data
          name: storage
        ports:
        - name: http-metrics
          containerPort: 3100
          protocol: TCP
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /ready
            port: http-metrics
            scheme: HTTP
          initialDelaySeconds: 45
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /ready
            port: http-metrics
            scheme: HTTP
          initialDelaySeconds: 45
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
        securityContext:
          procMount: Default
          readOnlyRootFilesystem: true