Chapter 2. Configure Loki network policies

Procedure

1. Update the LokiStack CR:

   apiVersion: loki.grafana.com/v1
   kind: LokiStack
   metadata:
     name: logging-loki
     namespace: openshift-logging
   spec:
     size: 1x.small
     storage:
       schemas:
       - version: v13
         effectiveDate: "<yyyy>-<mm>-<dd>"
       secret:
         name: logging-loki-s3
         type: s3
     storageClassName: <storage_class_name>
     tenants:
       mode: openshift-logging
     networkPolicies:
       ruleSet: RestrictIngressEgress

   You can set one of the following values for the spec.networkPolicies.ruleSet field:

   None

   Loki Operator will not deploy any network policy.

   RestrictIngressEgress

   Loki Operator will deploy a set of network policies that restrict the communications to and from the Loki components.

   If you do not define a spec.networkPolicies.ruleSet value, the platform and operator default values are inherited and full network access is allowed.

2. Apply the LokiStack CR object by running the following command:

   $ oc apply -f <filename>.yaml

Procedure

1. Create a network policy:

   apiVersion: networking.k8s.io/v1
   kind: NetworkPolicy
   metadata:
     name: <name>
   spec:
     podSelector:
       matchLabels:
         app.kubernetes.io/name: lokistack
         app.kubernetes.io/instance: <instance_name>
         app.kubernetes.io/component: <loki_component>
     policyTypes:
     - Egress
     egress:
     - to:
       - namespaceSelector:
           matchLabels:
             kubernetes.io/metadata.name: <namespace_name>
       ports:
       - protocol: TCP
         port: <port_number>

   Replace <component_name> with the component you want to integrate with.

2. Apply the network policy:

   $ oc apply -f <file_name>.yaml