<p>HTTPEncryption enables TLS encryption for all HTTP LokiStack services.
Each HTTP service requires a secret named as the service with the following data:
- <code>tls.crt</code>: The TLS server side certificate.
- <code>tls.key</code>: The TLS key for server-side encryption.
In addition each service requires a configmap named as the LokiStack CR with the
suffix <code>-ca-bundle</code>, e.g. <code>lokistack-dev-ca-bundle</code> and the following data:
- <code>service-ca.crt</code>: The CA signing the service certificate in <code>tls.crt</code>.</p>
</td>
</tr>
<tr>
<td>
<code>grpcEncryption</code><br/>
<em>
bool
</em>
</td>
<td>
<p>GRPCEncryption enables TLS encryption for all GRPC LokiStack services.
Each GRPC service requires a secret named as the service with the following data:
- <code>tls.crt</code>: The TLS server side certificate.
- <code>tls.key</code>: The TLS key for server-side encryption.
In addition each service requires a configmap named as the LokiStack CR with the
suffix <code>-ca-bundle</code>, e.g. <code>lokistack-dev-ca-bundle</code> and the following data:
- <code>service-ca.crt</code>: The CA signing the service certificate in <code>tls.crt</code>.</p>
</td>
</tr>
<tr>
<td>
<code>lokiStackGateway</code><br/>
<em>
bool
</em>
</td>
<td>
<p>LokiStackGateway enables reconciling the reverse-proxy lokistack-gateway
component for multi-tenant authentication/authorization traffic control
to Loki.</p>
</td>
</tr>
<tr>
<td>
<code>grafanaLabsUsageReport</code><br/>
<em>
bool
</em>
</td>
<td>
<p>GrafanaLabsUsageReport enables the Grafana Labs usage report for Loki.
More details: <ahref="https://grafana.com/docs/loki/latest/release-notes/v2-5/#usage-reporting">https://grafana.com/docs/loki/latest/release-notes/v2-5/#usage-reporting</a></p>
</td>
</tr>
<tr>
<td>
<code>runtimeSeccompProfile</code><br/>
<em>
bool
</em>
</td>
<td>
<p>RuntimeSeccompProfile enables the restricted seccomp profile on all
Lokistack components.</p>
</td>
</tr>
<tr>
<td>
<code>lokiStackWebhook</code><br/>
<em>
bool
</em>
</td>
<td>
<p>LokiStackWebhook enables the LokiStack CR validation and conversion webhooks.</p>
</td>
</tr>
<tr>
<td>
<code>alertingRuleWebhook</code><br/>
<em>
bool
</em>
</td>
<td>
<p>AlertingRuleWebhook enables the AlertingRule CR validation webhook.</p>
</td>
</tr>
<tr>
<td>
<code>recordingRuleWebhook</code><br/>
<em>
bool
</em>
</td>
<td>
<p>RecordingRuleWebhook enables the RecordingRule CR validation webhook.</p>
</td>
</tr>
<tr>
<td>
<code>defaultNodeAffinity</code><br/>
<em>
bool
</em>
</td>
<td>
<p>When DefaultNodeAffinity is enabled the operator will set a default node affinity on all pods.
This will limit scheduling of the pods to Nodes with Linux.</p>
<p>OpenShiftFeatureGates is the supported set of all operator features gates on OpenShift.</p>
</div>
<table>
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>servingCertsService</code><br/>
<em>
bool
</em>
</td>
<td>
<p>ServingCertsService enables OpenShift service-ca annotations on Services
to use the in-platform CA and generate a TLS cert/key pair per service for
in-cluster data-in-transit encryption.
More details: <ahref="https://docs.openshift.com/container-platform/latest/security/certificate_types_descriptions/service-ca-certificates.html">https://docs.openshift.com/container-platform/latest/security/certificate_types_descriptions/service-ca-certificates.html</a></p>
</td>
</tr>
<tr>
<td>
<code>gatewayRoute</code><br/>
<em>
bool
</em>
</td>
<td>
<p>GatewayRoute enables creating an OpenShift Route for the LokiStack
gateway to expose the service to public internet access.
More details: <ahref="https://docs.openshift.com/container-platform/latest/networking/understanding-networking.html">https://docs.openshift.com/container-platform/latest/networking/understanding-networking.html</a></p>
</td>
</tr>
<tr>
<td>
<code>ruleExtendedValidation</code><br/>
<em>
bool
</em>
</td>
<td>
<p>ExtendedRuleValidation enables extended validation of AlertingRule and RecordingRule
to enforce tenancy in an OpenShift context.</p>
</td>
</tr>
<tr>
<td>
<code>clusterTLSPolicy</code><br/>
<em>
bool
</em>
</td>
<td>
<p>ClusterTLSPolicy enables usage of TLS policies set in the API Server.
More details: <ahref="https://docs.openshift.com/container-platform/4.11/security/tls-security-profiles.html">https://docs.openshift.com/container-platform/4.11/security/tls-security-profiles.html</a></p>
| serviceMonitors | ServiceMonitors enables creating a Prometheus-Operator managed ServiceMonitor resource per LokiStack component. | bool | false |
| serviceMonitorTlsEndpoints | ServiceMonitorTLSEndpoints enables TLS for the ServiceMonitor endpoints. | bool | false |
| lokiStackAlerts | LokiStackAlerts enables creating Prometheus-Operator managed PrometheusRules for common Loki alerts. | bool | false |
| httpEncryption | HTTPEncryption enables TLS encryption for all HTTP LokiStack services. Each HTTP service requires a secret named as the service with the following data: - `tls.crt`: The TLS server side certificate. - `tls.key`: The TLS key for server-side encryption. In addition each service requires a configmap named as the LokiStack CR with the suffix `-ca-bundle`, e.g. `lokistack-dev-ca-bundle` and the following data: - `service-ca.crt`: The CA signing the service certificate in `tls.crt`. | bool | false |
| grpcEncryption | GRPCEncryption enables TLS encryption for all GRPC LokiStack services. Each GRPC service requires a secret named as the service with the following data: - `tls.crt`: The TLS server side certificate. - `tls.key`: The TLS key for server-side encryption. In addition each service requires a configmap named as the LokiStack CR with the suffix `-ca-bundle`, e.g. `lokistack-dev-ca-bundle` and the following data: - `service-ca.crt`: The CA signing the service certificate in `tls.crt`. | bool | false |
| lokiStackGateway | LokiStackGateway enables reconciling the reverse-proxy lokistack-gateway component for multi-tenant authentication/authorization traffic control to Loki. | bool | false |
| grafanaLabsUsageReport | GrafanaLabsUsageReport enables the Grafana Labs usage report for Loki. More details: https://grafana.com/docs/loki/latest/release-notes/v2-5/#usage-reporting | bool | false |
| runtimeSeccompProfile | RuntimeSeccompProfile enables the restricted seccomp profile on all Lokistack components. | bool | false |
| lokiStackWebhook | LokiStackWebhook enables the LokiStack CR validation and conversion webhooks. | bool | false |
| servingCertsService | ServingCertsService enables OpenShift service-ca annotations on Services to use the in-platform CA and generate a TLS cert/key pair per service for in-cluster data-in-transit encryption. More details: https://docs.openshift.com/container-platform/latest/security/certificate_types_descriptions/service-ca-certificates.html | bool | false |
| gatewayRoute | GatewayRoute enables creating an OpenShift Route for the LokiStack gateway to expose the service to public internet access. More details: https://docs.openshift.com/container-platform/latest/networking/understanding-networking.html | bool | false |
[Back to TOC](#table-of-contents)
## ProjectConfig
ProjectConfig is the Schema for the projectconfigs API
Mohamed-Amine Bouqsimi
3 years ago
committed by