Configure storage

The scalable installation requires a managed object store such as AWS S3 or Google Cloud Storage or a self-hosted store such as Minio. The single binary installation can use the filesystem for storage, but we recommend configuring object storage via cloud provider or pointing Loki at a MinIO cluster for production deployments.

This guide assumes Loki will be installed in one of the modes above and that a values.yaml has been created.

To use a managed object store:

1. In the values.yaml file, set the value for storage.type to azure, gcs, or s3.

2. Configure the storage client under loki.storage.azure, loki.storage.gcs, or loki.storage.s3.

To install Minio alongside Loki:

1. Change the configuration in values.yaml:

   • Enable Minio
   yamlCopy

   minio:
     enabled: true
   

To use Thanos object store clients (experimental):

Loki supports using Thanos-compatible storage clients as an alternative to the built-in storage clients. This is configured via loki.storage.use_thanos_objstore and will become the default in a future release.

1. Enable Thanos object store in values.yaml:

   yamlCopy

   loki:
     storage:
       use_thanos_objstore: true
       object_store:
         type: s3  # Valid options: s3, gcs, azure
         s3:
           endpoint: <YOUR_ENDPOINT>
           region: <YOUR_REGION>
   

2. Configure the storage client under loki.storage.object_store.s3, loki.storage.object_store.gcs, or loki.storage.object_store.azure.

To grant access to S3 via an IAM role without providing credentials:

1. Provision an IAM role, policy and S3 bucket as described in Storage.

   • If the Terraform module was used note the annotation emitted by terraform output -raw annotation.

2. Add the IAM role annotation to the service account in values.yaml:

   Copy

   serviceAccount:
     annotations:
       "eks.amazonaws.com/role-arn": "arn:aws:iam::<account id>:role/<role name>"
   

3. Configure the storage:

   Copy

   loki:
     storage:
       type: "s3"
       s3:
         region: eu-central-1
       bucketNames:
         chunks: <bucket name>
         ruler: <bucket name>
         admin: <bucket name>
   

   Note that endpoint, secretAccessKey and accessKeyId have been omitted.