feat(logs): read and write loki's chunks on RustFS

sean commented

2026-09-09 15:30:00 +00:00

Owner

The last consumer of MinIO in this repository. Both storage stanzas, the readiness wait and the credential source move to RustFS, and ClusterSecretStore/olly-platform-minio retires with them -- it existed to hand Loki and Tempo the olly-platform credential, whose policy grants platform-*, a wildcard over bucket names, to five Secrets. Loki now holds a key scoped to its own two buckets. The data is already mirrored: 53,580 objects, 2.3 GiB, nothing differing. The bucket-creating init container is removed rather than repointed, because it runs mc mb with a key that has no s3:CreateBucket. tests/object-store-endpoint-contract.sh pins no-MinIO, no-headless, explicit :9000 and no self-created buckets, with four controls confirmed red. https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

sean added 1 commit

2026-09-09 15:30:00 +00:00

feat(logs): read and write loki's chunks on RustFS

binjovi/ci Binjovi completed the frozen plan

Details

7acb8dd768

The last consumer of MinIO in this repository. Both storage stanzas, the
readiness wait and the credential source now point at RustFS, and
`ClusterSecretStore/olly-platform-minio` goes with them.

THE DATA IS ALREADY THERE. sean/seanfarm's mirror copied 53,580 objects and
2.3 GiB of platform-loki-chunks with nothing differing before this landed;
platform-loki-ruler is empty on both sides. The MinIO buckets are left
untouched and remain the rollback until MinIO retires. The handful of chunks
written to MinIO between the last mirror pass and this repoint are picked up by
the next run of that Job, which now has a quiet source and must reach zero.

WHAT RETIRES WITH IT. `olly-platform-minio` existed to let Loki and Tempo read
the platform MinIO credential -- `olly-platform`, whose policy grants
`platform-*`, a WILDCARD over bucket names, plus two more buckets, to five
different Secrets. It is the widest credential in that tenant. Tempo left it
when it moved; loki was the last thing holding it open, and namespace
olly-platform no longer exists. Loki now uses a key scoped to its own two
buckets, and Binjovi proves on every catalog release that the same key is
refused platform-tempo-traces and the isolation canary.

THE BUCKET-CREATING INIT CONTAINER IS GONE, NOT REPOINTED. It ran `mc mb` with
the workload's own scoped key, which has no s3:CreateBucket, so against RustFS
the pod CrashLoops. `--ignore-existing` does not help: mc still asks and still
gets Access Denied. Binjovi creates both buckets from the declaration in
sean/binjovi-plans and imports their lifecycle rules.

tests/object-store-endpoint-contract.sh keeps all of it: no MinIO endpoint
anywhere in manifests/, never the RustFS headless name -- which hands out
individual server addresses and lost requests twice during the 2026-09-02 node
roll -- always an explicit :9000, because RustFS has no port-80 listener so a
missing port reaches nothing rather than degrading, and no workload creating
its own bucket. Four negative controls, each confirmed red on its own.

Claude-Session: https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

binjovi-bot merged commit 7acb8dd768 into trunk

2026-09-09 15:30:21 +00:00

Rows
Columns

feat(logs): read and write loki's chunks on RustFS #99