Project

General

Profile

Actions

Feature #23160

closed

Salt installer grants access to Loki S3 backend bucket through roles instead of credentials

Added by Lucas Di Pentima 6 months ago. Updated 6 months ago.

Status:
Resolved
Priority:
Normal
Assigned To:
Category:
Deployment
Target version:
Story points:
-
Release relationship:
Auto

Description

The current implementation of Loki config is to create an access key/secret for the Loki service to write data to the S3 bucket.
This implies having clear text credentials on Loki's config file, something is not considered best practice.
We should give the Loki server access to the S3 data bucket via alternative means. One possibility can be adding those permissions to the Loki service instance profile.


Subtasks 1 (0 open1 closed)

Task #23162: Review 23160-installer-loki-s3-permsResolvedBrett Smith09/22/2025Actions
Actions #1

Updated by Lucas Di Pentima 6 months ago

  • Subject changed from salt installer grants access to Loki S3 backend bucket trhough roles instead of credentials to Salt installer grants access to Loki S3 backend bucket through roles instead of credentials
Actions #2

Updated by Brett Smith 6 months ago

  • Release deleted (81)
  • Target version changed from Future to Development 2025-10-01
  • Assigned To set to Lucas Di Pentima
Actions #3

Updated by Brett Smith 6 months ago

  • Subtask #23162 added
Actions #4

Updated by Lucas Di Pentima 6 months ago

  • Status changed from New to In Progress
Actions #5

Updated by Lucas Di Pentima 6 months ago

Have been trying to set up an initial test cluster but bumped into this: https://github.com/phusion/passenger/issues/2625 -- hopefully it gets fixed soon.

Actions #6

Updated by Lucas Di Pentima 6 months ago

23160-installer-loki-s3-perms @ f2d860ba85

test-provision: #1296
run-tests-doc-pysdk-api-fuse: #1236 (for doc updates)

  • All agreed upon points are implemented / addressed. Describe changes from pre-implementation design.
    • Yes. Instead of using an IAM User with access key & secret, we now assign S3 access to Loki's bucket to the entire instance.
  • Anything not implemented (discovered or discussed during work) has a follow-up story.
    • No.
  • Code is tested and passing, both automated and manual, what manual testing was done is described.
    • Manually tested by deploying a multi node cluster in our sandbox account. Automated test-provision tests make sure that I haven't broken anything else.
  • The tested code incorporates recent main branch changes.
    • Yes
  • New or changed UI/UX has gotten feedback from stakeholders.
    • UI simplified as it's not necessary anymore to save access key & secret on local.params.secrets
  • Documentation has been updated.
    • Yes. Updated multi-node installation instructions and added a deprecation note in the Upgrading section.
  • Behaves appropriately at the intended scale (describe intended scale).
    • No change in scale
  • Considered backwards and forwards compatibility issues between client and server.
    • No incompatible changes with previous version. Old credentials are invalidated and cause no issues if left in local.params.secrets file.
  • Follows our coding standards and GUI style guidelines.
    • N/A
Actions #7

Updated by Brett Smith 6 months ago

Lucas Di Pentima wrote in #note-6:

23160-installer-loki-s3-perms @ f2d860ba85

LGTM, thanks.

Actions #8

Updated by Lucas Di Pentima 6 months ago

  • Status changed from In Progress to Resolved
Actions #9

Updated by Brett Smith 6 months ago

  • Release set to 79
Actions

Also available in: Atom PDF