projectsyn · DebakelOrakel · May 14, 2026
diff --git a/class/defaults.yml b/class/defaults.yml
@@ -12,8 +12,8 @@ parameters:
 
     charts:
       loki:
-        source: https://grafana.github.io/helm-charts
-        version: v6.53.0
+        source: https://grafana-community.github.io/helm-charts
+        version: v13.5.0
 
     images:
       loki:
@@ -28,6 +28,9 @@ parameters:
       nginx:
         registry: docker.io
         repository: nginxinc/nginx-unprivileged
+      accessLogExporter:
+        registry: ghcr.io
+        repository: jkroepke/access-log-exporter
 
     preset: legacy
 

diff --git a/component/helm_values.jsonnet b/component/helm_values.jsonnet
@@ -90,9 +90,11 @@ local openshift = if isOpenshift then com.makeMergeable({
 }) else {};
 
 local images = com.makeMergeable({
-  image: {
-    repository: '%(registry)s/%(repository)s' % params.images.loki,
-    [if std.objectHas(params.images.loki, 'tag') then 'tag']: params.images.loki.tag,
+  loki: {
+    image: {
+      repository: '%(registry)s/%(repository)s' % params.images.loki,
+      [if std.objectHas(params.images.loki, 'tag') then 'tag']: params.images.loki.tag,
+    },
   },
   memcached: {
     image: {
@@ -114,13 +116,19 @@ local images = com.makeMergeable({
         [if std.objectHas(params.images.nginx, 'tag') then 'tag']: params.images.nginx.tag,
       },
     },
+    metrics: {
+      image: {
+        registry: params.images.accessLogExporter.registry,
+        repository: params.images.accessLogExporter.repository,
+        [if std.objectHas(params.images.accessLogExporter, 'tag') then 'tag']: params.images.accessLogExporter.tag,
+      },
+    },
   },
 });
 
 local global = com.makeMergeable({
   global: {
     extraEnvFrom: [ { secretRef: { name: '%s-bucket-secret' % inv.parameters._instance } } ],
-    extraArgs: [ '-config.expand-env=true' ],
     podAnnotations: {
       bucketSecretVersion: '%s' % params.s3.auth.secretVersion,
     },

diff --git a/tests/extra-config.yml b/tests/extra-config.yml
@@ -22,6 +22,8 @@ parameters:
         registry: dockerhub.vshn.net
       nginx:
         registry: dockerhub.vshn.net
+      accessLogExporter:
+        tag: latest
 
     components:
       ruler:

diff --git a/tests/golden/defaults/loki/loki/10_helm_loki/loki/templates/backend/clusterrole.yaml b/tests/golden/defaults/loki/loki/10_helm_loki/loki/templates/backend/clusterrole.yaml
@@ -4,8 +4,8 @@ metadata:
   labels:
     app.kubernetes.io/instance: loki
     app.kubernetes.io/name: loki
-    app.kubernetes.io/version: 3.6.5
-    helm.sh/chart: loki-6.53.0
+    app.kubernetes.io/version: 3.7.1
+    helm.sh/chart: loki-13.5.0
   name: loki-clusterrole
 rules:
   - apiGroups:

diff --git a/tests/golden/defaults/loki/loki/10_helm_loki/loki/templates/backend/clusterrolebinding.yaml b/tests/golden/defaults/loki/loki/10_helm_loki/loki/templates/backend/clusterrolebinding.yaml
@@ -4,8 +4,8 @@ metadata:
   labels:
     app.kubernetes.io/instance: loki
     app.kubernetes.io/name: loki
-    app.kubernetes.io/version: 3.6.5
-    helm.sh/chart: loki-6.53.0
+    app.kubernetes.io/version: 3.7.1
+    helm.sh/chart: loki-13.5.0
   name: loki-clusterrolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io

diff --git a/.../backend/poddisruptionbudget-backend.yaml → ...helm_loki/loki/templates/backend/pdb.yaml b/.../backend/poddisruptionbudget-backend.yaml → ...helm_loki/loki/templates/backend/pdb.yaml
@@ -5,8 +5,8 @@ metadata:
     app.kubernetes.io/component: backend
     app.kubernetes.io/instance: loki
     app.kubernetes.io/name: loki
-    app.kubernetes.io/version: 3.6.5
-    helm.sh/chart: loki-6.53.0
+    app.kubernetes.io/version: 3.7.1
+    helm.sh/chart: loki-13.5.0
   name: loki-backend
   namespace: syn-loki
 spec:

diff --git a/...lden/defaults/loki/loki/10_helm_loki/loki/templates/backend/service-backend-headless.yaml b/...lden/defaults/loki/loki/10_helm_loki/loki/templates/backend/service-backend-headless.yaml
diff --git a/tests/golden/defaults/loki/loki/10_helm_loki/loki/templates/backend/service-backend.yaml b/tests/golden/defaults/loki/loki/10_helm_loki/loki/templates/backend/service-backend.yaml
diff --git a/tests/golden/defaults/loki/loki/10_helm_loki/loki/templates/backend/service.yaml b/tests/golden/defaults/loki/loki/10_helm_loki/loki/templates/backend/service.yaml
@@ -0,0 +1,68 @@
+apiVersion: v1
+kind: Service
+metadata:
+  annotations: null
+  labels:
+    app.kubernetes.io/component: backend
+    app.kubernetes.io/instance: loki
+    app.kubernetes.io/name: loki
+    app.kubernetes.io/version: 3.7.1
+    helm.sh/chart: loki-13.5.0
+  name: loki-backend
+  namespace: syn-loki
+spec:
+  ports:
+    - name: http-metrics
+      port: 3100
+      protocol: TCP
+      targetPort: http-metrics
+    - name: grpc
+      port: 9095
+      protocol: TCP
+      targetPort: grpc
+    - name: grpclb
+      port: 9096
+      protocol: TCP
+      targetPort: grpc
+  publishNotReadyAddresses: true
+  selector:
+    app.kubernetes.io/component: backend
+    app.kubernetes.io/instance: loki
+    app.kubernetes.io/name: loki
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations: null
+  labels:
+    app.kubernetes.io/component: backend
+    app.kubernetes.io/instance: loki
+    app.kubernetes.io/name: loki
+    app.kubernetes.io/version: 3.7.1
+    helm.sh/chart: loki-13.5.0
+    prometheus.io/service-monitor: 'false'
+    variant: headless
+  name: loki-backend-headless
+  namespace: syn-loki
+spec:
+  clusterIP: None
+  ports:
+    - name: http-metrics
+      port: 3100
+      protocol: TCP
+      targetPort: http-metrics
+    - name: grpc
+      port: 9095
+      protocol: TCP
+      targetPort: grpc
+    - name: grpclb
+      port: 9096
+      protocol: TCP
+      targetPort: grpc
+  publishNotReadyAddresses: true
+  selector:
+    app.kubernetes.io/component: backend
+    app.kubernetes.io/instance: loki
+    app.kubernetes.io/name: loki
+  type: ClusterIP
diff --git a/...emplates/backend/statefulset-backend.yaml → ...i/loki/templates/backend/statefulset.yaml b/...emplates/backend/statefulset-backend.yaml → ...i/loki/templates/backend/statefulset.yaml
@@ -6,8 +6,8 @@ metadata:
     app.kubernetes.io/instance: loki
     app.kubernetes.io/name: loki
     app.kubernetes.io/part-of: memberlist
-    app.kubernetes.io/version: 3.6.5
-    helm.sh/chart: loki-6.53.0
+    app.kubernetes.io/version: 3.7.1
+    helm.sh/chart: loki-13.5.0
   name: loki-backend
   namespace: syn-loki
 spec:
@@ -26,15 +26,15 @@ spec:
   template:
     metadata:
       annotations:
-        checksum/config: 97913dbb9b85bb7a6df56d0176b64e94b3c339ab1700f212b9d56139f92b3d90
-        kubectl.kubernetes.io/default-container: loki
+        checksum/config: 253c4147cd4e25cd49d9777c4546b92ddd55ae4feed09b4dbe135d92e484f7a6
+        kubectl.kubernetes.io/default-container: backend
       labels:
         app.kubernetes.io/component: backend
         app.kubernetes.io/instance: loki
         app.kubernetes.io/name: loki
         app.kubernetes.io/part-of: memberlist
-        app.kubernetes.io/version: 3.6.5
-        helm.sh/chart: loki-6.53.0
+        app.kubernetes.io/version: 3.7.1
+        helm.sh/chart: loki-13.5.0
     spec:
       affinity:
         podAntiAffinity:
@@ -49,15 +49,32 @@ spec:
       containers:
         - args:
             - -config.file=/etc/loki/config/config.yaml
+            - -config.expand-env=true
             - -target=backend
             - -legacy-read-mode=false
-            - -config.expand-env=true
+          env:
+            - name: GOMEMLIMIT
+              value: 1740MiB
+            - name: GOGC
+              value: '80'
+            - name: HASH_RING_INSTANCE_ADDR
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
           envFrom:
             - secretRef:
                 name: loki-bucket-secret
-          image: docker.io/grafana/loki:3.6.5
+          image: docker.io/grafana/loki:3.7.1
           imagePullPolicy: IfNotPresent
-          name: loki
+          livenessProbe:
+            failureThreshold: 10
+            httpGet:
+              path: /loki/api/v1/status/buildinfo
+              port: http-metrics
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 1
+          name: backend
           ports:
             - containerPort: 3100
               name: http-metrics
@@ -90,15 +107,17 @@ spec:
               drop:
                 - ALL
             readOnlyRootFilesystem: true
+            seccompProfile:
+              type: RuntimeDefault
           volumeMounts:
             - mountPath: /etc/loki/config
               name: config
             - mountPath: /etc/loki/runtime-config
               name: runtime-config
-            - mountPath: /tmp
-              name: tmp
             - mountPath: /var/loki
               name: data
+            - mountPath: /tmp
+              name: temp
             - mountPath: /rules
               name: sc-rules-volume
         - env:
@@ -116,26 +135,57 @@ spec:
               value: '60'
             - name: LOG_LEVEL
               value: INFO
-          image: docker.io/kiwigrid/k8s-sidecar:1.30.9
+            - name: HEALTH_PORT
+              value: '8080'
+          image: docker.io/kiwigrid/k8s-sidecar:2.7.1
           imagePullPolicy: IfNotPresent
+          livenessProbe:
+            failureThreshold: 3
+            httpGet:
+              path: /healthz
+              port: http-sidecar
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 1
           name: loki-sc-rules
+          ports:
+            - containerPort: 8080
+              name: http-sidecar
+              protocol: TCP
+          readinessProbe:
+            failureThreshold: 3
+            httpGet:
+              path: /healthz
+              port: http-sidecar
+            initialDelaySeconds: 3
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 1
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:
               drop:
                 - ALL
             readOnlyRootFilesystem: true
+            seccompProfile:
+              type: RuntimeDefault
           volumeMounts:
+            - mountPath: /tmp
+              name: sc-rules-temp
             - mountPath: /rules
               name: sc-rules-volume
+      enableServiceLinks: true
       securityContext:
         fsGroupChangePolicy: OnRootMismatch
         runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       serviceAccountName: loki
       terminationGracePeriodSeconds: 300
       volumes:
         - emptyDir: {}
-          name: tmp
+          name: temp
         - configMap:
             items:
               - key: config.yaml
@@ -147,6 +197,8 @@ spec:
           name: runtime-config
         - emptyDir: {}
           name: sc-rules-volume
+        - emptyDir: {}
+          name: sc-rules-temp
   updateStrategy:
     rollingUpdate:
       partition: 0

diff --git a/...-cache/service-chunks-cache-headless.yaml → .../loki/templates/chunks-cache/service.yaml b/...-cache/service-chunks-cache-headless.yaml → .../loki/templates/chunks-cache/service.yaml
@@ -6,8 +6,8 @@ metadata:
     app.kubernetes.io/component: memcached-chunks-cache
     app.kubernetes.io/instance: loki
     app.kubernetes.io/name: loki
-    app.kubernetes.io/version: 3.6.5
-    helm.sh/chart: loki-6.53.0
+    app.kubernetes.io/version: 3.7.1
+    helm.sh/chart: loki-13.5.0
   name: loki-chunks-cache
   namespace: syn-loki
 spec: