konairius/homelab
10
0
Fork 0
Code Issues 9 Pull Requests 2 Packages Projects Releases 1 Wiki Activity

monitoring: GET-only Loki read gateway for the paperclip read SA (REN-621) #1119

Merged
Ghost merged 1 commits from atlas/ren-621-loki-read-gateway into master 2026-10-04 12:22:00 +00:00
Conversation 2 Commits 1 Files Changed 4
+174 -2
1 Commits
Author SHA1 Message Date
atlas-botandClaude Opus 5.5 fe2e163b6a monitoring: GET-only Loki read gateway for the paperclip read SA (REN-621)
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/pr-review Pipeline was successful
Details
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details 
Loki runs SingleBinary with auth disabled and answers GET on
/ingester/shutdown and /flush, so an RBAC `get` on services/proxy for
loki:3100 would not be read-only. Put an nginx allow-list in front of it
(query, query_range, labels, label/<name>/values, series; GET only;
upstream URI rebuilt per location) and grant the paperclip read SA
`get` on that Service only. Owner decision: REN-622 (option A2).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-04 12:20:27 +00:00