Skip to content

Migrate Loki to the bb-common subchart

Loki chart 6.55.0-bb.10 consumes the existing bb-common dependency as a regular Helm subchart. Its templates now render networking and Istio resources directly, and Helm validates their values against the dependency’s schema.

This is a breaking values change. Deploy this chart together with the matching Big Bang umbrella integration. Do not merge the conversion before the final Big Bang 3.x release, as required by Loki issue #328.

Move package overrides

Move Loki’s istio, networkPolicies, and routes overrides under bb-common. Other Loki chart values, including storage, replicas, and minio, stay where they are. For example, replace this legacy Big Bang 3.x umbrella override:

loki:
  values:
    routes:
      inbound:
        loki:
          enabled: true
    istio:
      enabled: true
      sidecar:
        enabled: true

with these current Big Bang umbrella values. The umbrella’s unified package contract also moves package configuration under packages::

packageConfiguration:
  version: v1
packages:
  loki:
    values:
      bb-common:
        routes:
          inbound:
            loki:
              enabled: true
        istio:
          enabled: true
          sidecar:
            enabled: true

For a direct Loki chart installation, omit packageConfiguration and the packages.loki.values wrapper. The chart’s default route host now uses global.domain, because a subchart cannot read its parent’s root domain value:

global:
  domain: example.mil
bb-common:
  routes:
    inbound:
      loki:
        enabled: true

The umbrella continues to use its top-level domain and passes that value to Loki’s global.domain. Explicit route hosts overrides still take precedence. The Loki VirtualService remains disabled by default. See the Istio guidance before exposing the log API.

Replace legacy hardened values

The converted umbrella integration no longer translates Loki’s legacy istio.hardened overrides. Use bb-common.istio.sidecar, bb-common.istio.serviceEntries.custom, and bb-common.istio.authorizationPolicies instead. The umbrella’s global packages.istiod.values.hardened.enabled setting still supplies the Sidecar default; authorization-policy generation is controlled separately by the umbrella’s authorizationPolicies.enabled or explicit packages.loki.values.bb-common.istio.authorizationPolicies settings. Do not move the old hardened block unchanged under bb-common.istio: it is not part of the dependency’s schema.

Configure Kubernetes API egress explicitly

The umbrella’s Loki-specific _bb-common-migrations.tpl fallback is removed. It previously derived a kubeAPI egress definition from networkPolicies.controlPlaneCidr and networkPolicies.vpcCidr when no shared definition existed. Set the shared definition explicitly if MinIO or enterprise token generation needs Kubernetes API access:

# Big Bang umbrella values. Replace this example CIDR with your API endpoints.
networkPolicies:
  egress:
    definitions:
      kubeAPI:
        to:
          - ipBlock:
              cidr: 10.0.0.10/32

For direct chart installations, place that definition under bb-common.networkPolicies.egress.definitions.kubeAPI. Enterprise token generation with network policies enabled requires this definition and uses its destinations and optional ports for the hook’s API egress policy.

For an API destination of 0.0.0.0/0, the token-generation hook preserves the legacy exclusion of 169.254.169.254/32 (the metadata endpoint). Existing explicit exceptions are retained without duplicating that exclusion. This protection is applied to a copy for the hook policy; it does not alter the shared definition or other generated policies. Prefer narrowly scoped API destinations over an all-IPv4 rule.

The original Loki bb-common integration MR and the umbrella migration-standardization MR did not specify additional Loki values scheduled for removal in 4.0. The removed fallback was marked for removal in Big Bang 4.0 in its template.

Upgrade and rollback validation

Before upgrading, save the baseline values and record the Loki policy names, selectors, routes, and PVC identities. Upgrade the umbrella wiring and package together with migrated overrides. Verify collector ingestion, queries for both old and new logs, Grafana datasource connectivity, and the expected networking resources in both supported strategies (monolith and scalable).

For rollback, restore the previous package, umbrella integration, and original flat overrides together. This conversion does not change storage configuration, schema, retention, or PVC settings. Chart rendering and unit tests alone do not prove live connectivity or data-preserving upgrade and rollback behavior.