fix(helm): correct GEL provisioner tenant creation instructions (#20271)

Author: petergreen86

production/helm/loki/docs/examples/enterprise/README.md

@@ -18,14 +18,15 @@ Open [overrides-enterprise-gcs.yaml](./overrides-enterprise-gcs.yaml) and replac
 
 ### Create Admin Token Secret (Required for Provisioner)
 
-If you are using the enterprise provisioner to automatically create tenant tokens, you must first create an admin token secret:
+If you are using the enterprise provisioner to automatically create tenants, you must first create an admin token secret:
 
 1. Generate an admin token using the Loki CLI:
    ```bash
-   docker run grafana/loki:latest -target=tokengen -tokengen.token-file=/tmp/token
+   docker run grafana/enterprise-logs:latest -target=tokengen -tokengen.token-file=/tmp/token
    # Copy the generated token from the container
    docker cp <container-id>:/tmp/token ./admin-token
    ```
+   > Alternatively see [batchjob.yaml](batchjob.yaml) for an example that uses a configmap in k8s to retreive the bucket configuration. Note that this requires GEL to be already in place with a `helm install` command beforehand to access the data
 
 2. Create the admin token secret:
    ```bash
@@ -45,26 +46,29 @@ If you are using the enterprise provisioner to automatically create tenant token
 
 `helm upgrade --install --values {PATH_TO_YOUR_OVERRIDES_YAML_FILE} {YOUR_RELEASE_NAME} grafana/loki-simple-scalable --namespace {KUBERNETES_NAMESPACE}`
 
-### Get Tenant Tokens from Provisioner
+### Create tenants automatically via the provisioner
 
-If you enabled the provisioner, retrieve the generated tenant tokens from the provisioner logs:
+If you enabled the provisioner, additional tenants will be automatically created based on your configuration. For example, the below will create a tenant named `loki-a`:
 
-```bash
-# Get provisioner job logs
-kubectl logs -l job-name=loki-provisioner --namespace {KUBERNETES_NAMESPACE}
+```yaml
+enterprise:  
+  adminToken:  
+    secret: loki-admin-token  
+  provisioner:  
+    enabled: true
+    additionalTenants:
+      - name: loki-a
+        secretNamespace: loki
 ```
 
-The provisioner outputs tokens for each configured tenant. You must manually create Kubernetes secrets for each tenant using these tokens:
+An additional tenant for monitoring will also be created based on the value of `.Values.monitoring.selfMonitoring.tenant`
 
 ```bash
-# Example for creating a tenant secret
-kubectl create secret generic <tenant-name> \
-  --from-literal=token-write=<write-token-from-logs> \
-  --from-literal=token-read=<read-token-from-logs> \
-  --namespace <tenant-namespace>
+# Get provisioner job logs
+kubectl logs -l job-name=loki-provisioner --namespace {KUBERNETES_NAMESPACE}
 ```
 
-### Manual Token Generation (Without Provisioner)
+### Manual Token Generation
 
 If you're not using the provisioner, you can manually generate tokens:
 

production/helm/loki/docs/examples/enterprise/batchjob.yaml

@@ -0,0 +1,32 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: tokengen
+  namespace: loki # The namespace of the GEL installation
+spec:
+  backoffLimit: 0
+  template:
+    metadata:
+      labels:
+        app: tokengen
+    spec:
+      serviceAccountName: loki-enterprise-logs # The service account of the GEL installation which has necessary IAM permissions to the storage bucket (e.g. GCS, S3, etc.)
+      restartPolicy: Never
+      containers:
+        - name: tokengen
+          image: grafana/enterprise-logs:latest
+          args:
+            - -target=tokengen
+            - -config.file=/etc/loki/config/config.yaml
+            - -tokengen.token-file=/tmp/token
+          volumeMounts:
+            - name: config-volume
+              mountPath: /etc/loki/config
+              readOnly: true
+      volumes:
+        - name: config-volume
+          configMap:
+            name: enterprise-logs # The configmap of the GEL installation which contains the configuration of the storage bucket
+            items:
+              - key: config.yaml
+                path: config.yaml

production/helm/loki/templates/provisioner/job-provisioner.yaml

@@ -53,8 +53,9 @@ spec:
             - -exuc
             - |
               echo "================================================================================"
-              echo "Starting provisioner. Tokens will be displayed below."
-              echo "Copy these tokens and create secrets manually for each tenant."
+              echo "Starting provisioner. Any configured tenants will be provisioned below."
+              echo "If you need to manually provision a tenant, see the following documentation: "
+              echo "https://github.com/grafana/loki/blob/main/production/helm/loki/docs/examples/enterprise/README.md"
               echo "================================================================================"
               {{- range .Values.enterprise.provisioner.additionalTenants }}
               echo "\nProvisioning tenant: {{ .name }}..."
@@ -78,7 +79,7 @@ spec:
                 -token=self-monitoring
               {{- end }}
               echo "\n================================================================================"
-              echo "Provisioning complete. Please create secrets using the tokens above."
+              echo "Provisioning complete."
               echo "================================================================================"
           volumeMounts:
             {{- with .Values.enterprise.provisioner.extraVolumeMounts }}