feat(Helm): Update Loki Helm chart for restricted environments (#14440)

**Statefulsets for ingester and index-gateway**
The change here is to make the `spec.updateStrategy.type` configurable, and to default to `RollingUpdate`.

**Enterprise tokengen**
For this change, if `enterprise` and `tokengen` are enabled, and `rbac.namespaced` is true, the chart will render a `Role` and `RoleBinding`. If `rbac.namespaced` is false, it will render a `ClusterRole` and `ClusterRoleBinding`.

Author: davidham

docs/sources/setup/install/helm/reference.md

@@ -4628,7 +4628,10 @@ null
   "serviceAnnotations": {},
   "serviceLabels": {},
   "terminationGracePeriodSeconds": 300,
-  "tolerations": []
+  "tolerations": [],
+  "updateStrategy": {
+    "type": "RollingUpdate"
+  }
 }
 </pre>
 </td>
@@ -4912,6 +4915,26 @@ null
 			<td><pre lang="json">
 []
 </pre>
+</td>
+		</tr>
+		<tr>
+			<td>indexGateway.updateStrategy</td>
+			<td>object</td>
+			<td>UpdateStrategy for the indexGateway StatefulSet.</td>
+			<td><pre lang="json">
+{
+  "type": "RollingUpdate"
+}
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>indexGateway.updateStrategy.type</td>
+			<td>string</td>
+			<td>One of  'OnDelete' or 'RollingUpdate'</td>
+			<td><pre lang="json">
+"RollingUpdate"
+</pre>
 </td>
 		</tr>
 		<tr>
@@ -5004,6 +5027,9 @@ null
       "whenUnsatisfiable": "ScheduleAnyway"
     }
   ],
+  "updateStrategy": {
+    "type": "RollingUpdate"
+  },
   "zoneAwareReplication": {
     "enabled": true,
     "maxUnavailablePct": 33,
@@ -5414,6 +5440,26 @@ false
 			<td><pre lang="">
 Defaults to allow skew no more than 1 node
 </pre>
+</td>
+		</tr>
+		<tr>
+			<td>ingester.updateStrategy</td>
+			<td>object</td>
+			<td>UpdateStrategy for the ingester StatefulSets.</td>
+			<td><pre lang="json">
+{
+  "type": "RollingUpdate"
+}
+</pre>
+</td>
+		</tr>
+		<tr>
+			<td>ingester.updateStrategy.type</td>
+			<td>string</td>
+			<td>One of  'OnDelete' or 'RollingUpdate'</td>
+			<td><pre lang="json">
+"RollingUpdate"
+</pre>
 </td>
 		</tr>
 		<tr>

production/helm/loki/README.md

@@ -22,7 +22,7 @@ Find more information in the Loki Helm Chart [documentation](https://grafana.com
 
 ## Contributing and releasing
 
-If you made any changes to the [Chart.yaml](https://github.com/grafana/loki/blob/main/production/helm/loki/Chart.yaml) or [values.yaml](https://github.com/grafana/loki/blob/main/production/helm/loki/values.yaml) run `make helm-doc` from the root of the repository to update the documentation and commit the changed files.
+If you made any changes to the [Chart.yaml](https://github.com/grafana/loki/blob/main/production/helm/loki/Chart.yaml) or [values.yaml](https://github.com/grafana/loki/blob/main/production/helm/loki/values.yaml) run `make helm-docs` from the root of the repository to update the documentation and commit the changed files.
 
 #### Versioning
 

production/helm/loki/README.md.gotmpl

@@ -12,7 +12,7 @@ Find more information in the Loki Helm Chart [documentation](https://grafana.com
 
 ## Contributing and releasing
 
-If you made any changes to the [Chart.yaml](https://github.com/grafana/loki/blob/main/production/helm/loki/Chart.yaml) or [values.yaml](https://github.com/grafana/loki/blob/main/production/helm/loki/values.yaml) run `make helm-doc` from the root of the repository to update the documentation and commit the changed files.
+If you made any changes to the [Chart.yaml](https://github.com/grafana/loki/blob/main/production/helm/loki/Chart.yaml) or [values.yaml](https://github.com/grafana/loki/blob/main/production/helm/loki/values.yaml) run `make helm-docs` from the root of the repository to update the documentation and commit the changed files.
 
 #### Versioning
 

production/helm/loki/templates/index-gateway/statefulset-index-gateway.yaml

@@ -12,9 +12,10 @@ metadata:
   {{- end }}
 spec:
   replicas: {{ .Values.indexGateway.replicas }}
+{{- with .Values.indexGateway.updateStrategy }}
   updateStrategy:
-    rollingUpdate:
-      partition: 0
+     {{- tpl (. | toYaml) $ | nindent 4 }}
+{{- end }}
   serviceName: {{ include "loki.indexGatewayFullname" . }}-headless
   revisionHistoryLimit: {{ .Values.loki.revisionHistoryLimit }}
   {{- if and (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) (.Values.indexGateway.persistence.enableStatefulSetAutoDeletePVC)  }}

production/helm/loki/templates/ingester/statefulset-ingester-zone-a.yaml

@@ -40,8 +40,10 @@ spec:
       {{- include "loki.ingesterSelectorLabels" . | nindent 6 }}
       name: ingester-zone-a
       rollout-group: ingester
+{{- with .Values.ingester.updateStrategy }}
   updateStrategy:
-    type: OnDelete
+     {{- tpl (. | toYaml) $ | nindent 4 }}
+{{- end }}
   template:
     metadata:
       annotations:

production/helm/loki/templates/ingester/statefulset-ingester-zone-b.yaml

@@ -40,8 +40,10 @@ spec:
       {{- include "loki.ingesterSelectorLabels" . | nindent 6 }}
       name: ingester-zone-b
       rollout-group: ingester
+{{- with .Values.ingester.updateStrategy }}
   updateStrategy:
-    type: OnDelete
+     {{- tpl (. | toYaml) $ | nindent 4 }}
+{{- end }}
   template:
     metadata:
       annotations:

production/helm/loki/templates/ingester/statefulset-ingester-zone-c.yaml

@@ -40,8 +40,10 @@ spec:
       {{- include "loki.ingesterSelectorLabels" . | nindent 6 }}
       name: ingester-zone-c
       rollout-group: ingester
+{{- with .Values.ingester.updateStrategy }}
   updateStrategy:
-    type: OnDelete
+     {{- tpl (. | toYaml) $ | nindent 4 }}
+{{- end }}
   template:
     metadata:
       annotations:

production/helm/loki/templates/ingester/statefulset-ingester.yaml

@@ -17,9 +17,10 @@ spec:
   replicas: {{ .Values.ingester.replicas }}
 {{- end }}
   podManagementPolicy: Parallel
+{{- with .Values.ingester.updateStrategy }}
   updateStrategy:
-    rollingUpdate:
-      partition: 0
+     {{- tpl (. | toYaml) $ | nindent 4 }}
+{{- end }}
   serviceName: {{ include "loki.ingesterFullname" . }}-headless
   revisionHistoryLimit: {{ .Values.loki.revisionHistoryLimit }}
   {{- if and (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) (.Values.ingester.persistence.enableStatefulSetAutoDeletePVC)  }}

production/helm/loki/templates/tokengen/clusterrole-tokengen.yaml

@@ -1,7 +1,7 @@
-{{ if and (and .Values.enterprise.tokengen.enabled .Values.enterprise.enabled) (not .Values.rbac.namespaced)}}
+{{ if and .Values.enterprise.tokengen.enabled .Values.enterprise.enabled }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
+kind: {{ if not .Values.rbac.namespaced }}Cluster{{ end }}Role
 metadata:
   name: {{ template "enterprise-logs.tokengenFullname" . }}
   labels:

production/helm/loki/templates/tokengen/clusterrolebinding-tokengen.yaml

@@ -1,7 +1,7 @@
-{{ if and (and .Values.enterprise.tokengen.enabled .Values.enterprise.enabled) (not .Values.rbac.namespaced)}}
+{{ if and .Values.enterprise.tokengen.enabled .Values.enterprise.enabled }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
+kind: {{ if not .Values.rbac.namespaced }}Cluster{{ end }}RoleBinding
 metadata:
   name: {{ template "enterprise-logs.tokengenFullname" . }}
   labels:
@@ -16,7 +16,7 @@ metadata:
     "helm.sh/hook": post-install
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
+  kind: {{ if not .Values.rbac.namespaced }}Cluster{{ end }}Role
   name: {{ template "enterprise-logs.tokengenFullname" . }}
 subjects:
   - kind: ServiceAccount

production/helm/loki/values.yaml

@@ -1796,6 +1796,13 @@ ingester:
   readinessProbe: {}
   # -- liveness probe settings for ingester pods. If empty use `loki.livenessProbe`
   livenessProbe: {}
+  # -- UpdateStrategy for the ingester StatefulSets.
+  updateStrategy:
+    # -- One of  'OnDelete' or 'RollingUpdate'
+    type: RollingUpdate
+    # -- Optional for updateStrategy.type=RollingUpdate. See [Partitioned rolling updates](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#partitions) in the StatefulSet docs for details.
+    # rollingUpdate:
+    #   partition: 0
   persistence:
     # -- Enable creating PVCs which is required when using boltdb-shipper
     enabled: false
@@ -2313,6 +2320,13 @@ indexGateway:
   # -- Set the optional grpc service protocol. Ex: "grpc", "http2" or "https"
   appProtocol:
     grpc: ""
+  # -- UpdateStrategy for the indexGateway StatefulSet.
+  updateStrategy:
+    # -- One of  'OnDelete' or 'RollingUpdate'
+    type: RollingUpdate
+    # -- Optional for updateStrategy.type=RollingUpdate. See [Partitioned rolling updates](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#partitions) in the StatefulSet docs for details.
+    # rollingUpdate:
+    #   partition: 0
 # -- Configuration for the compactor
 compactor:
   # -- Number of replicas for the compactor