feat(operator): add option to customize gateway server cert

operator/api/loki/v1/lokistack_types.go

@@ -289,6 +289,23 @@ type TenantsSpec struct {
 	// +kubebuilder:validation:Optional
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors="urn:alm:descriptor:com.tectonic.ui:booleanSwitch",displayName="Disable Ingress"
 	DisableIngress bool `json:"disableIngress,omitempty"`
+
+	// Gateway defines the configuration specific to Gateway server
+	//
+	// +optional
+	// +kubebuilder:validation:Optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Gateway"
+	Gateway *GatewaySpec `json:"gateway,omitempty"`
+}
+
+// GatewaySpec defines the configuration specific to Gateway server
+type GatewaySpec struct {
+	// TLS defines the TLS configuration for the Gateway server.
+	//
+	// +optional
+	// +kubebuilder:validation:Optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="TLS"
+	TLS *TLSSpec `json:"tls,omitempty"`
 }
 
 // OpenshiftTenantSpec defines the configuration specific to Openshift modes.
@@ -1235,6 +1252,64 @@ type ZoneSpec struct {
 	TopologyKey string `json:"topologyKey"`
 }
 
+// ValueReference encodes a reference to a single field in either a ConfigMap or Secret in the same namespace.
+//
+// +kubebuilder:validation:XValidation:rule="has(self.configMapName) || has(self.secretName)", message="Either configMapName or secretName needs to be set"
+// +kubebuilder:validation:XValidation:rule="!(has(self.configMapName) && has(self.secretName))", message="Only one of configMapName and secretName can be set"
+type ValueReference struct {
+	// Name of the key used to get the value in either the referenced ConfigMap or Secret.
+	//
+	// +kubebuilder:validation:Required
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Key Name",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:text"}
+	Key string `json:"key"`
+
+	// ConfigMapName contains the name of the ConfigMap containing the referenced value.
+	//
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="ConfigMap Name",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:text"}
+	ConfigMapName string `json:"configMapName,omitempty"`
+
+	// SecretName contains the name of the Secret containing the referenced value.
+	//
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Secret Name",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:text"}
+	SecretName string `json:"secretName,omitempty"`
+}
+
+// SecretReference encodes a reference to a single key in a Secret in the same namespace.
+type SecretReference struct {
+	// Key contains the name of the key inside the referenced Secret.
+	//
+	// +kubebuilder:validation:Required
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Key Name",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:text"}
+	Key string `json:"key"`
+
+	// SecretName contains the name of the Secret containing the referenced value.
+	//
+	// +kubebuilder:validation:Required
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Secret Name",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:text"}
+	SecretName string `json:"secretName"`
+}
+
+// TLSSpec contains options for TLS connections.
+type TLSSpec struct {
+	// CA can be used to specify a custom list of trusted certificate authorities.
+	//
+	// +kubebuilder:validation:Optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Certificate Authority Bundle"
+	CA *ValueReference `json:"ca,omitempty"`
+
+	// Certificate points to the server certificate to use.
+	//
+	// +kubebuilder:validation:Optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Certificate"
+	Certificate *ValueReference `json:"certificate,omitempty"`
+
+	// PrivateKey points to the private key of the server certificate.
+	//
+	// +kubebuilder:validation:Optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Private Key"
+	PrivateKey *SecretReference `json:"privateKey,omitempty"`
+}
+
 // LokiStackConditionType deifnes the type of condition types of a Loki deployment.
 type LokiStackConditionType string
 
@@ -1305,6 +1380,10 @@ const (
 	ReasonMissingGatewayAuthenticationConfig LokiStackConditionReason = "MissingGatewayTenantAuthenticationConfig"
 	// ReasonInvalidTenantsConfiguration when the tenant configuration provided is invalid.
 	ReasonInvalidTenantsConfiguration LokiStackConditionReason = "InvalidTenantsConfiguration"
+	// ReasonMissingGatewayTLSConfig when the referenced TLS Secret or ConfigMap for the gateway is missing.
+	ReasonMissingGatewayTLSConfig LokiStackConditionReason = "MissingGatewayTLSConfig"
+	// ReasonInvalidGatewayTLSConfig when the referenced TLS Secret or ConfigMap is invalid or missing required keys.
+	ReasonInvalidGatewayTLSConfig LokiStackConditionReason = "InvalidGatewayTLSConfig"
 	// ReasonMissingGatewayOpenShiftBaseDomain when the reconciler cannot lookup the OpenShift DNS base domain.
 	ReasonMissingGatewayOpenShiftBaseDomain LokiStackConditionReason = "MissingGatewayOpenShiftBaseDomain"
 	// ReasonFailedCertificateRotation when the reconciler cannot rotate any of the required TLS certificates.

operator/bundle/community-openshift/manifests/loki-operator.clusterserviceversion.yaml

@@ -152,7 +152,7 @@ metadata:
     categories: OpenShift Optional, Logging & Tracing
     certified: "false"
     containerImage: docker.io/grafana/loki-operator:0.9.0
-    createdAt: "2026-02-16T17:31:28Z"
+    createdAt: "2026-02-23T16:34:54Z"
     description: The Community Loki Operator provides Kubernetes native deployment
       and management of Loki and related logging components.
     features.operators.openshift.io/disconnected: "true"
@@ -1015,6 +1015,69 @@ spec:
         path: tenants.disableIngress
         x-descriptors:
         - urn:alm:descriptor:com.tectonic.ui:booleanSwitch
+      - description: Gateway defines the configuration specific to Gateway server
+        displayName: Gateway
+        path: tenants.gateway
+      - description: TLS defines the TLS configuration for the Gateway server.
+        displayName: TLS
+        path: tenants.gateway.tls
+      - description: CA can be used to specify a custom list of trusted certificate
+          authorities.
+        displayName: Certificate Authority Bundle
+        path: tenants.gateway.tls.ca
+      - description: ConfigMapName contains the name of the ConfigMap containing the
+          referenced value.
+        displayName: ConfigMap Name
+        path: tenants.gateway.tls.ca.configMapName
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:text
+      - description: Name of the key used to get the value in either the referenced
+          ConfigMap or Secret.
+        displayName: Key Name
+        path: tenants.gateway.tls.ca.key
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:text
+      - description: SecretName contains the name of the Secret containing the referenced
+          value.
+        displayName: Secret Name
+        path: tenants.gateway.tls.ca.secretName
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:text
+      - description: Certificate points to the server certificate to use.
+        displayName: Certificate
+        path: tenants.gateway.tls.certificate
+      - description: ConfigMapName contains the name of the ConfigMap containing the
+          referenced value.
+        displayName: ConfigMap Name
+        path: tenants.gateway.tls.certificate.configMapName
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:text
+      - description: Name of the key used to get the value in either the referenced
+          ConfigMap or Secret.
+        displayName: Key Name
+        path: tenants.gateway.tls.certificate.key
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:text
+      - description: SecretName contains the name of the Secret containing the referenced
+          value.
+        displayName: Secret Name
+        path: tenants.gateway.tls.certificate.secretName
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:text
+      - description: PrivateKey points to the private key of the server certificate.
+        displayName: Private Key
+        path: tenants.gateway.tls.privateKey
+      - description: Key contains the name of the key inside the referenced Secret.
+        displayName: Key Name
+        path: tenants.gateway.tls.privateKey.key
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:text
+      - description: SecretName contains the name of the Secret containing the referenced
+          value.
+        displayName: Secret Name
+        path: tenants.gateway.tls.privateKey.secretName
+        x-descriptors:
+        - urn:alm:descriptor:com.tectonic.ui:text
       - description: Mode defines the mode in which lokistack-gateway component will
           be configured.
         displayName: Mode

operator/bundle/community-openshift/manifests/loki.grafana.com_lokistacks.yaml

@@ -3868,6 +3868,84 @@ spec:
                       DisableIngress disables automatic creation of external access resources (Route / Ingress).
                       When true, no Route or Ingress will be created for the gateway.
                     type: boolean
+                  gateway:
+                    description: Gateway defines the configuration specific to Gateway
+                      server
+                    properties:
+                      tls:
+                        description: TLS defines the TLS configuration for the Gateway
+                          server.
+                        properties:
+                          ca:
+                            description: CA can be used to specify a custom list of
+                              trusted certificate authorities.
+                            properties:
+                              configMapName:
+                                description: ConfigMapName contains the name of the
+                                  ConfigMap containing the referenced value.
+                                type: string
+                              key:
+                                description: Name of the key used to get the value
+                                  in either the referenced ConfigMap or Secret.
+                                type: string
+                              secretName:
+                                description: SecretName contains the name of the Secret
+                                  containing the referenced value.
+                                type: string
+                            required:
+                            - key
+                            type: object
+                            x-kubernetes-validations:
+                            - message: Either configMapName or secretName needs to
+                                be set
+                              rule: has(self.configMapName) || has(self.secretName)
+                            - message: Only one of configMapName and secretName can
+                                be set
+                              rule: '!(has(self.configMapName) && has(self.secretName))'
+                          certificate:
+                            description: Certificate points to the server certificate
+                              to use.
+                            properties:
+                              configMapName:
+                                description: ConfigMapName contains the name of the
+                                  ConfigMap containing the referenced value.
+                                type: string
+                              key:
+                                description: Name of the key used to get the value
+                                  in either the referenced ConfigMap or Secret.
+                                type: string
+                              secretName:
+                                description: SecretName contains the name of the Secret
+                                  containing the referenced value.
+                                type: string
+                            required:
+                            - key
+                            type: object
+                            x-kubernetes-validations:
+                            - message: Either configMapName or secretName needs to
+                                be set
+                              rule: has(self.configMapName) || has(self.secretName)
+                            - message: Only one of configMapName and secretName can
+                                be set
+                              rule: '!(has(self.configMapName) && has(self.secretName))'
+                          privateKey:
+                            description: PrivateKey points to the private key of the
+                              server certificate.
+                            properties:
+                              key:
+                                description: Key contains the name of the key inside
+                                  the referenced Secret.
+                                type: string
+                              secretName:
+                                description: SecretName contains the name of the Secret
+                                  containing the referenced value.
+                                type: string
+                            required:
+                            - key
+                            - secretName
+                            type: object
+                        type: object
+                    type: object
                   mode:
                     default: openshift-logging
                     description: Mode defines the mode in which lokistack-gateway