2.2. Object storage types


Each object storage type has its own set of required fields which are configured directly in the ObservabilityInstaller CR.

2.2.1. Amazon S3 with Secure Token Service (STS) - Short lived

S3 with STS is supported by Tempo and Loki.

spec:
  capabilities:
    tracing:
      enabled: true
      storage:
        objectStorage:
          s3STS:
            bucket: bucket-name
            roleARN:
            region: us-east-1

Use the following command to create the secret containing the access key:

$ oc create secret generic storage-secret \
--from-literal=bucket="<BUCKET_NAME>" \
--from-literal=role_arn="<AWS_ROLE_ARN>" \
--from-literal=region="<AWS_REGION_YOUR_BUCKET_LIVES_IN>"

2.2.2. Amazon S3 / MinIO

Amazon S3 / MinIO is supported by Tempo and Loki.

spec:
  capabilities:
    tracing:
      enabled: true
      storage:
        objectStorage:
          s3:
            bucket: bucket-name
            endpoint: http://minio.minio.svc:9000
            accessKeyID: tempo
            accessKeySecret:
              name: minio-secret
              key: access_key_secret
            region: us-east-1

Use the following command to create the secret containing the access key:

$ oc create secret generic minio-secret \
--from-literal=access_key_secret="supersecret"

2.2.2.1. Secret supported by Tempo and Loki operators

$ oc create secret generic storage-secret \
    --from-literal=bucket="<BUCKET_NAME>" \
    --from-literal=endpoint="<AWS_BUCKET_ENDPOINT>" \
    --from-literal=access_key_id="<AWS_ACCESS_KEY_ID>" \
    --from-literal=access_key_secret="<AWS_ACCESS_KEY_SECRET>" \
    --from-literal=region="<AWS_REGION_YOUR_BUCKET_LIVES_IN>"
  • region is optional in Tempo and required by Loki.

2.2.3. Microsoft Azure Blob Storage

Microsoft Azure Blob Storag is supported by Tempo and Loki.

spec:
  capabilities:
    tracing:
      enabled: true
      storage:
        objectStorage:
          azure:
            container:
            accountName:
            accountKeySecret:
              name: azure-secret
              key: account_key

Use the following command to create the secret containing the access key:

$ oc create secret generic azure-secret \
--from-literal=account_key="<ACCOUNT_KEY>"

2.2.3.1. Secret supported by Tempo and Loki operators

$ oc create secret generic storage-secret \
--from-literal=container="<BLOB_STORAGE_CONTAINER_NAME>" \
--from-literal=account_name="<BLOB_STORAGE_ACCOUNT_NAME>" \
--from-literal=account_key="<BLOB_STORAGE_ACCOUNT_KEY>"

The Loki operator also supports the following fields:

  • environment
  • endpoint_suffix - optional

2.2.4. Azure WIF - Short lived

Azure WIF short lived is supported by Tempo.

spec:
  capabilities:
    tracing:
      enabled: true
      storage:
        objectStorage:
          azureWIF:
            container:
            accountName:
            audience:
            clientID:
            tenantID:

2.2.4.1. Secret supported by Tempo and Loki operators

$ oc create secret generic storage-secret \
--from-literal=container="<BLOB_STORAGE_CONTAINER_NAME>" \
--from-literal=account_name="<BLOB_STORAGE_ACCOUNT_NAME>" \
--from-literal=audience="<AUDIENCE>" \
--from-literal=client_id="CLIENT_ID>" \
--from-literal=tenant_id="<TENANT_ID>"
  • audience - optional and defaults to api://AzureADTokenExchange

2.2.5. Google Cloud Storage

Google Cloud Storage is supported by Tempo and Loki.

spec:
  capabilities:
    tracing:
      enabled: true
      storage:
        objectStorage:
          gcs:
            bucket: bucket-name
            keyJSONSecret:
              name: gcs-secret
              key: key.json

Use the following command to create the secret:

$ oc -n $NAMESPACE create secret generic gcs-secret \
--from-file=key.json="$GCS_KEY_FILE_PATH"

2.2.5.1. Secret supported by Tempo and Loki operators

$ oc create secret generic storage-secret \
--from-literal=bucketname="<BUCKET_NAME>" \
--from-literal=key.json="<PATH_TO_JSON_KEY_FILE>"

2.2.5.2. Google Cloud Storage WIF - Short lived

Google Cloud Storage WIF short lived is supported by Tempo.

spec:
  capabilities:
    tracing:
      enabled: true
      storage:
        objectStorage:
          gcsWIF:
            bucket: bucket-name
            keyJSONSecret:
              name: gcs-secret
              key: key.json
            audience: # optional

Use the following command to create the secret:

$ oc -n $NAMESPACE create secret generic gcs-secret \
--from-file=key.json="$GCS_KEY_FILE_PATH"
Red Hat logoGithubredditYoutubeTwitter

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 소개

Red Hat은 기업이 핵심 데이터 센터에서 네트워크 에지에 이르기까지 플랫폼과 환경 전반에서 더 쉽게 작업할 수 있도록 강화된 솔루션을 제공합니다.

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat은 코드, 문서, 웹 속성에서 문제가 있는 언어를 교체하기 위해 최선을 다하고 있습니다. 자세한 내용은 다음을 참조하세요.Red Hat 블로그.

Red Hat 문서 정보

Legal Notice

Theme

© 2026 Red Hat
맨 위로 이동