Merge branch 'main' into detected-labels-store

ADOPTERS.md

@@ -7,3 +7,4 @@
 * [Heureka Group](https://heureka.group)
 * [Norwegian Refugee Council](https://www.nrc.no/)
 * [Dropbox](https://www.dropbox.com/)
+* [ASML](https://www.asml.com/)

clients/cmd/promtail/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.21.9-bookworm as build
+FROM golang:1.22.2-bookworm as build
 
 COPY . /src/loki
 WORKDIR /src/loki
@@ -9,7 +9,7 @@ RUN make clean && make BUILD_IN_CONTAINER=false PROMTAIL_JOURNAL_ENABLED=true pr
 FROM debian:12.5-slim
 # tzdata required for the timestamp stage to work
 RUN apt-get update && \
-  apt-get install -qy tzdata ca-certificates libsystemd-dev && \
+  apt-get install -qy tzdata ca-certificates wget libsystemd-dev && \
   rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 COPY --from=build /src/loki/clients/cmd/promtail/promtail /usr/bin/promtail
 COPY clients/cmd/promtail/promtail-docker-config.yaml /etc/promtail/config.yml

clients/cmd/promtail/Dockerfile.arm32

@@ -1,4 +1,4 @@
-FROM golang:1.21.9-bookworm as build
+FROM golang:1.22.2-bookworm as build
 
 COPY . /src/loki
 WORKDIR /src/loki
@@ -9,7 +9,7 @@ RUN make clean && make BUILD_IN_CONTAINER=false PROMTAIL_JOURNAL_ENABLED=true pr
 FROM debian:12.5-slim
 # tzdata required for the timestamp stage to work
 RUN apt-get update && \
-  apt-get install -qy tzdata ca-certificates libsystemd-dev && \
+  apt-get install -qy tzdata ca-certificates wget libsystemd-dev && \
   rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 COPY --from=build /src/loki/clients/cmd/promtail/promtail /usr/bin/promtail
 COPY clients/cmd/promtail/promtail-local-config.yaml /etc/promtail/local-config.yaml

clients/cmd/promtail/Dockerfile.cross

@@ -2,7 +2,7 @@ ARG BUILD_IMAGE=grafana/loki-build-image:0.33.1
 # Directories in this file are referenced from the root of the project not this folder
 # This file is intended to be called from the root like so:
 # docker build -t grafana/promtail -f clients/cmd/promtail/Dockerfile .
-FROM golang:1.21.9-alpine as goenv
+FROM 1.22.2-alpine as goenv
 RUN go env GOARCH > /goarch && \
   go env GOARM > /goarm
 
@@ -16,7 +16,7 @@ RUN make clean && GOARCH=$(cat /goarch) GOARM=$(cat /goarm) make BUILD_IN_CONTAI
 FROM debian:12.5-slim
 # tzdata required for the timestamp stage to work
 RUN apt-get update && \
-  apt-get install -qy tzdata ca-certificates libsystemd-dev && \
+  apt-get install -qy tzdata ca-certificates wget libsystemd-dev && \
   rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 COPY --from=build /src/loki/clients/cmd/promtail/promtail /usr/bin/promtail
 COPY clients/cmd/promtail/promtail-local-config.yaml /etc/promtail/local-config.yaml

cmd/logcli/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.21.9 as build
+FROM golang:1.22.2 as build
 
 COPY . /src/loki
 WORKDIR /src/loki

cmd/logql-analyzer/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.21.9 as build
+FROM golang:1.22.2 as build
 
 COPY . /src/loki
 WORKDIR /src/loki

cmd/loki-canary-boringcrypto/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.21.9 as build
+FROM golang:1.22.2 as build
 
 COPY . /src/loki
 WORKDIR /src/loki

cmd/loki-canary/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.21.9 as build
+FROM golang:1.22.2 as build
 
 COPY . /src/loki
 WORKDIR /src/loki

cmd/loki-canary/Dockerfile.cross

@@ -2,7 +2,7 @@ ARG BUILD_IMAGE=grafana/loki-build-image:0.33.1
 # Directories in this file are referenced from the root of the project not this folder
 # This file is intended to be called from the root like so:
 # docker build -t grafana/promtail -f cmd/promtail/Dockerfile .
-FROM golang:1.21.9-alpine as goenv
+FROM golang:1.22.2-alpine as goenv
 RUN go env GOARCH > /goarch && \
   go env GOARM > /goarm
 

cmd/loki/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.21.9 as build
+FROM golang:1.22.2 as build
 
 COPY . /src/loki
 WORKDIR /src/loki

cmd/loki/Dockerfile.cross

@@ -2,7 +2,7 @@ ARG BUILD_IMAGE=grafana/loki-build-image:0.33.1
 # Directories in this file are referenced from the root of the project not this folder
 # This file is intended to be called from the root like so:
 # docker build -t grafana/loki -f cmd/loki/Dockerfile .
-FROM golang:1.21.9-alpine as goenv
+FROM golang:1.22.2-alpine as goenv
 RUN go env GOARCH > /goarch && \
     go env GOARM > /goarm
 

cmd/loki/Dockerfile.debug

@@ -3,7 +3,7 @@ ARG BUILD_IMAGE=grafana/loki-build-image:0.33.1
 # This file is intended to be called from the root like so:
 # docker build -t grafana/loki -f cmd/loki/Dockerfile.debug .
 
-FROM golang:1.21.9-alpine as goenv
+FROM golang:1.22.2-alpine as goenv
 RUN go env GOARCH > /goarch && \
     go env GOARM > /goarm && \
     go install github.com/go-delve/delve/cmd/dlv@latest

cmd/migrate/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.21.9 as build
+FROM golang:1.22.2 as build
 COPY . /src/loki
 WORKDIR /src/loki
 RUN make clean && make BUILD_IN_CONTAINER=false migrate

cmd/querytee/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.21.9 as build
+FROM golang:1.22.2 as build
 
 COPY . /src/loki
 WORKDIR /src/loki

cmd/querytee/Dockerfile.cross

@@ -2,7 +2,7 @@ ARG BUILD_IMAGE=grafana/loki-build-image:0.33.1
 # Directories in this file are referenced from the root of the project not this folder
 # This file is intended to be called from the root like so:
 # docker build -t grafana/promtail -f cmd/promtail/Dockerfile .
-FROM golang:1.21.9-alpine as goenv
+FROM golang:1.22.2-alpine as goenv
 RUN go env GOARCH > /goarch && \
   go env GOARM > /goarm
 

docs/sources/setup/install/helm/reference.md

@@ -2630,7 +2630,7 @@ null
     "tolerations": []
   },
   "useExternalLicense": false,
-  "version": "v1.8.6"
+  "version": "v3.0.0"
 }
 </pre>
 </td>
@@ -3457,7 +3457,7 @@ null
 			<td>string</td>
 			<td>Uses the specified users from the `loki.tenants` list to create the htpasswd file if `loki.tenants` is not set, the `gateway.basicAuth.username` and `gateway.basicAuth.password` are used The value is templated using `tpl`. Override this to use a custom htpasswd, e.g. in case the default causes high CPU load.</td>
 			<td><pre lang="json">
-"{{ if .Values.loki.tenants }}\n\n  {{- range $t := .Values.loki.tenants }}\n{{ htpasswd (required \"All tenants must have a 'name' set\" $t.name) (required \"All tenants must have a 'password' set\" $t.password) }}\n\n  {{- end }}\n{{ else }} {{ htpasswd (required \"'gateway.basicAuth.username' is required\" .Values.gateway.basicAuth.username) (required \"'gateway.basicAuth.password' is required\" .Values.gateway.basicAuth.password) }} {{ end }}"
+"{{ if .Values.loki.tenants }}\n\n\n  {{- range $t := .Values.loki.tenants }}\n{{ htpasswd (required \"All tenants must have a 'name' set\" $t.name) (required \"All tenants must have a 'password' set\" $t.password) }}\n\n\n  {{- end }}\n{{ else }} {{ htpasswd (required \"'gateway.basicAuth.username' is required\" .Values.gateway.basicAuth.username) (required \"'gateway.basicAuth.password' is required\" .Values.gateway.basicAuth.password) }} {{ end }}"
 </pre>
 </td>
 		</tr>
@@ -5250,7 +5250,8 @@ null
     "query_timeout": "300s",
     "reject_old_samples": true,
     "reject_old_samples_max_age": "168h",
-    "split_queries_by_interval": "15m"
+    "split_queries_by_interval": "15m",
+    "volume_enabled": true
   },
   "memberlistConfig": {},
   "memcached": {
@@ -5594,7 +5595,8 @@ null
   "query_timeout": "300s",
   "reject_old_samples": true,
   "reject_old_samples_max_age": "168h",
-  "split_queries_by_interval": "15m"
+  "split_queries_by_interval": "15m",
+  "volume_enabled": true
 }
 </pre>
 </td>
@@ -6418,6 +6420,7 @@ false
     },
     "tenant": {
       "name": "self-monitoring",
+      "password": null,
       "secretNamespace": "{{ .Release.Namespace }}"
     }
   },
@@ -6695,6 +6698,7 @@ null
 			<td><pre lang="json">
 {
   "name": "self-monitoring",
+  "password": null,
   "secretNamespace": "{{ .Release.Namespace }}"
 }
 </pre>
@@ -6707,6 +6711,15 @@ null
 			<td><pre lang="json">
 "self-monitoring"
 </pre>
+</td>
+		</tr>
+		<tr>
+			<td>monitoring.selfMonitoring.tenant.password</td>
+			<td>string</td>
+			<td>Password of the gateway for Basic auth</td>
+			<td><pre lang="json">
+null
+</pre>
 </td>
 		</tr>
 		<tr>

docs/sources/shared/configuration.md

@@ -354,6 +354,140 @@ pattern_ingester:
 # shards for performance.
 [compactor: <compactor>]
 
+compactor_grpc_client:
+  # gRPC client max receive message size (bytes).
+  # CLI flag: -compactor.grpc-client.grpc-max-recv-msg-size
+  [max_recv_msg_size: <int> | default = 104857600]
+
+  # gRPC client max send message size (bytes).
+  # CLI flag: -compactor.grpc-client.grpc-max-send-msg-size
+  [max_send_msg_size: <int> | default = 104857600]
+
+  # Use compression when sending messages. Supported values are: 'gzip',
+  # 'snappy' and '' (disable compression)
+  # CLI flag: -compactor.grpc-client.grpc-compression
+  [grpc_compression: <string> | default = ""]
+
+  # Rate limit for gRPC client; 0 means disabled.
+  # CLI flag: -compactor.grpc-client.grpc-client-rate-limit
+  [rate_limit: <float> | default = 0]
+
+  # Rate limit burst for gRPC client.
+  # CLI flag: -compactor.grpc-client.grpc-client-rate-limit-burst
+  [rate_limit_burst: <int> | default = 0]
+
+  # Enable backoff and retry when we hit rate limits.
+  # CLI flag: -compactor.grpc-client.backoff-on-ratelimits
+  [backoff_on_ratelimits: <boolean> | default = false]
+
+  backoff_config:
+    # Minimum delay when backing off.
+    # CLI flag: -compactor.grpc-client.backoff-min-period
+    [min_period: <duration> | default = 100ms]
+
+    # Maximum delay when backing off.
+    # CLI flag: -compactor.grpc-client.backoff-max-period
+    [max_period: <duration> | default = 10s]
+
+    # Number of times to backoff and retry before failing.
+    # CLI flag: -compactor.grpc-client.backoff-retries
+    [max_retries: <int> | default = 10]
+
+  # Initial stream window size. Values less than the default are not supported
+  # and are ignored. Setting this to a value other than the default disables the
+  # BDP estimator.
+  # CLI flag: -compactor.grpc-client.initial-stream-window-size
+  [initial_stream_window_size: <int> | default = 63KiB1023B]
+
+  # Initial connection window size. Values less than the default are not
+  # supported and are ignored. Setting this to a value other than the default
+  # disables the BDP estimator.
+  # CLI flag: -compactor.grpc-client.initial-connection-window-size
+  [initial_connection_window_size: <int> | default = 63KiB1023B]
+
+  # Enable TLS in the gRPC client. This flag needs to be enabled when any other
+  # TLS flag is set. If set to false, insecure connection to gRPC server will be
+  # used.
+  # CLI flag: -compactor.grpc-client.tls-enabled
+  [tls_enabled: <boolean> | default = false]
+
+  # Path to the client certificate, which will be used for authenticating with
+  # the server. Also requires the key path to be configured.
+  # CLI flag: -compactor.grpc-client.tls-cert-path
+  [tls_cert_path: <string> | default = ""]
+
+  # Path to the key for the client certificate. Also requires the client
+  # certificate to be configured.
+  # CLI flag: -compactor.grpc-client.tls-key-path
+  [tls_key_path: <string> | default = ""]
+
+  # Path to the CA certificates to validate server certificate against. If not
+  # set, the host's root CA certificates are used.
+  # CLI flag: -compactor.grpc-client.tls-ca-path
+  [tls_ca_path: <string> | default = ""]
+
+  # Override the expected name on the server certificate.
+  # CLI flag: -compactor.grpc-client.tls-server-name
+  [tls_server_name: <string> | default = ""]
+
+  # Skip validating server certificate.
+  # CLI flag: -compactor.grpc-client.tls-insecure-skip-verify
+  [tls_insecure_skip_verify: <boolean> | default = false]
+
+  # Override the default cipher suite list (separated by commas). Allowed
+  # values:
+  # 
+  # Secure Ciphers:
+  # - TLS_RSA_WITH_AES_128_CBC_SHA
+  # - TLS_RSA_WITH_AES_256_CBC_SHA
+  # - TLS_RSA_WITH_AES_128_GCM_SHA256
+  # - TLS_RSA_WITH_AES_256_GCM_SHA384
+  # - TLS_AES_128_GCM_SHA256
+  # - TLS_AES_256_GCM_SHA384
+  # - TLS_CHACHA20_POLY1305_SHA256
+  # - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
+  # - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
+  # - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
+  # - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
+  # - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
+  # - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
+  # - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+  # - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+  # - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
+  # - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
+  # 
+  # Insecure Ciphers:
+  # - TLS_RSA_WITH_RC4_128_SHA
+  # - TLS_RSA_WITH_3DES_EDE_CBC_SHA
+  # - TLS_RSA_WITH_AES_128_CBC_SHA256
+  # - TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
+  # - TLS_ECDHE_RSA_WITH_RC4_128_SHA
+  # - TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
+  # - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
+  # - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
+  # CLI flag: -compactor.grpc-client.tls-cipher-suites
+  [tls_cipher_suites: <string> | default = ""]
+
+  # Override the default minimum TLS version. Allowed values: VersionTLS10,
+  # VersionTLS11, VersionTLS12, VersionTLS13
+  # CLI flag: -compactor.grpc-client.tls-min-version
+  [tls_min_version: <string> | default = ""]
+
+  # The maximum amount of time to establish a connection. A value of 0 means
+  # default gRPC client connect timeout and backoff.
+  # CLI flag: -compactor.grpc-client.connect-timeout
+  [connect_timeout: <duration> | default = 5s]
+
+  # Initial backoff delay after first connection failure. Only relevant if
+  # ConnectTimeout > 0.
+  # CLI flag: -compactor.grpc-client.connect-backoff-base-delay
+  [connect_backoff_base_delay: <duration> | default = 1s]
+
+  # Maximum backoff delay when establishing a connection. Only relevant if
+  # ConnectTimeout > 0.
+  # CLI flag: -compactor.grpc-client.connect-backoff-max-delay
+  [connect_backoff_max_delay: <duration> | default = 5s]
+
 # The limits_config block configures global and per-tenant limits in Loki. The
 # values here can be overridden in the `overrides` section of the runtime_config
 # file

integration/client/client.go

@@ -111,7 +111,7 @@ func (c *Client) PushOTLPLogLine(line string, timestamp time.Time, logAttributes
 	return c.pushOTLPLogLine(line, timestamp, logAttributes)
 }
 
-func formatTS(ts time.Time) string {
+func FormatTS(ts time.Time) string {
 	return strconv.FormatInt(ts.UnixNano(), 10)
 }
 
@@ -130,7 +130,7 @@ func (c *Client) pushLogLine(line string, timestamp time.Time, structuredMetadat
 		},
 		Values: [][]any{
 			{
-				formatTS(timestamp),
+				FormatTS(timestamp),
 				line,
 				structuredMetadata,
 			},
@@ -509,7 +509,7 @@ func (c *Client) RunQuery(ctx context.Context, query string, extraHeaders ...Hea
 
 	v := url.Values{}
 	v.Set("query", query)
-	v.Set("time", formatTS(c.Now.Add(time.Second)))
+	v.Set("time", FormatTS(c.Now.Add(time.Second)))
 
 	u, err := url.Parse(c.baseURL)
 	if err != nil {
@@ -568,8 +568,8 @@ func (c *Client) parseResponse(buf []byte, statusCode int) (*Response, error) {
 func (c *Client) rangeQueryURL(query string, start, end time.Time) string {
 	v := url.Values{}
 	v.Set("query", query)
-	v.Set("start", formatTS(start))
-	v.Set("end", formatTS(end))
+	v.Set("start", FormatTS(start))
+	v.Set("end", FormatTS(end))
 
 	u, err := url.Parse(c.baseURL)
 	if err != nil {