---
id: w3/m5/t001
title: GitOps — Loki (single-binary, filesystem PVC) + log-shipper DaemonSet
worker: worker3
status: todo
estimate: 30m
depends_on: []
---

## Objective

Deploy the store and the shipper as platform infra: Loki in single-binary mode (filesystem storage on a PVC — no object store dependency) and a log-shipping DaemonSet (Grafana Alloy or Promtail) that tails pod logs and labels streams with namespace/pod/container/app labels, following the existing bought-component pattern (Prometheus: server-only chart, values in `deploy/gitops/base/values/`).

## Context

- Pattern to copy: `deploy/gitops/base/prometheus.yaml` (Argo Application over a Helm chart, values file, local-overlay sizing patch like `auth-dbs`).
- Label discipline matters: the bex-api query path (t002) will select on the App's namespace/name labels — ship them from the k8s metadata.
- Local overlay: shrink storage for CAPD (`deploy/gitops/overlays/local/`).

## Steps

1. Argo Application for Loki (chart pin, single-binary, PVC size + retention knob surfaced in values).
2. Shipper DaemonSet app (Alloy or Promtail — pick the one with the simpler static config, record why).
3. `scripts/gitops-validate.sh` / `kustomize build` both overlays.

## Files

- `deploy/gitops/base/` (loki.yaml, shipper yaml, values, kustomization entry)
- `deploy/gitops/overlays/local/`

## Acceptance criteria

- [ ] Loki and the shipper sync green; `logcli`/HTTP query returns lines for a running app labeled by namespace/pod/app.
- [ ] Both overlay builds pass validation.

## Out of scope

- bex-api integration (t002); retention tuning (t004); metrics in Loki (never — Prometheus owns metrics).
