From 3a95f57b8fb8ac8b9a84c2abe7c49d94a5560e64 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Mon, 20 Jul 2026 23:00:51 -0700
Subject: [PATCH] =?UTF-8?q?fix(loki):=20wire=20S3=20creds=20from=20loki-s3?=
 =?UTF-8?q?-creds=20Secret=20via=20expand-env=20+=20extraEnvFrom=20?=
 =?UTF-8?q?=E2=80=94=20replaces=20empty=20helmfile-injected=20access=20key?=
 =?UTF-8?q?s?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 k8s/platform/logging/loki-values.yaml | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/k8s/platform/logging/loki-values.yaml b/k8s/platform/logging/loki-values.yaml
index 43c6b15..94b5941 100644
--- a/k8s/platform/logging/loki-values.yaml
+++ b/k8s/platform/logging/loki-values.yaml
@@ -37,8 +37,10 @@ loki:
       region: us-east-1          # MinIO ignores region but Loki's S3 client requires it
       s3ForcePathStyle: true
       insecure: true
-      access_key_id: ""          # overridden by helmfile --set (MINIO_ROOT_USER)
-      secret_access_key: ""      # overridden by helmfile --set (MINIO_ROOT_PASSWORD)
+      # Interpolated at runtime from the loki-s3-creds Secret (SOPS-CMP emitted),
+      # injected as env vars via extraEnvFrom below. Requires -config.expand-env.
+      access_key_id: "${access_key_id}"
+      secret_access_key: "${secret_access_key}"
     bucketNames:
       chunks: loki-chunks
       ruler: loki-ruler
@@ -110,6 +112,14 @@ loki:
 singleBinary:
   replicas: 1
 
+  # Interpolate ${access_key_id}/${secret_access_key} in the S3 config from the
+  # loki-s3-creds Secret (SOPS-CMP emitted).
+  extraArgs:
+    - "-config.expand-env=true"
+  extraEnvFrom:
+    - secretRef:
+        name: loki-s3-creds
+
   resources:
     requests:
       cpu: 100m