Configure S3 credentials#

This guide shows you how to supply the object storage configuration the stack needs for Thanos metrics and Loki logs. The library creates the buckets through Crossplane and replicates the credentials through External Secrets Operator, but it relies on cluster-level resources you provide.

Provide the S3 block#

Set the s3 block in your mergeConfig input. Both endpoint forms are required: the full URL for Loki, and the host-only form for the Thanos object store config.

const config = mergeConfig({
  // other required cluster values ...
  s3: {
    endpoint: 'https://fsn1.your-objectstorage.com',
    endpointNoProtocol: 'fsn1.your-objectstorage.com',
    region: 'fsn1',
    buckets: { thanos: 'metrics-thanos-prod', loki: 'logs-loki-prod' },
  },
});

Name the external resources#

The stack does not create the Crossplane provider config or the External Secrets stores it relies on. You create those in your cluster under names of your choosing and pass the names through the integrations block.

const config = mergeConfig({
  // other required cluster values ...
  integrations: {
    s3ProviderConfig: 'my-s3-provider',
    s3SecretStore: 'my-s3-secret-store',
    s3CredentialsKey: 'my-s3-credentials',
    grafanaSecretStore: 'my-app-secret-store',
    grafanaCredentialsKey: 'my-grafana-admin',
  },
});

The names above are placeholders. Replace each with the name your cluster uses for that resource.

What the library creates#

From this block the stack synthesizes:

  • A Crossplane Bucket for Thanos and one for Loki, both in the crossplane-system namespace, with versioning and lifecycle rules.

  • A Thanos ExternalSecret that reads the source credentials and renders a thanos-objstore-config secret with an objstore.yml key.

  • A Loki ExternalSecret that renders a loki-s3-credentials secret with AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.

Provide the cluster-level resources#

The synthesized resources expect these to already exist.

The Crossplane provider config and credentials

The Bucket resources are reconciled by Crossplane in crossplane-system. A ProviderConfig and its credentials secret must point at your S3 endpoint. Pass the provider config name as integrations.s3ProviderConfig.

The S3 ClusterSecretStore

Both ExternalSecrets reference the store named by integrations.s3SecretStore. Create that store and point it at the namespace holding the source credentials.

The source credentials secret

Both ExternalSecrets extract from the remote key named by integrations.s3CredentialsKey in that store. The resolved secret must hold AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.

Important

The store and key names are not fixed in the library; you choose them and surface them through integrations. Make sure the values you pass for integrations.s3SecretStore and integrations.s3CredentialsKey match resources that actually exist, or the External Secrets will fail to resolve.

Verify#

After deployment, confirm the buckets reconciled and the secrets materialized.

kubectl get buckets.s3.aws.upbound.io -n crossplane-system
kubectl get externalsecrets -n monitoring
kubectl get secret thanos-objstore-config loki-s3-credentials -n monitoring

See also#