From e4a7e5629ab186cecc902a058da21c5e17210674 Mon Sep 17 00:00:00 2001
From: CTO Agent <cto-agent@basicstack.de>
Date: Sun, 16 Aug 2026 12:50:22 +0000
Subject: [PATCH] fix(monitoring): pin Loki to k3s-worker-2 to unblock
 backup-volumes (DEV-483)

Bridge fix so DEV-478 weekly OS-update preflight can proceed while
DEV-482 (Option 4: restic -> Hetzner Object Storage) is designed and
rolled out. Captures the previously out-of-band Loki Deployment as a
manifest and adds nodeSelector kubernetes.io/hostname: k3s-worker-2 so
the loki-storage-encrypted RWO CSI volume co-locates with the
backup-volumes CronJob on worker-2, resolving the RWO/nodeSelector race.

This nodeSelector is temporary. It comes back out as part of DEV-482
step 6 when the legacy backup-volumes CronJob is retired.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 apps/monitoring/loki-deployment.yaml | 57 ++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)
 create mode 100644 apps/monitoring/loki-deployment.yaml

diff --git a/apps/monitoring/loki-deployment.yaml b/apps/monitoring/loki-deployment.yaml
new file mode 100644
index 0000000..ef2c662
--- /dev/null
+++ b/apps/monitoring/loki-deployment.yaml
@@ -0,0 +1,57 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: loki
+  namespace: monitoring
+  labels:
+    app: loki
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: loki
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+  template:
+    metadata:
+      labels:
+        app: loki
+    spec:
+      # DEV-483 bridge fix: pin Loki to k3s-worker-2 so the loki-storage-encrypted
+      # RWO CSI volume co-locates with the backup-volumes CronJob (also on worker-2).
+      # Removed as part of DEV-482 step 6 once the legacy backup-volumes CronJob
+      # is retired (Option 4: restic -> Hetzner Object Storage).
+      nodeSelector:
+        kubernetes.io/hostname: k3s-worker-2
+      containers:
+      - name: loki
+        image: grafana/loki:2.9.2
+        args:
+        - -config.file=/etc/loki/loki.yaml
+        ports:
+        - containerPort: 3100
+          name: http
+        - containerPort: 9096
+          name: grpc
+        resources:
+          requests:
+            cpu: 200m
+            memory: 512Mi
+          limits:
+            cpu: 500m
+            memory: 1Gi
+        volumeMounts:
+        - name: loki-config
+          mountPath: /etc/loki
+        - name: loki-storage
+          mountPath: /loki
+      volumes:
+      - name: loki-config
+        configMap:
+          name: loki-config
+      - name: loki-storage
+        persistentVolumeClaim:
+          claimName: loki-storage-encrypted