LokiStack fails when at least two custom resources exist with the same name in RHOCP 4

Solution Verified - Updated -

Issue

  • Having two LokiStack Custom Resource (CR) wth the same name causes the LokiStack fails with the error:

    level=error name=lokistack-gateway ts=2025-04-15T07:25:49.770333877Z caller=opa.go:159 tenant=audit msg="received non-200 status code from OPA endpoint" URL=[http://localhost:8082/v1/data/lokistack/allow] body="cluster-wide SAR failed: failed to create subject access review: subjectaccessreviews.authorization.k8s.io is forbidden: User \"system:serviceaccount:openshift-logging:logging-loki-gateway\" cannot create resource \"subjectaccessreviews\" in API group \"authorization.k8s.io\" at the cluster scope\n" status="401 Unauthorized"
    E0415 07:25:50.011743       1 webhook.go:154] Failed to make webhook authenticator request: tokenreviews.authentication.k8s.io is forbidden: User "system:serviceaccount:openshift-logging:logging-loki-gateway" cannot create resource "tokenreviews" in API group "authentication.k8s.io" at the cluster scope
    
  • Vector fails to log forward the logs to the Red Hat LokiStack when two LokiStack Custom Resource (CR) exist with the same name. The error in Vector is:

    2025-04-15T07:39:17.795469Z ERROR sink\{component_kind="sink" component_id=output_default_lokistack_infrastructure component_type=loki}: vector_common::internal_event::service: Service call failed. No retries or retries exhausted. error=Some(ServerError \{ code: 302 }) request_id=28397 error_type="request_failed" stage="sending" internal_log_rate_limit=true
    

Environment

  • Red Hat OpenShift Container Platform (RHOCP)
    • 4
  • Red Hat OpenShift Logging (RHOL)
    • 5
    • 6
  • Red Hat LokiStack
    • 5
    • 6

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content