[don't merge/just review] operator: Add token storage for ingester + make sure PDBs are maxUnavail 1

.github/workflows/backport.yml

@@ -1,55 +1,50 @@
 name: Backport PR Creator
+run-name: "Backport for ${{ github.event.pull_request.title }} (#${{ github.event.pull_request.number }})"
+
 on:
   pull_request:
     types:
       - closed
       - labeled
 
-permissions:
-  contents: read
-
 jobs:
   main:
     # We don't run the backporting for PRs from forks because those can't access "loki-github-bot" secrets in vault.
     # We don't use GitHub actions app (secrets.GITHUB_TOKEN) because PRs created by the bot don't trigger CI.
     # Also only run if the PR is merged, as an extra safe-guard.
-    if: ${{ ! github.event.pull_request.head.repo.fork && github.event.pull_request.merged == true }}
-
-    runs-on: ubuntu-x64
+    # On 'labeled' events, require that the label just added is itself a backport label, otherwise
+    # adding an unrelated label to an already-backported PR would re-trigger the job with the wrong label.
+    if: |
+      !github.event.pull_request.head.repo.fork &&
+      github.event.pull_request.merged == true &&
+      (
+        (github.event.action == 'labeled' && startsWith(github.event.label.name, 'backport ')) ||
+        (github.event.action == 'closed' && contains(join(github.event.pull_request.labels.*.name, ','), 'backport '))
+      )
     permissions:
-      contents: "read"
-      id-token: "write"
-      pull-requests: "write"
+      contents: read
+      id-token: write
+    runs-on: ubuntu-x64
     steps:
-      - name: Checkout Actions
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          repository: grafana/grafana-github-actions
-          persist-credentials: false
-          path: ./actions
-          ref: 3c62d35c5a66e730186a338e45aeb8fa784e2d56
-
-      - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "22"
-
-      - name: Install Actions
-        working-directory: ./actions
-        run: |
-          corepack enable
-          yarn install --immutable
-
-      - name: Generate GitHub App Token
+      - name: Get GitHub App token
         id: app-token
         uses: grafana/shared-workflows/actions/create-github-app-token@46f48da11e78ebdba7a8747ae456b11062fac83e # create-github-app-token/v0.3.1
         with:
           github_app: loki-gh-app
 
+      - name: Checkout loki
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          fetch-depth: 2
+          persist-credentials: false
+
       - name: Run backport
-        uses: ./actions/backport
+        uses: grafana/grafana-github-actions-go/backport@d484b937d035459a2645f7cd6b1c68cdd40fb291
         with:
           token: ${{ steps.app-token.outputs.token }}
-          labelsToAdd: "backport"
-          title: "{{originalTitle}} (backport {{base}})"
-          removeDefaultReviewers: false
+          pr_title_template: "{{title}} [{{branch}}]"
+          pr_label: ${{ github.event.action == 'labeled' && github.event.label.name || '' }}
+          pr_number: ${{ github.event.pull_request.number }}
+          repo_owner: ${{ github.repository_owner }}
+          repo_name: ${{ github.event.repository.name }}

.github/workflows/helm-ci.yml

@@ -37,7 +37,7 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
         with:
-          version: v3.21.0
+          version: v4.2.1
 
       # Python is required because `ct lint` runs Yamale (https://github.com/23andMe/Yamale) and
       # yamllint (https://github.com/adrienverge/yamllint) which require Python
@@ -136,7 +136,7 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
         with:
-          version: v3.21.0
+          version: v4.2.1
 
       - name: Install Flux CLI
         uses: fluxcd/flux2/action@1fd61a06264d71cf445ed55c4f14d401d26a1c64  # v2.8.8

.github/workflows/helm-diff-ci.yml

@@ -95,7 +95,7 @@ jobs:
           cat helm_diff_output.txt >> formatted_diff_output.md
 
       - name: Upload diff output as artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         id: upload_diff
         with:
           name: ${{ matrix.scenario.name }}-diff-output
@@ -117,7 +117,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
 
       - name: Combine diff outputs
         run: |

.github/workflows/helm-tagged-release-pr.yaml

@@ -41,7 +41,7 @@ jobs:
           bash .github/workflows/scripts/helm-tagged-release.sh ${RELEASE_VERSION}
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
         with:
           token: ${{ steps.app-token.outputs.token }}
           title: "chore: release loki helm chart ${{ steps.update.outputs.new_chart_version }}"

.github/workflows/helm-weekly-release-pr.yaml

@@ -43,7 +43,7 @@ jobs:
           bash .github/workflows/scripts/helm-weekly-release.sh
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
         with:
           token: ${{ steps.app-token.outputs.token }}
           title: "chore: release loki helm chart ${{ steps.update.outputs.new_chart_version }}"

.github/workflows/logql-bench.yml

@@ -52,7 +52,7 @@ jobs:
         working-directory: ./pkg/logql/bench
 
       - name: Upload test data
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: logql-bench-testdata-${{ steps.checkout.outputs.commit }}
           path: ./pkg/logql/bench/data.zip
@@ -93,7 +93,7 @@ jobs:
           ref: ${{ inputs.ref }}
 
       - name: Download test data
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: logql-bench-testdata-${{ steps.checkout.outputs.commit }}
           path: ./pkg/logql/bench
@@ -123,7 +123,7 @@ jobs:
         working-directory: ./pkg/logql/bench
 
       - name: Upload results
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always() # Upload results even if one of the benchmark tests fails
         with:
           name: logql-bench-results-${{ matrix.store }}-${{ steps.checkout.outputs.commit }}

.github/workflows/logql-correctness.yml

@@ -59,7 +59,7 @@ jobs:
         working-directory: ./pkg/logql/bench
 
       - name: Upload test data
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: logql-bench-testdata-${{ steps.checkout.outputs.commit }}
           path: ./pkg/logql/bench/data.zip
@@ -84,7 +84,7 @@ jobs:
           ref: ${{ needs.generate-testdata.outputs.commit }}
 
       - name: Download test data
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: logql-bench-testdata-${{ needs.generate-testdata.outputs.commit }}
           path: ./pkg/logql/bench
@@ -120,7 +120,7 @@ jobs:
         working-directory: ./pkg/logql/bench
 
       - name: Upload results
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always() # Upload results even if one of the test tests fails
         with:
           name: logql-bench-results-${{ matrix.store }}-${{ matrix.range_type }}-${{ matrix.remote_transport == true && 'remote' || 'local' }}-${{ needs.generate-testdata.outputs.commit }}

clients/cmd/docker-driver/Dockerfile

@@ -12,13 +12,13 @@ WORKDIR /src/loki
 ARG GOARCH
 RUN make clean && make BUILD_IN_CONTAINER=false GOARCH=${GOARCH} clients/cmd/docker-driver/docker-driver
 
-FROM alpine:3.23.4@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11 AS temp
+FROM alpine:3.24.0@sha256:a2d49ea686c2adfe3c992e47dc3b5e7fa6e6b5055609400dc2acaeb241c829f4 AS temp
 
 ARG GOARCH
 
 RUN apk add --update --no-cache --arch=${GOARCH} ca-certificates tzdata
 
-FROM --platform=linux/${GOARCH} alpine:3.23.4@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11
+FROM --platform=linux/${GOARCH} alpine:3.24.0@sha256:a2d49ea686c2adfe3c992e47dc3b5e7fa6e6b5055609400dc2acaeb241c829f4
 
 COPY --from=temp /etc/ca-certificates.conf /etc/ca-certificates.conf
 COPY --from=temp /usr/share/ca-certificates /usr/share/ca-certificates

clients/cmd/fluent-bit/Dockerfile

@@ -14,7 +14,7 @@ RUN go build \
     -o clients/cmd/fluent-bit/out_grafana_loki.so \
     /src/clients/cmd/fluent-bit
 
-FROM fluent/fluent-bit:5.0.6@sha256:1abcf78fe8c9dee0c57fc2199693370a5a1f84e0af4716beddcd153b40cbbbb1
+FROM fluent/fluent-bit:5.0.7@sha256:c96ee743cba9b1d5a38654931f411700af80bb7652697afbe67daad46cae237b
 
 COPY --from=builder /src/clients/cmd/fluent-bit/out_grafana_loki.so /fluent-bit/bin
 COPY clients/cmd/fluent-bit/fluent-bit.conf /fluent-bit/etc/fluent-bit.conf

clients/cmd/logstash/Dockerfile

@@ -1,4 +1,4 @@
-FROM logstash:9.4.2@sha256:37bba85d7c27ae42a429a77812ae33d493928ebee175de74bc1d6ba9a26e53b2
+FROM logstash:9.4.2@sha256:648a781b7360736754a9f583f7819d166be9dcee42d272bbce7d67278f529398
 
 USER logstash
 ENV PATH /usr/share/logstash/vendor/jruby/bin:/usr/share/logstash/vendor/bundle/jruby/3.1.0/bin:/usr/share/logstash/jdk/bin:$PATH

cmd/dataobj-inspect/dump.go

@@ -16,6 +16,8 @@ import (
 	"github.com/grafana/loki/v3/pkg/dataobj/sections/indexpointers"
 	"github.com/grafana/loki/v3/pkg/dataobj/sections/logs"
 	"github.com/grafana/loki/v3/pkg/dataobj/sections/pointers"
+	"github.com/grafana/loki/v3/pkg/dataobj/sections/postings"
+	"github.com/grafana/loki/v3/pkg/dataobj/sections/stats"
 	"github.com/grafana/loki/v3/pkg/dataobj/sections/streams"
 )
 
@@ -27,7 +29,7 @@ type dumpCommand struct {
 	streamID   *int
 }
 
-func (cmd *dumpCommand) run(c *kingpin.ParseContext) error {
+func (cmd *dumpCommand) run(_ *kingpin.ParseContext) error {
 	for _, f := range *cmd.files {
 		cmd.dumpFile(f)
 	}
@@ -61,6 +63,10 @@ func (cmd *dumpCommand) dumpFile(name string) {
 			cmd.dumpStreamsSection(context.TODO(), offset, sec)
 		case logs.CheckSection(sec):
 			cmd.dumpLogsSection(context.TODO(), offset, sec)
+		case postings.CheckSection(sec):
+			cmd.dumpPostingsSection(context.TODO(), offset, sec)
+		case stats.CheckSection(sec):
+			cmd.dumpStatsSection(context.TODO(), offset, sec)
 		default:
 			fmt.Printf("unknown section: %s\n", sec.Type)
 		}
@@ -219,6 +225,67 @@ func (cmd *dumpCommand) dumpLogsSection(ctx context.Context, offset int, sec *da
 	}
 }
 
+func (cmd *dumpCommand) dumpPostingsSection(ctx context.Context, offset int, sec *dataobj.Section) {
+	postingsSec, err := postings.Open(ctx, sec)
+	if err != nil {
+		exitWithErr(err)
+	}
+	bold := color.New(color.Bold)
+	bold.Println("Postings section:")
+	bold.Printf("\toffset: %d, tenant: %s\n", offset, sec.Tenant)
+
+	r := postings.NewRowReader(ctx, postingsSec)
+	defer r.Close()
+	for r.Next() {
+		row := r.At()
+		switch row.Kind {
+		case postings.KindLabel:
+			bold.Printf("\t\t[Label] path: %s, section: %d, column: %s, value: %s, bitmap: %d bytes, uncompressedSize: %d, start: %s, end: %s\n",
+				row.ObjectPath, row.SectionIndex, row.ColumnName, row.LabelValue,
+				len(row.StreamIDBitmap), row.UncompressedSize,
+				time.Unix(0, row.MinTimestamp).UTC().Format(time.RFC3339Nano),
+				time.Unix(0, row.MaxTimestamp).UTC().Format(time.RFC3339Nano))
+		case postings.KindBloom:
+			bold.Printf("\t\t[Bloom] path: %s, section: %d, column: %s, bloom: %d bytes, bitmap: %d bytes, uncompressedSize: %d, start: %s, end: %s\n",
+				row.ObjectPath, row.SectionIndex, row.ColumnName,
+				len(row.BloomFilter), len(row.StreamIDBitmap), row.UncompressedSize,
+				time.Unix(0, row.MinTimestamp).UTC().Format(time.RFC3339Nano),
+				time.Unix(0, row.MaxTimestamp).UTC().Format(time.RFC3339Nano))
+		default:
+			fmt.Printf("\t\tunknown posting kind: %v\n", row.Kind)
+		}
+	}
+	if err := r.Err(); err != nil {
+		exitWithErr(err)
+	}
+}
+
+func (cmd *dumpCommand) dumpStatsSection(ctx context.Context, offset int, sec *dataobj.Section) {
+	statsSec, err := stats.Open(ctx, sec)
+	if err != nil {
+		exitWithErr(err)
+	}
+	bold := color.New(color.Bold)
+	bold.Println("Stats section:")
+	bold.Printf("\toffset: %d, tenant: %s\n", offset, sec.Tenant)
+
+	r := stats.NewRowReader(ctx, statsSec)
+	defer r.Close()
+	for r.Next() {
+		s := r.At()
+		bold.Printf("\t\tpath: %s, section: %d, sortSchema: %s, rows: %d, uncompressedSize: %d, start: %s, end: %s, labels:\n",
+			s.ObjectPath, s.SectionIndex, s.SortSchema, s.RowCount, s.UncompressedSize,
+			time.Unix(0, s.MinTimestamp).UTC().Format(time.RFC3339Nano),
+			time.Unix(0, s.MaxTimestamp).UTC().Format(time.RFC3339Nano))
+		for name, value := range s.Labels {
+			fmt.Printf("\t\t\t%s=%s\n", name, value)
+		}
+	}
+	if err := r.Err(); err != nil {
+		exitWithErr(err)
+	}
+}
+
 func addDumpCommand(app *kingpin.Application) {
 	cmd := &dumpCommand{}
 	dump := app.Command("dump", "Dump the contents of the data object.").Action(cmd.run)