Error getting credentials using GOOGLE_APPLICATION_CREDENTIALS environment variable

Grafana Loki
, ,
1

How to set up loki-values.yaml for work with gcs? the pods are crashing with error:
“google: error getting credentials using GOOGLE_APPLICATION_CREDENTIALS environment variable: invalid character ‘e’ at the beginning of the value
error creating object client”

loki:
  auth_enabled: false

  commonConfig:
    ring:
      instance_addr: 127.0.0.1
      kvstore:
        store: inmemory
    replication_factor: 1
    path_prefix: /loki

  storage:
    bucketNames:
      chunks: ab7d14a0f02ac9ab-loki-logs-bucket
    type: gcs

  schemaConfig:
    configs:
      - from: 2024-07-22
        store: tsdb
        object_store: gcs
        schema: v13
        index:
          prefix: index_
          period: 24h

  storageConfig:
    tsdb_shipper:
      active_index_directory: /loki/index
      cache_location: /loki/index_cache
    gcs:
      bucket_name: ab7d14a0f02ac9ab-loki-logs-bucket

write:
  extraEnv:
    - name: GOOGLE_APPLICATION_CREDENTIALS
      value: /etc/gcs/loki-gcs.json
  extraVolumeMounts:
    - name: gcs-key
      mountPath: /etc/gcs
  extraVolumes:
    - name: gcs-key
      secret:
        secretName: loki-gcs

read:
  extraEnv:
    - name: GOOGLE_APPLICATION_CREDENTIALS
      value: /etc/gcs/loki-gcs.json
  extraVolumeMounts:
    - name: gcs-key
      mountPath: /etc/gcs
  extraVolumes:
    - name: gcs-key
      secret:
        secretName: loki-gcs

backend:
  extraEnv:
    - name: GOOGLE_APPLICATION_CREDENTIALS
      value: /etc/gcs/loki-gcs.json
  extraVolumeMounts:
    - name: gcs-key
      mountPath: /etc/gcs
  extraVolumes:
    - name: gcs-key
      secret:
        secretName: loki-gcs

loki-gcs.tf:

resource "google_storage_bucket_iam_member" "loki" {
  depends_on = [google_storage_bucket.loki_logs]
  bucket = google_storage_bucket.loki_logs.name
  role   = "roles/storage.admin"
  member = "serviceAccount:${google_service_account.loki.email}"
}

resource "google_service_account_key" "loki" {
  service_account_id = google_service_account.loki.name
}

resource "kubernetes_secret" "loki_gcs" {
  metadata {
    name      = "loki-gcs"
    namespace = "default"
  }

  data = {
    "loki-gcs.json" = google_service_account_key.loki.private_key
  }
}
2

This auth method is deprecated. I used Workload Identity.