@bluedynamics/cdk8s-monitoring 0.0.1

package/lib/constructs/grafana-password-secret.d.ts

@@ -0,0 +1,57 @@
+import { Construct } from 'constructs';
+import { ExternalSecret } from '../imports/external-secrets.io';
+export interface GrafanaPasswordSecretProps {
+    readonly namespace: string;
+}
+/**
+ * Creates ExternalSecret for stable Grafana admin credentials.
+ *
+ * This construct creates an ExternalSecret that replicates the Grafana admin password
+ * from the application-secrets namespace to the monitoring namespace, following the
+ * centralized secret management pattern.
+ *
+ * Prerequisites:
+ * - External Secrets Operator installed
+ * - ClusterSecretStore 'monitoring-app-secrets-store' exists (points to application-secrets)
+ * - Secret 'grafana-admin' exists in application-secrets namespace with keys:
+ *   - admin-user
+ *   - admin-password
+ *
+ * Security Model:
+ * - Source secret stored in centralized application-secrets namespace
+ * - ExternalSecret CR (this) committed to git (GitOps-safe, no password in git)
+ * - ESO automatically replicates secret to monitoring namespace
+ * - Password persists across Helm upgrades (no auto-regeneration)
+ *
+ * Benefits:
+ * - Centralized secret management (all app secrets in application-secrets namespace)
+ * - GitOps-safe (ExternalSecret in git, actual password not in git)
+ * - Password rotation (update source → auto-sync to monitoring)
+ * - Follows GitLab BDA security model (see documentation/sources/deployments/gitlabbda/explanation/security-model.md)
+ *
+ * Usage in prometheus-stack.ts:
+ * ```yaml
+ * grafana:
+ *   admin:
+ *     existingSecret: "grafana-admin-credentials"
+ *     userKey: "admin-user"
+ *     passwordKey: "admin-password"
+ * ```
+ *
+ * Manual Setup Required:
+ * 1. Create source secret in application-secrets namespace:
+ *    ```bash
+ *    kubectl create secret generic grafana-admin -n application-secrets \
+ *      --from-literal=admin-user=admin \
+ *      --from-literal=admin-password='YourSecurePassword123!'
+ *    ```
+ *
+ * 2. Create ClusterSecretStore (if not exists):
+ *    See: documentation/sources/deployments/monitoring/how-to/setup-grafana-password.md
+ *
+ * 3. Deploy monitoring stack (this ExternalSecret will sync the secret)
+ */
+export declare class GrafanaPasswordSecret extends Construct {
+    readonly externalSecret: ExternalSecret;
+    constructor(scope: Construct, id: string, props: GrafanaPasswordSecretProps);
+}

package/lib/constructs/grafana-password-secret.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GrafanaPasswordSecret = void 0;
+const constructs_1 = require("constructs");
+const external_secrets_io_1 = require("../imports/external-secrets.io");
+/**
+ * Creates ExternalSecret for stable Grafana admin credentials.
+ *
+ * This construct creates an ExternalSecret that replicates the Grafana admin password
+ * from the application-secrets namespace to the monitoring namespace, following the
+ * centralized secret management pattern.
+ *
+ * Prerequisites:
+ * - External Secrets Operator installed
+ * - ClusterSecretStore 'monitoring-app-secrets-store' exists (points to application-secrets)
+ * - Secret 'grafana-admin' exists in application-secrets namespace with keys:
+ *   - admin-user
+ *   - admin-password
+ *
+ * Security Model:
+ * - Source secret stored in centralized application-secrets namespace
+ * - ExternalSecret CR (this) committed to git (GitOps-safe, no password in git)
+ * - ESO automatically replicates secret to monitoring namespace
+ * - Password persists across Helm upgrades (no auto-regeneration)
+ *
+ * Benefits:
+ * - Centralized secret management (all app secrets in application-secrets namespace)
+ * - GitOps-safe (ExternalSecret in git, actual password not in git)
+ * - Password rotation (update source → auto-sync to monitoring)
+ * - Follows GitLab BDA security model (see documentation/sources/deployments/gitlabbda/explanation/security-model.md)
+ *
+ * Usage in prometheus-stack.ts:
+ * ```yaml
+ * grafana:
+ *   admin:
+ *     existingSecret: "grafana-admin-credentials"
+ *     userKey: "admin-user"
+ *     passwordKey: "admin-password"
+ * ```
+ *
+ * Manual Setup Required:
+ * 1. Create source secret in application-secrets namespace:
+ *    ```bash
+ *    kubectl create secret generic grafana-admin -n application-secrets \
+ *      --from-literal=admin-user=admin \
+ *      --from-literal=admin-password='YourSecurePassword123!'
+ *    ```
+ *
+ * 2. Create ClusterSecretStore (if not exists):
+ *    See: documentation/sources/deployments/monitoring/how-to/setup-grafana-password.md
+ *
+ * 3. Deploy monitoring stack (this ExternalSecret will sync the secret)
+ */
+class GrafanaPasswordSecret extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const { namespace } = props;
+        // Create ExternalSecret to replicate Grafana credentials from application-secrets
+        // Wave 1: Credentials must exist before Grafana starts (Wave 2)
+        this.externalSecret = new external_secrets_io_1.ExternalSecret(this, 'external-secret', {
+            metadata: {
+                name: 'grafana-admin-credentials-es',
+                namespace,
+                labels: {
+                    'app.kubernetes.io/name': 'grafana',
+                    'app.kubernetes.io/component': 'credentials',
+                    'app.kubernetes.io/managed-by': 'external-secrets',
+                },
+                annotations: {
+                    'argocd.argoproj.io/sync-wave': '1',
+                },
+            },
+            spec: {
+                // Sync every hour to detect password rotation
+                refreshInterval: '1h',
+                // Reference to ClusterSecretStore (application-secrets → monitoring)
+                secretStoreRef: {
+                    name: 'monitoring-app-secrets-store',
+                    kind: external_secrets_io_1.ExternalSecretSpecSecretStoreRefKind.CLUSTER_SECRET_STORE,
+                },
+                // Target secret name that Grafana will use
+                target: {
+                    name: 'grafana-admin-credentials',
+                    creationPolicy: external_secrets_io_1.ExternalSecretSpecTargetCreationPolicy.OWNER,
+                },
+                // Copy all data from source secret (admin-user, admin-password)
+                dataFrom: [
+                    {
+                        extract: {
+                            key: 'grafana-admin',
+                        },
+                    },
+                ],
+            },
+        });
+    }
+}
+exports.GrafanaPasswordSecret = GrafanaPasswordSecret;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ3JhZmFuYS1wYXNzd29yZC1zZWNyZXQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY29uc3RydWN0cy9ncmFmYW5hLXBhc3N3b3JkLXNlY3JldC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSwyQ0FBdUM7QUFDdkMsd0VBSXdDO0FBTXhDOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQStDRztBQUNILE1BQWEscUJBQXNCLFNBQVEsc0JBQVM7SUFHbEQsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUFpQztRQUN6RSxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBRWpCLE1BQU0sRUFBRSxTQUFTLEVBQUUsR0FBRyxLQUFLLENBQUM7UUFFNUIsa0ZBQWtGO1FBQ2xGLGdFQUFnRTtRQUNoRSxJQUFJLENBQUMsY0FBYyxHQUFHLElBQUksb0NBQWMsQ0FBQyxJQUFJLEVBQUUsaUJBQWlCLEVBQUU7WUFDaEUsUUFBUSxFQUFFO2dCQUNSLElBQUksRUFBRSw4QkFBOEI7Z0JBQ3BDLFNBQVM7Z0JBQ1QsTUFBTSxFQUFFO29CQUNOLHdCQUF3QixFQUFFLFNBQVM7b0JBQ25DLDZCQUE2QixFQUFFLGFBQWE7b0JBQzVDLDhCQUE4QixFQUFFLGtCQUFrQjtpQkFDbkQ7Z0JBQ0QsV0FBVyxFQUFFO29CQUNYLDhCQUE4QixFQUFFLEdBQUc7aUJBQ3BDO2FBQ0Y7WUFDRCxJQUFJLEVBQUU7Z0JBQ0osOENBQThDO2dCQUM5QyxlQUFlLEVBQUUsSUFBSTtnQkFFckIscUVBQXFFO2dCQUNyRSxjQUFjLEVBQUU7b0JBQ2QsSUFBSSxFQUFFLDhCQUE4QjtvQkFDcEMsSUFBSSxFQUFFLDBEQUFvQyxDQUFDLG9CQUFvQjtpQkFDaEU7Z0JBRUQsMkNBQTJDO2dCQUMzQyxNQUFNLEVBQUU7b0JBQ04sSUFBSSxFQUFFLDJCQUEyQjtvQkFDakMsY0FBYyxFQUFFLDREQUFzQyxDQUFDLEtBQUs7aUJBQzdEO2dCQUVELGdFQUFnRTtnQkFDaEUsUUFBUSxFQUFFO29CQUNSO3dCQUNFLE9BQU8sRUFBRTs0QkFDUCxHQUFHLEVBQUUsZUFBZTt5QkFDckI7cUJBQ0Y7aUJBQ0Y7YUFDRjtTQUNGLENBQUMsQ0FBQztJQUNMLENBQUM7Q0FDRjtBQWxERCxzREFrREMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tICdjb25zdHJ1Y3RzJztcbmltcG9ydCB7XG4gIEV4dGVybmFsU2VjcmV0LFxuICBFeHRlcm5hbFNlY3JldFNwZWNUYXJnZXRDcmVhdGlvblBvbGljeSxcbiAgRXh0ZXJuYWxTZWNyZXRTcGVjU2VjcmV0U3RvcmVSZWZLaW5kLFxufSBmcm9tICcuLi9pbXBvcnRzL2V4dGVybmFsLXNlY3JldHMuaW8nO1xuXG5leHBvcnQgaW50ZXJmYWNlIEdyYWZhbmFQYXNzd29yZFNlY3JldFByb3BzIHtcbiAgcmVhZG9ubHkgbmFtZXNwYWNlOiBzdHJpbmc7XG59XG5cbi8qKlxuICogQ3JlYXRlcyBFeHRlcm5hbFNlY3JldCBmb3Igc3RhYmxlIEdyYWZhbmEgYWRtaW4gY3JlZGVudGlhbHMuXG4gKlxuICogVGhpcyBjb25zdHJ1Y3QgY3JlYXRlcyBhbiBFeHRlcm5hbFNlY3JldCB0aGF0IHJlcGxpY2F0ZXMgdGhlIEdyYWZhbmEgYWRtaW4gcGFzc3dvcmRcbiAqIGZyb20gdGhlIGFwcGxpY2F0aW9uLXNlY3JldHMgbmFtZXNwYWNlIHRvIHRoZSBtb25pdG9yaW5nIG5hbWVzcGFjZSwgZm9sbG93aW5nIHRoZVxuICogY2VudHJhbGl6ZWQgc2VjcmV0IG1hbmFnZW1lbnQgcGF0dGVybi5cbiAqXG4gKiBQcmVyZXF1aXNpdGVzOlxuICogLSBFeHRlcm5hbCBTZWNyZXRzIE9wZXJhdG9yIGluc3RhbGxlZFxuICogLSBDbHVzdGVyU2VjcmV0U3RvcmUgJ21vbml0b3JpbmctYXBwLXNlY3JldHMtc3RvcmUnIGV4aXN0cyAocG9pbnRzIHRvIGFwcGxpY2F0aW9uLXNlY3JldHMpXG4gKiAtIFNlY3JldCAnZ3JhZmFuYS1hZG1pbicgZXhpc3RzIGluIGFwcGxpY2F0aW9uLXNlY3JldHMgbmFtZXNwYWNlIHdpdGgga2V5czpcbiAqICAgLSBhZG1pbi11c2VyXG4gKiAgIC0gYWRtaW4tcGFzc3dvcmRcbiAqXG4gKiBTZWN1cml0eSBNb2RlbDpcbiAqIC0gU291cmNlIHNlY3JldCBzdG9yZWQgaW4gY2VudHJhbGl6ZWQgYXBwbGljYXRpb24tc2VjcmV0cyBuYW1lc3BhY2VcbiAqIC0gRXh0ZXJuYWxTZWNyZXQgQ1IgKHRoaXMpIGNvbW1pdHRlZCB0byBnaXQgKEdpdE9wcy1zYWZlLCBubyBwYXNzd29yZCBpbiBnaXQpXG4gKiAtIEVTTyBhdXRvbWF0aWNhbGx5IHJlcGxpY2F0ZXMgc2VjcmV0IHRvIG1vbml0b3JpbmcgbmFtZXNwYWNlXG4gKiAtIFBhc3N3b3JkIHBlcnNpc3RzIGFjcm9zcyBIZWxtIHVwZ3JhZGVzIChubyBhdXRvLXJlZ2VuZXJhdGlvbilcbiAqXG4gKiBCZW5lZml0czpcbiAqIC0gQ2VudHJhbGl6ZWQgc2VjcmV0IG1hbmFnZW1lbnQgKGFsbCBhcHAgc2VjcmV0cyBpbiBhcHBsaWNhdGlvbi1zZWNyZXRzIG5hbWVzcGFjZSlcbiAqIC0gR2l0T3BzLXNhZmUgKEV4dGVybmFsU2VjcmV0IGluIGdpdCwgYWN0dWFsIHBhc3N3b3JkIG5vdCBpbiBnaXQpXG4gKiAtIFBhc3N3b3JkIHJvdGF0aW9uICh1cGRhdGUgc291cmNlIOKGkiBhdXRvLXN5bmMgdG8gbW9uaXRvcmluZylcbiAqIC0gRm9sbG93cyBHaXRMYWIgQkRBIHNlY3VyaXR5IG1vZGVsIChzZWUgZG9jdW1lbnRhdGlvbi9zb3VyY2VzL2RlcGxveW1lbnRzL2dpdGxhYmJkYS9leHBsYW5hdGlvbi9zZWN1cml0eS1tb2RlbC5tZClcbiAqXG4gKiBVc2FnZSBpbiBwcm9tZXRoZXVzLXN0YWNrLnRzOlxuICogYGBgeWFtbFxuICogZ3JhZmFuYTpcbiAqICAgYWRtaW46XG4gKiAgICAgZXhpc3RpbmdTZWNyZXQ6IFwiZ3JhZmFuYS1hZG1pbi1jcmVkZW50aWFsc1wiXG4gKiAgICAgdXNlcktleTogXCJhZG1pbi11c2VyXCJcbiAqICAgICBwYXNzd29yZEtleTogXCJhZG1pbi1wYXNzd29yZFwiXG4gKiBgYGBcbiAqXG4gKiBNYW51YWwgU2V0dXAgUmVxdWlyZWQ6XG4gKiAxLiBDcmVhdGUgc291cmNlIHNlY3JldCBpbiBhcHBsaWNhdGlvbi1zZWNyZXRzIG5hbWVzcGFjZTpcbiAqICAgIGBgYGJhc2hcbiAqICAgIGt1YmVjdGwgY3JlYXRlIHNlY3JldCBnZW5lcmljIGdyYWZhbmEtYWRtaW4gLW4gYXBwbGljYXRpb24tc2VjcmV0cyBcXFxuICogICAgICAtLWZyb20tbGl0ZXJhbD1hZG1pbi11c2VyPWFkbWluIFxcXG4gKiAgICAgIC0tZnJvbS1saXRlcmFsPWFkbWluLXBhc3N3b3JkPSdZb3VyU2VjdXJlUGFzc3dvcmQxMjMhJ1xuICogICAgYGBgXG4gKlxuICogMi4gQ3JlYXRlIENsdXN0ZXJTZWNyZXRTdG9yZSAoaWYgbm90IGV4aXN0cyk6XG4gKiAgICBTZWU6IGRvY3VtZW50YXRpb24vc291cmNlcy9kZXBsb3ltZW50cy9tb25pdG9yaW5nL2hvdy10by9zZXR1cC1ncmFmYW5hLXBhc3N3b3JkLm1kXG4gKlxuICogMy4gRGVwbG95IG1vbml0b3Jpbmcgc3RhY2sgKHRoaXMgRXh0ZXJuYWxTZWNyZXQgd2lsbCBzeW5jIHRoZSBzZWNyZXQpXG4gKi9cbmV4cG9ydCBjbGFzcyBHcmFmYW5hUGFzc3dvcmRTZWNyZXQgZXh0ZW5kcyBDb25zdHJ1Y3Qge1xuICBwdWJsaWMgcmVhZG9ubHkgZXh0ZXJuYWxTZWNyZXQ6IEV4dGVybmFsU2VjcmV0O1xuXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBHcmFmYW5hUGFzc3dvcmRTZWNyZXRQcm9wcykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCk7XG5cbiAgICBjb25zdCB7IG5hbWVzcGFjZSB9ID0gcHJvcHM7XG5cbiAgICAvLyBDcmVhdGUgRXh0ZXJuYWxTZWNyZXQgdG8gcmVwbGljYXRlIEdyYWZhbmEgY3JlZGVudGlhbHMgZnJvbSBhcHBsaWNhdGlvbi1zZWNyZXRzXG4gICAgLy8gV2F2ZSAxOiBDcmVkZW50aWFscyBtdXN0IGV4aXN0IGJlZm9yZSBHcmFmYW5hIHN0YXJ0cyAoV2F2ZSAyKVxuICAgIHRoaXMuZXh0ZXJuYWxTZWNyZXQgPSBuZXcgRXh0ZXJuYWxTZWNyZXQodGhpcywgJ2V4dGVybmFsLXNlY3JldCcsIHtcbiAgICAgIG1ldGFkYXRhOiB7XG4gICAgICAgIG5hbWU6ICdncmFmYW5hLWFkbWluLWNyZWRlbnRpYWxzLWVzJyxcbiAgICAgICAgbmFtZXNwYWNlLFxuICAgICAgICBsYWJlbHM6IHtcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbmFtZSc6ICdncmFmYW5hJyxcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vY29tcG9uZW50JzogJ2NyZWRlbnRpYWxzJyxcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbWFuYWdlZC1ieSc6ICdleHRlcm5hbC1zZWNyZXRzJyxcbiAgICAgICAgfSxcbiAgICAgICAgYW5ub3RhdGlvbnM6IHtcbiAgICAgICAgICAnYXJnb2NkLmFyZ29wcm9qLmlvL3N5bmMtd2F2ZSc6ICcxJyxcbiAgICAgICAgfSxcbiAgICAgIH0sXG4gICAgICBzcGVjOiB7XG4gICAgICAgIC8vIFN5bmMgZXZlcnkgaG91ciB0byBkZXRlY3QgcGFzc3dvcmQgcm90YXRpb25cbiAgICAgICAgcmVmcmVzaEludGVydmFsOiAnMWgnLFxuXG4gICAgICAgIC8vIFJlZmVyZW5jZSB0byBDbHVzdGVyU2VjcmV0U3RvcmUgKGFwcGxpY2F0aW9uLXNlY3JldHMg4oaSIG1vbml0b3JpbmcpXG4gICAgICAgIHNlY3JldFN0b3JlUmVmOiB7XG4gICAgICAgICAgbmFtZTogJ21vbml0b3JpbmctYXBwLXNlY3JldHMtc3RvcmUnLFxuICAgICAgICAgIGtpbmQ6IEV4dGVybmFsU2VjcmV0U3BlY1NlY3JldFN0b3JlUmVmS2luZC5DTFVTVEVSX1NFQ1JFVF9TVE9SRSxcbiAgICAgICAgfSxcblxuICAgICAgICAvLyBUYXJnZXQgc2VjcmV0IG5hbWUgdGhhdCBHcmFmYW5hIHdpbGwgdXNlXG4gICAgICAgIHRhcmdldDoge1xuICAgICAgICAgIG5hbWU6ICdncmFmYW5hLWFkbWluLWNyZWRlbnRpYWxzJyxcbiAgICAgICAgICBjcmVhdGlvblBvbGljeTogRXh0ZXJuYWxTZWNyZXRTcGVjVGFyZ2V0Q3JlYXRpb25Qb2xpY3kuT1dORVIsXG4gICAgICAgIH0sXG5cbiAgICAgICAgLy8gQ29weSBhbGwgZGF0YSBmcm9tIHNvdXJjZSBzZWNyZXQgKGFkbWluLXVzZXIsIGFkbWluLXBhc3N3b3JkKVxuICAgICAgICBkYXRhRnJvbTogW1xuICAgICAgICAgIHtcbiAgICAgICAgICAgIGV4dHJhY3Q6IHtcbiAgICAgICAgICAgICAga2V5OiAnZ3JhZmFuYS1hZG1pbicsXG4gICAgICAgICAgICB9LFxuICAgICAgICAgIH0sXG4gICAgICAgIF0sXG4gICAgICB9LFxuICAgIH0pO1xuICB9XG59XG4iXX0=

package/lib/constructs/loki-s3-bucket.d.ts

@@ -0,0 +1,24 @@
+import { Construct } from 'constructs';
+import { MonitoringConfig } from '../types';
+export interface LokiS3BucketProps {
+    config: MonitoringConfig;
+}
+/**
+ * Creates Crossplane Bucket resources for Loki log storage.
+ *
+ * This construct generates:
+ * - S3 Bucket (via Crossplane Upbound provider-aws-s3)
+ * - BucketVersioning (for recovery of accidentally deleted logs)
+ * - BucketLifecycleConfiguration (90-day retention)
+ *
+ * Prerequisites:
+ * - Crossplane operator installed
+ * - Upbound provider-aws-s3 installed
+ * - ProviderConfig 'hetzner-s3' configured (points to Hetzner S3)
+ * - Hetzner S3 credentials secret exists in crossplane-system
+ *
+ * Sync Wave: 1 (external dependencies - must exist before pods access S3)
+ */
+export declare class LokiS3BucketConstruct extends Construct {
+    constructor(scope: Construct, id: string, props: LokiS3BucketProps);
+}

package/lib/constructs/loki-s3-bucket.js

@@ -0,0 +1,147 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LokiS3BucketConstruct = void 0;
+const cdk8s_1 = require("cdk8s");
+const constructs_1 = require("constructs");
+const s3_aws_upbound_io_1 = require("../imports/s3.aws.upbound.io");
+/**
+ * Creates Crossplane Bucket resources for Loki log storage.
+ *
+ * This construct generates:
+ * - S3 Bucket (via Crossplane Upbound provider-aws-s3)
+ * - BucketVersioning (for recovery of accidentally deleted logs)
+ * - BucketLifecycleConfiguration (90-day retention)
+ *
+ * Prerequisites:
+ * - Crossplane operator installed
+ * - Upbound provider-aws-s3 installed
+ * - ProviderConfig 'hetzner-s3' configured (points to Hetzner S3)
+ * - Hetzner S3 credentials secret exists in crossplane-system
+ *
+ * Sync Wave: 1 (external dependencies - must exist before pods access S3)
+ */
+class LokiS3BucketConstruct extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const { config } = props;
+        const bucketName = config.s3.buckets.loki;
+        const region = config.s3.region;
+        // Create Bucket
+        // Wave 1: External Dependencies - S3 bucket provisioned by Crossplane
+        // Note: Using ApiObject because cdk8s import limitations prevent importing Bucket type
+        new cdk8s_1.ApiObject(this, 'bucket', {
+            apiVersion: 's3.aws.upbound.io/v1beta2',
+            kind: 'Bucket',
+            metadata: {
+                name: bucketName,
+                namespace: 'crossplane-system',
+                labels: {
+                    'app.kubernetes.io/name': 'loki',
+                    'app.kubernetes.io/component': 'storage',
+                    'app.kubernetes.io/managed-by': 'cdk8s',
+                    'app.kubernetes.io/part-of': 'monitoring',
+                },
+                annotations: {
+                    'argocd.argoproj.io/sync-wave': '1',
+                    'crossplane.io/external-name': bucketName,
+                    'description': 'Loki log storage (90-day retention)',
+                },
+            },
+            spec: {
+                deletionPolicy: 'Delete',
+                managementPolicies: [
+                    'Observe',
+                    'Create',
+                    'Delete',
+                    // Skip Update to avoid tagging operations (not supported by Hetzner S3)
+                ],
+                forProvider: {
+                    region: region, // Production region (endpoint determines actual location)
+                },
+                providerConfigRef: {
+                    name: 'hetzner-s3',
+                },
+            },
+        });
+        // Create BucketVersioning
+        // Enable versioning for recovery of accidentally deleted logs
+        // Note: Using ApiObject because cdk8s import limitations prevent importing BucketVersioning type
+        new cdk8s_1.ApiObject(this, 'versioning', {
+            apiVersion: 's3.aws.upbound.io/v1beta2',
+            kind: 'BucketVersioning',
+            metadata: {
+                name: 'loki-logs-versioning',
+                namespace: 'crossplane-system',
+                labels: {
+                    'app.kubernetes.io/name': 'loki',
+                    'app.kubernetes.io/component': 'storage',
+                    'app.kubernetes.io/managed-by': 'cdk8s',
+                    'app.kubernetes.io/part-of': 'monitoring',
+                },
+                annotations: {
+                    'argocd.argoproj.io/sync-wave': '1',
+                },
+            },
+            spec: {
+                forProvider: {
+                    region: region, // Production region (same as bucket)
+                    bucketRef: {
+                        name: bucketName,
+                    },
+                    versioningConfiguration: {
+                        status: 'Enabled',
+                    },
+                },
+                providerConfigRef: {
+                    name: 'hetzner-s3',
+                },
+            },
+        });
+        // Create BucketLifecycleConfiguration
+        // Lifecycle policy: automatically delete logs older than 90 days
+        new s3_aws_upbound_io_1.BucketLifecycleConfiguration(this, 'lifecycle', {
+            metadata: {
+                name: 'loki-logs-lifecycle',
+                namespace: 'crossplane-system',
+                labels: {
+                    'app.kubernetes.io/name': 'loki',
+                    'app.kubernetes.io/component': 'storage',
+                    'app.kubernetes.io/managed-by': 'cdk8s',
+                    'app.kubernetes.io/part-of': 'monitoring',
+                },
+                annotations: {
+                    'argocd.argoproj.io/sync-wave': '1',
+                },
+            },
+            spec: {
+                managementPolicies: [
+                    s3_aws_upbound_io_1.BucketLifecycleConfigurationSpecManagementPolicies.OBSERVE,
+                    s3_aws_upbound_io_1.BucketLifecycleConfigurationSpecManagementPolicies.CREATE,
+                    s3_aws_upbound_io_1.BucketLifecycleConfigurationSpecManagementPolicies.DELETE,
+                ],
+                forProvider: {
+                    region: region, // Production region (same as bucket)
+                    bucketRef: {
+                        name: bucketName,
+                    },
+                    rule: [
+                        {
+                            id: 'delete-old-logs',
+                            status: 'Enabled',
+                            expiration: [
+                                {
+                                    days: 90, // 90-day retention (matches 31d Loki retention + buffer)
+                                },
+                            ],
+                        },
+                    ],
+                },
+                providerConfigRef: {
+                    name: 'hetzner-s3',
+                },
+            },
+        });
+    }
+}
+exports.LokiS3BucketConstruct = LokiS3BucketConstruct;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibG9raS1zMy1idWNrZXQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY29uc3RydWN0cy9sb2tpLXMzLWJ1Y2tldC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxpQ0FBa0M7QUFDbEMsMkNBQXVDO0FBQ3ZDLG9FQUFnSTtBQU9oSTs7Ozs7Ozs7Ozs7Ozs7O0dBZUc7QUFDSCxNQUFhLHFCQUFzQixTQUFRLHNCQUFTO0lBQ2xELFlBQVksS0FBZ0IsRUFBRSxFQUFVLEVBQUUsS0FBd0I7UUFDaEUsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztRQUVqQixNQUFNLEVBQUUsTUFBTSxFQUFFLEdBQUcsS0FBSyxDQUFDO1FBQ3pCLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxFQUFFLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQztRQUMxQyxNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsRUFBRSxDQUFDLE1BQU0sQ0FBQztRQUVoQyxnQkFBZ0I7UUFDaEIsc0VBQXNFO1FBQ3RFLHVGQUF1RjtRQUN2RixJQUFJLGlCQUFTLENBQUMsSUFBSSxFQUFFLFFBQVEsRUFBRTtZQUM1QixVQUFVLEVBQUUsMkJBQTJCO1lBQ3ZDLElBQUksRUFBRSxRQUFRO1lBQ2QsUUFBUSxFQUFFO2dCQUNSLElBQUksRUFBRSxVQUFVO2dCQUNoQixTQUFTLEVBQUUsbUJBQW1CO2dCQUM5QixNQUFNLEVBQUU7b0JBQ04sd0JBQXdCLEVBQUUsTUFBTTtvQkFDaEMsNkJBQTZCLEVBQUUsU0FBUztvQkFDeEMsOEJBQThCLEVBQUUsT0FBTztvQkFDdkMsMkJBQTJCLEVBQUUsWUFBWTtpQkFDMUM7Z0JBQ0QsV0FBVyxFQUFFO29CQUNYLDhCQUE4QixFQUFFLEdBQUc7b0JBQ25DLDZCQUE2QixFQUFFLFVBQVU7b0JBQ3pDLGFBQWEsRUFBRSxxQ0FBcUM7aUJBQ3JEO2FBQ0Y7WUFDRCxJQUFJLEVBQUU7Z0JBQ0osY0FBYyxFQUFFLFFBQVE7Z0JBQ3hCLGtCQUFrQixFQUFFO29CQUNsQixTQUFTO29CQUNULFFBQVE7b0JBQ1IsUUFBUTtvQkFDUix3RUFBd0U7aUJBQ3pFO2dCQUNELFdBQVcsRUFBRTtvQkFDWCxNQUFNLEVBQUUsTUFBTSxFQUFFLDBEQUEwRDtpQkFDM0U7Z0JBQ0QsaUJBQWlCLEVBQUU7b0JBQ2pCLElBQUksRUFBRSxZQUFZO2lCQUNuQjthQUNGO1NBQ0YsQ0FBQyxDQUFDO1FBRUgsMEJBQTBCO1FBQzFCLDhEQUE4RDtRQUM5RCxpR0FBaUc7UUFDakcsSUFBSSxpQkFBUyxDQUFDLElBQUksRUFBRSxZQUFZLEVBQUU7WUFDaEMsVUFBVSxFQUFFLDJCQUEyQjtZQUN2QyxJQUFJLEVBQUUsa0JBQWtCO1lBQ3hCLFFBQVEsRUFBRTtnQkFDUixJQUFJLEVBQUUsc0JBQXNCO2dCQUM1QixTQUFTLEVBQUUsbUJBQW1CO2dCQUM5QixNQUFNLEVBQUU7b0JBQ04sd0JBQXdCLEVBQUUsTUFBTTtvQkFDaEMsNkJBQTZCLEVBQUUsU0FBUztvQkFDeEMsOEJBQThCLEVBQUUsT0FBTztvQkFDdkMsMkJBQTJCLEVBQUUsWUFBWTtpQkFDMUM7Z0JBQ0QsV0FBVyxFQUFFO29CQUNYLDhCQUE4QixFQUFFLEdBQUc7aUJBQ3BDO2FBQ0Y7WUFDRCxJQUFJLEVBQUU7Z0JBQ0osV0FBVyxFQUFFO29CQUNYLE1BQU0sRUFBRSxNQUFNLEVBQUUscUNBQXFDO29CQUNyRCxTQUFTLEVBQUU7d0JBQ1QsSUFBSSxFQUFFLFVBQVU7cUJBQ2pCO29CQUNELHVCQUF1QixFQUFFO3dCQUN2QixNQUFNLEVBQUUsU0FBUztxQkFDbEI7aUJBQ0Y7Z0JBQ0QsaUJBQWlCLEVBQUU7b0JBQ2pCLElBQUksRUFBRSxZQUFZO2lCQUNuQjthQUNGO1NBQ0YsQ0FBQyxDQUFDO1FBRUgsc0NBQXNDO1FBQ3RDLGlFQUFpRTtRQUNqRSxJQUFJLGdEQUE0QixDQUFDLElBQUksRUFBRSxXQUFXLEVBQUU7WUFDbEQsUUFBUSxFQUFFO2dCQUNSLElBQUksRUFBRSxxQkFBcUI7Z0JBQzNCLFNBQVMsRUFBRSxtQkFBbUI7Z0JBQzlCLE1BQU0sRUFBRTtvQkFDTix3QkFBd0IsRUFBRSxNQUFNO29CQUNoQyw2QkFBNkIsRUFBRSxTQUFTO29CQUN4Qyw4QkFBOEIsRUFBRSxPQUFPO29CQUN2QywyQkFBMkIsRUFBRSxZQUFZO2lCQUMxQztnQkFDRCxXQUFXLEVBQUU7b0JBQ1gsOEJBQThCLEVBQUUsR0FBRztpQkFDcEM7YUFDRjtZQUNELElBQUksRUFBRTtnQkFDSixrQkFBa0IsRUFBRTtvQkFDbEIsc0VBQWtELENBQUMsT0FBTztvQkFDMUQsc0VBQWtELENBQUMsTUFBTTtvQkFDekQsc0VBQWtELENBQUMsTUFBTTtpQkFDMUQ7Z0JBQ0QsV0FBVyxFQUFFO29CQUNYLE1BQU0sRUFBRSxNQUFNLEVBQUUscUNBQXFDO29CQUNyRCxTQUFTLEVBQUU7d0JBQ1QsSUFBSSxFQUFFLFVBQVU7cUJBQ2pCO29CQUNELElBQUksRUFBRTt3QkFDSjs0QkFDRSxFQUFFLEVBQUUsaUJBQWlCOzRCQUNyQixNQUFNLEVBQUUsU0FBUzs0QkFDakIsVUFBVSxFQUFFO2dDQUNWO29DQUNFLElBQUksRUFBRSxFQUFFLEVBQUUseURBQXlEO2lDQUNwRTs2QkFDRjt5QkFDRjtxQkFDRjtpQkFDRjtnQkFDRCxpQkFBaUIsRUFBRTtvQkFDakIsSUFBSSxFQUFFLFlBQVk7aUJBQ25CO2FBQ0Y7U0FDRixDQUFDLENBQUM7SUFDTCxDQUFDO0NBQ0Y7QUE5SEQsc0RBOEhDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgQXBpT2JqZWN0IH0gZnJvbSAnY2RrOHMnO1xuaW1wb3J0IHsgQ29uc3RydWN0IH0gZnJvbSAnY29uc3RydWN0cyc7XG5pbXBvcnQgeyBCdWNrZXRMaWZlY3ljbGVDb25maWd1cmF0aW9uLCBCdWNrZXRMaWZlY3ljbGVDb25maWd1cmF0aW9uU3BlY01hbmFnZW1lbnRQb2xpY2llcyB9IGZyb20gJy4uL2ltcG9ydHMvczMuYXdzLnVwYm91bmQuaW8nO1xuaW1wb3J0IHsgTW9uaXRvcmluZ0NvbmZpZyB9IGZyb20gJy4uL3R5cGVzJztcblxuZXhwb3J0IGludGVyZmFjZSBMb2tpUzNCdWNrZXRQcm9wcyB7XG4gIGNvbmZpZzogTW9uaXRvcmluZ0NvbmZpZztcbn1cblxuLyoqXG4gKiBDcmVhdGVzIENyb3NzcGxhbmUgQnVja2V0IHJlc291cmNlcyBmb3IgTG9raSBsb2cgc3RvcmFnZS5cbiAqXG4gKiBUaGlzIGNvbnN0cnVjdCBnZW5lcmF0ZXM6XG4gKiAtIFMzIEJ1Y2tldCAodmlhIENyb3NzcGxhbmUgVXBib3VuZCBwcm92aWRlci1hd3MtczMpXG4gKiAtIEJ1Y2tldFZlcnNpb25pbmcgKGZvciByZWNvdmVyeSBvZiBhY2NpZGVudGFsbHkgZGVsZXRlZCBsb2dzKVxuICogLSBCdWNrZXRMaWZlY3ljbGVDb25maWd1cmF0aW9uICg5MC1kYXkgcmV0ZW50aW9uKVxuICpcbiAqIFByZXJlcXVpc2l0ZXM6XG4gKiAtIENyb3NzcGxhbmUgb3BlcmF0b3IgaW5zdGFsbGVkXG4gKiAtIFVwYm91bmQgcHJvdmlkZXItYXdzLXMzIGluc3RhbGxlZFxuICogLSBQcm92aWRlckNvbmZpZyAnaGV0em5lci1zMycgY29uZmlndXJlZCAocG9pbnRzIHRvIEhldHpuZXIgUzMpXG4gKiAtIEhldHpuZXIgUzMgY3JlZGVudGlhbHMgc2VjcmV0IGV4aXN0cyBpbiBjcm9zc3BsYW5lLXN5c3RlbVxuICpcbiAqIFN5bmMgV2F2ZTogMSAoZXh0ZXJuYWwgZGVwZW5kZW5jaWVzIC0gbXVzdCBleGlzdCBiZWZvcmUgcG9kcyBhY2Nlc3MgUzMpXG4gKi9cbmV4cG9ydCBjbGFzcyBMb2tpUzNCdWNrZXRDb25zdHJ1Y3QgZXh0ZW5kcyBDb25zdHJ1Y3Qge1xuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wczogTG9raVMzQnVja2V0UHJvcHMpIHtcbiAgICBzdXBlcihzY29wZSwgaWQpO1xuXG4gICAgY29uc3QgeyBjb25maWcgfSA9IHByb3BzO1xuICAgIGNvbnN0IGJ1Y2tldE5hbWUgPSBjb25maWcuczMuYnVja2V0cy5sb2tpO1xuICAgIGNvbnN0IHJlZ2lvbiA9IGNvbmZpZy5zMy5yZWdpb247XG5cbiAgICAvLyBDcmVhdGUgQnVja2V0XG4gICAgLy8gV2F2ZSAxOiBFeHRlcm5hbCBEZXBlbmRlbmNpZXMgLSBTMyBidWNrZXQgcHJvdmlzaW9uZWQgYnkgQ3Jvc3NwbGFuZVxuICAgIC8vIE5vdGU6IFVzaW5nIEFwaU9iamVjdCBiZWNhdXNlIGNkazhzIGltcG9ydCBsaW1pdGF0aW9ucyBwcmV2ZW50IGltcG9ydGluZyBCdWNrZXQgdHlwZVxuICAgIG5ldyBBcGlPYmplY3QodGhpcywgJ2J1Y2tldCcsIHtcbiAgICAgIGFwaVZlcnNpb246ICdzMy5hd3MudXBib3VuZC5pby92MWJldGEyJyxcbiAgICAgIGtpbmQ6ICdCdWNrZXQnLFxuICAgICAgbWV0YWRhdGE6IHtcbiAgICAgICAgbmFtZTogYnVja2V0TmFtZSxcbiAgICAgICAgbmFtZXNwYWNlOiAnY3Jvc3NwbGFuZS1zeXN0ZW0nLFxuICAgICAgICBsYWJlbHM6IHtcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbmFtZSc6ICdsb2tpJyxcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vY29tcG9uZW50JzogJ3N0b3JhZ2UnLFxuICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9tYW5hZ2VkLWJ5JzogJ2NkazhzJyxcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZic6ICdtb25pdG9yaW5nJyxcbiAgICAgICAgfSxcbiAgICAgICAgYW5ub3RhdGlvbnM6IHtcbiAgICAgICAgICAnYXJnb2NkLmFyZ29wcm9qLmlvL3N5bmMtd2F2ZSc6ICcxJyxcbiAgICAgICAgICAnY3Jvc3NwbGFuZS5pby9leHRlcm5hbC1uYW1lJzogYnVja2V0TmFtZSxcbiAgICAgICAgICAnZGVzY3JpcHRpb24nOiAnTG9raSBsb2cgc3RvcmFnZSAoOTAtZGF5IHJldGVudGlvbiknLFxuICAgICAgICB9LFxuICAgICAgfSxcbiAgICAgIHNwZWM6IHtcbiAgICAgICAgZGVsZXRpb25Qb2xpY3k6ICdEZWxldGUnLFxuICAgICAgICBtYW5hZ2VtZW50UG9saWNpZXM6IFtcbiAgICAgICAgICAnT2JzZXJ2ZScsXG4gICAgICAgICAgJ0NyZWF0ZScsXG4gICAgICAgICAgJ0RlbGV0ZScsXG4gICAgICAgICAgLy8gU2tpcCBVcGRhdGUgdG8gYXZvaWQgdGFnZ2luZyBvcGVyYXRpb25zIChub3Qgc3VwcG9ydGVkIGJ5IEhldHpuZXIgUzMpXG4gICAgICAgIF0sXG4gICAgICAgIGZvclByb3ZpZGVyOiB7XG4gICAgICAgICAgcmVnaW9uOiByZWdpb24sIC8vIFByb2R1Y3Rpb24gcmVnaW9uIChlbmRwb2ludCBkZXRlcm1pbmVzIGFjdHVhbCBsb2NhdGlvbilcbiAgICAgICAgfSxcbiAgICAgICAgcHJvdmlkZXJDb25maWdSZWY6IHtcbiAgICAgICAgICBuYW1lOiAnaGV0em5lci1zMycsXG4gICAgICAgIH0sXG4gICAgICB9LFxuICAgIH0pO1xuXG4gICAgLy8gQ3JlYXRlIEJ1Y2tldFZlcnNpb25pbmdcbiAgICAvLyBFbmFibGUgdmVyc2lvbmluZyBmb3IgcmVjb3Zlcnkgb2YgYWNjaWRlbnRhbGx5IGRlbGV0ZWQgbG9nc1xuICAgIC8vIE5vdGU6IFVzaW5nIEFwaU9iamVjdCBiZWNhdXNlIGNkazhzIGltcG9ydCBsaW1pdGF0aW9ucyBwcmV2ZW50IGltcG9ydGluZyBCdWNrZXRWZXJzaW9uaW5nIHR5cGVcbiAgICBuZXcgQXBpT2JqZWN0KHRoaXMsICd2ZXJzaW9uaW5nJywge1xuICAgICAgYXBpVmVyc2lvbjogJ3MzLmF3cy51cGJvdW5kLmlvL3YxYmV0YTInLFxuICAgICAga2luZDogJ0J1Y2tldFZlcnNpb25pbmcnLFxuICAgICAgbWV0YWRhdGE6IHtcbiAgICAgICAgbmFtZTogJ2xva2ktbG9ncy12ZXJzaW9uaW5nJyxcbiAgICAgICAgbmFtZXNwYWNlOiAnY3Jvc3NwbGFuZS1zeXN0ZW0nLFxuICAgICAgICBsYWJlbHM6IHtcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbmFtZSc6ICdsb2tpJyxcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vY29tcG9uZW50JzogJ3N0b3JhZ2UnLFxuICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9tYW5hZ2VkLWJ5JzogJ2NkazhzJyxcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZic6ICdtb25pdG9yaW5nJyxcbiAgICAgICAgfSxcbiAgICAgICAgYW5ub3RhdGlvbnM6IHtcbiAgICAgICAgICAnYXJnb2NkLmFyZ29wcm9qLmlvL3N5bmMtd2F2ZSc6ICcxJyxcbiAgICAgICAgfSxcbiAgICAgIH0sXG4gICAgICBzcGVjOiB7XG4gICAgICAgIGZvclByb3ZpZGVyOiB7XG4gICAgICAgICAgcmVnaW9uOiByZWdpb24sIC8vIFByb2R1Y3Rpb24gcmVnaW9uIChzYW1lIGFzIGJ1Y2tldClcbiAgICAgICAgICBidWNrZXRSZWY6IHtcbiAgICAgICAgICAgIG5hbWU6IGJ1Y2tldE5hbWUsXG4gICAgICAgICAgfSxcbiAgICAgICAgICB2ZXJzaW9uaW5nQ29uZmlndXJhdGlvbjoge1xuICAgICAgICAgICAgc3RhdHVzOiAnRW5hYmxlZCcsXG4gICAgICAgICAgfSxcbiAgICAgICAgfSxcbiAgICAgICAgcHJvdmlkZXJDb25maWdSZWY6IHtcbiAgICAgICAgICBuYW1lOiAnaGV0em5lci1zMycsXG4gICAgICAgIH0sXG4gICAgICB9LFxuICAgIH0pO1xuXG4gICAgLy8gQ3JlYXRlIEJ1Y2tldExpZmVjeWNsZUNvbmZpZ3VyYXRpb25cbiAgICAvLyBMaWZlY3ljbGUgcG9saWN5OiBhdXRvbWF0aWNhbGx5IGRlbGV0ZSBsb2dzIG9sZGVyIHRoYW4gOTAgZGF5c1xuICAgIG5ldyBCdWNrZXRMaWZlY3ljbGVDb25maWd1cmF0aW9uKHRoaXMsICdsaWZlY3ljbGUnLCB7XG4gICAgICBtZXRhZGF0YToge1xuICAgICAgICBuYW1lOiAnbG9raS1sb2dzLWxpZmVjeWNsZScsXG4gICAgICAgIG5hbWVzcGFjZTogJ2Nyb3NzcGxhbmUtc3lzdGVtJyxcbiAgICAgICAgbGFiZWxzOiB7XG4gICAgICAgICAgJ2FwcC5rdWJlcm5ldGVzLmlvL25hbWUnOiAnbG9raScsXG4gICAgICAgICAgJ2FwcC5rdWJlcm5ldGVzLmlvL2NvbXBvbmVudCc6ICdzdG9yYWdlJyxcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbWFuYWdlZC1ieSc6ICdjZGs4cycsXG4gICAgICAgICAgJ2FwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2YnOiAnbW9uaXRvcmluZycsXG4gICAgICAgIH0sXG4gICAgICAgIGFubm90YXRpb25zOiB7XG4gICAgICAgICAgJ2FyZ29jZC5hcmdvcHJvai5pby9zeW5jLXdhdmUnOiAnMScsXG4gICAgICAgIH0sXG4gICAgICB9LFxuICAgICAgc3BlYzoge1xuICAgICAgICBtYW5hZ2VtZW50UG9saWNpZXM6IFtcbiAgICAgICAgICBCdWNrZXRMaWZlY3ljbGVDb25maWd1cmF0aW9uU3BlY01hbmFnZW1lbnRQb2xpY2llcy5PQlNFUlZFLFxuICAgICAgICAgIEJ1Y2tldExpZmVjeWNsZUNvbmZpZ3VyYXRpb25TcGVjTWFuYWdlbWVudFBvbGljaWVzLkNSRUFURSxcbiAgICAgICAgICBCdWNrZXRMaWZlY3ljbGVDb25maWd1cmF0aW9uU3BlY01hbmFnZW1lbnRQb2xpY2llcy5ERUxFVEUsXG4gICAgICAgIF0sXG4gICAgICAgIGZvclByb3ZpZGVyOiB7XG4gICAgICAgICAgcmVnaW9uOiByZWdpb24sIC8vIFByb2R1Y3Rpb24gcmVnaW9uIChzYW1lIGFzIGJ1Y2tldClcbiAgICAgICAgICBidWNrZXRSZWY6IHtcbiAgICAgICAgICAgIG5hbWU6IGJ1Y2tldE5hbWUsXG4gICAgICAgICAgfSxcbiAgICAgICAgICBydWxlOiBbXG4gICAgICAgICAgICB7XG4gICAgICAgICAgICAgIGlkOiAnZGVsZXRlLW9sZC1sb2dzJyxcbiAgICAgICAgICAgICAgc3RhdHVzOiAnRW5hYmxlZCcsXG4gICAgICAgICAgICAgIGV4cGlyYXRpb246IFtcbiAgICAgICAgICAgICAgICB7XG4gICAgICAgICAgICAgICAgICBkYXlzOiA5MCwgLy8gOTAtZGF5IHJldGVudGlvbiAobWF0Y2hlcyAzMWQgTG9raSByZXRlbnRpb24gKyBidWZmZXIpXG4gICAgICAgICAgICAgICAgfSxcbiAgICAgICAgICAgICAgXSxcbiAgICAgICAgICAgIH0sXG4gICAgICAgICAgXSxcbiAgICAgICAgfSxcbiAgICAgICAgcHJvdmlkZXJDb25maWdSZWY6IHtcbiAgICAgICAgICBuYW1lOiAnaGV0em5lci1zMycsXG4gICAgICAgIH0sXG4gICAgICB9LFxuICAgIH0pO1xuICB9XG59XG4iXX0=

package/lib/constructs/loki-s3-credentials.d.ts

@@ -0,0 +1,27 @@
+import { Construct } from 'constructs';
+import { MonitoringConfig } from '../types';
+export interface LokiS3CredentialsProps {
+    namespace: string;
+    config: MonitoringConfig;
+}
+/**
+ * Creates ExternalSecret for Loki S3 credentials.
+ *
+ * This construct replicates Hetzner S3 credentials from crossplane-system
+ * namespace to monitoring namespace for Loki's object storage.
+ *
+ * Prerequisites:
+ * - External Secrets Operator installed
+ * - ClusterSecretStore 'hetzner-s3-cluster-store' exists (points to crossplane-system)
+ * - Secret 'hetzner-s3-creds-standard' exists in crossplane-system namespace
+ *
+ * Generated Secret:
+ * - Name: loki-s3-credentials
+ * - Keys: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
+ *
+ * Sync Wave: 1 (external dependencies - must exist before Loki starts)
+ */
+export declare class LokiS3CredentialsConstruct extends Construct {
+    readonly secretName = "loki-s3-credentials";
+    constructor(scope: Construct, id: string, props: LokiS3CredentialsProps);
+}

package/lib/constructs/loki-s3-credentials.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LokiS3CredentialsConstruct = void 0;
+const constructs_1 = require("constructs");
+const external_secrets_io_1 = require("../imports/external-secrets.io");
+/**
+ * Creates ExternalSecret for Loki S3 credentials.
+ *
+ * This construct replicates Hetzner S3 credentials from crossplane-system
+ * namespace to monitoring namespace for Loki's object storage.
+ *
+ * Prerequisites:
+ * - External Secrets Operator installed
+ * - ClusterSecretStore 'hetzner-s3-cluster-store' exists (points to crossplane-system)
+ * - Secret 'hetzner-s3-creds-standard' exists in crossplane-system namespace
+ *
+ * Generated Secret:
+ * - Name: loki-s3-credentials
+ * - Keys: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
+ *
+ * Sync Wave: 1 (external dependencies - must exist before Loki starts)
+ */
+class LokiS3CredentialsConstruct extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.secretName = 'loki-s3-credentials';
+        const { namespace } = props;
+        // Create ExternalSecret that replicates S3 credentials
+        // Wave 1: External Dependencies - credentials must exist before Loki components
+        new external_secrets_io_1.ExternalSecret(this, 'loki-s3-external-secret', {
+            metadata: {
+                name: 'loki-s3-credentials-es',
+                namespace: namespace,
+                labels: {
+                    'app.kubernetes.io/name': 'loki',
+                    'app.kubernetes.io/component': 's3-credentials',
+                    'app.kubernetes.io/managed-by': 'cdk8s',
+                    'app.kubernetes.io/part-of': 'monitoring',
+                },
+                annotations: {
+                    'argocd.argoproj.io/sync-wave': '1',
+                },
+            },
+            spec: {
+                // Refresh credentials every hour (automatic rotation support)
+                // Use full format to match Kubernetes normalization and avoid ArgoCD drift
+                refreshInterval: '1h0m0s',
+                // Use existing ClusterSecretStore for Hetzner S3 (infrastructure-level secrets)
+                secretStoreRef: {
+                    name: 'hetzner-s3-cluster-store',
+                    kind: external_secrets_io_1.ExternalSecretSpecSecretStoreRefKind.CLUSTER_SECRET_STORE,
+                },
+                // Target secret that Loki will consume via extraEnvFrom
+                target: {
+                    name: this.secretName,
+                    creationPolicy: external_secrets_io_1.ExternalSecretSpecTargetCreationPolicy.OWNER,
+                },
+                // Fetch S3 credentials from crossplane-system/hetzner-s3-creds-standard
+                dataFrom: [
+                    {
+                        extract: {
+                            key: 'hetzner-s3-creds-standard',
+                        },
+                    },
+                ],
+            },
+        });
+    }
+}
+exports.LokiS3CredentialsConstruct = LokiS3CredentialsConstruct;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibG9raS1zMy1jcmVkZW50aWFscy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jb25zdHJ1Y3RzL2xva2ktczMtY3JlZGVudGlhbHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsMkNBQXVDO0FBQ3ZDLHdFQUl3QztBQVF4Qzs7Ozs7Ozs7Ozs7Ozs7OztHQWdCRztBQUNILE1BQWEsMEJBQTJCLFNBQVEsc0JBQVM7SUFHdkQsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUE2QjtRQUNyRSxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBSEgsZUFBVSxHQUFHLHFCQUFxQixDQUFDO1FBS2pELE1BQU0sRUFBRSxTQUFTLEVBQUUsR0FBRyxLQUFLLENBQUM7UUFFNUIsdURBQXVEO1FBQ3ZELGdGQUFnRjtRQUNoRixJQUFJLG9DQUFjLENBQUMsSUFBSSxFQUFFLHlCQUF5QixFQUFFO1lBQ2xELFFBQVEsRUFBRTtnQkFDUixJQUFJLEVBQUUsd0JBQXdCO2dCQUM5QixTQUFTLEVBQUUsU0FBUztnQkFDcEIsTUFBTSxFQUFFO29CQUNOLHdCQUF3QixFQUFFLE1BQU07b0JBQ2hDLDZCQUE2QixFQUFFLGdCQUFnQjtvQkFDL0MsOEJBQThCLEVBQUUsT0FBTztvQkFDdkMsMkJBQTJCLEVBQUUsWUFBWTtpQkFDMUM7Z0JBQ0QsV0FBVyxFQUFFO29CQUNYLDhCQUE4QixFQUFFLEdBQUc7aUJBQ3BDO2FBQ0Y7WUFDRCxJQUFJLEVBQUU7Z0JBQ0osOERBQThEO2dCQUM5RCwyRUFBMkU7Z0JBQzNFLGVBQWUsRUFBRSxRQUFRO2dCQUV6QixnRkFBZ0Y7Z0JBQ2hGLGNBQWMsRUFBRTtvQkFDZCxJQUFJLEVBQUUsMEJBQTBCO29CQUNoQyxJQUFJLEVBQUUsMERBQW9DLENBQUMsb0JBQW9CO2lCQUNoRTtnQkFFRCx3REFBd0Q7Z0JBQ3hELE1BQU0sRUFBRTtvQkFDTixJQUFJLEVBQUUsSUFBSSxDQUFDLFVBQVU7b0JBQ3JCLGNBQWMsRUFBRSw0REFBc0MsQ0FBQyxLQUFLO2lCQUM3RDtnQkFFRCx3RUFBd0U7Z0JBQ3hFLFFBQVEsRUFBRTtvQkFDUjt3QkFDRSxPQUFPLEVBQUU7NEJBQ1AsR0FBRyxFQUFFLDJCQUEyQjt5QkFDakM7cUJBQ0Y7aUJBQ0Y7YUFDRjtTQUNGLENBQUMsQ0FBQztJQUNMLENBQUM7Q0FDRjtBQXBERCxnRUFvREMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tICdjb25zdHJ1Y3RzJztcbmltcG9ydCB7XG4gIEV4dGVybmFsU2VjcmV0LFxuICBFeHRlcm5hbFNlY3JldFNwZWNUYXJnZXRDcmVhdGlvblBvbGljeSxcbiAgRXh0ZXJuYWxTZWNyZXRTcGVjU2VjcmV0U3RvcmVSZWZLaW5kLFxufSBmcm9tICcuLi9pbXBvcnRzL2V4dGVybmFsLXNlY3JldHMuaW8nO1xuaW1wb3J0IHsgTW9uaXRvcmluZ0NvbmZpZyB9IGZyb20gJy4uL3R5cGVzJztcblxuZXhwb3J0IGludGVyZmFjZSBMb2tpUzNDcmVkZW50aWFsc1Byb3BzIHtcbiAgbmFtZXNwYWNlOiBzdHJpbmc7XG4gIGNvbmZpZzogTW9uaXRvcmluZ0NvbmZpZztcbn1cblxuLyoqXG4gKiBDcmVhdGVzIEV4dGVybmFsU2VjcmV0IGZvciBMb2tpIFMzIGNyZWRlbnRpYWxzLlxuICpcbiAqIFRoaXMgY29uc3RydWN0IHJlcGxpY2F0ZXMgSGV0em5lciBTMyBjcmVkZW50aWFscyBmcm9tIGNyb3NzcGxhbmUtc3lzdGVtXG4gKiBuYW1lc3BhY2UgdG8gbW9uaXRvcmluZyBuYW1lc3BhY2UgZm9yIExva2kncyBvYmplY3Qgc3RvcmFnZS5cbiAqXG4gKiBQcmVyZXF1aXNpdGVzOlxuICogLSBFeHRlcm5hbCBTZWNyZXRzIE9wZXJhdG9yIGluc3RhbGxlZFxuICogLSBDbHVzdGVyU2VjcmV0U3RvcmUgJ2hldHpuZXItczMtY2x1c3Rlci1zdG9yZScgZXhpc3RzIChwb2ludHMgdG8gY3Jvc3NwbGFuZS1zeXN0ZW0pXG4gKiAtIFNlY3JldCAnaGV0em5lci1zMy1jcmVkcy1zdGFuZGFyZCcgZXhpc3RzIGluIGNyb3NzcGxhbmUtc3lzdGVtIG5hbWVzcGFjZVxuICpcbiAqIEdlbmVyYXRlZCBTZWNyZXQ6XG4gKiAtIE5hbWU6IGxva2ktczMtY3JlZGVudGlhbHNcbiAqIC0gS2V5czogQVdTX0FDQ0VTU19LRVlfSUQsIEFXU19TRUNSRVRfQUNDRVNTX0tFWVxuICpcbiAqIFN5bmMgV2F2ZTogMSAoZXh0ZXJuYWwgZGVwZW5kZW5jaWVzIC0gbXVzdCBleGlzdCBiZWZvcmUgTG9raSBzdGFydHMpXG4gKi9cbmV4cG9ydCBjbGFzcyBMb2tpUzNDcmVkZW50aWFsc0NvbnN0cnVjdCBleHRlbmRzIENvbnN0cnVjdCB7XG4gIHB1YmxpYyByZWFkb25seSBzZWNyZXROYW1lID0gJ2xva2ktczMtY3JlZGVudGlhbHMnO1xuXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBMb2tpUzNDcmVkZW50aWFsc1Byb3BzKSB7XG4gICAgc3VwZXIoc2NvcGUsIGlkKTtcblxuICAgIGNvbnN0IHsgbmFtZXNwYWNlIH0gPSBwcm9wcztcblxuICAgIC8vIENyZWF0ZSBFeHRlcm5hbFNlY3JldCB0aGF0IHJlcGxpY2F0ZXMgUzMgY3JlZGVudGlhbHNcbiAgICAvLyBXYXZlIDE6IEV4dGVybmFsIERlcGVuZGVuY2llcyAtIGNyZWRlbnRpYWxzIG11c3QgZXhpc3QgYmVmb3JlIExva2kgY29tcG9uZW50c1xuICAgIG5ldyBFeHRlcm5hbFNlY3JldCh0aGlzLCAnbG9raS1zMy1leHRlcm5hbC1zZWNyZXQnLCB7XG4gICAgICBtZXRhZGF0YToge1xuICAgICAgICBuYW1lOiAnbG9raS1zMy1jcmVkZW50aWFscy1lcycsXG4gICAgICAgIG5hbWVzcGFjZTogbmFtZXNwYWNlLFxuICAgICAgICBsYWJlbHM6IHtcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbmFtZSc6ICdsb2tpJyxcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vY29tcG9uZW50JzogJ3MzLWNyZWRlbnRpYWxzJyxcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbWFuYWdlZC1ieSc6ICdjZGs4cycsXG4gICAgICAgICAgJ2FwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2YnOiAnbW9uaXRvcmluZycsXG4gICAgICAgIH0sXG4gICAgICAgIGFubm90YXRpb25zOiB7XG4gICAgICAgICAgJ2FyZ29jZC5hcmdvcHJvai5pby9zeW5jLXdhdmUnOiAnMScsXG4gICAgICAgIH0sXG4gICAgICB9LFxuICAgICAgc3BlYzoge1xuICAgICAgICAvLyBSZWZyZXNoIGNyZWRlbnRpYWxzIGV2ZXJ5IGhvdXIgKGF1dG9tYXRpYyByb3RhdGlvbiBzdXBwb3J0KVxuICAgICAgICAvLyBVc2UgZnVsbCBmb3JtYXQgdG8gbWF0Y2ggS3ViZXJuZXRlcyBub3JtYWxpemF0aW9uIGFuZCBhdm9pZCBBcmdvQ0QgZHJpZnRcbiAgICAgICAgcmVmcmVzaEludGVydmFsOiAnMWgwbTBzJyxcblxuICAgICAgICAvLyBVc2UgZXhpc3RpbmcgQ2x1c3RlclNlY3JldFN0b3JlIGZvciBIZXR6bmVyIFMzIChpbmZyYXN0cnVjdHVyZS1sZXZlbCBzZWNyZXRzKVxuICAgICAgICBzZWNyZXRTdG9yZVJlZjoge1xuICAgICAgICAgIG5hbWU6ICdoZXR6bmVyLXMzLWNsdXN0ZXItc3RvcmUnLFxuICAgICAgICAgIGtpbmQ6IEV4dGVybmFsU2VjcmV0U3BlY1NlY3JldFN0b3JlUmVmS2luZC5DTFVTVEVSX1NFQ1JFVF9TVE9SRSxcbiAgICAgICAgfSxcblxuICAgICAgICAvLyBUYXJnZXQgc2VjcmV0IHRoYXQgTG9raSB3aWxsIGNvbnN1bWUgdmlhIGV4dHJhRW52RnJvbVxuICAgICAgICB0YXJnZXQ6IHtcbiAgICAgICAgICBuYW1lOiB0aGlzLnNlY3JldE5hbWUsXG4gICAgICAgICAgY3JlYXRpb25Qb2xpY3k6IEV4dGVybmFsU2VjcmV0U3BlY1RhcmdldENyZWF0aW9uUG9saWN5Lk9XTkVSLFxuICAgICAgICB9LFxuXG4gICAgICAgIC8vIEZldGNoIFMzIGNyZWRlbnRpYWxzIGZyb20gY3Jvc3NwbGFuZS1zeXN0ZW0vaGV0em5lci1zMy1jcmVkcy1zdGFuZGFyZFxuICAgICAgICBkYXRhRnJvbTogW1xuICAgICAgICAgIHtcbiAgICAgICAgICAgIGV4dHJhY3Q6IHtcbiAgICAgICAgICAgICAga2V5OiAnaGV0em5lci1zMy1jcmVkcy1zdGFuZGFyZCcsXG4gICAgICAgICAgICB9LFxuICAgICAgICAgIH0sXG4gICAgICAgIF0sXG4gICAgICB9LFxuICAgIH0pO1xuICB9XG59XG4iXX0=

package/lib/constructs/loki.d.ts

@@ -0,0 +1,30 @@
+import { Construct } from 'constructs';
+import { MonitoringConfig } from '../types';
+export interface LokiProps {
+    namespace: string;
+    config: MonitoringConfig;
+    s3CredentialsSecretName: string;
+}
+/**
+ * Creates Loki HelmChart for log aggregation.
+ *
+ * This construct deploys Loki in SimpleScalable mode with:
+ * - Backend (2 replicas) - Index and compaction
+ * - Read (2 replicas) - Query processing
+ * - Write (2 replicas) - Log ingestion
+ * - Gateway (1 replica) - HTTP API endpoint
+ * - S3 storage backend (Hetzner Object Storage)
+ *
+ * Prerequisites:
+ * - Namespace exists
+ * - PriorityClass 'high-priority' exists
+ * - Longhorn storage class available
+ * - S3 bucket exists (via Crossplane)
+ * - S3 credentials secret exists (via LokiS3CredentialsConstruct)
+ *
+ * Sync Wave: 2 (core services - after S3 credentials secret)
+ */
+export declare class LokiConstruct extends Construct {
+    constructor(scope: Construct, id: string, props: LokiProps);
+    private generateHelmValues;
+}