diff --git a/fleet/s/dev/c/ruka/observability/fleet.yaml b/fleet/s/dev/c/ruka/observability/fleet.yaml
new file mode 100644
index 000000000..d9f884970
--- /dev/null
+++ b/fleet/s/dev/c/ruka/observability/fleet.yaml
@@ -0,0 +1,14 @@
+defaultNamespace: monitoring
+helmCharts:
+  - name: loki
+    repo: https://grafana.github.io/helm-charts
+    chart: loki
+    version: 5.8.4
+    valuesFiles:
+      - loki/values.yaml
+  - name: promtail
+    repo: https://grafana.github.io/helm-charts
+    chart: promtail
+    version: 6.11.1
+    valuesFiles:
+      - promtail/values.yaml
diff --git a/fleet/s/dev/c/ruka/observability/loki/values.yaml b/fleet/s/dev/c/ruka/observability/loki/values.yaml
new file mode 100644
index 000000000..91a08b6c9
--- /dev/null
+++ b/fleet/s/dev/c/ruka/observability/loki/values.yaml
@@ -0,0 +1,52 @@
+# loki/values.yaml
+config:
+  auth_enabled: false
+  server:
+    http_listen_port: 3100
+
+  storage_config:
+    aws:
+      s3: s3://s3.ruka.dev.lsst.org
+      endpoint: http://rook-ceph-rgw-lfa.rook-ceph.svc.cluster.local:80
+      region: us-east-1
+      access_key_id: ${ACCESS_KEY_ID}
+      secret_access_key: ${SECRET_ACCESS_KEY}
+      s3forcepathstyle: true
+      insecure: true
+    boltdb_shipper:
+      active_index_directory: /data/loki/index
+      shared_store: s3
+
+  schema_config:
+    configs:
+      - from: "2022-01-01"
+        store: boltdb-shipper
+        object_store: s3
+        schema: v11
+        index:
+          prefix: loki_index_
+          period: 168h
+
+  limits_config:
+    enforce_metric_name: false
+    reject_old_samples: true
+    reject_old_samples_max_age: 168h
+
+extraEnv:
+  - name: ACCESS_KEY_ID
+    valueFrom:
+      secretKeyRef:
+        name: rook-ceph-object-user-rook-ceph-loki
+        key: access_key_id
+  - name: SECRET_ACCESS_KEY
+    valueFrom:
+      secretKeyRef:
+        name: rook-ceph-object-user-rook-ceph-loki
+        key: secret_access_key
+
+persistence:
+  enabled: true
+  storageClassName: <your-storage-class>
+  accessModes:
+    - ReadWriteOnce
+  size: 10Gi
diff --git a/fleet/s/dev/c/ruka/observability/promtail/values.yaml b/fleet/s/dev/c/ruka/observability/promtail/values.yaml
new file mode 100644
index 000000000..b7f7ed580
--- /dev/null
+++ b/fleet/s/dev/c/ruka/observability/promtail/values.yaml
@@ -0,0 +1,34 @@
+# promtail/values.yaml
+config:
+  server:
+    http_listen_port: 9080
+    grpc_listen_port: 0  # Disable if not needed
+
+  positions:
+    filename: /run/promtail/positions.yaml
+  clients:
+    - url: http://loki.monitoring.svc.cluster.local:3100/loki/api/v1/push
+
+  scrape_configs:
+    - job_name: syslog
+      syslog:
+        listen_address:"0.0.0.0:1514"
+        label_structured_data: true
+        labels:
+          job:"syslog"
+      relabel_configs:
+        - source_labels: ["__syslog_message_hostname]
+          target_label:"host"
+
+extraPorts:
+  - name: syslog
+    containerPort: 1514
+    protocol: TCP
+
+service:
+  type: LoadBalancer
+  ports:
+    - name: syslog
+      port: 1514
+      targetPort: syslog
+      protocol: TCP