Skip to content

Commit 5edc23a

Browse files
pavolloffaypavolloffay
authored
Add support for query RBAC to tempomonolithic (#1131)
Signed-off-by: Pavol Loffay <p.loffay@gmail.com>
1 parent 27104b5 commit 5edc23a

22 files changed

+601
-11
lines changed

‎.chloggen/rbac-monolithic.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
2+
change_type: enhancement
3+
4+
# The name of the component, or a single word describing the area of concern, (e.g. tempostack, tempomonolithic, github action)
5+
component: tempomonolithic
6+
7+
# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
8+
note: Add support for query RBAC
9+
10+
# One or more tracking issues related to the change
11+
issues: [1131]
12+
13+
# (Optional) One or more lines of additional information to render under the primary note.
14+
# These lines will be padded with 2 spaces and then inserted directly into the document.
15+
# Use pipe (|) for multiline entries.
16+
subtext: |
17+
This feature allows users to apply query RBAC in the multitenancy mode.
18+
The RBAC allows filtering span/resource/scope attributes and events based on the namespaces which a user querying the data can access.
19+
For instance, a user can only see attributes from namespaces it can access.
20+
21+
```yaml
22+
spec:
23+
query:
24+
rbac:
25+
enabled: true
26+
```

‎api/tempo/v1alpha1/tempomonolithic_defaults.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,4 +102,7 @@ func (r *TempoMonolithic) Default(ctrlConfig configv1alpha1.ProjectConfig) {
102102
if r.Spec.Timeout.Duration == 0 {
103103
r.Spec.Timeout = defaultTimeout
104104
}
105+
if r.Spec.Query == nil {
106+
r.Spec.Query = &MonolithicQuerySpec{}
107+
}
105108
}

‎api/tempo/v1alpha1/tempomonolithic_defaults_test.go‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ func TestMonolithicDefault(t *testing.T) {
4949
},
5050
Management: "Managed",
5151
Timeout: metav1.Duration{Duration: time.Second * 30},
52+
Query: &MonolithicQuerySpec{},
5253
},
5354
},
5455
},
@@ -83,6 +84,7 @@ func TestMonolithicDefault(t *testing.T) {
8384
},
8485
Management: "Managed",
8586
Timeout: metav1.Duration{Duration: time.Second * 30},
87+
Query: &MonolithicQuerySpec{},
8688
},
8789
},
8890
},
@@ -109,6 +111,7 @@ func TestMonolithicDefault(t *testing.T) {
109111
},
110112
Management: "Unmanaged",
111113
Timeout: metav1.Duration{Duration: time.Second * 30},
114+
Query: &MonolithicQuerySpec{},
112115
},
113116
},
114117
expected: &TempoMonolithic{
@@ -131,6 +134,7 @@ func TestMonolithicDefault(t *testing.T) {
131134
},
132135
Management: "Unmanaged",
133136
Timeout: metav1.Duration{Duration: time.Second * 30},
137+
Query: &MonolithicQuerySpec{},
134138
},
135139
},
136140
},
@@ -203,6 +207,7 @@ func TestMonolithicDefault(t *testing.T) {
203207
},
204208
Management: "Managed",
205209
Timeout: metav1.Duration{Duration: time.Second * 30},
210+
Query: &MonolithicQuerySpec{},
206211
},
207212
},
208213
},
@@ -278,6 +283,7 @@ func TestMonolithicDefault(t *testing.T) {
278283
},
279284
Management: "Managed",
280285
Timeout: metav1.Duration{Duration: time.Second * 30},
286+
Query: &MonolithicQuerySpec{},
281287
},
282288
},
283289
},
@@ -345,6 +351,7 @@ func TestMonolithicDefault(t *testing.T) {
345351
},
346352
Management: "Managed",
347353
Timeout: metav1.Duration{Duration: time.Second * 30},
354+
Query: &MonolithicQuerySpec{},
348355
},
349356
},
350357
},
@@ -412,6 +419,7 @@ func TestMonolithicDefault(t *testing.T) {
412419
},
413420
Management: "Managed",
414421
Timeout: metav1.Duration{Duration: time.Second * 30},
422+
Query: &MonolithicQuerySpec{},
415423
},
416424
},
417425
},
@@ -478,6 +486,60 @@ func TestMonolithicDefault(t *testing.T) {
478486
},
479487
Management: "Managed",
480488
Timeout: metav1.Duration{Duration: time.Hour},
489+
Query: &MonolithicQuerySpec{},
490+
},
491+
},
492+
},
493+
{
494+
name: "query defined",
495+
input: &TempoMonolithic{
496+
ObjectMeta: v1.ObjectMeta{
497+
Name: "test",
498+
Namespace: "testns",
499+
},
500+
Spec: TempoMonolithicSpec{
501+
Storage: &MonolithicStorageSpec{
502+
Traces: MonolithicTracesStorageSpec{
503+
Backend: "memory",
504+
Size: &twoGBQuantity,
505+
},
506+
},
507+
Query: &MonolithicQuerySpec{
508+
RBAC: RBACSpec{
509+
Enabled: true,
510+
},
511+
},
512+
},
513+
},
514+
expected: &TempoMonolithic{
515+
ObjectMeta: v1.ObjectMeta{
516+
Name: "test",
517+
Namespace: "testns",
518+
},
519+
Spec: TempoMonolithicSpec{
520+
Ingestion: &MonolithicIngestionSpec{
521+
OTLP: &MonolithicIngestionOTLPSpec{
522+
GRPC: &MonolithicIngestionOTLPProtocolsGRPCSpec{
523+
Enabled: true,
524+
},
525+
HTTP: &MonolithicIngestionOTLPProtocolsHTTPSpec{
526+
Enabled: true,
527+
},
528+
},
529+
},
530+
Storage: &MonolithicStorageSpec{
531+
Traces: MonolithicTracesStorageSpec{
532+
Backend: "memory",
533+
Size: &twoGBQuantity,
534+
},
535+
},
536+
Management: "Managed",
537+
Timeout: metav1.Duration{Duration: time.Second * 30},
538+
Query: &MonolithicQuerySpec{
539+
RBAC: RBACSpec{
540+
Enabled: true,
541+
},
542+
},
481543
},
482544
},
483545
},

‎api/tempo/v1alpha1/tempomonolithic_types.go‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,9 +68,26 @@ type TempoMonolithicSpec struct {
6868
// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Extra Configuration",xDescriptors="urn:alm:descriptor:com.tectonic.ui:advanced"
6969
ExtraConfig *ExtraConfigSpec `json:"extraConfig,omitempty"`
7070

71+
// Query defines query configuration.
72+
//
73+
// +kubebuilder:validation:Optional
74+
// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Query Configuration",xDescriptors="urn:alm:descriptor:com.tectonic.ui:advanced"
75+
Query *MonolithicQuerySpec `json:"query,omitempty"`
76+
7177
MonolithicSchedulerSpec `json:",inline"`
7278
}
7379

80+
// MonolithicQuerySpec defines the query configuration.
81+
type MonolithicQuerySpec struct {
82+
// RBAC defines query RBAC options.
83+
// This option can be used only with multi-tenancy.
84+
//
85+
// +optional
86+
// +kubebuilder:validation:Optional
87+
// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Query RBAC Settings"
88+
RBAC RBACSpec `json:"rbac,omitempty"`
89+
}
90+
7491
// MonolithicStorageSpec defines the storage for the Tempo deployment.
7592
type MonolithicStorageSpec struct {
7693
// Traces defines the storage configuration for traces.

‎api/tempo/v1alpha1/tempostack_types.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -592,7 +592,7 @@ type TempoGatewaySpec struct {
592592
// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Gateway Ingress Settings"
593593
Ingress IngressSpec `json:"ingress,omitempty"`
594594

595-
// RBAC defines RBAC options.
595+
// RBAC defines query RBAC options.
596596
//
597597
// +optional
598598
// +kubebuilder:validation:Optional

‎api/tempo/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 21 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎bundle/community/manifests/tempo-operator.clusterserviceversion.yaml‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ metadata:
7474
capabilities: Deep Insights
7575
categories: Logging & Tracing,Monitoring
7676
containerImage: ghcr.io/grafana/tempo-operator/tempo-operator:v0.15.2
77-
createdAt: "2025-02-24T14:25:33Z"
77+
createdAt: "2025-02-25T15:15:23Z"
7878
description: Create and manage deployments of Tempo, a high-scale distributed
7979
tracing backend.
8080
operatorframework.io/cluster-monitoring: "true"
@@ -459,6 +459,19 @@ spec:
459459
- description: ServiceMonitors defines the ServiceMonitor configuration.
460460
displayName: Service Monitors
461461
path: observability.metrics.serviceMonitors
462+
- description: Query defines query configuration.
463+
displayName: Query Configuration
464+
path: query
465+
x-descriptors:
466+
- urn:alm:descriptor:com.tectonic.ui:advanced
467+
- description: |-
468+
RBAC defines query RBAC options.
469+
This option can be used only with multi-tenancy.
470+
displayName: Query RBAC Settings
471+
path: query.rbac
472+
- description: Enabled defines if the query RBAC should be enabled.
473+
displayName: Query RBAC Enabled
474+
path: query.rbac.enabled
462475
- description: ServiceAccount defines the Service Account to use for all Tempo
463476
components.
464477
displayName: Service Account
@@ -995,7 +1008,7 @@ spec:
9951008
all pods of this component.
9961009
displayName: PodSecurityContext
9971010
path: template.gateway.podSecurityContext
998-
- description: RBAC defines RBAC options.
1011+
- description: RBAC defines query RBAC options.
9991012
displayName: Query RBAC Settings
10001013
path: template.gateway.rbac
10011014
- description: Enabled defines if the query RBAC should be enabled.

‎bundle/community/manifests/tempo.grafana.com_tempomonolithics.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1531,6 +1531,19 @@ spec:
15311531
type: object
15321532
type: object
15331533
type: object
1534+
query:
1535+
description: Query defines query configuration.
1536+
properties:
1537+
rbac:
1538+
description: |-
1539+
RBAC defines query RBAC options.
1540+
This option can be used only with multi-tenancy.
1541+
properties:
1542+
enabled:
1543+
description: Enabled defines if the query RBAC should be enabled.
1544+
type: boolean
1545+
type: object
1546+
type: object
15341547
resources:
15351548
description: Resources defines the compute resource requirements of
15361549
the Tempo container.

‎bundle/community/manifests/tempo.grafana.com_tempostacks.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1435,7 +1435,7 @@ spec:
14351435
type: string
14361436
type: object
14371437
rbac:
1438-
description: RBAC defines RBAC options.
1438+
description: RBAC defines query RBAC options.
14391439
properties:
14401440
enabled:
14411441
description: Enabled defines if the query RBAC should

‎bundle/openshift/manifests/tempo-operator.clusterserviceversion.yaml‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ metadata:
7474
capabilities: Deep Insights
7575
categories: Logging & Tracing,Monitoring
7676
containerImage: ghcr.io/grafana/tempo-operator/tempo-operator:v0.15.2
77-
createdAt: "2025-02-24T14:25:31Z"
77+
createdAt: "2025-02-25T15:15:22Z"
7878
description: Create and manage deployments of Tempo, a high-scale distributed
7979
tracing backend.
8080
operatorframework.io/cluster-monitoring: "true"
@@ -459,6 +459,19 @@ spec:
459459
- description: ServiceMonitors defines the ServiceMonitor configuration.
460460
displayName: Service Monitors
461461
path: observability.metrics.serviceMonitors
462+
- description: Query defines query configuration.
463+
displayName: Query Configuration
464+
path: query
465+
x-descriptors:
466+
- urn:alm:descriptor:com.tectonic.ui:advanced
467+
- description: |-
468+
RBAC defines query RBAC options.
469+
This option can be used only with multi-tenancy.
470+
displayName: Query RBAC Settings
471+
path: query.rbac
472+
- description: Enabled defines if the query RBAC should be enabled.
473+
displayName: Query RBAC Enabled
474+
path: query.rbac.enabled
462475
- description: ServiceAccount defines the Service Account to use for all Tempo
463476
components.
464477
displayName: Service Account
@@ -995,7 +1008,7 @@ spec:
9951008
all pods of this component.
9961009
displayName: PodSecurityContext
9971010
path: template.gateway.podSecurityContext
998-
- description: RBAC defines RBAC options.
1011+
- description: RBAC defines query RBAC options.
9991012
displayName: Query RBAC Settings
10001013
path: template.gateway.rbac
10011014
- description: Enabled defines if the query RBAC should be enabled.

0 commit comments

Comments
 (0)