Skip to content

Commit d9db88f

Browse files
pavolloffaypavolloffay
authored
Add support for query RBAC (#1100)
* Add support for query RBAC Signed-off-by: Pavol Loffay <[email protected]> * Add webhook validation Signed-off-by: Pavol Loffay <[email protected]> * Update gateway Signed-off-by: Pavol Loffay <[email protected]> * Fix Signed-off-by: Pavol Loffay <[email protected]> --------- Signed-off-by: Pavol Loffay <[email protected]>
1 parent 7271d40 commit d9db88f

24 files changed

+311
-13
lines changed

‎.chloggen/query-rbac.yaml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
2+
change_type: enhancement
3+
4+
# The name of the component, or a single word describing the area of concern, (e.g. tempostack, tempomonolithic, github action)
5+
component: tempostack
6+
7+
# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
8+
note: Add support for query RBAC when Gateway/multitenancy is used.
9+
10+
# One or more tracking issues related to the change
11+
issues: [1100]
12+
13+
# (Optional) One or more lines of additional information to render under the primary note.
14+
# These lines will be padded with 2 spaces and then inserted directly into the document.
15+
# Use pipe (|) for multiline entries.
16+
subtext: |
17+
This feature allows users to apply query RBAC in the multitenancy mode.
18+
The RBAC allows filtering span/resource/scope attributes and events based on the namespaces which a user querying the data can access.
19+
For instance, a user can only see attributes from namespaces it can access.
20+
21+
```yaml
22+
spec:
23+
template:
24+
gateway:
25+
enabled: true
26+
rbac:
27+
enabled: true
28+
```

‎Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ OPERATOR_VERSION ?= 0.14.2
33
TEMPO_VERSION ?= 2.7.0
44
JAEGER_QUERY_VERSION ?= 1.62.0
55
TEMPO_QUERY_VERSION ?= 2.7.0
6-
TEMPO_GATEWAY_VERSION ?= main-2024-11-05-28e4c83
6+
TEMPO_GATEWAY_VERSION ?= main-2025-02-12-0636771
77
TEMPO_GATEWAY_OPA_VERSION ?= main-2024-10-09-7237863
88
OAUTH_PROXY_VERSION=4.14
99

‎api/tempo/v1alpha1/tempostack_types.go

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -589,8 +589,25 @@ type TempoGatewaySpec struct {
589589
//
590590
// +optional
591591
// +kubebuilder:validation:Optional
592-
// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Jaeger gateway Ingress Settings"
592+
// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Gateway Ingress Settings"
593593
Ingress IngressSpec `json:"ingress,omitempty"`
594+
595+
// RBAC defines RBAC options.
596+
//
597+
// +optional
598+
// +kubebuilder:validation:Optional
599+
// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Query RBAC Settings"
600+
RBAC RBACSpec `json:"rbac,omitempty"`
601+
}
602+
603+
// RBACSpec defines RBAC options.
604+
type RBACSpec struct {
605+
// Enabled defines if the query RBAC should be enabled.
606+
//
607+
// +optional
608+
// +kubebuilder:validation:Optional
609+
// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Query RBAC Enabled"
610+
Enabled bool `json:"enabled"`
594611
}
595612

596613
// TempoQueryFrontendSpec extends TempoComponentSpec with frontend specific parameters.

‎api/tempo/v1alpha1/zz_generated.deepcopy.go

Lines changed: 16 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎bundle/community/manifests/tempo-operator.clusterserviceversion.yaml

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ metadata:
7474
capabilities: Deep Insights
7575
categories: Logging & Tracing,Monitoring
7676
containerImage: ghcr.io/grafana/tempo-operator/tempo-operator:v0.14.2
77-
createdAt: "2025-02-05T16:29:10Z"
77+
createdAt: "2025-02-14T12:37:26Z"
7878
description: Create and manage deployments of Tempo, a high-scale distributed
7979
tracing backend.
8080
operatorframework.io/cluster-monitoring: "true"
@@ -967,7 +967,7 @@ spec:
967967
x-descriptors:
968968
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
969969
- description: Ingress defines gateway Ingress options.
970-
displayName: Jaeger gateway Ingress Settings
970+
displayName: Gateway Ingress Settings
971971
path: template.gateway.ingress
972972
- description: Annotations defines the annotations of the Ingress object.
973973
displayName: Annotations
@@ -995,6 +995,12 @@ spec:
995995
all pods of this component.
996996
displayName: PodSecurityContext
997997
path: template.gateway.podSecurityContext
998+
- description: RBAC defines RBAC options.
999+
displayName: Query RBAC Settings
1000+
path: template.gateway.rbac
1001+
- description: Enabled defines if the query RBAC should be enabled.
1002+
displayName: Query RBAC Enabled
1003+
path: template.gateway.rbac.enabled
9981004
- description: Replicas defines the number of replicas to be created for this
9991005
component.
10001006
displayName: Component Replicas
@@ -1508,7 +1514,7 @@ spec:
15081514
- name: RELATED_IMAGE_TEMPO_QUERY
15091515
value: docker.io/grafana/tempo-query:2.7.0
15101516
- name: RELATED_IMAGE_TEMPO_GATEWAY
1511-
value: quay.io/observatorium/api:main-2024-11-05-28e4c83
1517+
value: quay.io/observatorium/api:main-2025-02-12-0636771
15121518
- name: RELATED_IMAGE_TEMPO_GATEWAY_OPA
15131519
value: quay.io/observatorium/opa-openshift:main-2024-10-09-7237863
15141520
- name: RELATED_IMAGE_OAUTH_PROXY
@@ -1637,7 +1643,7 @@ spec:
16371643
name: jaeger-query
16381644
- image: docker.io/grafana/tempo-query:2.7.0
16391645
name: tempo-query
1640-
- image: quay.io/observatorium/api:main-2024-11-05-28e4c83
1646+
- image: quay.io/observatorium/api:main-2025-02-12-0636771
16411647
name: tempo-gateway
16421648
- image: quay.io/observatorium/opa-openshift:main-2024-10-09-7237863
16431649
name: tempo-gateway-opa

‎bundle/community/manifests/tempo.grafana.com_tempostacks.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1434,6 +1434,14 @@ spec:
14341434
- ""
14351435
type: string
14361436
type: object
1437+
rbac:
1438+
description: RBAC defines RBAC options.
1439+
properties:
1440+
enabled:
1441+
description: Enabled defines if the query RBAC should
1442+
be enabled.
1443+
type: boolean
1444+
type: object
14371445
required:
14381446
- enabled
14391447
type: object

‎bundle/openshift/manifests/tempo-operator.clusterserviceversion.yaml

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ metadata:
7474
capabilities: Deep Insights
7575
categories: Logging & Tracing,Monitoring
7676
containerImage: ghcr.io/grafana/tempo-operator/tempo-operator:v0.14.2
77-
createdAt: "2025-02-05T16:29:09Z"
77+
createdAt: "2025-02-14T12:37:25Z"
7878
description: Create and manage deployments of Tempo, a high-scale distributed
7979
tracing backend.
8080
operatorframework.io/cluster-monitoring: "true"
@@ -967,7 +967,7 @@ spec:
967967
x-descriptors:
968968
- urn:alm:descriptor:com.tectonic.ui:booleanSwitch
969969
- description: Ingress defines gateway Ingress options.
970-
displayName: Jaeger gateway Ingress Settings
970+
displayName: Gateway Ingress Settings
971971
path: template.gateway.ingress
972972
- description: Annotations defines the annotations of the Ingress object.
973973
displayName: Annotations
@@ -995,6 +995,12 @@ spec:
995995
all pods of this component.
996996
displayName: PodSecurityContext
997997
path: template.gateway.podSecurityContext
998+
- description: RBAC defines RBAC options.
999+
displayName: Query RBAC Settings
1000+
path: template.gateway.rbac
1001+
- description: Enabled defines if the query RBAC should be enabled.
1002+
displayName: Query RBAC Enabled
1003+
path: template.gateway.rbac.enabled
9981004
- description: Replicas defines the number of replicas to be created for this
9991005
component.
10001006
displayName: Component Replicas
@@ -1520,7 +1526,7 @@ spec:
15201526
- name: RELATED_IMAGE_TEMPO_QUERY
15211527
value: docker.io/grafana/tempo-query:2.7.0
15221528
- name: RELATED_IMAGE_TEMPO_GATEWAY
1523-
value: quay.io/observatorium/api:main-2024-11-05-28e4c83
1529+
value: quay.io/observatorium/api:main-2025-02-12-0636771
15241530
- name: RELATED_IMAGE_TEMPO_GATEWAY_OPA
15251531
value: quay.io/observatorium/opa-openshift:main-2024-10-09-7237863
15261532
- name: RELATED_IMAGE_OAUTH_PROXY
@@ -1655,7 +1661,7 @@ spec:
16551661
name: jaeger-query
16561662
- image: docker.io/grafana/tempo-query:2.7.0
16571663
name: tempo-query
1658-
- image: quay.io/observatorium/api:main-2024-11-05-28e4c83
1664+
- image: quay.io/observatorium/api:main-2025-02-12-0636771
16591665
name: tempo-gateway
16601666
- image: quay.io/observatorium/opa-openshift:main-2024-10-09-7237863
16611667
name: tempo-gateway-opa

‎bundle/openshift/manifests/tempo.grafana.com_tempostacks.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1434,6 +1434,14 @@ spec:
14341434
- ""
14351435
type: string
14361436
type: object
1437+
rbac:
1438+
description: RBAC defines RBAC options.
1439+
properties:
1440+
enabled:
1441+
description: Enabled defines if the query RBAC should
1442+
be enabled.
1443+
type: boolean
1444+
type: object
14371445
required:
14381446
- enabled
14391447
type: object

‎config/crd/bases/tempo.grafana.com_tempostacks.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1430,6 +1430,14 @@ spec:
14301430
- ""
14311431
type: string
14321432
type: object
1433+
rbac:
1434+
description: RBAC defines RBAC options.
1435+
properties:
1436+
enabled:
1437+
description: Enabled defines if the query RBAC should
1438+
be enabled.
1439+
type: boolean
1440+
type: object
14331441
required:
14341442
- enabled
14351443
type: object

‎config/manager/manager.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ spec:
4646
- name: RELATED_IMAGE_TEMPO_QUERY
4747
value: docker.io/grafana/tempo-query:2.7.0
4848
- name: RELATED_IMAGE_TEMPO_GATEWAY
49-
value: quay.io/observatorium/api:main-2024-11-05-28e4c83
49+
value: quay.io/observatorium/api:main-2025-02-12-0636771
5050
- name: RELATED_IMAGE_TEMPO_GATEWAY_OPA
5151
value: quay.io/observatorium/opa-openshift:main-2024-10-09-7237863
5252
- name: RELATED_IMAGE_OAUTH_PROXY

0 commit comments

Comments
 (0)