Release v0.14.1

🧰 Bug fixes 🧰

• tempostack: Fix enabling .spec.observability.tracing with multi-tenancy on OpenShift (#1081)
• tempostack, tempomonolithic: Register missing Jaeger UI routes (#1082)
  Without these routes, hitting refresh on the trace detail, system architecture or monitor page of Jaeger UI results in a 404 when multi-tenancy is enabled.

Components

• Tempo: v2.6.1

Release v0.14.0

🛑 Breaking changes 🛑

• tempostack: Use new default metrics namespace/prefix for span RED metrics in Jaeger query. (#1072)
  Use the new RED metrics default namespace traces.span.metrics for retrieval from Prometheus.
  Since OpenTelemetry Collector version 0.109.0 the default namespace is set to traces.span.metrics.
  The namespace taken into account by jaeger-query can be configured via a TempoStack CR entry.
  To achieve this the Operator will set the jaeger-query --prometheus.query.namespace= flag.
  Since Jaeger version 1.62, jaeger-query uses traces.span.metrics as default too.

  Example how to restore the default namespace used prior to version 0.109.0, by configuring an empty value for redMetricsNamespace in the TempoStack CR:

  apiVersion: tempo.grafana.com/v1alpha1
  kind: TempoStack
  ...
  spec:
    template:
      queryFrontend:
        jaegerQuery:
          enabled: true
          monitorTab:
            enabled: true
            prometheusEndpoint: "http://myPromInstance:9090"
            redMetricsNamespace: ""
  

  More details can be found here:

  • jaegertracing/jaeger#6007
  • open-telemetry/opentelemetry-collector-contrib#34485

• tempostack, tempomonolithic: Add unified timeout configuration. It changes the default to 30s. (#1045)
  Adding spec.timeout CRD option to configure timeout on all components and default it to 30s.
  Before Tempo server was defaulting to 3m, gateway to 2m, OpenShift route to 30s (for query), oauth-proxy to 30s (for query).

🚀 New components 🚀

• must-gather: Add must-gather to collect information about the components deployed by the operator in a cluster. (#1033)

💡 Enhancements 💡

• tempostack: Expose a way to set a PodSecurityContext on each component (#996)

• tempostack, tempomonolithic: bump jaeger to v1.62 (#1050)

• tempostack: Bump jaeger to v1.60 by replacing the tempo-query gRPC storage plugin due to the deprecation in Jaeger 1.58.0 with a gRPC standalone service. (#1025)

• operator: Kubernetes 1.30 enablement (#1030)

• tempostack, tempomonolithic: Make re-encrypt route the default TLS termination to allow access outside the cluster. (#1027)

• tempostack, tempomonolithic: Add tempo-query CRD option to speed up trace search. (#1048)
  Following CRD options were added to speed up trace search in Jaeger UI/API. The trace search first
  searches for traceids and then it gets a full trace. With this configuration option the requests
  to get the full trace can be run in parallel:
  For TempoStack - spec.template.queryFrontend.jaegerQuery.findTracesConcurrentRequests
  For TempoMonolithic - spec.jaegerui.findTracesConcurrentRequests

• tempostack: bump tempo-query to version with separate tls settings for server and client (#1057)

• operator: Update Tempo to v2.6.1 (#1044, #1064)

🧰 Bug fixes 🧰

• tempostack: The default value for the IngressType type is now correctly "" (empty string). Previously, it was impossible to select it in tools like the OpenShift web console, what could cause some issues. (#1054)

• tempostack: Add support for memberlist bind network configuration (#1060)
  Adds support to configure the memberlist instance_addr field using the pod network IP range instead of the default private network range used.
  In managed Kubernetes/OpenShift cluster environments as well as in special on-prem setup the private IP range might not be available for using them.
  With this change set the TempoStack administrator can choose as a bind address the current pod network IP assigned by the cluster's pod network.

• tempostack: grant jaeer-query access to pki certs (#1051)

• tempostack: Create query-frontend service monitor with HTTP protocol when gateway is disabled (#1070)

• tempostack: Fix panic when toggling spec.storage.tls.enabled to true, when using Tempo with AWS STS (#1067)

• tempostack, tempomonolithic: Mount CA and Certs to tempo-query when tls is enabled. (#1038)

• tempostack, tempomonolithic: The operator no longer sets the --prometheus.query.support-spanmetrics-connector flag that got removed in Jaeger 1.58. (#1036)
  The Flag controled whether the metrics queries should match the OpenTelemetry Collector's spanmetrics connector naming or spanmetrics processor naming.

• tempostack: Use the ReadinessProbe to better indicate when tempo-query is ready to accept requests. Improving the startup reliability by avoiding lost data. (#1058)
  Without a readiness check in place, there is a risk that data will be lost when the queryfrontend pod is ready but the tempo query API is not yet available.

Components

• Tempo: v2.6.1

Release v0.13.0

🧰 Bug fixes 🧰

• operator: Fix service account for monitoring-view cluster role binding when using oauth proxy. (#1016)
• tempostack: Fix setting annotations for Gateway route (#1014)
• tempostack, tempomonolithic: Fix infinite reconciliation on OpenShift when route for Jaeger UI is enabled. (#1018)
• tempostack, tempomonolithic: Cleanup instance metrics from the operator on instance delete action. (#1019)

Components

• Tempo: v2.5.0

Release v0.12.0

💡 Enhancements 💡

• tempostack, tempomonolithic: Add support for AWS S3 STS authentication. (#978)
  Now storage secret for S3 can contain

  data:
    bucket:      # Bucket name
    region:      # A valid AWS region, e.g. us-east-1
    role_arn:    # The AWS IAM Role associated with a trust relationship to Tempo serviceaccount
  

• tempostack: Use TLS via OpenShift service annotation when gateway/multitenancy is disabled (#963)
  On OpenShift when operator config servingCertsService is enabled and the following TempoStack CR is used.
  The operator provisions OpenShift serving certificates for the distributor ingest APIs

    apiVersion: tempo.grafana.com/v1alpha1
    kind:  TempoStack
    spec:
      template:
        distributor:
          tls:
            enabled: true
  

  No certName and caName should be provided, If you specify it, those will be used instead.

  In order to use this on the client side, the openshift CA certificate should be used, there are two ways of get
  access to it. You can mount the configmap generated by the operator, which will have the name <tempostack-name>-serving-cabundle
  Or you can access to it on var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt.

  An example of OTel configuration used:

     exporters:
      otlp:
        endpoint: tempo-simplest-distributor.chainsaw-tls-singletenant.svc.cluster.local:4317
        tls:
          insecure: false
          ca_file: "/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
  

• tempomonolithic: Use TLS via OpenShift service annotation when gateway/multitenancy is disabled (monolithic) (#963)
  On OpenShift when operator config servingCertsService is enabled and the following TempoMonolithic CR is used.
  The operator provisions OpenShift serving certificates for the distributor ingest APIs

    apiVersion: tempo.grafana.com/v1alpha1
    kind:  TempoMonolithic
    spec:
      ingestion:
        otlp:
          grpc:
            tls:
              enabled: true
  

  or

    apiVersion: tempo.grafana.com/v1alpha1
    kind:  TempoMonolithic
    spec:
      ingestion:
        otlp:
          http:
            tls:
              enabled: true
  

  No certName and caName should be provided, If you specify it, those will be used instead.

• tempostack, tempomonolithic: Bump observatorium gateway, (#991)
  In this version upstream certs and CA are reloaded if changed

🧰 Bug fixes 🧰

• tempostack, tempomonolithic: Allow configmaps and secrets with dot in the name (as it is valid for those objects to have dots as part of it's name) (#983)
• tempostack: Assign correct replicas in gateway component if it is specified in the CR, default is 1 if not set (#993)
• tempomonolithic: Allow create a monolithic with tls enabled on both grpc/http (#976)

Components

• Tempo: v2.5.0

Release v0.11.1

🧰 Bug fixes 🧰

• operator: Avoid certificate prompt when accessing UI via gateway (#967)

• operator: Modify SA annotations managed by the operator, preserve others. (#970)
  This prevents other controllers that modified the SA from create an infinite loop where the other controller modifies something,
  and tempo-operator removes it, the other controller detect the changes and add its and so on and so on.

  This is specific for OpenShift case, where the openshift-controller-manager annotates the SA with
  openshift.io/internal-registry-pull-secret-ref.

  See openshift/openshift-controller-manager#288 and
  https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html section about
  "Legacy service account API token secrets are no longer generated for each service account"

Components

• Tempo: v2.5.0

Release v0.11.0

🛑 Breaking changes 🛑

• operator: Update Tempo to 2.5.0 (#958)
  Upstream Tempo 2.5.0 image switched user from root to tempo (10001:10001) and ownership of /var/tempo.
  Therefore ingester's /var/tempo/wal created by previous deployment using Tempo 2.4.1 needs to be updated and
  changed ownership. The operator upgrades the /var/tempo ownership by deploying a job with securityContext.runAsUser(0)
  and it runs chown -R /var/tempo 10001:10001.

💡 Enhancements 💡

• operator: Enable OTLP HTTP on Gateway by default. (#948)
• operator: Use golang 1.22 to build the operator (#959)
• operator: Make configurable availability of the service names in Tempo monolithic (#942)
• operator: Add oauth-proxy support for tempo monolithic (#922)
• operator: Protect Jaeger UI when multi tenancy is disabled. (#909)

Components

• Tempo: v2.5.0

Release v0.10.0

🛑 Breaking changes 🛑

• operator: TempoMonolithic: Split tempo-<name> service into tempo-<name> and tempo-<name>-jaegerui (#846)

💡 Enhancements 💡

• operator: Add the ability to configure an expiration time for jaeger UI services (#904)

• operator: Prevent creation of TempoStack and TempoMonolithic with same name (#879)

• operator: Bump tempo version to 2.4.1 (#901)

• operator: Add storage and managed operands gauge metric to the operator metrics. (#838)

• operator: Support Grafana instances in a different namespace (#840)

• operator: Support custom ServiceAccount in TempoMonolithic CR (#836)

• operator: Enable internal server for health checks in TempoMonolithic CR (#847)

• operator: Support multi-tenancy in TempoMonolithic CR (#816)

• operator: Support TLS Profile in TempoMonolithic CR (#862)

• operator: Support upgrading TempoMonolithic CR (#850)
  The metric series tempooperator_upgrades_total{state="up-to-date"} was removed.
  A new label kind (TempoStack or TempoMonolithic) was added to tempooperator_upgrades_total{}.

• operator: Updating Operator-sdk to 1.32 (#717)

• operator: Add security context to tempo-query container (#864)

🧰 Bug fixes 🧰

• operator: Fix parsing of nodeSelector, tolerations and affinity in TempoMonolithic CR (#867)

Components

• Tempo: v2.4.1

Release v0.9.0

💡 Enhancements 💡

• operator: Kubernetes 1.29 enablement (#735)
• operator: Allow resource limits/requests override per component (#726)
• operator: Support creating ServiceMonitors, PrometheusRules and Grafana Data Sources in TempoMonolithic CR (#793)
• operator: Support scheduling rules (nodeSelector, tolerations and affinity) in TempoMonolithic CR (#782)
• operator: Expose operand status in TempoMonolithic CR (#787)

🧰 Bug fixes 🧰

• operator: Fix infinite reconciliation of serving CA Bundle ConfigMap (#818)

Components

• Tempo: v2.3.1

Release v0.8.0

💡 Enhancements 💡

• operator: Make Tempo-Query forwarding on gateway optional (#628)

• operator: Support monolithic deployment mode (#710)

  The operator exposes a new CRD TempoMonolithic, which manages a Tempo instance in monolithic mode.
  The monolithic mode supports the following additional storage backends: in-memory and file system (persistent volume).

🧰 Bug fixes 🧰

• operator: Fix the cluster-monitoring-view RBAC when operator is deployed in arbitrary namespace (#741)
• operator: NIL pointer dereference when OIDC not specified for tenants in static mode (#647)

Components

• Tempo: v2.3.1

Release v0.7.0

💡 Enhancements 💡

• operator: Divide assigned limits with replicas (#721)
• operator: Allow override arbitrary tempo configurations (#629)
• operator: Create Grafana Tempo Operator datasource (#423)
• operator: Add .spec.hashRing.memberlist.enableIPv6 option to enable IPv6 support (#704)
• operator: Propagating proxy env vars to component containers (#700)
• operator: Upgrade tempo to v2.3.1 (#729)

🧰 Bug fixes 🧰

• operator: Configure the number of replicas for compactor, querier and query-frontend according to the CR (#712)

Components

• Tempo: v2.3.1