Expose pod security context per component (#1029)

* Expose pod security context per component Signed-off-by: Ruben Vargas <[email protected]> * Update apis/tempo/v1alpha1/tempostack_types.go Co-authored-by: Andreas Gerstmayr <[email protected]> Signed-off-by: Ruben Vargas <[email protected]> * update bundle Signed-off-by: Ruben Vargas <[email protected]> * update bundle Signed-off-by: Ruben Vargas <[email protected]> * regenerate docs Signed-off-by: Ruben Vargas <[email protected]> --------- Signed-off-by: Ruben Vargas <[email protected]> Co-authored-by: Andreas Gerstmayr <[email protected]>
grafana · Sep 27, 2024 · c91129c · c91129c
1 parent 52a04d6
commit c91129c
Show file tree

Hide file tree

Showing 17 changed files with 3,443 additions and 2 deletions.
diff --git a/.chloggen/add_pod_security_context.yaml b/.chloggen/add_pod_security_context.yaml
@@ -0,0 +1,16 @@
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: enhancement
+
+# The name of the component, or a single word describing the area of concern, (e.g. tempostack, tempomonolithic, github action)
+component: tempostack
+
+# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Expose a way to set a PodSecurityContext on each component
+
+# One or more tracking issues related to the change
+issues: [996]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:
diff --git a/apis/tempo/v1alpha1/tempostack_types.go b/apis/tempo/v1alpha1/tempostack_types.go
@@ -523,6 +523,12 @@ type TempoComponentSpec struct {
 	// +optional
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Resources"
 	Resources *corev1.ResourceRequirements `json:"resources,omitempty"`
+
+	// PodSecurityContext defines security context will be applied to all pods of this component.
+	//
+	// +optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="PodSecurityContext"
+	PodSecurityContext *corev1.PodSecurityContext `json:"podSecurityContext,omitempty"`
 }
 
 // TempoGatewaySpec extends TempoComponentSpec with gateway parameters.

diff --git a/apis/tempo/v1alpha1/zz_generated.deepcopy.go b/apis/tempo/v1alpha1/zz_generated.deepcopy.go
diff --git a/bundle/community/manifests/tempo-operator.clusterserviceversion.yaml b/bundle/community/manifests/tempo-operator.clusterserviceversion.yaml
@@ -74,7 +74,7 @@ metadata:
     capabilities: Deep Insights
     categories: Logging & Tracing,Monitoring
     containerImage: ghcr.io/grafana/tempo-operator/tempo-operator:v0.13.0
-    createdAt: "2024-09-04T09:14:02Z"
+    createdAt: "2024-09-21T07:00:19Z"
     description: Create and manage deployments of Tempo, a high-scale distributed
       tracing backend.
     operatorframework.io/cluster-monitoring: "true"
@@ -831,6 +831,10 @@ spec:
       - description: NodeSelector defines the simple form of the node-selection constraint.
         displayName: Node Selector
         path: template.compactor.nodeSelector
+      - description: PodSecurityContext defines security context will be applied to
+          all pods of this component.
+        displayName: PodSecurityContext
+        path: template.compactor.podSecurityContext
       - description: Replicas defines the number of replicas to be created for this
           component.
         displayName: Component Replicas
@@ -848,6 +852,10 @@ spec:
       - description: NodeSelector defines the simple form of the node-selection constraint.
         displayName: Node Selector
         path: template.distributor.nodeSelector
+      - description: PodSecurityContext defines security context will be applied to
+          all pods of this component.
+        displayName: PodSecurityContext
+        path: template.distributor.podSecurityContext
       - description: Replicas defines the number of replicas to be created for this
           component.
         displayName: Component Replicas
@@ -910,6 +918,10 @@ spec:
       - description: NodeSelector defines the simple form of the node-selection constraint.
         displayName: Node Selector
         path: template.gateway.nodeSelector
+      - description: PodSecurityContext defines security context will be applied to
+          all pods of this component.
+        displayName: PodSecurityContext
+        path: template.gateway.podSecurityContext
       - description: Replicas defines the number of replicas to be created for this
           component.
         displayName: Component Replicas
@@ -927,6 +939,10 @@ spec:
       - description: NodeSelector defines the simple form of the node-selection constraint.
         displayName: Node Selector
         path: template.ingester.nodeSelector
+      - description: PodSecurityContext defines security context will be applied to
+          all pods of this component.
+        displayName: PodSecurityContext
+        path: template.ingester.podSecurityContext
       - description: Replicas defines the number of replicas to be created for this
           component.
         displayName: Component Replicas
@@ -944,6 +960,10 @@ spec:
       - description: NodeSelector defines the simple form of the node-selection constraint.
         displayName: Node Selector
         path: template.querier.nodeSelector
+      - description: PodSecurityContext defines security context will be applied to
+          all pods of this component.
+        displayName: PodSecurityContext
+        path: template.querier.podSecurityContext
       - description: Replicas defines the number of replicas to be created for this
           component.
         displayName: Component Replicas
@@ -1032,6 +1052,10 @@ spec:
       - description: NodeSelector defines the simple form of the node-selection constraint.
         displayName: Node Selector
         path: template.queryFrontend.nodeSelector
+      - description: PodSecurityContext defines security context will be applied to
+          all pods of this component.
+        displayName: PodSecurityContext
+        path: template.queryFrontend.podSecurityContext
       - description: Replicas defines the number of replicas to be created for this
           component.
         displayName: Component Replicas