Skip to content

Commit e860368

Browse files
rubenvp8510max-cx
rubenvp8510
authored and
max-cx
committed
OBSDOCS-1676: Tempo-OTel Multitenancy documentation improvements
Signed-off-by: Ruben Vargas <[email protected]>
1 parent bdbd9f8 commit e860368

9 files changed

+242
-252
lines changed

‎modules/distr-tracing-tempo-config-multitenancy.adoc

-179
This file was deleted.

‎modules/distr-tracing-tempo-config-spanmetrics.adoc

+6-2
Original file line numberDiff line numberDiff line change
@@ -87,12 +87,16 @@ spec:
8787
name: minio-test
8888
type: s3
8989
storageSize: 1Gi
90+
tenants:
91+
mode: openshift
92+
authentication:
93+
- tenantName: dev
94+
tenantId: "1610b0c3-c509-4592-a256-a1871353dbfa"
9095
template:
9196
gateway:
92-
enabled: false
97+
enabled: true
9398
queryFrontend:
9499
jaegerQuery:
95-
enabled: true
96100
monitorTab:
97101
enabled: true # <1>
98102
prometheusEndpoint: https://thanos-querier.openshift-monitoring.svc.cluster.local:9091 # <2>

‎modules/distr-tracing-tempo-install-gateway-permissions.adoc

+169
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * observability/distr_tracing/distr_tracing_tempo/distr-tracing-tempo-installing.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="distr-tracing-tempo-install-gateway-permissions{context}"]
7+
= Configure tenants and permissions
8+
9+
Authentication and authorization is provided in the Tempo Gateway service. The authentication uses OpenShift OAuth and the Kubernetes `TokenReview` API. The authorization uses the Kubernetes `SubjectAccessReview` API.
10+
11+
To properly define tenants and manage their read and write access, the distributed tracing stack—built on the Red Hat distribution of OpenTelemetry and Tempo—requires a well-configured authorization setup.
12+
13+
This setup relies on Kubernetes Role-Based Access Control (RBAC) through ClusterRole and ClusterRoleBinding. By default, no users are granted read or write permissions, ensuring a secure baseline until explicit configurations are defined.
14+
15+
16+
You can install a Configure those permissionns from the *Administrator* view of the web console or using command line CLI.
17+
18+
.Prerequisites
19+
20+
* You are logged in to the {product-title} web console as a cluster administrator with the `cluster-admin` role.
21+
* For {product-dedicated}, you must be logged in using an account with the `dedicated-admin` role.
22+
23+
.Reading traces 
24+
25+
To grant users permission to read a specific tenant, follow these steps:
26+
27+
. Define desired tenant name and tenant Id.
28+
. Enable tenants to read traces by adding them to a `ClusterRole` and giving them read (get) permissions
29+
30+
.Sample of the read RBAC configuration that allows authenticated users to read the trace data of the `dev` and `prod` tenants
31+
[source,yaml]
32+
----
33+
apiVersion: rbac.authorization.k8s.io/v1
34+
kind: ClusterRole
35+
metadata:
36+
name: tempostack-traces-reader
37+
rules:
38+
- apiGroups:
39+
- 'tempo.grafana.com'
40+
resources: # <1>
41+
- dev
42+
- prod
43+
resourceNames:
44+
- traces
45+
verbs:
46+
- 'get' # <2>
47+
---
48+
apiVersion: rbac.authorization.k8s.io/v1
49+
kind: ClusterRoleBinding
50+
metadata:
51+
name: tempostack-traces-reader
52+
roleRef:
53+
apiGroup: rbac.authorization.k8s.io
54+
kind: ClusterRole
55+
name: tempostack-traces-reader
56+
subjects:
57+
- kind: Group
58+
apiGroup: rbac.authorization.k8s.io
59+
name: system:authenticated # <3>
60+
----
61+
<1> Lists the tenants.
62+
<2> The `get` value enables the read operation.
63+
<3> Grants all authenticated users the read permissions for trace data.
64+
65+
.Writing traces
66+
67+
To ingest traces, we must first install the OpenTelemetry Collector and configure it to use a properly authorized service account with the necessary permissions.
68+
69+
. Create a ServiceAccount to be used with OpenTelemetry Collector
70+
+
71+
[source,yaml]
72+
----
73+
apiVersion: v1
74+
kind: ServiceAccount
75+
metadata:
76+
name: otel-collector # <1>
77+
namespace: otel
78+
----
79+
. Grant the OpenTelemetry Collector write permissions by defining a Role with write permissions and ClusterRoleBinding to attach the OpenTelemetry Collector ServiceAccount.
80+
81+
The following is a sample on how to write RBAC configuration that allows the `otel-collector` ServiceAccount to write the trace data for the `dev` tenant
82+
+
83+
[source,yaml]
84+
----
85+
apiVersion: rbac.authorization.k8s.io/v1
86+
kind: ClusterRole
87+
metadata:
88+
name: tempostack-traces-write
89+
rules:
90+
- apiGroups:
91+
- 'tempo.grafana.com'
92+
resources: # <1>
93+
- dev
94+
resourceNames:
95+
- traces
96+
verbs:
97+
- 'create' # <2>
98+
---
99+
apiVersion: rbac.authorization.k8s.io/v1
100+
kind: ClusterRoleBinding
101+
metadata:
102+
name: tempostack-traces
103+
roleRef:
104+
apiGroup: rbac.authorization.k8s.io
105+
kind: ClusterRole
106+
name: tempostack-traces-write
107+
subjects:
108+
- kind: ServiceAccount
109+
name: otel-collector # <3>
110+
namespace: otel
111+
----
112+
<1> Lists the tenants.
113+
<2> The `create` value enables the write operation.
114+
<3> The service account name for the client to use when exporting trace data. The client must send the service account token, `/var/run/secrets/kubernetes.io/serviceaccount/token`, as the bearer token header.
115+
+
116+
. Configure the OpenTelemetry collector by:
117+
* Adding the bearertokenauth extension and a valid token to the tracing pipeline service.
118+
* Add the desired tenant in the otlp/otlphttp exporters as the "X-Scope-OrgID" headers
119+
* Enable TLS with a valid certificate authority file.
120+
121+
Trace data can be sent to the Tempo instance from the OpenTelemetry Collector that uses the service account with RBAC for writing the data.
122+
+
123+
.Sample OpenTelemetry CR configuration
124+
[source,yaml]
125+
----
126+
apiVersion: opentelemetry.io/v1alpha1
127+
kind: OpenTelemetryCollector
128+
metadata:
129+
name: cluster-collector
130+
namespace: <project_of_tempostack_instance>
131+
spec:
132+
mode: deployment
133+
serviceAccount: otel-collector # <1>
134+
config: |
135+
extensions:
136+
bearertokenauth: # <2>
137+
filename: "/var/run/secrets/kubernetes.io/serviceaccount/token"
138+
exporters:
139+
otlp/dev: # <3>
140+
endpoint: sample-gateway.tempo.svc.cluster.local:8090
141+
tls:
142+
insecure: false
143+
ca_file: "/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt" # <4>
144+
auth:
145+
authenticator: bearertokenauth # <4>
146+
headers:
147+
X-Scope-OrgID: "dev" <5>
148+
otlphttp/dev: # <6>
149+
endpoint: https://sample-gateway.<project_of_tempostack_instance>.svc.cluster.local:8080/api/traces/v1/dev
150+
tls:
151+
insecure: false
152+
ca_file: "/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"
153+
auth:
154+
authenticator: bearertokenauth
155+
headers:
156+
X-Scope-OrgID: "dev"
157+
service:
158+
extensions: [bearertokenauth]
159+
pipelines:
160+
traces:
161+
exporters: [otlp/dev] # <7>
162+
----
163+
<1> Service Account configured with write permissions
164+
<2> Bearer Token extension to use service account token
165+
<3> OTLP gRPC Exporter.
166+
<4> Service account CA
167+
<5> Header with tenant name
168+
<6> OTLP HTTP Exporter.
169+
<7> You can specify `otlp/dev` for the OTLP gRPC Exporter or `otlphttp/dev` for the OTLP HTTP Exporter.

0 commit comments

Comments
 (0)