[tempo-distributed] Fix zone aware replication upgrade and rollout operator

charts/tempo-distributed/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: tempo-distributed
 description: Grafana Tempo in MicroService mode
 type: application
-version: 1.13.1
+version: 1.13.2
 appVersion: 2.5.0
 engine: gotpl
 home: https://grafana.com/docs/tempo/latest/

charts/tempo-distributed/README.md

@@ -1,6 +1,6 @@
 # tempo-distributed
 
-![Version: 1.13.1](https://img.shields.io/badge/Version-1.13.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.5.0](https://img.shields.io/badge/AppVersion-2.5.0-informational?style=flat-square)
+![Version: 1.13.2](https://img.shields.io/badge/Version-1.13.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.5.0](https://img.shields.io/badge/AppVersion-2.5.0-informational?style=flat-square)
 
 Grafana Tempo in MicroService mode
 
@@ -46,7 +46,7 @@ The command removes all the Kubernetes components associated with the chart and
 
 A major chart version change indicates that there is an incompatible breaking change needing manual actions.
 
-### from Chart versions < 1.11.0
+### from Chart versions < 1.13.0
 
 EXPERIMENTAL: Zone Aware Replication has been added to the ingester statefulset.
 Attention, the calculation of the pods per AZ is as follows ```(.values.ingester.replicas + numberOfZones -1)/numberOfZones```
@@ -766,6 +766,15 @@ The memcached default args are removed and should be provided manually. The sett
 | rbac.create | bool | `false` | Specifies whether RBAC manifests should be created |
 | rbac.pspEnabled | bool | `false` | Specifies whether a PodSecurityPolicy should be created |
 | reportingEnabled | bool | `true` | If true, Tempo will report anonymous usage data about the shape of a deployment to Grafana Labs |
+| rollout_operator.enabled | bool | `false` | Enable rollout-operator. It must be enabled when using Zone Aware Replication. |
+| rollout_operator.podSecurityContext.fsGroup | int | `10001` |  |
+| rollout_operator.podSecurityContext.runAsGroup | int | `10001` |  |
+| rollout_operator.podSecurityContext.runAsNonRoot | bool | `true` |  |
+| rollout_operator.podSecurityContext.runAsUser | int | `10001` |  |
+| rollout_operator.podSecurityContext.seccompProfile.type | string | `"RuntimeDefault"` |  |
+| rollout_operator.securityContext.allowPrivilegeEscalation | bool | `false` |  |
+| rollout_operator.securityContext.capabilities.drop[0] | string | `"ALL"` |  |
+| rollout_operator.securityContext.readOnlyRootFilesystem | bool | `true` |  |
 | server.grpc_server_max_recv_msg_size | int | `4194304` | Max gRPC message size that can be received |
 | server.grpc_server_max_send_msg_size | int | `4194304` | Max gRPC message size that can be sent |
 | server.httpListenPort | int | `3100` | HTTP server listen host |

charts/tempo-distributed/README.md.gotmpl

@@ -39,10 +39,10 @@ The command removes all the Kubernetes components associated with the chart and
 
 A major chart version change indicates that there is an incompatible breaking change needing manual actions.
 
-### from Chart versions < 1.11.0
+### from Chart versions < 1.13.0
 
-EXPERIMENTAL: Zone Aware Replication has been added to the ingester statefulset. 
-Attention, the calculation of the pods per AZ is as follows ```(.values.ingester.replicas + numberOfZones -1)/numberOfZones``` 
+EXPERIMENTAL: Zone Aware Replication has been added to the ingester statefulset.
+Attention, the calculation of the pods per AZ is as follows ```(.values.ingester.replicas + numberOfZones -1)/numberOfZones```
 
 ### From Chart versions < 1.8.0
 

charts/tempo-distributed/templates/ingester/_helpers-ingester.tpl

@@ -14,14 +14,16 @@
 {{- $replicaPerZone := div (add $requestedReplicas $numberOfZones -1) $numberOfZones -}}
 {{- range $idx, $rolloutZone := .ctx.Values.ingester.zoneAwareReplication.zones -}}
 {{- $_ := set $zonesMap $rolloutZone.name (dict
-  "affinity" (($rolloutZone.extraAffinity | default (dict)) | mergeOverwrite (include "ingester.zoneAntiAffinity" (dict "rolloutZoneName" $rolloutZone.name "topologyKey" $.ctx.Values.ingester.zoneAwareReplication.topologyKey) | fromYaml))
-  "nodeSelector" ($rolloutZone.nodeSelector | default (dict) )
-  "replicas" $replicaPerZone
-  "storageClass" $rolloutZone.storageClass
-  ) -}}
+"affinity" (($rolloutZone.extraAffinity | default (dict)) | mergeOverwrite (include "ingester.zoneAntiAffinity" (dict "rolloutZoneName" $rolloutZone.name "topologyKey" $.ctx.Values.ingester.zoneAwareReplication.topologyKey) | fromYaml))
+"nodeSelector" ($rolloutZone.nodeSelector | default (dict) )
+"replicas" $replicaPerZone
+"storageClass" $rolloutZone.storageClass
+) -}}
 {{- end -}}
-{{- $zonesMap | toYaml }}
+{{- else -}}
+{{- $_ := set $zonesMap "" $defaultZone -}}
 {{- end -}}
+{{- $zonesMap | toYaml }}
 {{- end -}}
 {{/*
 Calculate anti-affinity for a zone
@@ -177,4 +179,4 @@ app.kubernetes.io/part-of: memberlist
 rollout-group: ingester
 zone: {{ .rolloutZoneName }}
 {{- end }}
-{{- end -}}
+{{- end -}}

charts/tempo-distributed/templates/ingester/statefulset-ingester.yaml

@@ -11,7 +11,7 @@ metadata:
   labels:
     {{- include "ingester.labels" $dict | indent 4 }}
   {{- if .Values.ingester.zoneAwareReplication.enabled }}
-  annotations: 
+  annotations:
     {{- include "ingester.Annotations" $dict | nindent 4}}
   {{- else }}
   {{- with .Values.ingester.annotations }}
@@ -125,10 +125,18 @@ spec:
         {{- tpl . $ | nindent 8 }}
       {{- end }}
       {{- end }}
+      {{- if eq $zoneName ""}}
+      {{- with $rolloutZone.affinity }}
+      affinity:
+        {{- tpl . $ | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- if ne $zoneName "" }}
       {{- with $rolloutZone.affinity }}
       affinity:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- end }}
       {{- with $rolloutZone.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
@@ -184,4 +192,4 @@ spec:
   {{- end }}
 ---
 {{ end }}
-{{ end }}
+{{ end }}

charts/tempo-distributed/values.yaml

@@ -992,6 +992,25 @@ enterpriseFederationFrontend:
 
 multitenancyEnabled: false
 
+rollout_operator:
+# -- Enable rollout-operator. It must be enabled when using Zone Aware Replication.
+  enabled: false
+
+  podSecurityContext:
+    fsGroup: 10001
+    runAsGroup: 10001
+    runAsNonRoot: true
+    runAsUser: 10001
+    seccompProfile:
+      type: RuntimeDefault
+
+  # Set the container security context
+  securityContext:
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop: [ALL]
+    allowPrivilegeEscalation: false
+
 traces:
   jaeger:
     grpc: