tempo

global:

# -- Common labels for all object directly managed by this chart.

commonLabels: {}

# -- Overrides the Docker registry globally for all images

imageRegistry: null

# -- Overrides the chart's name

nameOverride: ""

# -- Overrides the chart's computed fullname

fullnameOverride: ""

# -- Define the amount of instances

replicas: 1

# -- Number of old history to retain to allow rollback (If not set, default Kubernetes value is set to 10)

# revisionHistoryLimit: 1

# -- labels for tempo

labels: {}

# -- Annotations for the StatefulSet

annotations: {}

tempo:

registry: chainreg.biz

repository: scratch-images/test-tmp/tempo

tag: 2.10.8-r2@sha256:7283535e4f2ad447ede997d9a1765a66387d6d8951aabe3311eb3a83c5ef3265

pullPolicy: IfNotPresent

## Optionally specify an array of imagePullSecrets.

## Secrets must be manually created in the namespace.

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

##

# pullSecrets:

# - myRegistryKeySecretName

updateStrategy: RollingUpdate

resources: {}

# requests:

# cpu: 1000m

# memory: 4Gi

# limits:

# cpu: 2000m

# memory: 6Gi

streamOverHttpEnabled: false

memBallastSizeMbs: 1024

multitenancyEnabled: false

# -- If true, Tempo will report anonymous usage data about the shape of a deployment to Grafana Labs

reportingEnabled: true

metricsGenerator:

# -- If true, enables Tempo's metrics generator (https://grafana.com/docs/tempo/next/metrics-generator/)

enabled: false

remoteWriteUrl: "http://prometheus.monitoring:9090/api/v1/write"

# -- Processor-specific configuration for metrics generator (optional)

# Supports service_graphs, span_metrics, and local_blocks processors

processor: {}

# local_blocks:

# flush_to_storage: true

# filter_server_spans: false

# max_block_duration: 1m

# service_graphs:

# wait: 10s

# max_items: 10000

# span_metrics:

# enable_target_info: true

# -- Registry configuration for metrics generator (optional)

registry: {}

# collection_interval: 15s

# external_labels:

# cluster: "primary"

# -- Storage configuration for metrics generator

# This section configures the storage path and remote write endpoints

storage:

# -- Path for storing metrics blocks. Defaults to /tmp/tempo for backward compatibility, but /var/tempo/metrics is recommended for production with persistent storage

path: "/tmp/tempo"

# -- Optional remote write configuration (will use remoteWriteUrl if not specified)

# Supports full Prometheus remote_write config: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#remote_write

remote_write: []

# -- Traces storage (WAL) configuration for metrics generator

# This configures the Write Ahead Log for traces used by the metrics generator

traces_storage:

# -- Path for traces storage WAL used by metrics generator

path: "/tmp/traces"

# -- Configuration options for the ingester.

# Refers to: https://grafana.com/docs/tempo/latest/configuration/#ingester

ingester: {}

# flush_check_period: 10s

# trace_idle_period: 10s

# max_block_duration: 30m

# complete_block_timeout: 1h

# -- Configuration options for the querier.

# Refers to: https://grafana.com/docs/tempo/latest/configuration/#querier

querier: {}

# max_concurrent_queries: 20

# -- Configuration options for the query-fronted.

# Refers to: https://grafana.com/docs/tempo/latest/configuration/#query-frontend

queryFrontend: {}

# search:

# concurrent_jobs: 2000

retention: 24h

# -- The standard overrides configuration section. This can include a `defaults` object for applying to all tenants (not to be confused with the `global` property of the same name, which overrides `max_byte_per_trace` for all tenants). For an example on how to enable the metrics generator using the `overrides` object, see the 'Activate metrics generator' section below. Refer to [Standard overrides](https://grafana.com/docs/tempo/latest/configuration/#standard-overrides) for more details.

overrides:

# -- Default config values for all tenants, can be overridden by per-tenant overrides. If a tenant's specific overrides are not found in the `per_tenant_overrides` block, the values in this `default` block will be used. Configs inside this block should follow the new overrides indentation format

defaults: {}

# metrics_generator:

# processors:

# - service-graphs

# - span-metrics

# -- Path to the per tenant override config file. The values of the `per_tenant_overrides` config below will be written to the default path `/conf/overrides.yaml`. Users can set tenant-specific overrides settings in a separate file and point per_tenant_override_config to it if not using the per_tenant_overrides block below.

per_tenant_override_config: /conf/overrides.yaml

# -- The `per tenant` aka `tenant-specific` runtime overrides. This allows overriding values set in the configuration on a per-tenant basis. Note that *all* values must be given for each per-tenant configuration block. Refer to [Runtime overrides](https://grafana.com/docs/tempo/latest/configuration/#runtime-overrides) and [Tenant-Specific overrides](https://grafana.com/docs/tempo/latest/configuration/#tenant-specific-overrides) documentation for more details.

per_tenant_overrides: {}

# 'tenant-id':

# metrics_generator:

# processors:

# - service-graphs

# - span-metrics

# Tempo server configuration.

# Refers to: https://grafana.com/docs/tempo/latest/configuration/#server

server:

# -- HTTP server listen port

http_listen_port: 3200

# Readiness and Liveness Probe Configuration Options

livenessProbe:

httpGet:

path: /ready

port: 3200

initialDelaySeconds: 30

periodSeconds: 10

timeoutSeconds: 5

failureThreshold: 3

successThreshold: 1

readinessProbe:

httpGet:

path: /ready

port: 3200

initialDelaySeconds: 20

periodSeconds: 10

timeoutSeconds: 5

failureThreshold: 3

successThreshold: 1

storage:

trace:

# tempo storage backend.

# Refers to: https://grafana.com/docs/tempo/latest/configuration/#storage

## Use s3 for example

# backend: s3

# store traces in s3

# s3:

# bucket: <your s3 bucket> # store traces in this bucket

# endpoint: s3.dualstack.us-east-2.amazonaws.com # api endpoint

# access_key: ... # optional. access key when using static credentials.

# secret_key: ... # optional. secret key when using static credentials.

# insecure: false # optional. enable if endpoint is http

backend: local

local:

path: /var/tempo/traces

wal:

path: /var/tempo/wal

# this configuration will listen on all ports and protocols that tempo is capable of.

# the receives all come from the OpenTelemetry collector. more configuration information can

# be found there: https://github.com/open-telemetry/opentelemetry-collector/tree/master/receiver

receivers:

jaeger:

protocols:

grpc:

endpoint: 0.0.0.0:14250

thrift_binary:

endpoint: 0.0.0.0:6832

thrift_compact:

endpoint: 0.0.0.0:6831

thrift_http:

endpoint: 0.0.0.0:14268

otlp:

protocols:

grpc:

endpoint: "0.0.0.0:4317"

http:

endpoint: "0.0.0.0:4318"

securityContext: {}

# allowPrivilegeEscalation: false

# capabilities:

# drop:

# - ALL

# readOnlyRootFilesystem: true

## Additional container arguments

extraArgs: {}

# -- Environment variables to add

extraEnv: []

# -- Environment variables from secrets or configmaps to add to the ingester pods

extraEnvFrom: []

# -- Volume mounts to add

extraVolumeMounts: []

# - name: extra-volume

# mountPath: /mnt/volume

# readOnly: true

# existingClaim: volume-claim

# -- Tempo configuration file contents

# @default -- Dynamically generated tempo configmap

config: |

stream_over_http_enabled: {{ .Values.tempo.streamOverHttpEnabled }}

memberlist:

cluster_label: "{{ .Release.Name }}.{{ .Release.Namespace }}"

multitenancy_enabled: {{ .Values.tempo.multitenancyEnabled }}

usage_report:

reporting_enabled: {{ .Values.tempo.reportingEnabled }}

compactor:

compaction:

block_retention: {{ .Values.tempo.retention }}

distributor:

receivers:

{{- toYaml .Values.tempo.receivers | nindent 8 }}

ingester:

{{- toYaml .Values.tempo.ingester | nindent 6 }}

server:

{{- toYaml .Values.tempo.server | nindent 6 }}

storage:

{{- toYaml .Values.tempo.storage | nindent 6 }}

querier:

{{- toYaml .Values.tempo.querier | nindent 6 }}

query_frontend:

{{- toYaml .Values.tempo.queryFrontend | nindent 6 }}

overrides:

{{- toYaml .Values.tempo.overrides | nindent 6 }}

{{- if .Values.tempo.metricsGenerator.enabled }}

metrics_generator:

{{- if .Values.tempo.metricsGenerator.processor }}

processor:

{{- toYaml .Values.tempo.metricsGenerator.processor | nindent 8 }}

{{- end }}

{{- if .Values.tempo.metricsGenerator.registry }}

registry:

{{- toYaml .Values.tempo.metricsGenerator.registry | nindent 8 }}

{{- end }}

storage:

path: {{ .Values.tempo.metricsGenerator.storage.path | quote }}

{{- if .Values.tempo.metricsGenerator.storage.remote_write }}

remote_write:

{{- toYaml .Values.tempo.metricsGenerator.storage.remote_write | nindent 10 }}

{{- else }}

remote_write:

- url: {{ .Values.tempo.metricsGenerator.remoteWriteUrl }}

{{- end }}

traces_storage:

path: {{ .Values.tempo.metricsGenerator.traces_storage.path | quote }}

{{- end }}

tempoQuery:

repository: chainreg.biz/scratch-images/test-tmp/busybox

tag: glibc-1.38.0-r2@sha256:81c876518b800ae1cc727f1a3cd0d4c03b542e38afcbc77b0200a18070971f0e

pullPolicy: IfNotPresent

## Optionally specify an array of imagePullSecrets.

## Secrets must be manually created in the namespace.

## Refers to: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

##

# pullSecrets:

# - myRegistryKeySecretName

# -- if False the tempo-query container is not deployed

enabled: false

service:

port: 16686

ingress:

enabled: false

# For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName

# See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress

# ingressClassName: nginx

# Values can be templated

annotations: {}

# kubernetes.io/ingress.class: nginx

# kubernetes.io/tls-acme: "true"

labels: {}

path: /

# pathType is only for k8s >= 1.1=

pathType: Prefix

hosts:

- query.tempo.example.com

## Extra paths to prepend to every host configuration. This is useful when working with annotation based services.

extraPaths: []

# - path: /*

# backend:

# serviceName: ssl-redirect

# servicePort: use-annotation

## Or for k8s > 1.19

# - path: /*

# pathType: Prefix

# backend:

# service:

# name: ssl-redirect

# port:

# name: use-annotation

tls: []

# - secretName: tempo-query-tls

# hosts:

# - query.tempo.example.com

resources: {}

# requests:

# cpu: 1000m

# memory: 4Gi

# limits:

# cpu: 2000m

# memory: 6Gi

## Additional container arguments

extraArgs: {}

# -- Environment variables to add

extraEnv: []

# -- Volume mounts to add

extraVolumeMounts: []

# - name: extra-volume

# mountPath: /mnt/volume

# readOnly: true

# existingClaim: volume-claim

securityContext: {}

# allowPrivilegeEscalation: false

# capabilities:

# drop:

# - ALL

# readOnlyRootFilesystem: false # fails if true, do not enable

# -- securityContext for container

securityContext:

runAsUser: 10001

runAsGroup: 10001

fsGroup: 10001

runAsNonRoot: true

serviceAccount:

# -- Specifies whether a ServiceAccount should be created

create: true

# -- The name of the ServiceAccount to use.

# If not set and create is true, a name is generated using the fullname template

name: null

# -- Image pull secrets for the service account

imagePullSecrets: []

# -- Annotations for the service account

annotations: {}

# -- Labels for the service account

labels: {}

automountServiceAccountToken: true

service:

type: ClusterIP

clusterIP: ""

# -- (string) IP address, in case of 'type: LoadBalancer'

loadBalancerIP:

# -- If service type is LoadBalancer, the exposed protocol can either be "UDP", "TCP" or "UDP,TCP"

protocol: "TCP"

annotations: {}

labels: {}

targetPort: ""

# -- BETA: Configure the gateway routes for the chart here.

# More routes can be added by adding a dictionary key like the 'main' route.

# Being BETA this can/will change in the future without notice, do not use unless you want to take that risk

# [[ref]](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io%2fv1alpha2)

route:

main:

# -- Enables or disables the route

enabled: false

# -- Set the route apiVersion, e.g. gateway.networking.k8s.io/v1 or gateway.networking.k8s.io/v1beta1

# If not set, the latest available version will be auto-detected

apiVersion: ""

# -- Set the route kind. The template renders an HTTPRoute body, so only

# HTTPRoute is supported. The field stays configurable for a future route kind.

kind: HTTPRoute

# -- Route annotations

annotations: {}

# -- Route labels

labels: {}

# -- Hostnames for the route

hostnames: []

# - tempo.example.com

# -- Parent references (gateway to attach to)

parentRefs: []

# - name: my-gateway

# namespace: gateway-namespace

# -- Port of the tempo service to route to. Defaults to the Tempo HTTP API port.

# Use 4318 for the OTLP HTTP receiver or tempoQuery.service.port for the Jaeger UI.

# The port must be one that the tempo service exposes. The receiver ports follow

# `tempo.receivers`, so a route to a disabled receiver fails the render.

backendPort: 3200

matches:

- path:

type: PathPrefix

value: /

## Timeouts define the timeouts that can be configured for an HTTP request.

## Ref. https://gateway-api.sigs.k8s.io/api-types/httproute/#timeouts-optional

timeouts: {}

# request: 10s

# backendRequest: 5s

## Filters define the filters that are applied to requests that match this rule.

filters: []

## Additional custom rules that can be added to the route

additionalRules: []

## httpsRedirect adds a filter for redirecting to https (HTTP 301 Moved Permanently).

## To redirect HTTP traffic to HTTPS, you need to have a Gateway with both HTTP and HTTPS listeners.

## Matches and filters do not take effect if enabled.

## Ref. https://gateway-api.sigs.k8s.io/guides/http-redirect-rewrite/

httpsRedirect: false

serviceMonitor:

enabled: false

interval: ""

additionalLabels: {}

annotations: {}

# scrapeTimeout: 10s

persistence:

enabled: false

# -- Enable StatefulSetAutoDeletePVC feature

enableStatefulSetAutoDeletePVC: false

# storageClassName: local-path

accessModes:

- ReadWriteOnce

size: 10Gi

# -- Pod Annotations

podAnnotations: {}

# -- Pod (extra) Labels

podLabels: {}

# Apply extra labels to common labels.

extraLabels: {}

# -- Add initContainers to the Tempo StatefulSet

initContainers: []

# -- Add extra containers to the Tempo StatefulSet

extraContainers: []

# -- Volumes to add

extraVolumes: []

# -- Node labels for pod assignment. See: https://kubernetes.io/docs/user-guide/node-selection/

nodeSelector: {}

# -- Tolerations for pod assignment. See: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

tolerations: []

# -- Affinity for pod assignment. See: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

affinity: {}

# -- The name of the PriorityClass

priorityClassName: null

# -- hostAliases to add

hostAliases: []

# - ip: 1.2.3.4

# hostnames:

# - domain.tld

networkPolicy:

## @param networkPolicy.enabled Enable creation of NetworkPolicy resources. Only Ingress traffic is filtered for now.

##

enabled: false

## @param networkPolicy.allowExternal Don't require client label for connections

## The Policy model to apply. When set to false, only pods with the correct

## client label will have network access to tempo port defined.

## When true, tempo will accept connections from any source

## (with the correct destination port).

##

ingress: true

## @param networkPolicy.ingress When true enables the creation

## an ingress network policy

##

allowExternal: true

## @param networkPolicy.explicitNamespacesSelector A Kubernetes LabelSelector to explicitly select namespaces from which traffic could be allowed

## If explicitNamespacesSelector is missing or set to {}, only client Pods that are in the networkPolicy's namespace

## and that match other criteria, the ones that have the good label, can reach the tempo.

## But sometimes, we want the tempo to be accessible to clients from other namespaces, in this case, we can use this

## LabelSelector to select these namespaces, note that the networkPolicy's namespace should also be explicitly added.

##

## Example:

## explicitNamespacesSelector:

## matchLabels:

## role: frontend

## matchExpressions:

## - {key: role, operator: In, values: [frontend]}

##

explicitNamespacesSelector: {}

##

egress:

## @param networkPolicy.egress.enabled When enabled, an egress network policy will be

## created allowing tempo to connect to external data sources from kubernetes cluster.

enabled: false

##

## @param networkPolicy.egress.blockDNSResolution When enabled, DNS resolution will be blocked

## for all pods in the tempo namespace.

blockDNSResolution: false

##

## @param networkPolicy.egress.ports Add individual ports to be allowed by the egress

ports: []

## Add ports to the egress by specifying - port: <port number>

## E.X.

## - port: 80

## - port: 443

##

## @param networkPolicy.egress.to Allow egress traffic to specific destinations

to: []

## Add destinations to the egress by specifying - ipBlock: <CIDR>

## E.X.

## to:

## - namespaceSelector:

## matchExpressions:

## - {key: role, operator: In, values: [tempo]}