Skip to content

Instantly share code, notes, and snippets.

@dobesv

dobesv/tempo-metrics-generator-mtls.certificate.yaml

Created August 21, 2025 03:23
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save dobesv/32ab42d3d48d5e4e3e0fb831dd484561 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save dobesv/32ab42d3d48d5e4e3e0fb831dd484561 to your computer and use it in GitHub Desktop.
Download ZIP
tempo-operator-w-manual-metrics-generator
Raw
tempo-metrics-generator-mtls.certificate.yaml
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: &name tempo-metrics-generator-mtls
spec:
secretName: *name
dnsNames:
- 'tempo-metrics-generator.tempo.svc.cluster.local'
- '*.tempo-metrics-generator.tempo.svc'
- '*.tempo-metrics-generator.tempo.svc.cluster.local'
usages:
- server auth
- client auth
- digital signature
- key encipherment
subject:
organizations:
- tempo
organizationalUnits:
- tempo-metrics-generator
issuerRef:
name: tempo-tempo-signing-ca
kind: Issuer
Raw
tempo-metrics-generator.service.yaml
kind: Service
apiVersion: v1
metadata:
name: tempo-metrics-generator
namespace: tempo
labels:
app.kubernetes.io/component: metrics-generator
app.kubernetes.io/instance: tempo
app.kubernetes.io/name: tempo
spec:
ports:
- name: http
protocol: TCP
port: 3200
targetPort: http
- name: grpc
protocol: TCP
port: 9095
targetPort: grpc
selector:
app.kubernetes.io/component: metrics-generator
app.kubernetes.io/instance: tempo
app.kubernetes.io/name: tempo
type: ClusterIP
internalTrafficPolicy: Cluster
Raw
tempo-metrics-generator.statefulset.yaml
kind: StatefulSet
apiVersion: apps/v1
metadata:
name: tempo-metrics-generator
namespace: tempo
labels:
app.kubernetes.io/component: metrics-generator
app.kubernetes.io/instance: tempo
app.kubernetes.io/name: tempo
spec:
replicas: 3
selector:
matchLabels:
app.kubernetes.io/component: metrics-generator
app.kubernetes.io/instance: tempo
app.kubernetes.io/name: tempo
serviceName: tempo-metrics-generator
template:
metadata:
labels:
app.kubernetes.io/component: metrics-generator
app.kubernetes.io/instance: tempo
app.kubernetes.io/name: tempo
tempo-gossip-member: 'true'
annotations:
tempo.grafana.com/config.hash: 4ca4407b06913e46513ac1cec9ee15c1714ce2e8d8e2ec5bfb18ffcd2b485f58
spec:
volumes:
- name: tempo-conf
configMap:
name: tempo-tempo
defaultMode: 420
- name: tempo-tempo-ca-bundle
configMap:
name: tempo-tempo-ca-bundle
defaultMode: 420
- name: tempo-metrics-generator-mtls
secret:
secretName: tempo-metrics-generator-mtls
defaultMode: 420
containers:
- name: tempo
image: docker.io/grafana/tempo:2.8.1
args:
- '-target=metrics-generator'
- '-config.file=/conf/tempo.yaml'
- '-log.level=info'
- '-config.expand-env=true'
ports:
- name: http-memberlist
containerPort: 7946
protocol: TCP
- name: http-healthcheck
containerPort: 3101
protocol: TCP
- name: http
containerPort: 3200
protocol: TCP
- name: grpc
containerPort: 9095
protocol: TCP
env:
- name: GOMEMLIMIT
value: '1145324646'
resources:
limits: &resources
cpu: 500m
memory: '500Mi'
requests: *resources
volumeMounts:
- name: tempo-conf
readOnly: true
mountPath: /conf
- name: data
mountPath: /var/tempo
- name: tempo-tempo-ca-bundle
mountPath: /var/run/ca
- name: tempo-metrics-generator-mtls
mountPath: /var/run/tls/server
readinessProbe:
httpGet:
path: /ready
port: 3101
scheme: HTTPS
initialDelaySeconds: 15
timeoutSeconds: 1
periodSeconds: 10
successThreshold: 1
failureThreshold: 3
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
imagePullPolicy: IfNotPresent
securityContext:
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
restartPolicy: Always
terminationGracePeriodSeconds: 30
dnsPolicy: ClusterFirst
serviceAccountName: tempo
securityContext:
fsGroup: 1000
affinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 100
podAffinityTerm:
labelSelector:
matchLabels:
app.kubernetes.io/component: metrics-generator
app.kubernetes.io/instance: tempo
app.kubernetes.io/name: tempo
topologyKey: kubernetes.io/hostname
- weight: 75
podAffinityTerm:
labelSelector:
matchLabels:
app.kubernetes.io/component: metrics-generator
app.kubernetes.io/instance: tempo
app.kubernetes.io/name: tempo
topologyKey: failure-domain.beta.kubernetes.io/zone
schedulerName: default-scheduler
volumeClaimTemplates:
- kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: data
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 10Gi
storageClassName: gp3
volumeMode: Filesystem
podManagementPolicy: Parallel
updateStrategy:
type: RollingUpdate
rollingUpdate:
partition: 0
Raw
tempo-tempo-signing-ca.issuer.yaml
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: tempo-tempo-signing-ca
spec:
ca:
secretName: tempo-tempo-signing-ca
Raw
tempo.tempostack.yaml
apiVersion: tempo.grafana.com/v1alpha1
kind: TempoStack
metadata:
name: tempo
namespace: tempo
spec:
extraConfig:
tempo:
stream_over_http_enabled: true
metrics_generator:
processor:
local_blocks: {}
traces_storage:
path: /var/tempo/traces
storage:
path: /var/tempo/wal
overrides:
defaults:
metrics_generator:
processors:
- local-blocks
metrics_generator_client:
grpc_client_config:
tls_ca_path: /var/run/ca/service-ca.crt
tls_cert_path: /var/run/tls/server/tls.crt
tls_enabled: true
tls_insecure_skip_verify: false
tls_key_path: /var/run/tls/server/tls.key
tls_min_version: VersionTLS13
tls_server_name: tempo-metrics-generator.tempo.svc.cluster.local
hashRing:
memberlist: {}
images: {}
limits:
global:
ingestion: {}
query:
maxSearchDuration: 0s
managementState: Managed
observability:
grafana:
instanceSelector: {}
metrics:
createPrometheusRules: true
createServiceMonitors: true
tracing:
jaeger_agent_endpoint: localhost:6831
otlp_http_endpoint: http://localhost:4320
replicationFactor: 2
resources:
total:
limits:
# Note: suggestion is 750m CPU per 1 MB/s ingested (https://github.com/grafana/tempo/issues/1540#issuecomment-1178035971)
cpu: "3"
# Note: suggestion is 2 GiB memory per 1 MB/s ingested (https://github.com/grafana/tempo/issues/1540#issuecomment-1178035971)
memory: 8Gi
retention:
global:
traces: 48h0m0s
search:
defaultResultLimit: 20
maxDuration: 0s
serviceAccount: tempo
storage:
secret:
name: tempo-s3-config
type: s3
tls:
enabled: false
storageSize: 10Gi
storageClassName: gp3
template:
compactor:
replicas: 1
distributor:
component:
replicas: 3
tls:
enabled: false
ingester:
podSecurityContext:
fsGroup: 1000
replicas: 3
querier:
replicas: 3
queryFrontend:
component:
replicas: 3
jaegerQuery:
enabled: true
ingress:
route: {}
monitorTab:
enabled: false
prometheusEndpoint: ""
servicesQueryDuration: 72h0m0s
tempoQuery: {}
timeout: 30s
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment