Installing

Go to Operators → OperatorHub and search for Tempo Operator.

Select the Tempo Operator that is provided by Red Hat.

Select the Enable Operator recommended cluster monitoring on this Namespace checkbox.

Select Install → Install → View Operator.

Create a project for the Tempo Operator by running the following command:

$ oc apply -f - << EOF
apiVersion: project.openshift.io/v1
kind: Project
metadata:
  labels:
    kubernetes.io/metadata.name: openshift-tempo-operator
    openshift.io/cluster-monitoring: "true"
  name: openshift-tempo-operator
EOF

Create an Operator group by running the following command:

$ oc apply -f - << EOF
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
  name: openshift-tempo-operator
  namespace: openshift-tempo-operator
spec:
  upgradeStrategy: Default
EOF

Create a subscription by running the following command:

$ oc apply -f - << EOF
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: tempo-product
  namespace: openshift-tempo-operator
spec:
  channel: stable
  installPlanApproval: Automatic
  name: tempo-product
  source: redhat-operators
  sourceNamespace: openshift-marketplace
EOF

Go to Home → Projects → Create Project to create a project of your choice for the TempoStack instance that you will create in a subsequent step.

Go to Workloads → Secrets → Create → From YAML to create a secret for your object storage bucket in the project that you created for the TempoStack instance. For more information, see "Object storage setup".

apiVersion: v1
kind: Secret
metadata:
  name: minio-test
stringData:
  endpoint: http://minio.minio.svc:9000
  bucket: tempo
  access_key_id: tempo
  access_key_secret: <secret>
type: Opaque

Create a TempoStack instance.

Use the Project: dropdown list to select the project of the TempoStack instance.

Go to Operators → Installed Operators to verify that the Status of the TempoStack instance is Condition: Ready.

Go to Workloads → Pods to verify that all the component pods of the TempoStack instance are running.

Access the Tempo console:

Run the following command to create a project of your choice for the TempoStack instance that you will create in a subsequent step:

$ oc apply -f - << EOF
apiVersion: project.openshift.io/v1
kind: Project
metadata:
  name: <project_of_tempostack_instance>
EOF

In the project that you created for the TempoStack instance, create a secret for your object storage bucket by running the following command:

$ oc apply -f - << EOF
<object_storage_secret>
EOF

apiVersion: v1
kind: Secret
metadata:
  name: minio-test
stringData:
  endpoint: http://minio.minio.svc:9000
  bucket: tempo
  access_key_id: tempo
  access_key_secret: <secret>
type: Opaque

Create a TempoStack instance in the project that you created for it:

Verify that the status of all TempoStack components is Running and the conditions are type: Ready by running the following command:

$ oc get tempostacks.tempo.grafana.com simplest -o yaml

Verify that all the TempoStack component pods are running by running the following command:

$ oc get pods

Access the Tempo console:

Go to Home → Projects → Create Project to create a project of your choice for the TempoMonolithic instance that you will create in a subsequent step.

Decide which type of supported storage to use for storing traces: in-memory storage, a persistent volume, or object storage.

apiVersion: v1
kind: Secret
metadata:
  name: minio-test
stringData:
  endpoint: http://minio.minio.svc:9000
  bucket: tempo
  access_key_id: tempo
  access_key_secret: <secret>
type: Opaque

Create a TempoMonolithic instance:

Use the Project: dropdown list to select the project of the TempoMonolithic instance.

Go to Operators → Installed Operators to verify that the Status of the TempoMonolithic instance is Condition: Ready.

Go to Workloads → Pods to verify that the pod of the TempoMonolithic instance is running.

Access the Jaeger UI:

When the pod of the TempoMonolithic instance is ready, you can send traces to the tempo-<metadata_name_of_TempoMonolithic_CR>:4317 (OTLP/gRPC) and tempo-<metadata_name_of_TempoMonolithic_CR>:4318 (OTLP/HTTP) endpoints inside the cluster.

Run the following command to create a project of your choice for the TempoMonolithic instance that you will create in a subsequent step:

$ oc apply -f - << EOF
apiVersion: project.openshift.io/v1
kind: Project
metadata:
  name: <project_of_tempomonolithic_instance>
EOF

Decide which type of supported storage to use for storing traces: in-memory storage, a persistent volume, or object storage.

$ oc apply -f - << EOF
<object_storage_secret>
EOF

apiVersion: v1
kind: Secret
metadata:
  name: minio-test
stringData:
  endpoint: http://minio.minio.svc:9000
  bucket: tempo
  access_key_id: tempo
  access_key_secret: <secret>
type: Opaque

Create a TempoMonolithic instance in the project that you created for it.

Verify that the status of all TempoMonolithic components is Running and the conditions are type: Ready by running the following command:

$ oc get tempomonolithic.tempo.grafana.com <metadata_name_of_tempomonolithic_cr> -o yaml

Run the following command to verify that the pod of the TempoMonolithic instance is running:

$ oc get pods

Access the Jaeger UI:

When the pod of the TempoMonolithic instance is ready, you can send traces to the tempo-<metadata_name_of_tempomonolithic_cr>:4317 (OTLP/gRPC) and tempo-<metadata_name_of_tempomonolithic_cr>:4318 (OTLP/HTTP) endpoints inside the cluster.

Create an AWS S3 bucket.

Create the following trust.json file for the AWS IAM policy that will set up a trust relationship for the AWS IAM role, created in the next step, with the service account of the TempoStack instance:

{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "Federated": "arn:aws:iam::${<aws_account_id>}:oidc-provider/${<oidc_provider>}" (1)
        },
        "Action": "sts:AssumeRoleWithWebIdentity",
        "Condition": {
          "StringEquals": {
            "${OIDC_PROVIDER}:sub": [
              "system:serviceaccount:${<openshift_project_for_tempostack>}:tempo-${<tempostack_cr_name>}" (2)
              "system:serviceaccount:${<openshift_project_for_tempostack>}:tempo-${<tempostack_cr_name>}-query-frontend"
           ]
         }
       }
     }
    ]
}

Create an AWS IAM role by attaching the trust.json policy file that you created:

$ aws iam create-role \
      --role-name "tempo-s3-access" \
      --assume-role-policy-document "file:///tmp/trust.json" \
      --query Role.Arn \
      --output text

Attach an AWS IAM policy to the created role:

$ aws iam attach-role-policy \
      --role-name "tempo-s3-access" \
      --policy-arn "arn:aws:iam::aws:policy/AmazonS3FullAccess"

In the OpenShift Container Platform, create an object storage secret with keys as follows:

apiVersion: v1
kind: Secret
metadata:
  name: minio-test
stringData:
  bucket: <s3_bucket_name>
  region: <s3_region>
  role_arn: <s3_role_arn>
type: Opaque