feat: add tempo helmfile setup

helmfile.d/tempo.yaml.gotmpl

@@ -0,0 +1,42 @@
+bases:
+ - ../envs/environments.yaml.gotmpl
+
+repositories:
+- name: tempo
+  url: https://grafana.github.io/helm-charts
+
+commonLabels:
+  tier: system
+
+releases:
+- name: tempo
+  namespace: tempo
+  chart: tempo/tempo
+  condition: tempo.enabled
+  values:
+  - ../values/tempo/values/values.yaml.gotmpl
+  - ../values/tempo/values/values-{{ .Environment.Name }}.yaml.gotmpl
+  postRenderer: ../bin/kustomizer
+  postRendererArgs:
+  - ../values/tempo/kustomize/{{ .Environment.Name }}
+  missingFileHandler: Info
+- name: manifests
+  namespace: tempo
+  chart: manifests
+  condition: tempo.enabled
+  missingFileHandler: Info
+  values:
+  - ../values/env.yaml
+  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+  - ../values/tempo/env.yaml.gotmpl
+  - ../values/tempo/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  hooks:
+  - events: [ prepare, cleanup ]
+    showlogs: true
+    command: ../bin/helmify
+    args:
+    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
+    - '{{`{{ .Release.Chart }}`}}'
+    - '{{`{{ .Environment.Name }}`}}'
+    - ../values/tempo/manifests
+    - manifests

values/tempo/env-oceanbox.yaml.gotmpl

@@ -0,0 +1,4 @@
+tempo:
+  enabled: true
+  autosync: false
+

values/tempo/env.yaml.gotmpl

@@ -1,12 +1,12 @@
 tempo:
   enabled: true
-  autosync: true
+  autosync: false
   s3:
-    endpoint: ""
+    endpoint: "http://10.255.241.30:30080"
-    region: ""
+    region: tos
     insecure_skip_verify: false
     secret:
-    name: ""
+      name: tempo-s3
-    access_key: ""
+      access_key: AWS_ACCESS_KEY_ID
-    access_secret: ""
+      access_secret: AWS_ACCESS_KEY_SECRET
-  bucketName: ""
+    bucket: tempo-traces

values/tempo/kustomize/base/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - _manifest.yaml

values/tempo/kustomize/default/kustomization.yaml

@@ -1,4 +0,0 @@
-generatorOptions:
-  disableNameSuffixHash: true
-resources:
-  - ../base

values/tempo/manifests/network/CiliumNetworkPolicy-allow-api-server.yaml

@@ -0,0 +1,14 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-api-server
+  namespace: tempo
+spec:
+  egress:
+    - toPorts:
+        - ports:
+            - port: "7946"
+              protocol: TCP
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: tempo

values/tempo/manifests/tempo.yaml

@@ -15,12 +15,16 @@ spec:
   sources:
   - repoURL: {{ .Values.clusterConfig.manifests }}
     targetRevision: HEAD
-    path: helmfiles/tempo
+    path: helmfile.d
     plugin:
-      name: helmfile
+      name: helmfile-cmp
       env:
       - name: CLUSTER_NAME
         value: {{ .Values.clusterConfig.cluster }}
+      - name: HELMFILE_ENVIRONMENT
+        value: default
+      - name: HELMFILE_FILE_PATH
+        value: tempo.yaml.gotmpl
   project: sys
   syncPolicy:
     managedNamespaceMetadata:

values/tempo/values/tempo.yaml.gotmpl

@@ -1,53 +0,0 @@
-tempo:
-    reportingEnabled: false
-    storage:
-    trace:
-        backend: s3
-        s3:
-        bucket: {{ .Values.tempo.bucketName | default "tempo-traces" }}
-        endpoint: {{ .Values.tempo.s3.endpoint | default "https://s3.production.itpartner.no" }}
-        prefix: traces
-        access_key: ${S3KEY}
-        secret_key: ${S3SECRET}
-        forcepathstyle: true
-        region: us-east-1
-        {{- if .Values.tempo.s3.insecure_skip_verify }}
-        tls_insecure_skip_verify: true
-        {{- end }}
-        local:
-        path: /var/tempo/traces
-        wal:
-        path: /var/tempo/wal
-    metricsGenerator:
-    enabled: true
-    remoteWriteUrl: "http://prom-prometheus.prometheus:9090/api/v1/write"
-    extraArgs: { config.expand-env=true }
-    extraEnv:
-    - name: S3KEY
-    valueFrom:
-        secretKeyRef:
-        name: {{ .Values.tempo.secret.name | default "s3-credentials"}}
-        key: {{ .Values.tempo.secret.access_key | default "access_key" }}
-    - name: S3SECRET
-    valueFrom:
-        secretKeyRef:
-        name: {{ .Values.tempo.secret.name | default "s3-credentials"}}
-        key: {{ .Values.tempo.secret.access_key | default "access_secret" }}
-tempoQuery:
-    ingress:
-    enabled: true
-    ingressClassName: nginx
-    annotations:
-        cert-manager.io/cluster-issuer: {{ .Values.cluster_config.ingress_clusterissuer }}
-        nginx.ingress.kubernetes.io/ssl-redirect: "true"
-        {{- with .Values.cluster_config.ingress_whitelist }}
-        nginx.ingress.kubernetes.io/whitelist-source-range: {{ join "," . }}
-        {{- end }}
-    path: /
-    pathType: Prefix
-    hosts:
-        - query.tempo.{{ .Values.cluster_config.domain }}
-    tls:
-        - secretName: tempo-query-tls
-        hosts:
-            - query.tempo.{{ .Values.cluster_config.domain }}

values/tempo/values/values.yaml.gotmpl

@@ -0,0 +1,51 @@
+tempo:
+  reportingEnabled: false
+  storage:
+    trace:
+      backend: s3
+      s3:
+        bucket: {{ .Values.tempo.s3.bucket | default "tempo-traces" }}
+        endpoint: {{ .Values.tempo.s3.endpoint }}
+        prefix: traces
+        access_key: ${S3KEY}
+        secret_key: ${S3SECRET}
+        forcepathstyle: true
+        insecure: true
+      local:
+        path: /var/tempo/traces
+      wal:
+        path: /var/tempo/wal
+  metricsGenerator:
+    enabled: true
+    remoteWriteUrl: "http://prom-prometheus.prometheus:9090/api/v1/write"
+  extraArgs: { config.expand-env=true }
+  extraEnv:
+  - name: S3KEY
+    valueFrom:
+      secretKeyRef:
+      name: {{ .Values.tempo.s3.secret.name | default "s3-credentials"}}
+      key: {{ .Values.tempo.s3.secret.access_key | default "access_key" }}
+  - name: S3SECRET
+    valueFrom:
+      secretKeyRef:
+      name: {{ .Values.tempo.s3.secret.name | default "s3-credentials"}}
+      key: {{ .Values.tempo.s3.secret.access_key | default "access_secret" }}
+tempoQuery:
+  ingress:
+    enabled: true
+    ingressClassName: nginx
+    annotations:
+      cert-manager.io/cluster-issuer: {{ .Values.clusterConfig.ingress_clusterissuer }}
+      nginx.ingress.kubernetes.io/ssl-redirect: "true"
+      {{- with .Values.clusterConfig.ingress_whitelist }}
+      nginx.ingress.kubernetes.io/whitelist-source-range: {{ join "," . }}
+      {{- end }}
+      oceanbox.io/expose: internal
+    path: /
+    pathType: Prefix
+    hosts:
+      - query.tempo.{{ .Values.clusterConfig.domain }}
+    tls:
+      - secretName: tempo-query-tls
+        hosts:
+        - query.tempo.{{ .Values.clusterConfig.domain }}