Skip to content

Tempo

Grafana Tempo is the tracing backend deployed by this package. Big Bang installs the upstream Tempo chart in single-binary mode and integrates it with Big Bang networking, mesh, storage, monitoring, and test resources. Grafana owns the Tempo datasource and trace UI; refer to the Grafana package documentation for that integration.

Configuration

Configure the package from the umbrella’s tempo parent. Big Bang-specific settings, such as objectStorage, metricsGenerator, and package values, are owned by the umbrella. General Tempo chart configuration is passed through tempo.values.upstream.

Use the Tempo chart values for version 3.2.1 and the Tempo configuration reference for upstream configuration options. Do not copy nested upstream values into the umbrella configuration.

Trace ingestion and querying

The default upstream configuration enables OpenTelemetry receivers, including OTLP gRPC on port 4317. Big Bang also configures the Zipkin receiver on port 9411. Coordinate any receiver or port change with the trace producer and the Big Bang NetworkPolicy configuration. Alloy owns collector configuration and Grafana and Kiali own their query/UI integrations.

Tempo exposes its HTTP endpoint on port 3200. Big Bang permits the Grafana, Kiali, and monitoring service accounts to reach that endpoint when their corresponding packages are enabled. This package does not deploy a standalone Tempo Query or Jaeger UI; the legacy Tempo UI/SSO configuration is not a current integration path.

Storage and retention

The package defaults to local storage in the single-binary StatefulSet. For production, configure a durable S3-compatible object store through the umbrella’s tempo.objectStorage parent and explicitly review retention and replica behavior. The umbrella creates the object-storage Secret and injects its credentials into the Tempo workload; do not put credentials in a ConfigMap or package documentation.

See Tempo in Production for the Big Bang storage boundary. For storage backends and retention behavior, use the upstream Tempo configuration reference.

Monitoring, dashboards, and mesh

When both the umbrella monitoring package and tempo.metricsGenerator are enabled, Big Bang configures Tempo metrics-generator remote write to the monitoring endpoint. This package supplies Tempo dashboards only when the metrics generator is enabled. Rendering those resources does not prove traces or generated metrics are flowing; verify telemetry in the deployed collector, Tempo, monitoring, and Grafana components.

The package renders bb-common NetworkPolicies, Istio resources, and routes when enabled by the umbrella. In strict mTLS deployments, the umbrella applies the scrape compatibility post-renderer for Tempo’s ServiceMonitor. Coordinate mesh mode, receiver exposure, and NetworkPolicy changes with the umbrella and the receiving packages.

Migrating to the bb-common subchart

Starting with chart 3.2.1-bb.1, move package overrides for istio, networkPolicies, and routes beneath bb-common. Use the matching Big Bang umbrella integration when upgrading. For example:

packages:
  tempo:
    values:
      bb-common:
        istio:
          sidecar:
            enabled: true
          authorizationPolicies:
            enabled: true
            generateFromNetpol: true
        networkPolicies:
          enabled: true
        routes:
          inbound:
            tempo-query:
              enabled: false

Replace istio.hardened.enabled with the explicit sidecar and authorization policy switches above (sidecars must be disabled in ambient mode). Move legacy istio.hardened.customServiceEntries to bb-common.istio.serviceEntries.custom and istio.hardened.customAuthorizationPolicies to bb-common.istio.authorizationPolicies.custom. Remove istio.injection; the umbrella owns workload injection. The obsolete networkPolicies.ingressLabels setting is removed; configure ingress through bb-common.routes instead.

Direct chart consumers must also move domain to global.domain. The umbrella maps its domain automatically. Remove the old networkPolicies.controlPlaneCidr setting; the upgrade Job now uses the shared kubeAPI egress definition. Its pre-upgrade NetworkPolicy is generated by bb-common and selects the Job’s existing app.kubernetes.io/name: tempo-upgrade-job pod label. Upgrade Job configuration remains package-owned; the umbrella does not derive its name or policy selector. The legacy upgrade Job’s labels and version guard are unchanged. The policy runs at the pre-upgrade hook phase; it does not enable the Job on nonqualifying upgrades. If customizing upgradeJob.hook, also align the policy’s annotations under bb-common.networkPolicies.egress.from.tempo-upgrade-job.metadata.annotations.

The default kubeAPI definition permits the private ranges 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, with API ports discovered from the default/kubernetes Service. For an API endpoint outside those ranges, or to restrict access further, configure the umbrella’s shared definition (using your actual API endpoint CIDR and target port):

networkPolicies:
  egress:
    definitions:
      kubeAPI:
        to:
          - ipBlock:
              cidr: 10.0.0.10/32
        ports:
          - port: 6443
            protocol: TCP

Direct chart consumers can set the same definition beneath bb-common.networkPolicies.egress.definitions.kubeAPI.

Because subcharts cannot read parent-chart values, a custom Job name requires a matching policy selector. Set both in the package values (beneath packages.tempo.values when deploying through Big Bang):

upgradeJob:
  name: custom-tempo-upgrade
bb-common:
  networkPolicies:
    egress:
      from:
        tempo-upgrade-job:
          podSelector:
            matchLabels:
              app.kubernetes.io/name: custom-tempo-upgrade

Dependencies and upgrade considerations

The umbrella conditionally orders Tempo after monitoring and Istio when those integrations are enabled. The legacy SSO setting also adds an Authservice dependency, but it does not establish a current Tempo UI integration.

The package includes a guarded pre-upgrade hook for upgrades from chart versions before 1.23.0-bb.0; it recreates the Tempo StatefulSet to handle immutable fields. Do not enable, broaden, or run that hook as a routine operational step without maintainer approval and a disposable upgrade test.

Upstream references