tests: update operator-metrics thresholds and chainsaw apply timeout

.chainsaw-openshift.yaml

@@ -10,4 +10,4 @@ spec:
     delete: 5m00s
     error: 5m00s
     exec: 5m00s
-    apply: 10s
+    apply: 30s

.chloggen/feat_metrics-generator.yaml

@@ -0,0 +1,35 @@
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: new_component
+
+# The name of the component, or a single word describing the area of concern, (e.g. tempostack, tempomonolithic, github action)
+component: metrics-generator
+
+# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Add support for deploying metrics-generator via TempoStack resource.
+
+# One or more tracking issues related to the change
+issues: [1120]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext: |
+  To enable the metrics-generator, add a `metricsGenerator` section to the TempoStack spec:
+
+  ```yaml
+  spec:
+    template:
+      metricsGenerator:
+        enabled: true
+        remoteWriteURLs:
+          - http://prometheus:9090/api/v1/write
+        processors: ['service-graphs', 'span-metrics', 'local-blocks']
+  ```
+
+  `enabled` must be set to `true` to deploy the metrics-generator component.
+  `remoteWriteURLs` is required and must contain at least one Prometheus remote write endpoint.
+  `processors` is optional. span-metrics, service-graphs, and local-blocks are enabled by default.
+
+  Additional metrics-generator configuration can be set via `extraConfig.tempo`. Refer to the
+  [Tempo metrics-generator documentation](https://grafana.com/docs/tempo/latest/configuration/#metrics-generator)
+  for all available options.

.chloggen/optional-defaulted-required-fields.yaml

@@ -0,0 +1,16 @@
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: bug_fix
+
+# The name of the component, or a single word describing the area of concern, (e.g. tempostack, tempomonolithic, github action)
+component: tempostack
+
+# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Mark `spec.managementState` and `spec.tenants.mode` optional so they are no longer listed as required in the generated CRDs. Both have defaults, so offline validators (e.g. kubeconform) no longer reject valid resources that omit them.
+
+# One or more tracking issues related to the change
+issues: [1491]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:

.github/workflows/actionlint.yaml

@@ -41,7 +41,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 

.github/workflows/changelog.yaml

@@ -37,7 +37,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0
           persist-credentials: false

.github/workflows/continuous-integration.yaml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -50,20 +50,20 @@ jobs:
       security-events: write # write CodeQL alerts
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/init@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1
         with:
           languages: go
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/autobuild@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/analyze@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1
 
   # Diffs dependency changes in a PR and flags new CVEs or incompatible licenses.
   dependency-review:
@@ -75,7 +75,7 @@ jobs:
       pull-requests: write # to post findings as a PR comment
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 
@@ -87,7 +87,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 

.github/workflows/e2e.yaml

@@ -29,7 +29,7 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
 
@@ -60,7 +60,7 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         fetch-depth: 0
         persist-credentials: false

.github/workflows/prepare-release.yaml

@@ -28,7 +28,7 @@ jobs:
               --force
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           repository: ${{ env.OPERATOR_BOT_USER }}/${{ github.event.repository.name }}
           token: ${{ secrets.TEMPOOPERATORBOT_GITHUB_TOKEN }}

.github/workflows/publish-test-utils-image.yaml

@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 

.github/workflows/release.yaml

@@ -17,7 +17,7 @@ jobs:
       operator_version: ${{ steps.operator-version.outputs.version }}
     steps:
     - name: Checkout
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         ref: main
         token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/reusable-operator-hub-release.yaml

@@ -42,14 +42,14 @@ jobs:
               --force
 
       - name: Checkout operatorhub repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           repository: tempooperatorbot/${{ inputs.repo }}
           token: ${{ secrets.TEMPOOPERATORBOT_GITHUB_TOKEN }}
           persist-credentials: false
 
       - name: Checkout tempo-operator to tmp/ directory
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           repository: ${{ inputs.oprepo }}
           token: ${{ secrets.TEMPOOPERATORBOT_GITHUB_TOKEN }}

.github/workflows/reusable-publish-images.yaml

@@ -23,7 +23,7 @@ jobs:
       packages: write # push container image
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 

.github/workflows/scorecard.yaml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 

.github/workflows/validate-test-utils-image.yaml

@@ -19,7 +19,7 @@ jobs:
     permissions: {}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 

Dockerfile

@@ -1,6 +1,6 @@
 # Build the manager binary
 # Digest pinned to golang:1.25 as of 2026-05-26; Dependabot will raise PRs when it changes.
-FROM golang:1.25@sha256:c138bff780910acf4254ab3a6f7ff0f64bbd841f27bd82bfa986fe122c109538 AS builder
+FROM golang:1.25@sha256:dd7d32e19b28621cd982082397fc0510d396805b717d5e77466aa2dd692340de AS builder
 
 WORKDIR /workspace
 # Cache tool dependencies

api/tempo/v1alpha1/auth.go

@@ -19,11 +19,11 @@ const (
 type TenantsSpec struct {
 	// Mode defines the multitenancy mode.
 	//
-	// +required
-	// +kubebuilder:validation:Required
+	// +optional
+	// +kubebuilder:validation:Optional
 	// +kubebuilder:default:=static
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:select:static","urn:alm:descriptor:com.tectonic.ui:select:openshift"},displayName="Mode"
-	Mode ModeType `json:"mode"`
+	Mode ModeType `json:"mode,omitempty"`
 
 	// Authentication defines the tempo-gateway component authentication configuration spec per tenant.
 	//

api/tempo/v1alpha1/tempostack_types.go

@@ -53,8 +53,8 @@ type TempoStackSpec struct {
 	// ManagementState defines if the CR should be managed by the operator or not.
 	// Default is managed.
 	//
-	// +required
-	// +kubebuilder:validation:Required
+	// +optional
+	// +kubebuilder:validation:Optional
 	// +kubebuilder:default:=Managed
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:select:Managed","urn:alm:descriptor:com.tectonic.ui:select:Unmanaged"},displayName="Management State"
 	ManagementState ManagementStateType `json:"managementState,omitempty"`
@@ -346,6 +346,13 @@ type ComponentStatus struct {
 	// +kubebuilder:validation:Optional
 	// +operator-sdk:csv:customresourcedefinitions:type=status,xDescriptors="urn:alm:descriptor:com.tectonic.ui:podStatuses",displayName="Gateway",order=6
 	Gateway PodStatusMap `json:"gateway"`
+
+	// MetricsGenerator is a map to the per pod status of the metrics-generator deployment.
+	//
+	// +optional
+	// +kubebuilder:validation:Optional
+	// +operator-sdk:csv:customresourcedefinitions:type=status,xDescriptors="urn:alm:descriptor:com.tectonic.ui:podStatuses",displayName="Metrics Generator",order=7
+	MetricsGenerator PodStatusMap `json:"metricsGenerator,omitempty"`
 }
 
 // TempoStackStatus defines the observed state of TempoStack.
@@ -601,6 +608,48 @@ type TempoTemplateSpec struct {
 	// +kubebuilder:validation:Optional
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Gateway pods"
 	Gateway TempoGatewaySpec `json:"gateway,omitempty"`
+
+	// MetricsGenerator defines the metrics-generator component spec.
+	//
+	// +optional
+	// +kubebuilder:validation:Optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Metrics Generator pods"
+	MetricsGenerator TempoMetricsGeneratorSpec `json:"metricsGenerator,omitempty"`
+}
+
+// TempoMetricsGeneratorSpec defines the metrics-generator component spec.
+type TempoMetricsGeneratorSpec struct {
+	// Enabled defines if the Metrics Generator component should be deployed.
+	//
+	// +optional
+	// +kubebuilder:validation:Optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Enable metrics generator",xDescriptors="urn:alm:descriptor:com.tectonic.ui:booleanSwitch"
+	Enabled bool `json:"enabled"`
+
+	// TempoComponentSpec is embedded to extend this definition with further options.
+	//
+	// Currently, there is no way to inline this field.
+	// See: https://github.com/golang/go/issues/6213
+	//
+	// +optional
+	// +kubebuilder:validation:Optional
+	TempoComponentSpec `json:"component,omitempty"`
+
+	// RemoteWriteURLs defines the list of Prometheus remote write endpoints
+	// to which the metrics-generator will push generated metrics.
+	//
+	// +optional
+	// +kubebuilder:validation:Optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Remote Write URLs"
+	RemoteWriteURLs []string `json:"remoteWriteURLs,omitempty"`
+
+	// Processors defines the list of metrics-generator processors to enable.
+	// If empty, span-metrics, service-graphs and local-blocks are enabled by default.
+	//
+	// +optional
+	// +kubebuilder:validation:Optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Processors"
+	Processors []string `json:"processors,omitempty"`
 }
 
 // TempoDistributorSpec defines the template of all requirements to configure