Add support for query RBAC

[pavolloffay]

Depends on observatorium/api#789

TEMPO_GATEWAY_IMAGE=docker.io/pavolloffay/obs-api:51 IMG_PREFIX=docker.io/pavolloffay OPERATOR_VERSION=$(date +%s).0.0 BUNDLE_VARIANT=openshift make docker-build docker-push bundle bundle-build bundle-push olm-upgrade reset

 k apply -f tests/e2e-openshift/multitenancy/02-install-otelcol.yaml
k apply -f tests/e2e-openshift/multitenancy/00-install-storage.yaml 
k apply -f tests/e2e-openshift/multitenancy/01-install-tempo.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: job-tempo-query
automountServiceAccountToken: true
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: tempostack-traces-reader
rules:
  - apiGroups:
      - 'tempo.grafana.com'
    resources:
      - dev
    resourceNames:
      - traces
    verbs:
      - 'get'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: tempo-job-view
  namespace: chainsaw-multitenancy
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: tempostack-traces-reader
subjects:
- kind: ServiceAccount
  name: job-tempo-query
  namespace: chainsaw-multitenancy
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: view
  namespace: chainsaw-multitenancy
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: view
subjects:
- kind: ServiceAccount
  name: job-tempo-query
  namespace: chainsaw-multitenancy


apiVersion: batch/v1
kind: Job
metadata:
  name: verify-traces-grpc
  namespace: chainsaw-multitenancy
spec:
  template:
    spec:
      serviceAccountName: job-tempo-query
      containers:
      - name: verify-traces
        image: ghcr.io/grafana/tempo-operator/test-utils:main
        command:
        - /bin/bash
        - -eux
        - -c
        args:
        - |
          token=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
          curl \
            -v -G \
            --header "Authorization: Bearer $token" \
            --header "X-Scope-OrgID: dev" \
            --cacert /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt \
           https://tempo-simplest-gateway.chainsaw-multitenancy.svc:8080/api/traces/v1/dev/tempo/api/search --data-urlencode 'q={ }' \
            | tee /tmp/jaeger.out
      restartPolicy: Never

[codecov-commenter]

Codecov Report

Attention: Patch coverage is 46.66667% with 16 lines in your changes missing coverage. Please review.

Project coverage is 58.61%. Comparing base (c2c2f7b) to head (f4071b9).

Files with missing lines	Patch %	Lines
api/tempo/v1alpha1/zz_generated.deepcopy.go	0.00%	10 Missing ⚠️
internal/manifests/gateway/gateway.go	68.42%	4 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1100      +/-   ##
==========================================
- Coverage   58.64%   58.61%   -0.04%     
==========================================
  Files         113      113              
  Lines       10145    10175      +30     
==========================================
+ Hits         5950     5964      +14     
- Misses       3892     3906      +14     
- Partials      303      305       +2     

Flag	Coverage Δ
unittests	58.61% <46.66%> (-0.04%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.