-
Bug
-
Resolution: Done
-
Undefined
-
None
-
None
-
None
-
Quality / Stability / Reliability
-
1
-
False
-
-
False
-
-
-
Tracing Sprint # 270, Tracing Sprint # 271
Description of the issue:
Currently we are supporting the following parameters for Tempo with GCP WIF.
data: bucketname: # Bucket name iam_sa: # a name for your the Google IAM service account iam_sa_project_id: # The project ID for your IAM service account.
We also need add parameter to set audience in the ID token required when the audience in the provider is different due to which the we cannot generate access token.
% oc logs tempo-gcpwiftm-compactor-75bbbbfd54-xx29x level=warn ts=2025-04-04T06:07:17.253908196Z caller=main.go:133 msg="-- CONFIGURATION WARNINGS --" level=warn ts=2025-04-04T06:07:17.253945244Z caller=main.go:139 msg="c.StorageConfig.Trace.Cache is deprecated and will be removed in a future release." explain="Please migrate to the top level cache settings config." level=info ts=2025-04-04T06:07:17.254039639Z caller=main.go:121 msg="Starting Tempo" version="(version=2.7.1, branch=HEAD, revision=ec946c4e8)" level=info msg="server listening on addresses" http=[::]:3101 grpc=[::]:44867 level=error ts=2025-04-04T06:07:17.401354391Z caller=main.go:124 msg="error running Tempo" err="failed to init module services: error initialising module: store: failed to create store: getting bucket attrs: Get \"https://storage.googleapis.com/storage/v1/b/ikanse-gcp-wif-tempo?alt=json&prettyPrint=false&projection=full\": oauth2/google: unable to generate access token: Post \"https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/ikanse-gcp-wif-tempo-sa@openshift-qe.iam.gserviceaccount.com:generateAccessToken\": oauth2/google: status code 400: {\"error\":\"invalid_grant\",\"error_description\":\"The audience in ID Token [https://storage.googleapis.com/ikanse-28-23186-oidc, https://kubernetes.default.svc] does not match the expected audience openshift.\"}"
Steps to reproduce the issue:
1. Install Tempo Operator built off the latest upstream main branch.
2. Deploy a OCP with GCP WIF support.
3. Create the required SA, roles, bucket and secret using the following script.
4. Create TempoStack instance using the following resource file.
5. Check the pod logs for auth errors.
Additional notes:
Loki Operator's GCP WIF docs: https://loki-operator.dev/docs/short_lived_tokens_authentication.md/#gcp-workload-identity-federation
