Repository: dasmeta/terraform-onpremise-grafana
Pull request #27: feat(DMVP-5039): add tempo
Author: login: SarhadMeta
Labels: name: released
Created: 2025-03-28T06:12:38Z | Merged: 2025-03-31T15:26:51Z



Diff:
diff --git a/README.md b/README.md
index 4f58cc4..509fd14 100644
--- a/README.md
+++ b/README.md
@@ -124,7 +124,9 @@ Check `./tests`, `modules/alert-rules/tests`, `modules/alert-contact-points/test
 
 ## Providers
 
-No providers.
+| Name | Version |
+|------|---------|
+| <a name="provider_grafana"></a> [grafana](#provider\_grafana) | 3.22.0 |
 
 ## Modules
 
@@ -134,10 +136,13 @@ No providers.
 | <a name="module_application_dashboard"></a> [application\_dashboard](#module\_application\_dashboard) | ./modules/dashboard/ | n/a |
 | <a name="module_grafana"></a> [grafana](#module\_grafana) | ./modules/grafana | n/a |
 | <a name="module_prometheus"></a> [prometheus](#module\_prometheus) | ./modules/prometheus | n/a |
+| <a name="module_tempo"></a> [tempo](#module\_tempo) | ./modules/tempo | n/a |
 
 ## Resources
 
-No resources.
+| Name | Type |
+|------|------|
+| [grafana_data_source.tempo](https://registry.terraform.io/providers/grafana/grafana/latest/docs/resources/data_source) | resource |
 
 ## Inputs
 
@@ -149,7 +154,9 @@ No resources.
 | <a name="input_grafana_admin_password"></a> [grafana\_admin\_password](#input\_grafana\_admin\_password) | grafana admin user password | `string` | `""` | no |
 | <a name="input_grafana_configs"></a> [grafana\_configs](#input\_grafana\_configs) | Values to construct the values file for Grafana Helm chart | <pre>object({<br/>    enabled = optional(bool, true)<br/>    resources = optional(object({<br/>      request = optional(object({<br/>        cpu = optional(string, "1")<br/>        mem = optional(string, "2Gi")<br/>      }), {})<br/>      limit = optional(object({<br/>        cpu = optional(string, "2")<br/>        mem = optional(string, "3Gi")<br/>      }), {})<br/>    }), {})<br/>    persistence = optional(object({<br/>      enabled = optional(bool, true)<br/>      type    = optional(string, "pvc")<br/>      size    = optional(string, "10Gi")<br/>    }), {})<br/>    ingress_configs = optional(object({<br/>      annotations = optional(map(string),<br/>        {<br/>          "kubernetes.io/ingress.class"                = "alb"<br/>          "alb.ingress.kubernetes.io/scheme"           = "internet-facing"<br/>          "alb.ingress.kubernetes.io/target-type"      = "ip"<br/>          "alb.ingress.kubernetes.io/listen-ports"     = "[{\"HTTP\": 80}]"<br/>          "alb.ingress.kubernetes.io/group.name"       = "monitoring"<br/>          "alb.ingress.kubernetes.io/healthcheck-path" = "/api/health"<br/>        }<br/>      )<br/>      hosts     = optional(list(string), ["grafana.example.com"])<br/>      path      = optional(string, "/")<br/>      path_type = optional(string, "Prefix")<br/>    }))<br/>    prometheus_url = optional(string, "http://prometheus-operated.monitoring.svc.cluster.local:9090")<br/><br/>    replicas  = optional(number, 1)<br/>    image_tag = optional(string, "11.4.2")<br/>  })</pre> | `{}` | no |
 | <a name="input_name"></a> [name](#input\_name) | Dashboard name | `string` | n/a | yes |
+| <a name="input_namespace"></a> [namespace](#input\_namespace) | n/a | `string` | `"monitoring"` | no |
 | <a name="input_prometheus_configs"></a> [prometheus\_configs](#input\_prometheus\_configs) | values to be used as prometheus's chart values | <pre>object({<br/>    enabled        = optional(bool, true)<br/>    retention_days = optional(string, "15d")<br/>    storage_class  = optional(string, "efs-sc-root")<br/>    storage_size   = optional(string, "10Gi")<br/>    resources = optional(object({<br/>      request = optional(object({<br/>        cpu = optional(string, "500m")<br/>        mem = optional(string, "500Mi")<br/>      }), {})<br/>      limit = optional(object({<br/>        cpu = optional(string, "1")<br/>        mem = optional(string, "1Gi")<br/>      }), {})<br/>    }), {})<br/>    enable_alertmanager = optional(bool, true)<br/>  })</pre> | `{}` | no |
+| <a name="input_tempo_configs"></a> [tempo\_configs](#input\_tempo\_configs) | confgis for tempo deployment | <pre>object({<br/>    enabled                  = optional(string, false)<br/>    tempo_image_tag          = optional(string, "2.4.0")<br/>    tempo_role_arn           = optional(string, "")<br/>    storage_backend          = optional(string, "s3") # "local" or "s3"<br/>    bucket_name              = optional(string)<br/>    enable_metrics_generator = optional(bool, true)<br/>    enable_service_monitor   = optional(bool, true)<br/>    oidc_provider_arn        = optional(string, "")<br/><br/>    persistence = optional(object({<br/>      enabled       = optional(bool, true)<br/>      size          = optional(string, "10Gi")<br/>      storage_class = optional(string, "gp2")<br/>    }), {})<br/><br/>    tempo_datasource_json = optional(object({<br/>      httpMethod = optional(string, "GET")<br/><br/>      tracesToMetrics = optional(object({<br/>        datasourceUid = optional(string, "prometheus")<br/>      }), {})<br/><br/>      serviceMap = optional(object({<br/>        datasourceUid = optional(string, "prometheus")<br/>      }), {})<br/><br/>      nodeGraph = optional(object({<br/>        enabled = optional(bool, true)<br/>      }), {})<br/>    }), {})<br/>  })</pre> | `{}` | no |
 
 ## Outputs
 
diff --git a/main.tf b/main.tf
index 264b01d..72fcf0f 100644
--- a/main.tf
+++ b/main.tf
@@ -33,6 +33,7 @@ module "grafana" {
   grafana_admin_password = var.grafana_admin_password
   configs                = var.grafana_configs
   aws_region             = var.aws_region
+  namespace              = var.namespace
 
 }
 
@@ -41,5 +42,31 @@ module "prometheus" {
 
   count = var.prometheus_configs.enabled ? 1 : 0
 
-  configs = var.prometheus_configs
+  configs   = var.prometheus_configs
+  namespace = var.namespace
+}
+
+module "tempo" {
+  source = "./modules/tempo"
+
+  count = var.tempo_configs.enabled ? 1 : 0
+
+  configs   = var.tempo_configs
+  region    = var.aws_region
+  namespace = var.namespace
+}
+
+resource "grafana_data_source" "tempo" {
+  count = var.tempo_configs.enabled ? 1 : 0
+
+  type        = "tempo"
+  name        = "Tempo"
+  access_mode = "proxy"
+  uid         = "tempo"
+  is_default  = false
+  url         = module.tempo[0].tempo_url
+
+  json_data_encoded = jsonencode(var.tempo_configs.tempo_datasource_json)
+
+  depends_on = [module.tempo, module.grafana]
 }
diff --git a/modules/prometheus/values/prometheus-values.yaml.tpl b/modules/prometheus/values/prometheus-values.yaml.tpl
index 37013f8..a051238 100644
--- a/modules/prometheus/values/prometheus-values.yaml.tpl
+++ b/modules/prometheus/values/prometheus-values.yaml.tpl
@@ -28,6 +28,25 @@ prometheus:
         memory: ${limit_mem}
         cpu: ${limit_cpu}
     serviceMonitorSelectorNilUsesHelmValues: false
+    podMonitorSelectorNilUsesHelmValues: false
+
+    additionalScrapeConfigs:
+      - job_name: "annotation-scrape"
+        kubernetes_sd_configs:
+          - role: pod
+        relabel_configs:
+          - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
+            action: keep
+            regex: "true"
+          - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
+            action: replace
+            target_label: __metrics_path__
+            regex: (.+)
+          - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
+            action: replace
+            target_label: __address__
+            regex: (.+):(?:\d+);(.+)
+            replacement: $1:$2
 
 alertmanager:
   enabled: ${enable_alertmanager}
diff --git a/modules/tempo/README.md b/modules/tempo/README.md
new file mode 100644
index 0000000..4414d64
--- /dev/null
+++ b/modules/tempo/README.md
@@ -0,0 +1,47 @@
+# tempo
+
+<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | > 5.0 |
+| <a name="requirement_helm"></a> [helm](#requirement\_helm) | >= 2.0 |
+| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >2.3 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | > 5.0 |
+| <a name="provider_helm"></a> [helm](#provider\_helm) | >= 2.0 |
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_tempo_bucket"></a> [tempo\_bucket](#module\_tempo\_bucket) | dasmeta/s3/aws | 1.3.1 |
+| <a name="module_tempo_iam_eks_role"></a> [tempo\_iam\_eks\_role](#module\_tempo\_iam\_eks\_role) | terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks | 5.53.0 |
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_iam_policy.tempo_s3_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
+| [helm_release.tempo](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_configs"></a> [configs](#input\_configs) | n/a | <pre>object({<br/>    tempo_image_tag          = optional(string, "2.4.0")<br/>    tempo_role_arn           = optional(string, "")<br/>    storage_backend          = optional(string, "s3") # "local" or "s3"<br/>    bucket_name              = optional(string, "")<br/>    enable_metrics_generator = optional(bool, true)<br/>    enable_service_monitor   = optional(bool, true)<br/>    tempo_role_name          = optional(string, "tempo-s3-role")<br/>    oidc_provider_arn        = optional(string, "")<br/><br/>    persistence = optional(object({<br/>      enabled       = optional(bool, true)<br/>      size          = optional(string, "10Gi")<br/>      storage_class = optional(string, "gp2")<br/>    }), {})<br/><br/>    service_account = optional(object({<br/>      name        = optional(string, "tempo-serviceaccount")<br/>      annotations = optional(map(string), {})<br/>    }), {})<br/>  })</pre> | n/a | yes |
+| <a name="input_namespace"></a> [namespace](#input\_namespace) | namespace for tempo deployment | `string` | `"monitoring"` | no |
+| <a name="input_region"></a> [region](#input\_region) | aws region | `string` | `"eu-central-1"` | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_tempo_url"></a> [tempo\_url](#output\_tempo\_url) | Internal Tempo service URL |
+<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
diff --git a/modules/tempo/locals.tf b/modules/tempo/locals.tf
new file mode 100644
index 0000000..fe130d5
--- /dev/null
+++ b/modules/tempo/locals.tf
@@ -0,0 +1,5 @@
+locals {
+  create_tempo_role           = var.configs.storage_backend == "s3" && var.configs.tempo_role_arn == ""
+  tempo_role                  = local.create_tempo_role ? module.tempo_iam_eks_role[0].iam_role_arn : (var.configs.storage_backend == "s3" ? var.configs.tempo_role_arn : "")
+  service_account_annotations = merge(var.configs.service_account.annotations, { "eks.amazonaws.com/role-arn" = local.tempo_role })
+}
diff --git a/modules/tempo/main.tf b/modules/tempo/main.tf
new file mode 100644
index 0000000..35256ae
--- /dev/null
+++ b/modules/tempo/main.tf
@@ -0,0 +1,82 @@
+resource "helm_release" "tempo" {
+  name             = "tempo"
+  repository       = "https://grafana.github.io/helm-charts"
+  chart            = "tempo"
+  version          = "1.18.3"
+  namespace        = var.namespace
+  create_namespace = true
+
+  values = [
+    templatefile("${path.module}/values/tempo-values.yaml.tpl", {
+      tempo_image_tag = var.configs.tempo_image_tag
+      storage_backend = var.configs.storage_backend
+      bucket_name     = module.tempo_bucket.s3_bucket_id
+      region          = var.region
+
+      persistence_enabled = var.configs.persistence.enabled
+      persistence_size    = var.configs.persistence.size
+      persistence_class   = var.configs.persistence.storage_class
+
+      enable_metrics_generator = var.configs.enable_metrics_generator
+      enable_service_monitor   = var.configs.enable_service_monitor
+
+      service_account_name        = var.configs.service_account.name
+      service_account_annotations = local.service_account_annotations
+    })
+  ]
+  depends_on = [module.tempo_bucket]
+}
+
+module "tempo_bucket" {
+  source  = "dasmeta/s3/aws"
+  version = "1.3.1"
+
+  name = var.configs.bucket_name
+
+}
+
+module "tempo_iam_eks_role" {
+  source  = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
+  version = "5.53.0"
+
+  count = local.create_tempo_role ? 1 : 0
+
+  role_name = "${var.configs.tempo_role_name}-role"
+  role_policy_arns = {
+    policy = resource.aws_iam_policy.tempo_s3_access[0].arn
+  }
+
+  oidc_providers = {
+    one = {
+      provider_arn               = var.configs.oidc_provider_arn
+      namespace_service_accounts = ["${var.namespace}:${var.configs.service_account.name}"]
+    }
+  }
+}
+
+resource "aws_iam_policy" "tempo_s3_access" {
+  count = local.create_tempo_role ? 1 : 0
+  name  = "${var.configs.tempo_role_name}-policy"
+  path  = "/"
+
+  policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [
+      {
+        Effect   = "Allow",
+        Action   = ["s3:ListBucket"],
+        Resource = "arn:aws:s3:::${var.configs.bucket_name}"
+      },
+      {
+        Effect = "Allow",
+        Action = [
+          "s3:GetObject",
+          "s3:PutObject",
+          "s3:DeleteObject"
+        ],
+        Resource = "arn:aws:s3:::${var.configs.bucket_name}/*"
+      }
+    ]
+  })
+
+}
diff --git a/modules/tempo/outputs.tf b/modules/tempo/outputs.tf
new file mode 100644
index 0000000..53019c9
--- /dev/null
+++ b/modules/tempo/outputs.tf
@@ -0,0 +1,4 @@
+output "tempo_url" {
+  description = "Internal Tempo service URL"
+  value       = "http://tempo.${var.namespace}.svc.cluster.local:3100"
+}
diff --git a/modules/tempo/tests/0-setup.tf b/modules/tempo/tests/0-setup.tf
new file mode 100644
index 0000000..af433f4
--- /dev/null
+++ b/modules/tempo/tests/0-setup.tf
@@ -0,0 +1,9 @@
+provider "helm" {
+  kubernetes {
+    config_path = "~/.kube/config"
+  }
+}
+
+provider "kubernetes" {
+  config_path = "~/.kube/config"
+}
diff --git a/modules/tempo/tests/1-example.tf b/modules/tempo/tests/1-example.tf
new file mode 100644
index 0000000..acf6457
--- /dev/null
+++ b/modules/tempo/tests/1-example.tf
@@ -0,0 +1,33 @@
+module "tempo" {
+  source = "../."
+  region = "us-east-2"
+
+  configs = {
+    enabled           = true
+    storage_backend   = "s3"
+    bucket_name       = "my-tempo-traces-kauwnw"
+    oidc_provider_arn = "eks-oidc-provider-arn"
+
+    enable_metrics_generator = true
+    enable_service_monitor   = true
+
+    persistence = {
+      enabled       = true
+      size          = "10Gi"
+      storage_class = "gp2"
+    }
+
+    ingress = {
+      enabled = true
+      annotations = {
+        "kubernetes.io/ingress.class"                = "nginx"
+        "nginx.ingress.kubernetes.io/rewrite-target" = "/"
+        "nginx.ingress.kubernetes.io/ssl-redirect"   = "true"
+      }
+      hosts     = ["tempo.example.com"]
+      path      = "/"
+      path_type = "Prefix"
+    }
+  }
+
+}
diff --git a/modules/tempo/tests/README.md b/modules/tempo/tests/README.md
new file mode 100644
index 0000000..a518157
--- /dev/null
+++ b/modules/tempo/tests/README.md
@@ -0,0 +1,29 @@
+# tests
+
+<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+## Requirements
+
+No requirements.
+
+## Providers
+
+No providers.
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_tempo"></a> [tempo](#module\_tempo) | ../. | n/a |
+
+## Resources
+
+No resources.
+
+## Inputs
+
+No inputs.
+
+## Outputs
+
+No outputs.
+<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
diff --git a/modules/tempo/values/tempo-values.yaml.tpl b/modules/tempo/values/tempo-values.yaml.tpl
new file mode 100644
index 0000000..c6d0880
--- /dev/null
+++ b/modules/tempo/values/tempo-values.yaml.tpl
@@ -0,0 +1,37 @@
+
+tempo:
+  image:
+    tag: ${tempo_image_tag}
+
+  storage:
+    trace:
+      backend: ${storage_backend}  # "s3" or "local"
+%{ if storage_backend == "s3" }
+      s3:
+        bucket: ${bucket_name}
+        endpoint: s3.${region}.amazonaws.com
+        region: ${region}
+        insecure: false
+%{ else }
+      local:
+        path: /var/tempo/traces
+%{ endif }
+
+  persistence:
+    enabled: ${persistence_enabled}
+    size: ${persistence_size}
+    storageClassName: ${persistence_class}
+
+  metricsGenerator:
+    enabled: ${enable_metrics_generator}
+
+serviceMonitor:
+  enabled: ${enable_service_monitor}
+
+serviceAccount:
+  create: true
+  name: ${service_account_name}
+  annotations:
+  %{for k, v in service_account_annotations }
+      ${k}: "${v}"
+  %{~ endfor }
diff --git a/modules/tempo/variables.tf b/modules/tempo/variables.tf
new file mode 100644
index 0000000..08052c1
--- /dev/null
+++ b/modules/tempo/variables.tf
@@ -0,0 +1,35 @@
+variable "namespace" {
+  type        = string
+  description = "namespace for tempo deployment"
+  default     = "monitoring"
+}
+
+variable "region" {
+  type        = string
+  description = "aws region"
+  default     = "eu-central-1"
+}
+
+variable "configs" {
+  type = object({
+    tempo_image_tag          = optional(string, "2.4.0")
+    tempo_role_arn           = optional(string, "")
+    storage_backend          = optional(string, "s3") # "local" or "s3"
+    bucket_name              = optional(string, "")
+    enable_metrics_generator = optional(bool, true)
+    enable_service_monitor   = optional(bool, true)
+    tempo_role_name          = optional(string, "tempo-s3-role")
+    oidc_provider_arn        = optional(string, "")
+
+    persistence = optional(object({
+      enabled       = optional(bool, true)
+      size          = optional(string, "10Gi")
+      storage_class = optional(string, "gp2")
+    }), {})
+
+    service_account = optional(object({
+      name        = optional(string, "tempo-serviceaccount")
+      annotations = optional(map(string), {})
+    }), {})
+  })
+}
diff --git a/modules/tempo/versions.tf b/modules/tempo/versions.tf
new file mode 100644
index 0000000..5b1e710
--- /dev/null
+++ b/modules/tempo/versions.tf
@@ -0,0 +1,12 @@
+terraform {
+  required_version = ">= 1.3.0"
+  required_providers {
+    aws = {
+      version = "> 5.0"
+    }
+    helm = ">= 2.0"
+    kubernetes = {
+      version = ">2.3"
+    }
+  }
+}
diff --git a/tests/base/0-setup.tf b/tests/base/0-setup.tf
index bc3c515..f0988c1 100644
--- a/tests/base/0-setup.tf
+++ b/tests/base/0-setup.tf
@@ -10,12 +10,16 @@ terraform {
       source  = "hashicorp/helm"
       version = "~> 2.17"
     }
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
   }
 }
 
 # you can start dev grafana server locally using `docker compose up -d` from `/tests` folder before running the test locally
 provider "grafana" {
-  url  = "https://grafana.example.com"
+  url  = "https://grafana.dev.trysela.com"
   auth = "admin:admin"
 
 }
@@ -25,3 +29,7 @@ provider "helm" {
     config_path = "~/.kube/config"
   }
 }
+
+provider "aws" {
+  region = "us-east-2"
+}
diff --git a/tests/base/1-example.tf b/tests/base/1-example.tf
index 27fc983..25cd28e 100644
--- a/tests/base/1-example.tf
+++ b/tests/base/1-example.tf
@@ -91,6 +91,36 @@ module "this" {
       hosts = ["grafana.example.com"]
     }
   }
+
+  tempo_configs = {
+    enabled         = true
+    storage_backend = "s3"
+    bucket_name     = "my-tempo-traces-kauwnw"
+    # tempo_role_arn    = "arn:aws:iam::12345678901:role/tempo-s3-access-manual" # if the role arn is provided then a role will not be created
+    oidc_provider_arn = ""
+
+    enable_metrics_generator = true
+    enable_service_monitor   = true
+
+    persistence = {
+      enabled       = true
+      size          = "10Gi"
+      storage_class = "gp2"
+    }
+
+    ingress = {
+      enabled = true
+      annotations = {
+        "kubernetes.io/ingress.class"                = "nginx"
+        "nginx.ingress.kubernetes.io/rewrite-target" = "/"
+        "nginx.ingress.kubernetes.io/ssl-redirect"   = "true"
+      }
+      hosts     = ["tempo.example.com"]
+      path      = "/"
+      path_type = "Prefix"
+    }
+  }
+
   grafana_admin_password = "admin"
   aws_region             = "us-east-2"
 }
diff --git a/tests/base/README.md b/tests/base/README.md
index ecdb921..f0da1fc 100644
--- a/tests/base/README.md
+++ b/tests/base/README.md
@@ -6,6 +6,7 @@
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 5.0 |
 | <a name="requirement_grafana"></a> [grafana](#requirement\_grafana) | ~>3.21.0  |
 | <a name="requirement_helm"></a> [helm](#requirement\_helm) | ~> 2.17 |
 
diff --git a/variables.tf b/variables.tf
index fe3eb34..3a70807 100644
--- a/variables.tf
+++ b/variables.tf
@@ -225,3 +225,45 @@ variable "aws_region" {
   type    = string
   default = "eu-central-1"
 }
+
+variable "tempo_configs" {
+  type = object({
+    enabled                  = optional(string, false)
+    tempo_image_tag          = optional(string, "2.4.0")
+    tempo_role_arn           = optional(string, "")
+    storage_backend          = optional(string, "s3") # "local" or "s3"
+    bucket_name              = optional(string)
+    enable_metrics_generator = optional(bool, true)
+    enable_service_monitor   = optional(bool, true)
+    oidc_provider_arn        = optional(string, "")
+
+    persistence = optional(object({
+      enabled       = optional(bool, true)
+      size          = optional(string, "10Gi")
+      storage_class = optional(string, "gp2")
+    }), {})
+
+    tempo_datasource_json = optional(object({
+      httpMethod = optional(string, "GET")
+
+      tracesToMetrics = optional(object({
+        datasourceUid = optional(string, "prometheus")
+      }), {})
+
+      serviceMap = optional(object({
+        datasourceUid = optional(string, "prometheus")
+      }), {})
+
+      nodeGraph = optional(object({
+        enabled = optional(bool, true)
+      }), {})
+    }), {})
+  })
+  description = "confgis for tempo deployment"
+  default     = {}
+}
+
+variable "namespace" {
+  type    = string
+  default = "monitoring"
+}


Reviews:
user: login: github-advanced-security[bot]
state: COMMENTED
author_association: NONE
submitted_at: 2025-03-28T06:13:06Z
user: login: mrdntgrn
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-28T07:01:04Z
user: login: SarhadMeta
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-28T08:34:35Z
user: login: SarhadMeta
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-28T08:36:00Z
user: login: mrdntgrn
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-28T10:49:56Z
user: login: mrdntgrn
state: DISMISSED
author_association: CONTRIBUTOR
submitted_at: 2025-03-31T11:10:59Z
user: login: mrdntgrn
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-03-31T15:25:19Z

Review comments:
diff_hunk: @@ -41,5 +42,31 @@
 
   count = var.prometheus_configs.enabled ? 1 : 0
 
-  configs = var.prometheus_configs
+  configs   = var.prometheus_configs
+  namespace = var.namespace
+}
+
+module "tempo" {
+  source = "./modules/tempo"
+
+  count = var.tempo_configs.enabled ? 1 : 0
+
+  configs   = var.tempo_configs
+  region    = var.aws_region
+  namespace = var.namespace
+}
path: main.tf
user: login: github-advanced-security[bot]
body: ## S3 Access block should block public ACL

Public access block does not block public ACLs

[Show more details](https://github.com/dasmeta/terraform-onpremise-grafana/security/code-scanning/37)
created_at: 2025-03-28T06:13:05Z
author_association: NONE
diff_hunk: @@ -41,5 +42,31 @@
 
   count = var.prometheus_configs.enabled ? 1 : 0
 
-  configs = var.prometheus_configs
+  configs   = var.prometheus_configs
+  namespace = var.namespace
+}
+
+module "tempo" {
+  source = "./modules/tempo"
+
+  count = var.tempo_configs.enabled ? 1 : 0
+
+  configs   = var.tempo_configs
+  region    = var.aws_region
+  namespace = var.namespace
+}
path: main.tf
user: login: github-advanced-security[bot]
body: ## S3 Access block should block public policy

Public access block does not block public policies

[Show more details](https://github.com/dasmeta/terraform-onpremise-grafana/security/code-scanning/38)
created_at: 2025-03-28T06:13:06Z
author_association: NONE
diff_hunk: @@ -41,5 +42,31 @@
 
   count = var.prometheus_configs.enabled ? 1 : 0
 
-  configs = var.prometheus_configs
+  configs   = var.prometheus_configs
+  namespace = var.namespace
+}
+
+module "tempo" {
+  source = "./modules/tempo"
+
+  count = var.tempo_configs.enabled ? 1 : 0
+
+  configs   = var.tempo_configs
+  region    = var.aws_region
+  namespace = var.namespace
+}
path: main.tf
user: login: github-advanced-security[bot]
body: ## Unencrypted S3 bucket.

Bucket does not have encryption enabled

[Show more details](https://github.com/dasmeta/terraform-onpremise-grafana/security/code-scanning/39)
created_at: 2025-03-28T06:13:06Z
author_association: NONE
diff_hunk: @@ -41,5 +42,31 @@
 
   count = var.prometheus_configs.enabled ? 1 : 0
 
-  configs = var.prometheus_configs
+  configs   = var.prometheus_configs
+  namespace = var.namespace
+}
+
+module "tempo" {
+  source = "./modules/tempo"
+
+  count = var.tempo_configs.enabled ? 1 : 0
+
+  configs   = var.tempo_configs
+  region    = var.aws_region
+  namespace = var.namespace
+}
path: main.tf
user: login: github-advanced-security[bot]
body: ## S3 Bucket does not have logging enabled.

Bucket does not have logging enabled

[Show more details](https://github.com/dasmeta/terraform-onpremise-grafana/security/code-scanning/40)
created_at: 2025-03-28T06:13:06Z
author_association: NONE
diff_hunk: @@ -41,5 +42,31 @@
 
   count = var.prometheus_configs.enabled ? 1 : 0
 
-  configs = var.prometheus_configs
+  configs   = var.prometheus_configs
+  namespace = var.namespace
+}
+
+module "tempo" {
+  source = "./modules/tempo"
+
+  count = var.tempo_configs.enabled ? 1 : 0
+
+  configs   = var.tempo_configs
+  region    = var.aws_region
+  namespace = var.namespace
+}
path: main.tf
user: login: github-advanced-security[bot]
body: ## S3 Data should be versioned

Bucket does not have versioning enabled

[Show more details](https://github.com/dasmeta/terraform-onpremise-grafana/security/code-scanning/41)
created_at: 2025-03-28T06:13:06Z
author_association: NONE
diff_hunk: @@ -41,5 +42,31 @@
 
   count = var.prometheus_configs.enabled ? 1 : 0
 
-  configs = var.prometheus_configs
+  configs   = var.prometheus_configs
+  namespace = var.namespace
+}
+
+module "tempo" {
+  source = "./modules/tempo"
+
+  count = var.tempo_configs.enabled ? 1 : 0
+
+  configs   = var.tempo_configs
+  region    = var.aws_region
+  namespace = var.namespace
+}
path: main.tf
user: login: github-advanced-security[bot]
body: ## S3 encryption should use Customer Managed Keys

Bucket does not encrypt data with a customer managed key.

[Show more details](https://github.com/dasmeta/terraform-onpremise-grafana/security/code-scanning/42)
created_at: 2025-03-28T06:13:06Z
author_association: NONE
diff_hunk: @@ -41,5 +42,31 @@
 
   count = var.prometheus_configs.enabled ? 1 : 0
 
-  configs = var.prometheus_configs
+  configs   = var.prometheus_configs
+  namespace = var.namespace
+}
+
+module "tempo" {
+  source = "./modules/tempo"
+
+  count = var.tempo_configs.enabled ? 1 : 0
+
+  configs   = var.tempo_configs
+  region    = var.aws_region
+  namespace = var.namespace
+}
path: main.tf
user: login: github-advanced-security[bot]
body: ## S3 Access Block should Ignore Public Acl

Public access block does not ignore public ACLs

[Show more details](https://github.com/dasmeta/terraform-onpremise-grafana/security/code-scanning/43)
created_at: 2025-03-28T06:13:06Z
author_association: NONE
diff_hunk: @@ -41,5 +42,31 @@
 
   count = var.prometheus_configs.enabled ? 1 : 0
 
-  configs = var.prometheus_configs
+  configs   = var.prometheus_configs
+  namespace = var.namespace
+}
+
+module "tempo" {
+  source = "./modules/tempo"
+
+  count = var.tempo_configs.enabled ? 1 : 0
+
+  configs   = var.tempo_configs
+  region    = var.aws_region
+  namespace = var.namespace
+}
path: main.tf
user: login: github-advanced-security[bot]
body: ## S3 Access block should restrict public bucket to limit access

Public access block does not restrict public buckets

[Show more details](https://github.com/dasmeta/terraform-onpremise-grafana/security/code-scanning/44)
created_at: 2025-03-28T06:13:06Z
author_association: NONE
diff_hunk: @@ -0,0 +1,90 @@
+resource "helm_release" "tempo" {
+  name             = "tempo"
+  repository       = "https://grafana.github.io/helm-charts"
+  chart            = "tempo"
+  version          = "1.18.3"
+  namespace        = var.namespace
+  create_namespace = true
+
+  values = [
+    templatefile("${path.module}/values/tempo-values.yaml.tpl", {
+      tempo_image_tag = var.configs.tempo_image_tag
+      storage_backend = var.configs.storage_backend
+      bucket_name     = module.my_bucket.s3_bucket_id
+      region          = var.region
+
+      persistence_enabled = var.configs.persistence.enabled
+      persistence_size    = var.configs.persistence.size
+      persistence_class   = var.configs.persistence.storage_class
+
+      enable_metrics_generator = var.configs.enable_metrics_generator
+      enable_service_monitor   = var.configs.enable_service_monitor
+
+      enable_ingress      = var.configs.ingress.enabled
+      ingress_annotations = var.configs.ingress.annotations
+      ingress_hosts       = var.configs.ingress.hosts
+      ingress_path        = var.configs.ingress.path
+      ingress_path_type   = var.configs.ingress.path_type
+
+      service_account_name        = var.configs.service_account.name
+      service_account_annotations = local.service_account_annotations
+    })
+  ]
+  depends_on = [module.my_bucket]
+}
+
+module "my_bucket" {
+  source  = "dasmeta/s3/aws"
+  version = "1.2.1"
+
+  name = var.configs.bucket_name
+
+
+  acl = "public"
+}
+
+module "tempo_iam_eks_role" {
+  source  = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
+  version = "5.53.0"
+
+  count = var.configs.storage_backend == "s3" && var.configs.tempo_role_arn == "" ? 1 : 0
+
+  role_name = var.configs.tempo_role_name
+  role_policy_arns = {
+    policy = resource.aws_iam_policy.tempo_s3_access[0].arn
+  }
+
+  oidc_providers = {
+    one = {
+      provider_arn               = var.configs.oidc_provider_arn
+      namespace_service_accounts = ["${var.namespace}:${var.configs.service_account.name}"]
+    }
+  }
+}
+
+resource "aws_iam_policy" "tempo_s3_access" {
+  count = var.configs.storage_backend == "s3" && var.configs.tempo_role_arn == "" ? 1 : 0
+  name  = "tempo_s3_access_policy"
path: modules/tempo/main.tf
user: login: mrdntgrn
body: lets have this name also dynamic configurable, can be just used `var.configs.tempo_role_name` variable, something like
"${var.configs.tempo_role_name}-role"
created_at: 2025-03-28T06:50:30Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,50 @@
+variable "namespace" {
+  type        = string
+  description = "namespace for tempo deployment"
+  default     = "namespace"
path: modules/tempo/variables.tf
user: login: mrdntgrn
body: the default namespace "namespace" seems is not as convenient, maybe better to set common "monitoring" ?
created_at: 2025-03-28T06:51:32Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,50 @@
+variable "namespace" {
+  type        = string
+  description = "namespace for tempo deployment"
+  default     = "namespace"
+}
+
+variable "region" {
+  type        = string
+  description = "aws region for s3 bucket"
+  default     = "us-east-2"
+}
+
+variable "configs" {
+  type = object({
+    tempo_image_tag          = optional(string, "2.4.0")
+    tempo_role_arn           = optional(string, "")
+    storage_backend          = optional(string, "s3") # "local" or "s3"
+    bucket_name              = optional(string, "")
+    region                   = optional(string)
path: modules/tempo/variables.tf
user: login: mrdntgrn
body: why we have region as separate variable `var.region` and as part of config, can we have just only one, maybe we can remove `var.region` and use `var.configs.region` ?
created_at: 2025-03-28T06:55:38Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,50 @@
+variable "namespace" {
+  type        = string
+  description = "namespace for tempo deployment"
+  default     = "namespace"
+}
+
+variable "region" {
+  type        = string
+  description = "aws region for s3 bucket"
+  default     = "us-east-2"
+}
+
+variable "configs" {
+  type = object({
+    tempo_image_tag          = optional(string, "2.4.0")
+    tempo_role_arn           = optional(string, "")
+    storage_backend          = optional(string, "s3") # "local" or "s3"
+    bucket_name              = optional(string, "")
+    region                   = optional(string)
+    enable_metrics_generator = optional(bool, true)
+    enable_service_monitor   = optional(bool, true)
+    tempo_role_name          = optional(string, "tempo-s3-role")
+    oidc_provider_arn        = optional(string, "")
+
+    persistence = optional(object({
+      enabled       = optional(bool, true)
+      size          = optional(string, "10Gi")
+      storage_class = optional(string, "gp2")
+    }), {})
+
+    ingress = optional(object({
+      enabled     = optional(bool, false)
+      annotations = optional(map(string), {})
+      hosts       = optional(list(string), ["tempo.example.com"])
+      path        = optional(string, "/")
+      path_type   = optional(string, "Prefix")
+    }), {})
+
+    service_account = optional(object({
+      name        = optional(string, "tempo-serviceaccount")
+      annotations = optional(map(string), {})
+    }), {})
+  })
+}
+
+variable "oidc_provider_arn" {
path: modules/tempo/variables.tf
user: login: mrdntgrn
body: this config variable seems not being used
created_at: 2025-03-28T06:56:28Z
author_association: CONTRIBUTOR
diff_hunk: @@ -225,3 +225,53 @@ variable "aws_region" {
   type    = string
   default = "eu-central-1"
 }
+
+variable "tempo_configs" {
+  type = object({
+    enabled                  = optional(string, false)
+    tempo_image_tag          = optional(string, "2.4.0")
+    storage_backend          = optional(string, "s3") # "local" or "s3"
+    bucket_name              = optional(string)
+    region                   = optional(string)
+    enable_metrics_generator = optional(bool, true)
+    enable_service_monitor   = optional(bool, true)
+    oidc_provider_arn        = optional(string, "")
+
+    persistence = optional(object({
+      enabled       = optional(bool, true)
+      size          = optional(string, "10Gi")
+      storage_class = optional(string, "gp2")
+    }), {})
+
+    ingress = optional(object({
+      enabled     = optional(bool, true)
path: variables.tf
user: login: mrdntgrn
body: is it common scenario to have tempo exposed via ingress? seems the tempo as prometheus, loki is supposed at first to be internal and used by grafana via internal endpoint
created_at: 2025-03-28T06:59:07Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,90 @@
+resource "helm_release" "tempo" {
+  name             = "tempo"
+  repository       = "https://grafana.github.io/helm-charts"
+  chart            = "tempo"
+  version          = "1.18.3"
+  namespace        = var.namespace
+  create_namespace = true
+
+  values = [
+    templatefile("${path.module}/values/tempo-values.yaml.tpl", {
+      tempo_image_tag = var.configs.tempo_image_tag
+      storage_backend = var.configs.storage_backend
+      bucket_name     = module.my_bucket.s3_bucket_id
+      region          = var.region
+
+      persistence_enabled = var.configs.persistence.enabled
+      persistence_size    = var.configs.persistence.size
+      persistence_class   = var.configs.persistence.storage_class
+
+      enable_metrics_generator = var.configs.enable_metrics_generator
+      enable_service_monitor   = var.configs.enable_service_monitor
+
+      enable_ingress      = var.configs.ingress.enabled
+      ingress_annotations = var.configs.ingress.annotations
+      ingress_hosts       = var.configs.ingress.hosts
+      ingress_path        = var.configs.ingress.path
+      ingress_path_type   = var.configs.ingress.path_type
+
+      service_account_name        = var.configs.service_account.name
+      service_account_annotations = local.service_account_annotations
+    })
+  ]
+  depends_on = [module.my_bucket]
+}
+
+module "my_bucket" {
+  source  = "dasmeta/s3/aws"
+  version = "1.2.1"
+
+  name = var.configs.bucket_name
+
+
+  acl = "public"
+}
+
+module "tempo_iam_eks_role" {
+  source  = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
+  version = "5.53.0"
+
+  count = var.configs.storage_backend == "s3" && var.configs.tempo_role_arn == "" ? 1 : 0
+
+  role_name = var.configs.tempo_role_name
+  role_policy_arns = {
+    policy = resource.aws_iam_policy.tempo_s3_access[0].arn
+  }
+
+  oidc_providers = {
+    one = {
+      provider_arn               = var.configs.oidc_provider_arn
+      namespace_service_accounts = ["${var.namespace}:${var.configs.service_account.name}"]
+    }
+  }
+}
+
+resource "aws_iam_policy" "tempo_s3_access" {
+  count = var.configs.storage_backend == "s3" && var.configs.tempo_role_arn == "" ? 1 : 0
+  name  = "tempo_s3_access_policy"
path: modules/tempo/main.tf
user: login: SarhadMeta
body: This is the policy name which will be attached to the role. Do you think we need to configure the policy name? Maybe we can set it to ${var.configs.tempo_role_name}-policy?
created_at: 2025-03-28T08:34:35Z
author_association: CONTRIBUTOR
diff_hunk: @@ -225,3 +225,53 @@ variable "aws_region" {
   type    = string
   default = "eu-central-1"
 }
+
+variable "tempo_configs" {
+  type = object({
+    enabled                  = optional(string, false)
+    tempo_image_tag          = optional(string, "2.4.0")
+    storage_backend          = optional(string, "s3") # "local" or "s3"
+    bucket_name              = optional(string)
+    region                   = optional(string)
+    enable_metrics_generator = optional(bool, true)
+    enable_service_monitor   = optional(bool, true)
+    oidc_provider_arn        = optional(string, "")
+
+    persistence = optional(object({
+      enabled       = optional(bool, true)
+      size          = optional(string, "10Gi")
+      storage_class = optional(string, "gp2")
+    }), {})
+
+    ingress = optional(object({
+      enabled     = optional(bool, true)
path: variables.tf
user: login: SarhadMeta
body: yea, agreed
created_at: 2025-03-28T08:35:59Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,90 @@
+resource "helm_release" "tempo" {
+  name             = "tempo"
+  repository       = "https://grafana.github.io/helm-charts"
+  chart            = "tempo"
+  version          = "1.18.3"
+  namespace        = var.namespace
+  create_namespace = true
+
+  values = [
+    templatefile("${path.module}/values/tempo-values.yaml.tpl", {
+      tempo_image_tag = var.configs.tempo_image_tag
+      storage_backend = var.configs.storage_backend
+      bucket_name     = module.my_bucket.s3_bucket_id
+      region          = var.region
+
+      persistence_enabled = var.configs.persistence.enabled
+      persistence_size    = var.configs.persistence.size
+      persistence_class   = var.configs.persistence.storage_class
+
+      enable_metrics_generator = var.configs.enable_metrics_generator
+      enable_service_monitor   = var.configs.enable_service_monitor
+
+      enable_ingress      = var.configs.ingress.enabled
+      ingress_annotations = var.configs.ingress.annotations
+      ingress_hosts       = var.configs.ingress.hosts
+      ingress_path        = var.configs.ingress.path
+      ingress_path_type   = var.configs.ingress.path_type
+
+      service_account_name        = var.configs.service_account.name
+      service_account_annotations = local.service_account_annotations
+    })
+  ]
+  depends_on = [module.my_bucket]
+}
+
+module "my_bucket" {
+  source  = "dasmeta/s3/aws"
+  version = "1.2.1"
+
+  name = var.configs.bucket_name
+
+
+  acl = "public"
path: modules/tempo/main.tf
user: login: mrdntgrn
body: 1. why we have this bucket public?
this bucket tempo uses for its internal storage, can we have it private, the default one is private so maybe we can just remove this acl line?
2. also there is available new version 1.3.1 for dasmeta/s3/aws module, will be great if we use latest versions of modules, if there is no special need to use older version,
3. can we have better name for this module, `my_bucket` sounds more like a test tmp name for tf modules
created_at: 2025-03-28T10:49:09Z
author_association: CONTRIBUTOR

PR comments:
user: login: github-actions[bot]
created_at: 2025-03-28T06:13:19Z
body: [//]: <> (infracost-comment, valid-at=2025-03-31T15:24:10Z)

<h4>💰 Infracost report</h4>
<h4>Monthly estimate generated</h4>
<details>

<summary>Estimate details (includes details of skipped projects due to errors)</summary>

```
──────────────────────────────────
Project: home-runner-work-terraform-onpremise-grafana-terraform-onpremise-grafana
Module path: home/runner/work/terraform-onpremise-grafana/terraform-onpremise-grafana
Errors:
  Failed to lookup module "dasmeta/iam/aws//modules/role" - error fetching module git::https://github.com/dasmeta/terraform-aws-iam?ref=6f522e277e7a1ab3946cda30eaba2efc7447db27 from remote:
    error downloading 'https://github.com/dasmeta/terraform-aws-iam?ref=6f522e277e7a1ab3946cda30eaba2efc7447db27':
      /usr/bin/git exited with 128:
        fatal:
          could not create leading directories of '/.infracost/terraform_modules/5ddd59dfbed1c5b5bc2334dbaadf05e2':
            Permission denied

  Diff baseline error:
    Failed to lookup module "dasmeta/iam/aws//modules/role" - error fetching module git::https://github.com/dasmeta/terraform-aws-iam?ref=6f522e277e7a1ab3946cda30eaba2efc7447db27 from remote:
      error downloading 'https://github.com/dasmeta/terraform-aws-iam?ref=6f522e277e7a1ab3946cda30eaba2efc7447db27':
        /usr/bin/git exited with 128:
          fatal:
            could not create leading directories of '/.infracost/terraform_modules/5ddd59dfbed1c5b5bc2334dbaadf05e2':
              Permission denied


──────────────────────────────────

No cloud resources were detected
```
</details>
<sub>This comment will be updated when code changes.
</sub>

author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-28T06:13:21Z
body: ## Output
```diff
check for added large files..............................................Passed
check for merge conflicts................................................Passed
check vcs permalinks.....................................................Passed
fix end of files.........................................................Passed
trim trailing whitespace.................................................Passed
check yaml...............................................................Passed
check for merge conflicts................................................Passed
check for case conflicts.................................................Passed
mixed line ending........................................................Passed
detect aws credentials...................................................Passed
detect private key.......................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Failed
- hook id: terraform_docs
- files were modified by this hook
Detect hardcoded secrets.................................................Passed
```
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-28T06:21:19Z
body: ## Output
```diff
check for added large files..............................................Passed
check for merge conflicts................................................Passed
check vcs permalinks.....................................................Passed
fix end of files.........................................................Passed
trim trailing whitespace.................................................Passed
check yaml...............................................................Passed
check for merge conflicts................................................Passed
check for case conflicts.................................................Passed
mixed line ending........................................................Passed
detect aws credentials...................................................Passed
detect private key.......................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Failed
- hook id: terraform_docs
- files were modified by this hook
Detect hardcoded secrets.................................................Passed
```
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-28T10:33:59Z
body: ## Output
```diff
check for added large files..............................................Passed
check for merge conflicts................................................Passed
check vcs permalinks.....................................................Passed
fix end of files.........................................................Passed
trim trailing whitespace.................................................Passed
check yaml...............................................................Passed
check for merge conflicts................................................Passed
check for case conflicts.................................................Passed
mixed line ending........................................................Passed
detect aws credentials...................................................Passed
detect private key.......................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Failed
- hook id: terraform_docs
- files were modified by this hook
Detect hardcoded secrets.................................................Passed
```
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-28T13:22:48Z
body: ## Output
```diff
check for added large files..............................................Passed
check for merge conflicts................................................Passed
check vcs permalinks.....................................................Passed
fix end of files.........................................................Passed
trim trailing whitespace.................................................Passed
check yaml...............................................................Passed
check for merge conflicts................................................Passed
check for case conflicts.................................................Passed
mixed line ending........................................................Passed
detect aws credentials...................................................Passed
detect private key.......................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Failed
- hook id: terraform_docs
- files were modified by this hook
Detect hardcoded secrets.................................................Passed
```
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-31T14:29:06Z
body: ## Output
```diff
check for added large files..............................................Passed
check for merge conflicts................................................Passed
check vcs permalinks.....................................................Passed
fix end of files.........................................................Passed
trim trailing whitespace.................................................Passed
check yaml...............................................................Passed
check for merge conflicts................................................Passed
check for case conflicts.................................................Passed
mixed line ending........................................................Passed
detect aws credentials...................................................Passed
detect private key.......................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Failed
- hook id: terraform_docs
- files were modified by this hook
Detect hardcoded secrets.................................................Passed
```
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-31T15:24:12Z
body: ## Output
```diff
check for added large files..............................................Passed
check for merge conflicts................................................Passed
check vcs permalinks.....................................................Passed
fix end of files.........................................................Passed
trim trailing whitespace.................................................Passed
check yaml...............................................................Passed
check for merge conflicts................................................Passed
check for case conflicts.................................................Passed
mixed line ending........................................................Passed
detect aws credentials...................................................Passed
detect private key.......................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Failed
- hook id: terraform_docs
- files were modified by this hook
Detect hardcoded secrets.................................................Passed
```
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-31T15:27:19Z
body: :tada: This PR is included in version 1.12.0 :tada:

The release is available on [GitHub release](https://github.com/dasmeta/terraform-onpremise-grafana/releases/tag/v1.12.0)

Your **[semantic-release](https://github.com/semantic-release/semantic-release)** bot :package::rocket:
author_association: NONE
user: login: github-actions[bot]
created_at: 2025-03-31T15:27:24Z
body: ## Output
```diff
check for added large files..............................................Passed
check for merge conflicts................................................Passed
check vcs permalinks.....................................................Passed
fix end of files.........................................................Passed
trim trailing whitespace.................................................Passed
check yaml...............................................................Passed
check for merge conflicts................................................Passed
check for case conflicts.................................................Passed
mixed line ending........................................................Passed
detect aws credentials...................................................Passed
detect private key.......................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Failed
- hook id: terraform_docs
- files were modified by this hook
Detect hardcoded secrets.................................................Passed
```
author_association: NONE