From a734da4a840eb8ed0be505f8165ba9e2e0794bd1 Mon Sep 17 00:00:00 2001 From: Andreas Gerstmayr Date: Tue, 25 Aug 2026 12:43:52 +0200 Subject: [PATCH] TRACING-6707: clarify feature gates environment variable Signed-off-by: Andreas Gerstmayr --- modules/distr-tracing-tempo-config-operator.adoc | 3 +++ modules/distr-tracing-tempo-tls-profile.adoc | 7 ++++--- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/modules/distr-tracing-tempo-config-operator.adoc b/modules/distr-tracing-tempo-config-operator.adoc index ee55d72483c..499a705d662 100644 --- a/modules/distr-tracing-tempo-config-operator.adoc +++ b/modules/distr-tracing-tempo-config-operator.adoc @@ -58,6 +58,9 @@ The following table shows the feature gates: |`openshift.oauthProxy` |Enables {ocp-product-title} OAuth proxy integration. +|`openshift.clusterTLSPolicy` +|Enables inheriting the TLS configuration from the {ocp-product-title} `APIServer` CR. + |`httpEncryption` |Enables HTTP encryption for Tempo components. diff --git a/modules/distr-tracing-tempo-tls-profile.adoc b/modules/distr-tracing-tempo-tls-profile.adoc index 248d88a70ef..970fb6bf9f6 100644 --- a/modules/distr-tracing-tempo-tls-profile.adoc +++ b/modules/distr-tracing-tempo-tls-profile.adoc @@ -9,10 +9,11 @@ [role="_abstract"] The {TempoOperator} inherits the TLS configuration defined in the {ocp-product-title} `APIServer` custom resource (CR). The Operator and its operands inherit TLS settings like minimum TLS version and TLS cipher suites from the `APIServer` CR for all TLS communications. -You can configure the TLS cluster profile by using the following environment variables: +The `FEATURE_GATES` environment variable of the {TempoOperator} contains a comma-separated list of feature gates. The `openshift.clusterTLSPolicy` feature gate, which enables inheriting the TLS configuration from the `APIServer` CR, is included in the default list. +For the full list of feature gates, see xref:distr-tracing-tempo-config-operator_{context}[Configuring the {TempoOperator}]. -`FEATURE_GATE=openshift.clusterTLSPolicy`:: Enables inheriting the TLS configuration from the `APIServer` CR, and is enabled by default. +To disable the `openshift.clusterTLSPolicy` feature gate, remove it from the comma-separated `FEATURE_GATES` list. Do not replace the entire variable value, because doing so disables all other default feature gates. -If the `openshift.clusterTLSPolicy` environment variable is disabled, you can manually set the TLS profile by using the following environment variable: +If the `openshift.clusterTLSPolicy` feature gate is disabled, you can manually set the TLS profile by using the following environment variable: `TLS_PROFILE`:: The TLS profile environment variable. Supported values are: `Old`, `Intermediate`, and `Modern`. For more information, see "Security/Server Side TLS" in Mozilla documentation.