build(deps): bump github.com/grafana/tempo-operator from 0.20.0 to 0.21.0

[dependabot]

Bumps github.com/grafana/tempo-operator from 0.20.0 to 0.21.0.

Release notes

Sourced from github.com/grafana/tempo-operator's releases.

Release v0.21.0

💡 Enhancements 💡

• operator: Bump Golang to 1.25 (#1427)

• operator: Bump observatorium/api gateway image to main-2026-05-19-489f301 (#1459)

• operator: Bump Tempo to 2.10.5 (#1459)

• tempostack, tempomonolithic: Add env and envFrom fields to inject environment variables into Tempo containers from Kubernetes Secrets or ConfigMaps. (#1135) The new spec.env and spec.envFrom fields allow injecting environment variables into all Tempo containers. Combined with spec.extraConfig and the -config.expand-env=true flag, this enables referencing sensitive values (e.g. a Redis cache password) stored in Kubernetes Secrets using ${VAR_NAME} syntax in the Tempo configuration. The -config.expand-env=true flag has also been added to TempoMonolithic for feature parity with TempoStack.

  Example TempoStack CR with a password-protected Redis cache:

  apiVersion: tempo.grafana.com/v1alpha1
  kind: TempoStack
  metadata:
    name: tempo
  spec:
    env:
      - name: REDIS_PASSWORD
        valueFrom:
          secretKeyRef:
            name: redis-creds
            key: password
    extraConfig:
      tempo:
        cache:
          caches:
            - redis:
                endpoint: "redis.host"
                password: "${REDIS_PASSWORD}"

• tempostack, tempomonolithic: Support ca-bundle.crt key in storage TLS CA ConfigMap for OpenShift trusted CA bundle injection (#1437) ConfigMaps labeled with config.openshift.io/inject-trusted-cabundle use the key ca-bundle.crt, which is now recognized in addition to service-ca.crt and ca.crt.

• tempostack, tempomonolithic: Use TLS profile (min version and ciphers) from the feature gate or OpenShift APIServer CR. (#1367) When feature gate openshift.clusterTLSPolicy is enabled the TLS profile (min version and ciphers) are obtained from OpenShift APIServer CR. The feature gate tlsProfile can set the profile explicitly and is active only when openshift.clusterTLSPolicy is disabled.

  The TLS profile is then used in all TLS connections, however it can be overridden if (min version or ciphers) are directly specified in the TLS config for a given component in the CR.

  The openshift.clusterTLSPolicy can be enabled via FEATURE_GATES env variable The tlsProfile feature gate can be enabled via TLS_PROFILE environment variable and valid values are: Old, Intermediate, Modern.

  On OpenShift the openshift.clusterTLSPolicy is enabled by default.

... (truncated)

Changelog

Sourced from github.com/grafana/tempo-operator's changelog.

0.21.0

💡 Enhancements 💡

• operator: Bump Golang to 1.25 (#1427)

• operator: Bump observatorium/api gateway image to main-2026-05-19-489f301 (#1459)

• operator: Bump Tempo to 2.10.5 (#1459)

• tempostack, tempomonolithic: Add env and envFrom fields to inject environment variables into Tempo containers from Kubernetes Secrets or ConfigMaps. (#1135) The new spec.env and spec.envFrom fields allow injecting environment variables into all Tempo containers. Combined with spec.extraConfig and the -config.expand-env=true flag, this enables referencing sensitive values (e.g. a Redis cache password) stored in Kubernetes Secrets using ${VAR_NAME} syntax in the Tempo configuration. The -config.expand-env=true flag has also been added to TempoMonolithic for feature parity with TempoStack.

  Example TempoStack CR with a password-protected Redis cache:

  apiVersion: tempo.grafana.com/v1alpha1
  kind: TempoStack
  metadata:
    name: tempo
  spec:
    env:
      - name: REDIS_PASSWORD
        valueFrom:
          secretKeyRef:
            name: redis-creds
            key: password
    extraConfig:
      tempo:
        cache:
          caches:
            - redis:
                endpoint: "redis.host"
                password: "${REDIS_PASSWORD}"

• tempostack, tempomonolithic: Support ca-bundle.crt key in storage TLS CA ConfigMap for OpenShift trusted CA bundle injection (#1437) ConfigMaps labeled with config.openshift.io/inject-trusted-cabundle use the key ca-bundle.crt, which is now recognized in addition to service-ca.crt and ca.crt.

• tempostack, tempomonolithic: Use TLS profile (min version and ciphers) from the feature gate or OpenShift APIServer CR. (#1367) When feature gate openshift.clusterTLSPolicy is enabled the TLS profile (min version and ciphers) are obtained from OpenShift APIServer CR. The feature gate tlsProfile can set the profile explicitly and is active only when openshift.clusterTLSPolicy is disabled.

  The TLS profile is then used in all TLS connections, however it can be overridden if (min version or ciphers) are directly specified in the TLS config for a given component in the CR.

  The openshift.clusterTLSPolicy can be enabled via FEATURE_GATES env variable The tlsProfile feature gate can be enabled via TLS_PROFILE environment variable and valid values are: Old, Intermediate, Modern.

  On OpenShift the openshift.clusterTLSPolicy is enabled by default.

... (truncated)

Commits

• ce8c0fa Prepare Release 0.21.0 (#1490)
• 54135e1 Bump actions/checkout from 5.0.1 to 6.0.2 (#1489)
• e1e7290 chore(deps): update actions/checkout action to v5.0.1 (#1486)
• a82a3ec chore(deps): update dependency golangci/golangci-lint to v2.12.2 (#1480)
• 455d896 Bump docker/setup-buildx-action from 4.0.0 to 4.1.0 (#1482)
• 9ecbcb0 chore(deps): update docker/setup-buildx-action action to v4.1.0 (#1481)
• 4acca2d Bump the opentelemetry group across 1 directory with 4 updates (#1484)
• e63b749 ci: Add actionlint workflow and fix existing lint findings (#1485)
• 9906e8b Bump docker/setup-qemu-action from 4.0.0 to 4.1.0 (#1483)
• eef54f6 chore(deps): update codecov/codecov-action action to v6.0.1 (#1476)
• Additional commits viewable in compare view

[openshift-ci]

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a rhobs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[simonpasquier]

/approve
/lgtm
/ok-to-test

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dependabot[bot], simonpasquier

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [simonpasquier]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[simonpasquier]

/lgtm