feat(operator): Introduce passthrough tenancy

[JoaoBraveCoding]

What this PR does / why we need it:

This PR introduces a new tenancy mode called passthrough. This new tenancy mode was designed with the goal of delegating Authentication and Authorization to another component. Instead the new gateway will only server a central point of interaction with LokiStack and it will possibly enforce that requests to it contain a X-Scope-OrgID

Which issue(s) this PR fixes:
https://issues.redhat.com/browse/LOG-8331

Special notes for your reviewer:

CLF manifest with cert writing to LokiStack

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: loki-output-cluster-issuer
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: loki-output-ca
  namespace: openshift-logging
spec:
  isCA: true
  commonName: loki-output-ca
  secretName: loki-output-ca
  privateKey:
    algorithm: RSA
    size: 4096
  issuerRef:
    name: loki-output-cluster-issuer
    kind: ClusterIssuer
    group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: loki-output-issuer
  namespace: openshift-logging
spec:
  ca:
    secretName: loki-output-ca
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: loki-output-tls
  namespace: openshift-logging
spec:
  secretName: loki-output-tls
  duration: 2160h # 90d
  renewBefore: 360h # 15d
  commonName: loki-output-client
  privateKey:
    rotationPolicy: Never
    algorithm: RSA
    encoding: PKCS8
    size: 4096
  usages:
    - digital signature
    - key encipherment
    - client auth
  issuerRef:
    name: loki-output-issuer
    kind: Issuer
---
apiVersion: observability.openshift.io/v1
kind: ClusterLogForwarder
metadata:
  name: mycollector
  namespace: openshift-logging
  annotations:
    observability.openshift.io/tech-preview-otlp-output: enabled
spec:
  serviceAccount:
    name: mycollector
  outputs:
    - name: loki-passthrough
      type: otlp
      otlp:
        url: https://lokistack-dev-gateway-http.openshift-logging.svc.cluster.local:8080/otlp/v1/logs
      tls:
        ca:
          configMapName: openshift-service-ca.crt
          key: service-ca.crt
        certificate:
          secretName: loki-output-tls
          key: tls.crt
        key:
          secretName: loki-output-tls
          key: tls.key
  pipelines:
  - name: all-logs
    inputRefs:
      - infrastructure
    outputRefs:
      - loki-passthrough

Lokistack configured for passthrough

apiVersion: loki.grafana.com/v1
kind: LokiStack
metadata:
  name: lokistack-dev
  namespace: openshift-logging
spec:
  size: 1x.demo
  storage:
    schemas:
    - version: v13
      effectiveDate: 2023-10-15
    secret:
      name: test
      type: s3
  storageClassName: gp3-csi
  tenants:
    mode: passthrough
    passthrough:
      ca:
        secretName: loki-output-tls
        key: ca.crt
      defaultTenant: default
  rules:
    enabled: true
    selector:
      matchLabels:
        openshift.io/cluster-monitoring: "true"
    namespaceSelector:
      matchLabels:
        openshift.io/cluster-monitoring: "true"

Checklist

• Reviewed the CONTRIBUTING.md guide (required)
• Documentation added
• Tests updated
• Title matches the required conventional commits format, see here
  • Note that Promtail is considered to be feature complete, and future development for logs collection will be in Grafana Alloy. As such, feat PRs are unlikely to be accepted unless a case can be made for the feature actually being a bug fix to existing behavior.
• Changes that require user attention or interaction to upgrade are documented in docs/sources/setup/upgrade/_index.md
• If the change is deprecating or removing a configuration option, update the deprecated-config.yaml and deleted-config.yaml files respectively in the tools/deprecated-config-checker directory. Example PR

---

Note

Medium Risk
Adds a new tenancy mode that changes gateway deployment, image selection, and TLS/mTLS validation behavior; misconfiguration could break gateway connectivity or weaken/overconstrain client auth.

Overview
Adds a new passthrough tenancy mode to the LokiStack API, including tenants.passthrough configuration (ca bundle and optional defaultTenant) and a new degraded condition reason (InvalidPassthroughConfiguration).

Updates gateway reconciliation/manifests to deploy a different gateway implementation in passthrough mode (new passthrough deployment, different args/upstreams), enforce/validate mTLS CA presence when HTTPEncryption is enabled, skip rules-API wiring for this mode, and select a separate gateway image via RELATED_IMAGE_PASSTHROUGH_GATEWAY with a new default image.

Regenerates CRDs/CSVs/bundles and docs to expose the new mode in UI descriptors and schema, adds related documentation (new tenancy-modes.md), and extends unit tests for mode validation, degraded behavior, image selection, and passthrough gateway manifest/TLS wiring.

^{Reviewed by Cursor Bugbot for commit 6874c31. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 3 potential issues.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

^{Reviewed by Cursor Bugbot for commit f5bde66. Configure here.}

[cursor]

Default passthrough gateway image uses personal registry

Medium Severity

DefaultPassthroughGatewayImage is set to quay.io/jmarcal/passthrough-gateway:latest, a personal repository. This is the production fallback default when the RELATED_IMAGE_PASSTHROUGH_GATEWAY environment variable is not set. While a TODO comment exists, shipping this as a default means any deployment without the env var override will depend on a personal, non-official image registry.

 

^{Reviewed by Cursor Bugbot for commit f5bde66. Configure here.}

[xperimental]

Main thing is that the options on the passthrough-gateway have changed (this also needs updated tests).

The question on which image we will use is an open point as well.

[xperimental]

Fine to merge, once the component PR is merged. 👍