Add support for namespace-scoped installation (namespaced mode) of the Tempo Operator

[peterbueschel]

Hi,

Currently, the operator only supports cluster-scoped installation and requires cluster-wide RBAC permissions to function. When trying to restrict its access to namespace-scoped resources—by assigning only a Role in the operator’s namespace and a minimal ClusterRole for cluster-wide reads—the operator continues to attempt cluster-wide list and watch operations (e.g., for secrets, deployments, etc.). This results in permission errors and does not allow running the operator with least privilege in multi-tenant environments.

Feature Request:

Please add support for running the Tempo Operator in "namespace-scoped" or "restricted" mode, such that:

• Only resources within a given namespace are watched/managed by the operator.
• The operator can function fully when granted only namespace-scoped RBAC permissions (with no need for list/watch on resources cluster-wide).
• An installation option (deployment flag, environment variable, or Helm value) allows choosing namespaced vs cluster-wide mode.

This is important for:

• Secure, least-privilege operator setups
• Clusters where operator admins do not have cluster-admin or wide RBAC rights

Related behavior:

• Attempts to use the (unsupported) --namespace flag currently result in unknown flag errors.
• Other Kubernetes operators often support this via a --namespace or POD_NAMESPACE environment configuration.

Thank you