coleenquadros · Jul 9, 2026 · Jul 9, 2026 · Jul 15, 2026 · Aug 7, 2026 · Aug 7, 2026
diff --git a/Makefile b/Makefile
@@ -64,6 +64,13 @@ generate-perses-op-crds: $(CONTROLLER_GEN)
 		output:dir=. \
 		output:crd:dir=./deploy/perses/crds
 
+.PHONY: generate-thanos-op-crds
+generate-thanos-op-crds: $(CONTROLLER_GEN)
+	$(CONTROLLER_GEN) crd:ignoreUnexportedFields=true,maxDescLen=0 \
+		paths=github.com/thanos-community/thanos-operator/api/... \
+		output:dir=. \
+		output:crd:dir=./deploy/thanos/crds
+
 .PHONY: generate-crds
 generate-crds: $(CONTROLLER_GEN) generate-prom-op-crds
 	$(CONTROLLER_GEN) crd \

diff --git a/bundle/manifests/monitoring.thanos.io_thanoscompacts.yaml b/bundle/manifests/monitoring.thanos.io_thanoscompacts.yaml
diff --git a/bundle/manifests/monitoring.thanos.io_thanosqueries.yaml b/bundle/manifests/monitoring.thanos.io_thanosqueries.yaml
diff --git a/bundle/manifests/monitoring.thanos.io_thanosreceives.yaml b/bundle/manifests/monitoring.thanos.io_thanosreceives.yaml
diff --git a/bundle/manifests/monitoring.thanos.io_thanosrulers.yaml b/bundle/manifests/monitoring.thanos.io_thanosrulers.yaml
diff --git a/bundle/manifests/monitoring.thanos.io_thanosstores.yaml b/bundle/manifests/monitoring.thanos.io_thanosstores.yaml
diff --git a/bundle/manifests/observability-operator.clusterserviceversion.yaml b/bundle/manifests/observability-operator.clusterserviceversion.yaml
@@ -153,17 +153,42 @@ spec:
       kind: ServiceMonitor
       name: servicemonitors.monitoring.rhobs
       version: v1
+    - description: ThanosCompact deploys a Thanos Compactor
+      displayName: Thanos Compact
+      kind: ThanosCompact
+      name: thanoscompacts.monitoring.thanos.io
+      version: v1alpha1
     - description: ThanosQuerier outlines the Thanos querier components, managed by
         this stack
       displayName: ThanosQuerier
       kind: ThanosQuerier
       name: thanosqueriers.monitoring.rhobs
       version: v1alpha1
+    - description: ThanosQuery deploys a Thanos Querier
+      displayName: Thanos Query
+      kind: ThanosQuery
+      name: thanosqueries.monitoring.thanos.io
+      version: v1alpha1
+    - description: ThanosReceive deploys a Thanos Receive component
+      displayName: Thanos Receive
+      kind: ThanosReceive
+      name: thanosreceives.monitoring.thanos.io
+      version: v1alpha1
     - description: ThanosRuler defines a ThanosRuler deployment
       displayName: ThanosRuler
       kind: ThanosRuler
       name: thanosrulers.monitoring.rhobs
       version: v1
+    - description: ThanosRuler deploys a Thanos Ruler
+      displayName: Thanos Ruler
+      kind: ThanosRuler
+      name: thanosrulers.monitoring.thanos.io
+      version: v1alpha1
+    - description: ThanosStore deploys a Thanos Store Gateway
+      displayName: Thanos Store
+      kind: ThanosStore
+      name: thanosstores.monitoring.thanos.io
+      version: v1alpha1
     - description: UIPlugin defines a console plugin for observability
       displayName: UIPlugin
       kind: UIPlugin
@@ -922,6 +947,128 @@ spec:
           - list
           - watch
         serviceAccountName: perses-operator
+      - rules:
+        - apiGroups:
+          - ""
+          resources:
+          - configmaps
+          - persistentvolumeclaims
+          - secrets
+          - serviceaccounts
+          - services
+          verbs:
+          - create
+          - delete
+          - get
+          - list
+          - patch
+          - update
+          - watch
+        - apiGroups:
+          - apps
+          resources:
+          - deployments
+          - statefulsets
+          verbs:
+          - create
+          - delete
+          - get
+          - list
+          - patch
+          - update
+          - watch
+        - apiGroups:
+          - discovery.k8s.io
+          resources:
+          - endpointslices
+          verbs:
+          - get
+          - list
+          - watch
+        - apiGroups:
+          - monitoring.coreos.com
+          resources:
+          - prometheusrules
+          verbs:
+          - get
+          - list
+          - watch
+        - apiGroups:
+          - monitoring.coreos.com
+          resources:
+          - servicemonitors
+          verbs:
+          - create
+          - delete
+          - get
+          - list
+          - patch
+          - update
+          - watch
+        - apiGroups:
+          - monitoring.thanos.io
+          resources:
+          - thanoscompacts
+          - thanosqueries
+          - thanosreceives
+          - thanosrulers
+          - thanosstores
+          verbs:
+          - create
+          - delete
+          - get
+          - list
+          - patch
+          - update
+          - watch
+        - apiGroups:
+          - monitoring.thanos.io
+          resources:
+          - thanoscompacts/finalizers
+          - thanosqueries/finalizers
+          - thanosreceives/finalizers
+          - thanosrulers/finalizers
+          - thanosstores/finalizers
+          verbs:
+          - update
+        - apiGroups:
+          - monitoring.thanos.io
+          resources:
+          - thanoscompacts/status
+          - thanosqueries/status
+          - thanosreceives/status
+          - thanosrulers/status
+          - thanosstores/status
+          verbs:
+          - get
+          - patch
+          - update
+        - apiGroups:
+          - policy
+          resources:
+          - poddisruptionbudgets
+          verbs:
+          - create
+          - delete
+          - get
+          - list
+          - patch
+          - update
+          - watch
+        - apiGroups:
+          - rbac.authorization.k8s.io
+          resources:
+          - rolebindings
+          - roles
+          verbs:
+          - create
+          - delete
+          - get
+          - list
+          - patch
+          - update
+          - watch
+        serviceAccountName: thanos-operator
       deployments:
       - label:
           app.kubernetes.io/component: controller
@@ -1143,6 +1290,71 @@ spec:
                 secret:
                   optional: true
                   secretName: observability-operator-tls
+      - label:
+          app.kubernetes.io/component: controller
+          app.kubernetes.io/name: thanos-operator
+          app.kubernetes.io/part-of: observability-operator
+        name: thanos-operator
+        spec:
+          replicas: 1
+          selector:
+            matchLabels:
+              app.kubernetes.io/component: controller
+              app.kubernetes.io/name: thanos-operator
+              app.kubernetes.io/part-of: observability-operator
+          strategy: {}
+          template:
+            metadata:
+              annotations:
+                kubectl.kubernetes.io/default-container: thanos-operator
+              labels:
+                app.kubernetes.io/component: controller
+                app.kubernetes.io/name: thanos-operator
+                app.kubernetes.io/part-of: observability-operator
+            spec:
+              affinity:
+                nodeAffinity:
+                  preferredDuringSchedulingIgnoredDuringExecution:
+                  - preference:
+                      matchExpressions:
+                      - key: node-role.kubernetes.io/infra
+                        operator: Exists
+                    weight: 1
+              containers:
+              - args:
+                - --leader-elect
+                - --health-probe-bind-address=:8081
+                image: quay.io/thanos/thanos-operator:main-2026-07-02-e6d1790
+                livenessProbe:
+                  httpGet:
+                    path: /healthz
+                    port: 8081
+                  initialDelaySeconds: 15
+                  periodSeconds: 20
+                name: thanos-operator
+                readinessProbe:
+                  httpGet:
+                    path: /readyz
+                    port: 8081
+                  initialDelaySeconds: 5
+                  periodSeconds: 10
+                resources:
+                  limits:
+                    cpu: 500m
+                    memory: 512Mi
+                  requests:
+                    cpu: 100m
+                    memory: 128Mi
+                securityContext:
+                  allowPrivilegeEscalation: false
+                  capabilities:
+                    drop:
+                    - ALL
+              serviceAccountName: thanos-operator
+              tolerations:
+              - effect: NoSchedule
+                key: node-role.kubernetes.io/infra
+                operator: Exists
       - label:
           app.kubernetes.io/component: controller
           app.kubernetes.io/name: perses-operator
@@ -1217,6 +1429,28 @@ spec:
                   name: openshift-service-ca.crt
                   optional: true
                 name: openshift-service-ca
+      permissions:
+      - rules:
+        - apiGroups:
+          - coordination.k8s.io
+          resources:
+          - leases
+          verbs:
+          - create
+          - delete
+          - get
+          - list
+          - patch
+          - update
+          - watch
+        - apiGroups:
+          - ""
+          resources:
+          - events
+          verbs:
+          - create
+          - patch
+        serviceAccountName: thanos-operator
     strategy: deployment
   installModes:
   - supported: false

diff --git a/...s/thanos-operator-thanoscompact-editor-role_rbac.authorization.k8s.io_v1_clusterrole.yaml b/...s/thanos-operator-thanoscompact-editor-role_rbac.authorization.k8s.io_v1_clusterrole.yaml
@@ -0,0 +1,31 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/created-by: thanos-operator
+    app.kubernetes.io/instance: thanoscompact-editor-role
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: clusterrole
+    app.kubernetes.io/part-of: observability-operator
+  name: thanos-operator-thanoscompact-editor-role
+rules:
+- apiGroups:
+  - monitoring.thanos.io
+  resources:
+  - thanoscompacts
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - monitoring.thanos.io
+  resources:
+  - thanoscompacts/status
+  verbs:
+  - get
diff --git a/...s/thanos-operator-thanoscompact-viewer-role_rbac.authorization.k8s.io_v1_clusterrole.yaml b/...s/thanos-operator-thanoscompact-viewer-role_rbac.authorization.k8s.io_v1_clusterrole.yaml
@@ -0,0 +1,27 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/created-by: thanos-operator
+    app.kubernetes.io/instance: thanoscompact-viewer-role
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: clusterrole
+    app.kubernetes.io/part-of: observability-operator
+  name: thanos-operator-thanoscompact-viewer-role
+rules:
+- apiGroups:
+  - monitoring.thanos.io
+  resources:
+  - thanoscompacts
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - monitoring.thanos.io
+  resources:
+  - thanoscompacts/status
+  verbs:
+  - get
diff --git a/...sts/thanos-operator-thanosquery-editor-role_rbac.authorization.k8s.io_v1_clusterrole.yaml b/...sts/thanos-operator-thanosquery-editor-role_rbac.authorization.k8s.io_v1_clusterrole.yaml
@@ -0,0 +1,31 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/created-by: thanos-operator
+    app.kubernetes.io/instance: thanosquery-editor-role
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: clusterrole
+    app.kubernetes.io/part-of: observability-operator
+  name: thanos-operator-thanosquery-editor-role
+rules:
+- apiGroups:
+  - monitoring.thanos.io
+  resources:
+  - thanosqueries
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - monitoring.thanos.io
+  resources:
+  - thanosqueries/status
+  verbs:
+  - get