-
Notifications
You must be signed in to change notification settings - Fork 632
fix: enable kubernetesAttributes preset for OpenTelemetry Collector #7791
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
fix: enable kubernetesAttributes preset for OpenTelemetry Collector #7791
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #7791 +/- ##
==========================================
- Coverage 72.82% 72.79% -0.03%
==========================================
Files 235 235
Lines 35176 35176
==========================================
- Hits 25618 25608 -10
- Misses 7743 7752 +9
- Partials 1815 1816 +1 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
b2bbbba to
55d6aaf
Compare
|
please run |
55d6aaf to
c894947
Compare
|
@zirain done the changes |
…Telemetry Collector The OpenTelemetry Collector configuration requires Kubernetes permissions for pod/namespace discovery, but the necessary RBAC is not created because the kubernetesAttributes preset is not enabled by default. This enables the kubernetesAttributes preset which creates the necessary ClusterRole and ClusterRoleBinding for the otel-collector service account. Fixes envoyproxy#7726 Signed-off-by: Nexusrex18 <lavisnj350@gmail.com>
c894947 to
91d9be7
Compare
|
@zirain just updated my PR to resolve a git conflict and also wanted to check why ci test got failed previously. |
|
Sorry @Nexusrex18 , #7774 merged first, can you rebase and rerun |
What this PR fixes
When deploying the
gateway-addons-helmchart with only OpenTelemetry Collector enabled (opentelemetry-collector.enabled: true), the collector pod logs RBAC errors because no ClusterRole/ClusterRoleBinding is created for theotel-collectorservice account.Error example from issue #7726:
pods is forbidden: User "system:serviceaccount:gateway-api-resources:otel-collector" cannot list resource "pods" at the cluster scope replicasets.apps is forbidden: User "system:serviceaccount:gateway-api-resources:otel-collector" cannot list resource "replicasets" namespaces "kube-system" is forbidden: User "system:serviceaccount:gateway-api-resources:otel-collector" cannot list resource "namespaces"Root cause
The OpenTelemetry Collector subchart only creates RBAC when either:
clusterRole.create: trueORkubernetesAttributes.enabled: true)The
gateway-addons-helmchart's default values don't enable any presets, so when users enable only the collector, they get no RBAC.Solution
Enable the
kubernetesAttributespreset by default in the OpenTelemetry Collector configuration. This preset provides exactly the permissions shown in the error logs:podsandnamespaces(for Kubernetes discovery)replicasets(for pod owner references)The change adds 5 lines after
fullnameOverride: otel-collectorinvalues.yaml: