-
cluster-observability: Fix dependencies required by the bundled agent and cluster Collector configurations (#3821, #3818)
Follow-ups to the initial ClusterObservability framework so generated
Collectors start cleanly across supported distributions:
- Use K8s Collector distribution for the agent and cluster Collectors,
defaulting to the operator's Collector version and supporting the
--clusterobservability-collector-image override. Apply matching version
labels and canonical component IDs.
- Inject
K8S_NODE_NAME, which the bundled kubelet_stats receiver uses
for its endpoint.
- Report cluster Collector readiness from its StatefulSet so
ClusterObservability does not remain Pending after the workload is ready.
- Mount the host root at
/hostfs for host_metrics and exclude virtual
and container-runtime filesystems that cannot be scraped reliably.
- On OpenShift, run the agent under the generated
spc_t SCC so file_log
can read root-owned container logs under /var/log/pods.
- On OpenShift, verify kubelet TLS with the platform serving CA.
- Point generated
Instrumentation resources to the agent's OTLP/HTTP port
because auto-instrumentation SDKs commonly use http/protobuf.
-
collector: Fix OpenShift collector dashboard (#5342)
The collector v0.155.0 renamed the deprecated otelcol_processor_accepted_*/dropped_*/refused_* metrics
to otelcol_processor_memory_limiter_* (open-telemetry/opentelemetry-collector#11203).
The dashboard queries have been updated to use the new metric names.
-
collector: Register the snake-case spellings of several renamed receivers (kubelet_stats, k8s_objects, resource_detection, fluent_forward, tcp_log, udp_log, ssh_check, cloud_foundry, http_check, flink_metrics) alongside their original spellings when generating RBAC and service ports from a Collector CR, so either spelling produces the same result. (#5317)
These components were renamed to snake_case in opentelemetry-collector-contrib
(#47957 kubeletstats, #47440 k8sobjects, #48525 resourcedetection, #47930
fluentforward, #47369 tcplog, #47370 udplog, #47515 sshcheck, #47932
cloudfoundry, #47505 httpcheck, #47929 flinkmetrics) while keeping the
original names accepted, but the operator only recognized one spelling per
component, so configs using the other spelling got no RBAC/ports or the
wrong service port name. This extends the k8s_attributes fix (#4983) to
the remaining renamed components, and makes NewScraperParser accept
aliases so future renames of this kind are a one-line fix.
-
target allocator: Fix collector mtls with a TargetAllocator CR (#4297)
This only affected collectors associated with a TargetAllocator CR whose name differs from the
collector's, e.g. via the opentelemetry.io/target-allocator label, causing them to address the
wrong hostname (and TLS certificate) once mTLS was enabled.
-
target allocator: Refresh stale Prometheus meta labels (e.g. __meta_kubernetes_pod_name) on rediscovered targets whose address is unchanged (#4839)
Target identity is deliberately hashed without meta labels, since Prometheus discards them after
relabeling. But because the allocator's target map is keyed by that same hash, a rediscovered
target whose address is unchanged (e.g. a hostNetwork DaemonSet pod after a restart) was never
recognized as changed, so its stale meta labels persisted until target-allocator itself restarted.
-
collector: Fix operator crash on startup when Gateway API CRDs are not installed by moving gatewayv1 scheme registration to be gated on autodetect result. (#5357)
-
auto-instrumentation: Apply security context to Java extension init containers (#5335)
Extension init containers injected alongside the Java agent were not receiving
a security context. This affected both the explicit spec.initContainerSecurityContext
field on the Instrumentation CR and the fallback behaviour that inherits the
security context from the instrumented application container. Only the main
opentelemetry-auto-instrumentation-java init container was having its security
context set; extension containers were always created with a nil security context.
This caused admission failures on clusters with policies that require all
containers to drop capabilities or disallow privilege escalation (e.g. OPA
Gatekeeper). The security context is now applied to all Java-related init
containers at construction time.
-
target allocator: Propagate the TargetAllocator CR's metadata annotations to all resources created for it, and restrict podAnnotations to the pod template (#4393)
This aligns the TargetAllocator with the OpenTelemetryCollector behavior: CR metadata annotations now land
(respecting the annotations filter) on the Deployment, Service, ConfigMap, ServiceAccount, ServiceMonitor,
PodDisruptionBudget and NetworkPolicy, while podAnnotations is no longer copied to the NetworkPolicy and
PodDisruptionBudget.
