From a9a4ffc8446c4f405733976ccc53ac7b1b1e0945 Mon Sep 17 00:00:00 2001 From: Pavol Loffay Date: Mon, 29 Sep 2025 14:50:48 +0200 Subject: [PATCH 1/4] TRACING-5677: RHOSDT 3.8, OTEL googlecloud exporter Signed-off-by: Pavol Loffay --- .../otel-collector-exporters.adoc | 44 +++++++++++++++++++ 1 file changed, 44 insertions(+) diff --git a/observability/otel/otel-collector/otel-collector-exporters.adoc b/observability/otel/otel-collector/otel-collector-exporters.adoc index ece479afefe0..d1c76f9af9c4 100644 --- a/observability/otel/otel-collector/otel-collector-exporters.adoc +++ b/observability/otel/otel-collector/otel-collector-exporters.adoc @@ -445,6 +445,50 @@ include::snippets/technology-preview.adoc[] // * link:https://docs.aws.amazon.com/sdk-for-go/v2/developer-guide/configure-auth.html[Configure Authentication] (AWS SDK for Go v2 Developer Guide) * link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html[IAM roles] (AWS Identity and Access Management User Guide) +[id="googlecloud-exporter_{context}"] +== Google Cloud Exporter + +The Google Cloud Exporter can be used converts the OpenTelemetry spans, metrics and logs to the Google Cloud Trace, Monitoring, and Logging formats and then sends them directly to the Google Cloud operations suite (formerly Stackdriver). + +The Goolge Cloud Exporter can be used to send metrics to Google Cloud Monitoring (formerly Stackdriver), traces to Google Cloud Trace, and logs to Google Cloud Logging. + +:FeatureName: The Google Cloud Exporter +include::snippets/technology-preview.adoc[] + +.OpenTelemetry Collector custom resource with the enabled Google Cloud Exporter +[source,yaml] +---- +# ... + env: + - name: GOOGLE_APPLICATION_CREDENTIALS + value: /var/secrets/google/key.json # <1> + volumeMounts: + - name: google-application-credentials + mountPath: /var/secrets/google + readOnly: true + volumes: + - name: google-application-credentials + secret: + secretName: google-application-credentials + config: + exporters: + googlecloud: + project: # <3> +# ... +---- +<1> The `GOOGLE_APPLICATION_CREDENTIALS` environment variable which points to the authentication `key.json` file. The `key.json` file is mounted as a secret volume to the collector. +<2> Optional project identifier. If not specified, the project is determined from the credentials. + +[role="_additional-resources"] +.Additional resources +* link:https://cloud.google.com/monitoring?hl=en[Google Cloud Monitoring] +* link:https://cloud.google.com/logging?hl=en[Google Cloud Logging] +* link:https://cloud.google.com/trace?hl=en[Google Cloud Trace] +* link:https://cloud.google.com/iam/docs/workload-identity-federation-with-kubernetes#deploy[Google Workflow Identity Federation docs] + +=== Multi-Project exporting +By default, the exporter sends telemetry to the project specified by project in the configuration. This can be overridden on a per-metrics basis using the `gcp.project.id` resource attribute. For example, if a metric has a label project, you could use the groupbyattrs processor to promote it to a resource label, and the resource processor to rename the attribute from project to `gcp.project.id`. + [id="file-exporter_{context}"] == File Exporter From 43136947235775f7736302fd19ea0595631354bf Mon Sep 17 00:00:00 2001 From: Pavol Loffay Date: Mon, 29 Sep 2025 14:50:55 +0200 Subject: [PATCH 2/4] TRACING-5677: RHOSDT 3.8, OTEL googlecloud exporter Signed-off-by: Pavol Loffay --- .../otel-forwarding-logs-to-googlecloud.adoc | 170 ++++++++++++++++++ 1 file changed, 170 insertions(+) create mode 100644 modules/otel-forwarding-logs-to-googlecloud.adoc diff --git a/modules/otel-forwarding-logs-to-googlecloud.adoc b/modules/otel-forwarding-logs-to-googlecloud.adoc new file mode 100644 index 000000000000..7b54be481249 --- /dev/null +++ b/modules/otel-forwarding-logs-to-googlecloud.adoc @@ -0,0 +1,170 @@ +//Module included in the following assemblies: +// +// * observability/otel/otel-forwarding-data.adoc + +:_mod-docs-content-type: PROCEDURE +[id="otel-forwarding-logs-to-tempostack_{context}"] += Forwarding logs to a LokiStack instance + +You can deploy the OpenTelemetry Collector to forward logs to a `LokiStack` instance by using the `openshift-logging` tenants mode. + +.Prerequisites + +* The {OTELOperator} is installed. +* The {loki-op} is installed. +* A supported `LokiStack` instance is deployed on the cluster. For more information about the supported `LokiStack` configuration, see _Logging_. + +.Procedure + +. Create a service account for the OpenTelemetry Collector. ++ +.Example `ServiceAccount` object +[source,yaml] +---- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: otel-collector-deployment + namespace: openshift-logging +---- + +. Create a cluster role that grants the Collector's service account the permissions to push logs to the `LokiStack` application tenant. ++ +.Example `ClusterRole` object +[source,yaml] +---- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: otel-collector-logs-writer +rules: + - apiGroups: ["loki.grafana.com"] + resourceNames: ["logs"] + resources: ["application"] + verbs: ["create"] + - apiGroups: [""] + resources: ["pods", "namespaces", "nodes"] + verbs: ["get", "watch", "list"] + - apiGroups: ["apps"] + resources: ["replicasets"] + verbs: ["get", "list", "watch"] + - apiGroups: ["extensions"] + resources: ["replicasets"] + verbs: ["get", "list", "watch"] +---- + +. Bind the cluster role to the service account. ++ +.Example `ClusterRoleBinding` object +[source,yaml] +---- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: otel-collector-logs-writer +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: otel-collector-logs-writer +subjects: + - kind: ServiceAccount + name: otel-collector-deployment + namespace: openshift-logging +---- + +. Create an `OpenTelemetryCollector` custom resource (CR) object. ++ +.Example `OpenTelemetryCollector` CR object +[source,yaml] +---- +apiVersion: opentelemetry.io/v1beta1 +kind: OpenTelemetryCollector +metadata: + name: otel + namespace: openshift-logging +spec: + serviceAccount: otel-collector-deployment + config: + extensions: + bearertokenauth: + filename: "/var/run/secrets/kubernetes.io/serviceaccount/token" + receivers: + otlp: + protocols: + grpc: {} + http: {} + processors: + k8sattributes: {} + resource: + attributes: # <1> + - key: kubernetes.namespace_name + from_attribute: k8s.namespace.name + action: upsert + - key: kubernetes.pod_name + from_attribute: k8s.pod.name + action: upsert + - key: kubernetes.container_name + from_attribute: k8s.container.name + action: upsert + - key: log_type + value: application + action: upsert + transform: + log_statements: + - context: log + statements: + - set(attributes["level"], ConvertCase(severity_text, "lower")) + exporters: + otlphttp: + endpoint: https://logging-loki-gateway-http.openshift-logging.svc.cluster.local:8080/api/logs/v1/application/otlp + encoding: json + tls: + ca_file: "/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt" + auth: + authenticator: bearertokenauth + debug: + verbosity: detailed + service: + extensions: [bearertokenauth] # <2> + pipelines: + logs: + receivers: [otlp] + processors: [k8sattributes, transform, resource] + exporters: [otlphttp] # <3> + logs/test: + receivers: [otlp] + processors: [] + exporters: [debug] +---- +<1> Provides the following resource attributes to be used by the web console: `kubernetes.namespace_name`, `kubernetes.pod_name`, `kubernetes.container_name`, and `log_type`. +<2> Enables the BearerTokenAuth Extension that is required by the OTLP HTTP Exporter. +<3> Enables the OTLP HTTP Exporter to export logs from the Collector. + +[TIP] +==== +You can deploy `telemetrygen` as a test: + +[source,yaml] +---- +apiVersion: batch/v1 +kind: Job +metadata: + name: telemetrygen +spec: + template: + spec: + containers: + - name: telemetrygen + image: ghcr.io/open-telemetry/opentelemetry-collector-contrib/telemetrygen:v0.106.1 + args: + - logs + - --otlp-endpoint=otel-collector.openshift-logging.svc.cluster.local:4317 + - --otlp-insecure + - --duration=180s + - --workers=1 + - --logs=10 + - --otlp-attributes=k8s.container.name="telemetrygen" + restartPolicy: Never + backoffLimit: 4 +---- +==== From 58a4dd49eca058aa9132317457a2231f75e3b3ee Mon Sep 17 00:00:00 2001 From: Pavol Loffay Date: Mon, 29 Sep 2025 15:23:04 +0200 Subject: [PATCH 3/4] TRACING-5677: RHOSDT 3.8, OTEL googlecloud exporter Signed-off-by: Pavol Loffay --- .../otel-forwarding-data-to-googlecloud.adoc | 11 ++ .../otel-forwarding-logs-to-googlecloud.adoc | 170 ------------------ .../otel/otel-forwarding-telemetry-data.adoc | 2 + 3 files changed, 13 insertions(+), 170 deletions(-) create mode 100644 modules/otel-forwarding-data-to-googlecloud.adoc delete mode 100644 modules/otel-forwarding-logs-to-googlecloud.adoc diff --git a/modules/otel-forwarding-data-to-googlecloud.adoc b/modules/otel-forwarding-data-to-googlecloud.adoc new file mode 100644 index 000000000000..ae5855e542a3 --- /dev/null +++ b/modules/otel-forwarding-data-to-googlecloud.adoc @@ -0,0 +1,11 @@ +//Module included in the following assemblies: +// +// * observability/otel/otel-forwarding-data.adoc + +:_mod-docs-content-type: PROCEDURE +[id="otel-forwarding-data-to-googlecloud_{context}"] += Forwarding telemetry data to Google Cloud + +You can deploy the OpenTelemetry Collector to forward metrics, logs and traces to the Google Cloud by using the Google Cloud exporter. + +TODO Add link to the googlecloud exporter from the collector configuration page. \ No newline at end of file diff --git a/modules/otel-forwarding-logs-to-googlecloud.adoc b/modules/otel-forwarding-logs-to-googlecloud.adoc deleted file mode 100644 index 7b54be481249..000000000000 --- a/modules/otel-forwarding-logs-to-googlecloud.adoc +++ /dev/null @@ -1,170 +0,0 @@ -//Module included in the following assemblies: -// -// * observability/otel/otel-forwarding-data.adoc - -:_mod-docs-content-type: PROCEDURE -[id="otel-forwarding-logs-to-tempostack_{context}"] -= Forwarding logs to a LokiStack instance - -You can deploy the OpenTelemetry Collector to forward logs to a `LokiStack` instance by using the `openshift-logging` tenants mode. - -.Prerequisites - -* The {OTELOperator} is installed. -* The {loki-op} is installed. -* A supported `LokiStack` instance is deployed on the cluster. For more information about the supported `LokiStack` configuration, see _Logging_. - -.Procedure - -. Create a service account for the OpenTelemetry Collector. -+ -.Example `ServiceAccount` object -[source,yaml] ----- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: otel-collector-deployment - namespace: openshift-logging ----- - -. Create a cluster role that grants the Collector's service account the permissions to push logs to the `LokiStack` application tenant. -+ -.Example `ClusterRole` object -[source,yaml] ----- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: otel-collector-logs-writer -rules: - - apiGroups: ["loki.grafana.com"] - resourceNames: ["logs"] - resources: ["application"] - verbs: ["create"] - - apiGroups: [""] - resources: ["pods", "namespaces", "nodes"] - verbs: ["get", "watch", "list"] - - apiGroups: ["apps"] - resources: ["replicasets"] - verbs: ["get", "list", "watch"] - - apiGroups: ["extensions"] - resources: ["replicasets"] - verbs: ["get", "list", "watch"] ----- - -. Bind the cluster role to the service account. -+ -.Example `ClusterRoleBinding` object -[source,yaml] ----- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: otel-collector-logs-writer -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: otel-collector-logs-writer -subjects: - - kind: ServiceAccount - name: otel-collector-deployment - namespace: openshift-logging ----- - -. Create an `OpenTelemetryCollector` custom resource (CR) object. -+ -.Example `OpenTelemetryCollector` CR object -[source,yaml] ----- -apiVersion: opentelemetry.io/v1beta1 -kind: OpenTelemetryCollector -metadata: - name: otel - namespace: openshift-logging -spec: - serviceAccount: otel-collector-deployment - config: - extensions: - bearertokenauth: - filename: "/var/run/secrets/kubernetes.io/serviceaccount/token" - receivers: - otlp: - protocols: - grpc: {} - http: {} - processors: - k8sattributes: {} - resource: - attributes: # <1> - - key: kubernetes.namespace_name - from_attribute: k8s.namespace.name - action: upsert - - key: kubernetes.pod_name - from_attribute: k8s.pod.name - action: upsert - - key: kubernetes.container_name - from_attribute: k8s.container.name - action: upsert - - key: log_type - value: application - action: upsert - transform: - log_statements: - - context: log - statements: - - set(attributes["level"], ConvertCase(severity_text, "lower")) - exporters: - otlphttp: - endpoint: https://logging-loki-gateway-http.openshift-logging.svc.cluster.local:8080/api/logs/v1/application/otlp - encoding: json - tls: - ca_file: "/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt" - auth: - authenticator: bearertokenauth - debug: - verbosity: detailed - service: - extensions: [bearertokenauth] # <2> - pipelines: - logs: - receivers: [otlp] - processors: [k8sattributes, transform, resource] - exporters: [otlphttp] # <3> - logs/test: - receivers: [otlp] - processors: [] - exporters: [debug] ----- -<1> Provides the following resource attributes to be used by the web console: `kubernetes.namespace_name`, `kubernetes.pod_name`, `kubernetes.container_name`, and `log_type`. -<2> Enables the BearerTokenAuth Extension that is required by the OTLP HTTP Exporter. -<3> Enables the OTLP HTTP Exporter to export logs from the Collector. - -[TIP] -==== -You can deploy `telemetrygen` as a test: - -[source,yaml] ----- -apiVersion: batch/v1 -kind: Job -metadata: - name: telemetrygen -spec: - template: - spec: - containers: - - name: telemetrygen - image: ghcr.io/open-telemetry/opentelemetry-collector-contrib/telemetrygen:v0.106.1 - args: - - logs - - --otlp-endpoint=otel-collector.openshift-logging.svc.cluster.local:4317 - - --otlp-insecure - - --duration=180s - - --workers=1 - - --logs=10 - - --otlp-attributes=k8s.container.name="telemetrygen" - restartPolicy: Never - backoffLimit: 4 ----- -==== diff --git a/observability/otel/otel-forwarding-telemetry-data.adoc b/observability/otel/otel-forwarding-telemetry-data.adoc index 938baee81a51..ad570a806e10 100644 --- a/observability/otel/otel-forwarding-telemetry-data.adoc +++ b/observability/otel/otel-forwarding-telemetry-data.adoc @@ -11,3 +11,5 @@ You can use the OpenTelemetry Collector to forward your telemetry data. include::modules/otel-forwarding-traces.adoc[leveloffset=+1] include::modules/otel-forwarding-logs-to-tempostack.adoc[leveloffset=+1] + +include::modules/otel-forwarding-data-to-googlecloud.adoc[leveloffset=+1] From 72d557f9234b10c223aac7a8cfe85cffe6a006df Mon Sep 17 00:00:00 2001 From: Pavol Loffay Date: Mon, 29 Sep 2025 16:17:15 +0200 Subject: [PATCH 4/4] TRACING-5677: RHOSDT 3.8, OTEL googlecloud exporter Signed-off-by: Pavol Loffay --- modules/otel-forwarding-data-to-aws.adoc | 11 +++++++++++ .../otel/otel-collector/otel-collector-exporters.adoc | 4 ++++ .../otel/otel-forwarding-telemetry-data.adoc | 2 ++ 3 files changed, 17 insertions(+) create mode 100644 modules/otel-forwarding-data-to-aws.adoc diff --git a/modules/otel-forwarding-data-to-aws.adoc b/modules/otel-forwarding-data-to-aws.adoc new file mode 100644 index 000000000000..3c61b4476e4f --- /dev/null +++ b/modules/otel-forwarding-data-to-aws.adoc @@ -0,0 +1,11 @@ +//Module included in the following assemblies: +// +// * observability/otel/otel-forwarding-data.adoc + +:_mod-docs-content-type: PROCEDURE +[id="otel-forwarding-data-to-googlecloud_{context}"] += Forwarding telemetry data to AWS + +You can deploy the OpenTelemetry Collector to forward metrics, logs and traces to the AWS CloudWatch and X-Ray. + +TODO Add link to the AWF CloudWatch, EMF and X-Ray exporter from the collector configuration page. \ No newline at end of file diff --git a/observability/otel/otel-collector/otel-collector-exporters.adoc b/observability/otel/otel-collector/otel-collector-exporters.adoc index d1c76f9af9c4..e7edc79cb137 100644 --- a/observability/otel/otel-collector/otel-collector-exporters.adoc +++ b/observability/otel/otel-collector/otel-collector-exporters.adoc @@ -311,6 +311,7 @@ include::snippets/technology-preview.adoc[] region: # <3> endpoint: # <4> log_retention: # <5> + role_arn: "" # <6> # ... ---- <1> Required. If the log group does not exist yet, it is automatically created. @@ -318,6 +319,7 @@ include::snippets/technology-preview.adoc[] <3> Optional. If the AWS region is not already set in the default credential chain, you must specify it. <4> Optional. You can override the default Amazon CloudWatch Logs service endpoint to which the requests are forwarded. You must include the protocol, such as `https://`, as part of the endpoint value. For the list of service endpoints by region, see link:https://docs.aws.amazon.com/general/latest/gr/cwl_region.html[Amazon CloudWatch Logs endpoints and quotas] (AWS General Reference). <5> Optional. With this parameter, you can set the log retention policy for new Amazon CloudWatch log groups. If this parameter is omitted or set to `0`, the logs never expire by default. Supported values for retention in days are `1`, `3`, `5`, `7`, `14`, `30`, `60`, `90`, `120`, `150`, `180`, `365`, `400`, `545`, `731`, `1827`, `2192`, `2557`, `2922`, `3288`, or `3653`. +<6> Optional. The AWS Identity and Access Management (IAM) role for uploading the X-Ray segments to a different account. [role="_additional-resources"] .Additional resources @@ -357,6 +359,7 @@ include::snippets/technology-preview.adoc[] endpoint: # <5> log_retention: # <6> namespace: # <7> + role_arn: "" # <8> # ... ---- <1> Customized log group name. @@ -366,6 +369,7 @@ include::snippets/technology-preview.adoc[] <5> Optional. You can override the default Amazon CloudWatch Logs service endpoint to which the requests are forwarded. You must include the protocol, such as `https://`, as part of the endpoint value. For the list of service endpoints by region, see link:https://docs.aws.amazon.com/general/latest/gr/cwl_region.html[Amazon CloudWatch Logs endpoints and quotas] (AWS General Reference). <6> Optional. With this parameter, you can set the log retention policy for new Amazon CloudWatch log groups. If this parameter is omitted or set to `0`, the logs never expire by default. Supported values for retention in days are `1`, `3`, `5`, `7`, `14`, `30`, `60`, `90`, `120`, `150`, `180`, `365`, `400`, `545`, `731`, `1827`, `2192`, `2557`, `2922`, `3288`, or `3653`. <7> Optional. A custom namespace for the Amazon CloudWatch metrics. +<8> Optional. The AWS Identity and Access Management (IAM) role for uploading the X-Ray segments to a different account. [discrete] [id="log-group-name_{context}"] diff --git a/observability/otel/otel-forwarding-telemetry-data.adoc b/observability/otel/otel-forwarding-telemetry-data.adoc index ad570a806e10..21770a165c2f 100644 --- a/observability/otel/otel-forwarding-telemetry-data.adoc +++ b/observability/otel/otel-forwarding-telemetry-data.adoc @@ -13,3 +13,5 @@ include::modules/otel-forwarding-traces.adoc[leveloffset=+1] include::modules/otel-forwarding-logs-to-tempostack.adoc[leveloffset=+1] include::modules/otel-forwarding-data-to-googlecloud.adoc[leveloffset=+1] + +include::modules/otel-forwarding-data-to-aws.adoc[leveloffset=+1]