Skip to content

TRACING-5677 | RHOSDT 3.8, Google Cloud exporter and AWS IAM/ #99810

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 4 commits into
base: main
Choose a base branch
from
Draft

TRACING-5677 | RHOSDT 3.8, Google Cloud exporter and AWS IAM/ #99810

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a9a4ffc
TRACING-5677: RHOSDT 3.8, OTEL googlecloud exporter
pavolloffay Sep 29, 2025
4313694
TRACING-5677: RHOSDT 3.8, OTEL googlecloud exporter
pavolloffay Sep 29, 2025
58a4dd4
TRACING-5677: RHOSDT 3.8, OTEL googlecloud exporter
pavolloffay Sep 29, 2025
72d557f
TRACING-5677: RHOSDT 3.8, OTEL googlecloud exporter
pavolloffay Sep 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions modules/otel-forwarding-data-to-aws.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
//Module included in the following assemblies:
//
// * observability/otel/otel-forwarding-data.adoc

:_mod-docs-content-type: PROCEDURE
[id="otel-forwarding-data-to-googlecloud_{context}"]
= Forwarding telemetry data to AWS

You can deploy the OpenTelemetry Collector to forward metrics, logs and traces to the AWS CloudWatch and X-Ray.

TODO Add link to the AWF CloudWatch, EMF and X-Ray exporter from the collector configuration page.
11 changes: 11 additions & 0 deletions modules/otel-forwarding-data-to-googlecloud.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
//Module included in the following assemblies:
//
// * observability/otel/otel-forwarding-data.adoc

:_mod-docs-content-type: PROCEDURE
[id="otel-forwarding-data-to-googlecloud_{context}"]
= Forwarding telemetry data to Google Cloud

You can deploy the OpenTelemetry Collector to forward metrics, logs and traces to the Google Cloud by using the Google Cloud exporter.

TODO Add link to the googlecloud exporter from the collector configuration page.
48 changes: 48 additions & 0 deletions observability/otel/otel-collector/otel-collector-exporters.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -311,13 +311,15 @@ include::snippets/technology-preview.adoc[]
region: <aws_region_of_log_stream> # <3>
endpoint: <protocol><service_endpoint_of_amazon_cloudwatch_logs> # <4>
log_retention: <supported_value_in_days> # <5>
role_arn: "<iam_role>" # <6>
Copy link
Member Author

@pavolloffay pavolloffay Sep 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@IshwarKanse we should update our e2e tests https://github.com/openshift/distributed-tracing-qe/tree/main/tests/e2e-otel to use the role_arn

Copy link
Member

@IshwarKanse IshwarKanse Oct 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added googlecloud exporter test which used WIF openshift/distributed-tracing-qe#117 We have aws tests using role ARN as well.

# ...
----
<1> Required. If the log group does not exist yet, it is automatically created.
<2> Required. If the log stream does not exist yet, it is automatically created.
<3> Optional. If the AWS region is not already set in the default credential chain, you must specify it.
<4> Optional. You can override the default Amazon CloudWatch Logs service endpoint to which the requests are forwarded. You must include the protocol, such as `https://`, as part of the endpoint value. For the list of service endpoints by region, see link:https://docs.aws.amazon.com/general/latest/gr/cwl_region.html[Amazon CloudWatch Logs endpoints and quotas] (AWS General Reference).
<5> Optional. With this parameter, you can set the log retention policy for new Amazon CloudWatch log groups. If this parameter is omitted or set to `0`, the logs never expire by default. Supported values for retention in days are `1`, `3`, `5`, `7`, `14`, `30`, `60`, `90`, `120`, `150`, `180`, `365`, `400`, `545`, `731`, `1827`, `2192`, `2557`, `2922`, `3288`, or `3653`.
<6> Optional. The AWS Identity and Access Management (IAM) role for uploading the X-Ray segments to a different account.

[role="_additional-resources"]
.Additional resources
Expand Down Expand Up @@ -357,6 +359,7 @@ include::snippets/technology-preview.adoc[]
endpoint: <protocol><endpoint> # <5>
log_retention: <supported_value_in_days> # <6>
namespace: <custom_namespace> # <7>
role_arn: "<iam_role>" # <8>
# ...
----
<1> Customized log group name.
Expand All @@ -366,6 +369,7 @@ include::snippets/technology-preview.adoc[]
<5> Optional. You can override the default Amazon CloudWatch Logs service endpoint to which the requests are forwarded. You must include the protocol, such as `https://`, as part of the endpoint value. For the list of service endpoints by region, see link:https://docs.aws.amazon.com/general/latest/gr/cwl_region.html[Amazon CloudWatch Logs endpoints and quotas] (AWS General Reference).
<6> Optional. With this parameter, you can set the log retention policy for new Amazon CloudWatch log groups. If this parameter is omitted or set to `0`, the logs never expire by default. Supported values for retention in days are `1`, `3`, `5`, `7`, `14`, `30`, `60`, `90`, `120`, `150`, `180`, `365`, `400`, `545`, `731`, `1827`, `2192`, `2557`, `2922`, `3288`, or `3653`.
<7> Optional. A custom namespace for the Amazon CloudWatch metrics.
<8> Optional. The AWS Identity and Access Management (IAM) role for uploading the X-Ray segments to a different account.

[discrete]
[id="log-group-name_{context}"]
Expand Down Expand Up @@ -445,6 +449,50 @@ include::snippets/technology-preview.adoc[]
// * link:https://docs.aws.amazon.com/sdk-for-go/v2/developer-guide/configure-auth.html[Configure Authentication] (AWS SDK for Go v2 Developer Guide)
* link:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html[IAM roles] (AWS Identity and Access Management User Guide)

[id="googlecloud-exporter_{context}"]
== Google Cloud Exporter

The Google Cloud Exporter can be used converts the OpenTelemetry spans, metrics and logs to the Google Cloud Trace, Monitoring, and Logging formats and then sends them directly to the Google Cloud operations suite (formerly Stackdriver).

The Goolge Cloud Exporter can be used to send metrics to Google Cloud Monitoring (formerly Stackdriver), traces to Google Cloud Trace, and logs to Google Cloud Logging.

:FeatureName: The Google Cloud Exporter
include::snippets/technology-preview.adoc[]

.OpenTelemetry Collector custom resource with the enabled Google Cloud Exporter
[source,yaml]
----
# ...
env:
- name: GOOGLE_APPLICATION_CREDENTIALS
value: /var/secrets/google/key.json # <1>
volumeMounts:
- name: google-application-credentials
mountPath: /var/secrets/google
readOnly: true
volumes:
- name: google-application-credentials
secret:
secretName: google-application-credentials
config:
exporters:
googlecloud:
project: # <3>
# ...
----
<1> The `GOOGLE_APPLICATION_CREDENTIALS` environment variable which points to the authentication `key.json` file. The `key.json` file is mounted as a secret volume to the collector.
<2> Optional project identifier. If not specified, the project is determined from the credentials.

[role="_additional-resources"]
.Additional resources
* link:https://cloud.google.com/monitoring?hl=en[Google Cloud Monitoring]
* link:https://cloud.google.com/logging?hl=en[Google Cloud Logging]
* link:https://cloud.google.com/trace?hl=en[Google Cloud Trace]
* link:https://cloud.google.com/iam/docs/workload-identity-federation-with-kubernetes#deploy[Google Workflow Identity Federation docs]
Copy link
Member Author

@pavolloffay pavolloffay Sep 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@IshwarKanse are you using these commands to configure WIF?

gcloud iam workload-identity-pools create-cred-config \
    projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/WORKLOAD_PROVIDER_ID \
    --service-account=SERVICE_ACCOUNT_EMAIL \
    --credential-source-file=/var/run/service-account/token \
    --credential-source-type=text \
    --output-file=credential-configuration.json

Is it possible to use just the k8s SA to push data to the google cloud? e.g. without using the key.json?


=== Multi-Project exporting
By default, the exporter sends telemetry to the project specified by project in the configuration. This can be overridden on a per-metrics basis using the `gcp.project.id` resource attribute. For example, if a metric has a label project, you could use the groupbyattrs processor to promote it to a resource label, and the resource processor to rename the attribute from project to `gcp.project.id`.

[id="file-exporter_{context}"]
== File Exporter

Expand Down
4 changes: 4 additions & 0 deletions observability/otel/otel-forwarding-telemetry-data.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,7 @@ You can use the OpenTelemetry Collector to forward your telemetry data.
include::modules/otel-forwarding-traces.adoc[leveloffset=+1]

include::modules/otel-forwarding-logs-to-tempostack.adoc[leveloffset=+1]

include::modules/otel-forwarding-data-to-googlecloud.adoc[leveloffset=+1]

include::modules/otel-forwarding-data-to-aws.adoc[leveloffset=+1]