Add securityContext support for TargetAllocator

[hahakiki2025]

Currently, when namespace-level privilege is not enabled, deploying TargetAllocator alongside the OpenTelemetry Collector (with enabled=true) fails due to PodSecurity "restricted" policy violations:

• allowPrivilegeEscalation must be set to false
• capabilities must drop ["ALL"]

This change adds support for configuring securityContext for the TargetAllocator container, enabling compliant deployments under restricted PodSecurity settings.

Test Steps and Logs

• Create an OpenTelemetryCollector with TargetAllocator enabled and securityContext configured:

apiVersion: opentelemetry.io/v1beta1
kind: OpenTelemetryCollector
metadata:
  name: collector-with-ta
spec:
  securityContext:
    allowPrivilegeEscalation: false
    capabilities:
      drop:
      - ALL
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  mode: statefulset
  targetAllocator:
    enabled: true
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
    podSecurityContext:
      runAsNonRoot: true
      seccompProfile:
        type: RuntimeDefault
  config:
    receivers:
      prometheus:
        config:
          scrape_configs:
          - job_name: 'otel-collector'
            scrape_interval: 10s
            static_configs:
            - targets: [ '0.0.0.0:8888' ]
            metric_relabel_configs:
            - action: labeldrop
              regex: (id|name)
            - action: labelmap
              regex: label_(.+)
              replacement: $$1

    exporters:
      debug: {}

    service:
      pipelines:
        metrics:
          receivers: [prometheus]
          exporters: [debug]

• Apply the manifest

kubectl apply -f opentelemetry-collector-targetallocator.yml -n test1

• Verify the TargetAllocator pod is running:

kubectl get pods -n test1 |grep target
collector-with-ta-targetallocator-57986fd8f4-6l9hb   1/1     Running   0          43m

• Inspect the securityContext of the TargetAllocator container that it's correctly applied:

kubectl get pod <targetallocator-pod> -n test1 -o yaml | yq .spec.containers[].securityContext
allowPrivilegeEscalation: false
capabilities:
  drop:
    - ALL

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: hahakiki2025 / name: Yan Li (99cc9f2)
• ✅ login: TylerHelmuth / name: Tyler Helmuth (34a3017)

[TylerHelmuth]

@hahakiki2025 please sign the CLA then I will review the code

[hahakiki2025]

@hahakiki2025 please sign the CLA then I will review the code

@TylerHelmuth CLA signed, please go ahead, thanks

[TylerHelmuth]

@hahakiki2025 please bump the charts minor version and regenerate the examples with make generate-examples CHARTS=opentelemetry-target-allocator

[hahakiki2025]

@hahakiki2025 please bump the charts minor version and regenerate the examples with make generate-examples CHARTS=opentelemetry-target-allocator
Hi Tyler,
I'm new contributor to the Opentelemetry Upstream. Regarding the bumping the charts minor version, is it similar to the version bump as this PR? In the PR it bumped the version to 0.112.2 in Chart.yaml and then run make generate-examples for the examples update? thanks

[hahakiki2025]

@hahakiki2025 please bump the charts minor version and regenerate the examples with make generate-examples CHARTS=opentelemetry-target-allocator
Hi Tyler,
I'm new contributor to the Opentelemetry Upstream. Regarding the bumping the charts minor version, is it similar to the version bump as this PR? In the PR it bumped the version to 0.112.2 in Chart.yaml and then run make generate-examples for the examples update? thanks

@TylerHelmuth Done the version bump, please help have a look, thanks!

[hahakiki2025]

@TylerHelmuth I have rebased the code to resolve the conflicts. Since @atoulme and @povilasv have already approved it, could you please take another look and help merge this when you have a moment? Thank you!

[TylerHelmuth]

All the files in this dir are managed via make update-operator-crds. We can't add this manually, it would need to be in the upstream OpenTelemetry Operator CRD