Skip to content

Commit 2ae1acf

Browse files
davidhajadavidhaja
committed
Merge branch 'main' of https://github.com/open-telemetry/opentelemetry-operator into 2947-updating-ds-sf-depl-mutation
2 parents 1d1ebb1 + b703b78 commit 2ae1acf

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+1573
-151
lines changed

‎.chloggen/fix_validation-stabilizationWindowSeconds.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
2+
change_type: bug_fix
3+
4+
# The name of the component, or a single word describing the area of concern, (e.g. collector, target allocator, auto-instrumentation, opamp, github action)
5+
component: collector-webhook
6+
7+
# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
8+
note: "Fixed validation of `stabilizationWindowSeconds` in autoscaler behaviour"
9+
10+
# One or more tracking issues related to the change
11+
issues: [3345]
12+
13+
# (Optional) One or more lines of additional information to render under the primary note.
14+
# These lines will be padded with 2 spaces and then inserted directly into the document.
15+
# Use pipe (|) for multiline entries.
16+
subtext: |
17+
The validation of `stabilizationWindowSeconds` in the `autoscaler.behaviour.scale[Up|Down]` incorrectly rejected 0 as an invalid value.
18+
This has been fixed to ensure that the value is validated correctly (should be >=0 and <=3600) and the error messsage has been updated to reflect this.

‎.chloggen/inst-tls.yaml

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
2+
change_type: enhancement
3+
4+
# The name of the component, or a single word describing the area of concern, (e.g. collector, target allocator, auto-instrumentation, opamp, github action)
5+
component: auto-instrumentation
6+
7+
# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
8+
note: Add support for specifying exporter TLS certificates in auto-instrumentation.
9+
10+
# One or more tracking issues related to the change
11+
issues: [3338]
12+
13+
# (Optional) One or more lines of additional information to render under the primary note.
14+
# These lines will be padded with 2 spaces and then inserted directly into the document.
15+
# Use pipe (|) for multiline entries.
16+
subtext: |
17+
Now Instrumentation CR supports specifying TLS certificates for exporter:
18+
```yaml
19+
spec:
20+
exporter:
21+
endpoint: https://otel-collector:4317
22+
tls:
23+
secretName: otel-tls-certs
24+
configMapName: otel-ca-bundle
25+
# otel-ca-bundle
26+
ca_file: ca.crt
27+
# present in otel-tls-certs
28+
cert_file: tls.crt
29+
# present in otel-tls-certs
30+
key_file: tls.key
31+
```
32+
33+
* Propagating secrets across namespaces can be done with https://github.com/EmberStack/kubernetes-reflector or https://github.com/zakkg3/ClusterSecret
34+
* Restarting workloads on certificate renewal can be done with https://github.com/stakater/Reloader or https://github.com/wave-k8s/wave

‎.chloggen/native_sidecar.yaml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
2+
change_type: enhancement
3+
4+
# The name of the component, or a single word describing the area of concern, (e.g. collector, target allocator, auto-instrumentation, opamp, github action)
5+
component: collector
6+
7+
# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
8+
note: Add native sidecar injection behind a feature gate which is disabled by default.
9+
10+
# One or more tracking issues related to the change
11+
issues: [2376]
12+
13+
# (Optional) One or more lines of additional information to render under the primary note.
14+
# These lines will be padded with 2 spaces and then inserted directly into the document.
15+
# Use pipe (|) for multiline entries.
16+
subtext: |
17+
Native sidecars are supported since Kubernetes version `1.28` and are availabe by default since `1.29`.
18+
To use native sidecars on Kubernetes v1.28 make sure the "SidecarContainers" feature gate on kubernetes is enabled.
19+
If native sidecars are available, the operator can be advised to use them by adding adding
20+
the `--feature-gates=operator.sidecarcontainers.native` to the Operator args.
21+
In the future this may will become availabe as deployment mode on the Collector CR. See [#3356](https://github.com/open-telemetry/opentelemetry-operator/issues/3356)

‎.github/workflows/e2e.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,9 @@ jobs:
4646
setup: "add-operator-arg OPERATOR_ARG='--feature-gates=operator.targetallocator.mtls' add-certmanager-permissions prepare-e2e"
4747
- group: e2e-automatic-rbac
4848
setup: "add-rbac-permissions-to-operator prepare-e2e"
49+
- group: e2e-native-sidecar
50+
setup: "add-operator-arg OPERATOR_ARG='--feature-gates=operator.sidecarcontainers.native' prepare-e2e"
51+
kube-version: "1.29"
4952
steps:
5053
- name: Check out code into the Go module directory
5154
uses: actions/checkout@v4

‎Makefile

+7
Original file line numberDiff line numberDiff line change
@@ -267,6 +267,13 @@ generate: controller-gen
267267
e2e: chainsaw
268268
$(CHAINSAW) test --test-dir ./tests/e2e
269269

270+
# e2e-native-sidecar
271+
# NOTE: make sure the k8s featuregate "SidecarContainers" is set to true.
272+
# NOTE: make sure the operator featuregate "operator.sidecarcontainers.native" is enabled.
273+
.PHONY: e2e-native-sidecar
274+
e2e-native-sidecar: chainsaw
275+
$(CHAINSAW) test --test-dir ./tests/e2e-native-sidecar
276+
270277
# end-to-end-test for testing automatic RBAC creation
271278
.PHONY: e2e-automatic-rbac
272279
e2e-automatic-rbac: chainsaw

‎apis/v1alpha1/instrumentation_types.go

+29
Original file line numberDiff line numberDiff line change
@@ -97,8 +97,37 @@ type Resource struct {
9797
// Exporter defines OTLP exporter configuration.
9898
type Exporter struct {
9999
// Endpoint is address of the collector with OTLP endpoint.
100+
// If the endpoint defines https:// scheme TLS has to be specified.
100101
// +optional
101102
Endpoint string `json:"endpoint,omitempty"`
103+
104+
// TLS defines certificates for TLS.
105+
// TLS needs to be enabled by specifying https:// scheme in the Endpoint.
106+
TLS *TLS `json:"tls,omitempty"`
107+
}
108+
109+
// TLS defines TLS configuration for exporter.
110+
type TLS struct {
111+
// SecretName defines secret name that will be used to configure TLS on the exporter.
112+
// It is user responsibility to create the secret in the namespace of the workload.
113+
// The secret must contain client certificate (Cert) and private key (Key).
114+
// The CA certificate might be defined in the secret or in the config map.
115+
SecretName string `json:"secretName,omitempty"`
116+
117+
// ConfigMapName defines configmap name with CA certificate. If it is not defined CA certificate will be
118+
// used from the secret defined in SecretName.
119+
ConfigMapName string `json:"configMapName,omitempty"`
120+
121+
// CA defines the key of certificate (e.g. ca.crt) in the configmap map, secret or absolute path to a certificate.
122+
// The absolute path can be used when certificate is already present on the workload filesystem e.g.
123+
// /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
124+
CA string `json:"ca_file,omitempty"`
125+
// Cert defines the key (e.g. tls.crt) of the client certificate in the secret or absolute path to a certificate.
126+
// The absolute path can be used when certificate is already present on the workload filesystem.
127+
Cert string `json:"cert_file,omitempty"`
128+
// Key defines a key (e.g. tls.key) of the private key in the secret or absolute path to a certificate.
129+
// The absolute path can be used when certificate is already present on the workload filesystem.
130+
Key string `json:"key_file,omitempty"`
102131
}
103132

104133
// Sampler defines sampling configuration.

‎apis/v1alpha1/instrumentation_webhook.go

+22
Original file line numberDiff line numberDiff line change
@@ -236,9 +236,31 @@ func (w InstrumentationWebhook) validate(r *Instrumentation) (admission.Warnings
236236
default:
237237
return warnings, fmt.Errorf("spec.sampler.type is not valid: %s", r.Spec.Sampler.Type)
238238
}
239+
240+
warnings = append(warnings, validateExporter(r.Spec.Exporter)...)
241+
239242
return warnings, nil
240243
}
241244

245+
func validateExporter(exporter Exporter) []string {
246+
var warnings []string
247+
if exporter.TLS != nil {
248+
tls := exporter.TLS
249+
if tls.Key != "" && tls.Cert == "" || tls.Cert != "" && tls.Key == "" {
250+
warnings = append(warnings, "both exporter.tls.key and exporter.tls.cert mut be set")
251+
}
252+
253+
if !strings.HasPrefix(exporter.Endpoint, "https://") {
254+
warnings = append(warnings, "exporter.tls is configured but exporter.endpoint is not enabling TLS with https://")
255+
}
256+
}
257+
if strings.HasPrefix(exporter.Endpoint, "https://") && exporter.TLS == nil {
258+
warnings = append(warnings, "exporter is using https:// but exporter.tls is unset")
259+
}
260+
261+
return warnings
262+
}
263+
242264
func validateJaegerRemoteSamplerArgument(argument string) error {
243265
parts := strings.Split(argument, ",")
244266

‎apis/v1alpha1/instrumentation_webhook_test.go

+88
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,94 @@ func TestInstrumentationValidatingWebhook(t *testing.T) {
113113
},
114114
},
115115
},
116+
{
117+
name: "exporter: tls cert set but missing key",
118+
inst: Instrumentation{
119+
Spec: InstrumentationSpec{
120+
Sampler: Sampler{
121+
Type: ParentBasedTraceIDRatio,
122+
Argument: "0.99",
123+
},
124+
Exporter: Exporter{
125+
Endpoint: "https://collector:4317",
126+
TLS: &TLS{
127+
Cert: "cert",
128+
},
129+
},
130+
},
131+
},
132+
warnings: []string{"both exporter.tls.key and exporter.tls.cert mut be set"},
133+
},
134+
{
135+
name: "exporter: tls key set but missing cert",
136+
inst: Instrumentation{
137+
Spec: InstrumentationSpec{
138+
Sampler: Sampler{
139+
Type: ParentBasedTraceIDRatio,
140+
Argument: "0.99",
141+
},
142+
Exporter: Exporter{
143+
Endpoint: "https://collector:4317",
144+
TLS: &TLS{
145+
Key: "key",
146+
},
147+
},
148+
},
149+
},
150+
warnings: []string{"both exporter.tls.key and exporter.tls.cert mut be set"},
151+
},
152+
{
153+
name: "exporter: tls set but using http://",
154+
inst: Instrumentation{
155+
Spec: InstrumentationSpec{
156+
Sampler: Sampler{
157+
Type: ParentBasedTraceIDRatio,
158+
Argument: "0.99",
159+
},
160+
Exporter: Exporter{
161+
Endpoint: "http://collector:4317",
162+
TLS: &TLS{
163+
Key: "key",
164+
Cert: "cert",
165+
},
166+
},
167+
},
168+
},
169+
warnings: []string{"exporter.tls is configured but exporter.endpoint is not enabling TLS with https://"},
170+
},
171+
{
172+
name: "exporter: exporter using http://, but the tls is nil",
173+
inst: Instrumentation{
174+
Spec: InstrumentationSpec{
175+
Sampler: Sampler{
176+
Type: ParentBasedTraceIDRatio,
177+
Argument: "0.99",
178+
},
179+
Exporter: Exporter{
180+
Endpoint: "https://collector:4317",
181+
},
182+
},
183+
},
184+
warnings: []string{"exporter is using https:// but exporter.tls is unset"},
185+
},
186+
{
187+
name: "exporter no warning set",
188+
inst: Instrumentation{
189+
Spec: InstrumentationSpec{
190+
Sampler: Sampler{
191+
Type: ParentBasedTraceIDRatio,
192+
Argument: "0.99",
193+
},
194+
Exporter: Exporter{
195+
Endpoint: "https://collector:4317",
196+
TLS: &TLS{
197+
Key: "key",
198+
Cert: "cert",
199+
},
200+
},
201+
},
202+
},
203+
},
116204
}
117205

118206
for _, test := range tests {

‎apis/v1alpha1/zz_generated.deepcopy.go

+21-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎apis/v1beta1/collector_webhook.go

+4-4
Original file line numberDiff line numberDiff line change
@@ -385,13 +385,13 @@ func ValidatePorts(ports []PortsSpec) error {
385385
func checkAutoscalerSpec(autoscaler *AutoscalerSpec) error {
386386
if autoscaler.Behavior != nil {
387387
if autoscaler.Behavior.ScaleDown != nil && autoscaler.Behavior.ScaleDown.StabilizationWindowSeconds != nil &&
388-
*autoscaler.Behavior.ScaleDown.StabilizationWindowSeconds < int32(1) {
389-
return fmt.Errorf("the OpenTelemetry Spec autoscale configuration is incorrect, scaleDown should be one or more")
388+
(*autoscaler.Behavior.ScaleDown.StabilizationWindowSeconds < int32(0) || *autoscaler.Behavior.ScaleDown.StabilizationWindowSeconds > 3600) {
389+
return fmt.Errorf("the OpenTelemetry Spec autoscale configuration is incorrect, scaleDown.stabilizationWindowSeconds should be >=0 and <=3600")
390390
}
391391

392392
if autoscaler.Behavior.ScaleUp != nil && autoscaler.Behavior.ScaleUp.StabilizationWindowSeconds != nil &&
393-
*autoscaler.Behavior.ScaleUp.StabilizationWindowSeconds < int32(1) {
394-
return fmt.Errorf("the OpenTelemetry Spec autoscale configuration is incorrect, scaleUp should be one or more")
393+
(*autoscaler.Behavior.ScaleUp.StabilizationWindowSeconds < int32(0) || *autoscaler.Behavior.ScaleUp.StabilizationWindowSeconds > 3600) {
394+
return fmt.Errorf("the OpenTelemetry Spec autoscale configuration is incorrect, scaleUp.stabilizationWindowSeconds should be >=0 and <=3600")
395395
}
396396
}
397397
if autoscaler.TargetCPUUtilization != nil && *autoscaler.TargetCPUUtilization < int32(1) {

0 commit comments

Comments
 (0)