Receiving telemetry data

Procedure

1. Mount the following certificates in the OpenTelemetry Collector instance, skipping already mounted certificates.

   1. An Issuer to generate the certificates by using the cert-manager Operator for Red Hat OpenShift.

      apiVersion: cert-manager.io/v1
      kind: Issuer
      metadata:
        name: selfsigned-issuer
      spec:
        selfSigned: {}

   2. A self-signed certificate.

      apiVersion: cert-manager.io/v1
      kind: Certificate
      metadata:
        name: ca
      spec:
        isCA: true
        commonName: ca
        subject:
          organizations:
            - <your_organization_name>
          organizationalUnits:
            - Widgets
        secretName: ca-secret
        privateKey:
          algorithm: ECDSA
          size: 256
        issuerRef:
          name: selfsigned-issuer
          kind: Issuer
          group: cert-manager.io

   3. A CA issuer.

      apiVersion: cert-manager.io/v1
      kind: Issuer
      metadata:
        name: test-ca-issuer
      spec:
        ca:
          secretName: ca-secret

   4. A server certificate.

      apiVersion: cert-manager.io/v1
      kind: Certificate
      metadata:
        name: server
      spec:
        secretName: server-tls
        isCA: false
        usages:
          - server auth
          - client auth
        dnsNames:
        - "otel.observability.svc.cluster.local"
        issuerRef:
          name: ca-issuer

      where:

      dnsNames

      Lists exact DNS names to be mapped to a solver in the server OpenTelemetry Collector instance.

   5. A client certificate.

      apiVersion: cert-manager.io/v1
      kind: Certificate
      metadata:
        name: client
      spec:
        secretName: client-tls
        isCA: false
        usages:
          - server auth
          - client auth
        dnsNames:
        - "otel.observability.svc.cluster.local"
        issuerRef:
          name: ca-issuer

      where:

      dnsNames

      Lists exact DNS names to be mapped to a solver in the client OpenTelemetry Collector instance.

2. Create a service account for the OpenTelemetry Collector instance.

   The following is an example ServiceAccount:

   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: otel-collector-deployment

3. Create a cluster role for the service account.

   The following is an example ClusterRole:

   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
     name: otel-collector
   rules:
    <rule_a>
    <rube_b>
   - apiGroups: ["", "config.openshift.io"]
     resources: ["pods", "namespaces", "infrastructures", "infrastructures/status"]
     verbs: ["get", "watch", "list"]

   where:

   <rule_a>

   The k8sattributesprocessor processor requires permissions for pods and namespace resources.

   <rube_b>

   The resourcedetectionprocessor processor requires permissions for infrastructures and status.

4. Bind the cluster role to the service account.

   The following is an example ClusterRoleBinding:

   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRoleBinding
   metadata:
     name: otel-collector
   subjects:
   - kind: ServiceAccount
     name: otel-collector-deployment
     namespace: otel-collector-<example>
   roleRef:
     kind: ClusterRole
     name: otel-collector
     apiGroup: rbac.authorization.k8s.io

5. Create the YAML file to define the OpenTelemetryCollector custom resource (CR) in the edge clusters.

   The following is an example OpenTelemetryCollector custom resource for the edge clusters:

   apiVersion: opentelemetry.io/v1beta1
   kind: OpenTelemetryCollector
   metadata:
     name: otel
     namespace: otel-collector-<example>
   spec:
     mode: daemonset
     serviceAccount: otel-collector-deployment
     config:
       receivers:
         jaeger:
           protocols:
             grpc: {}
             thrift_binary: {}
             thrift_compact: {}
             thrift_http: {}
         opencensus:
         otlp:
           protocols:
             grpc: {}
             http: {}
         zipkin: {}
       processors:
         batch: {}
         k8sattributes: {}
         memory_limiter:
           check_interval: 1s
           limit_percentage: 50
           spike_limit_percentage: 30
         resourcedetection:
           detectors: [openshift]
       exporters:
         otlphttp:
           endpoint: https://observability-cluster.com:443
           tls:
             insecure: false
             cert_file: /certs/server.crt
             key_file: /certs/server.key
             ca_file: /certs/ca.crt
       service:
         pipelines:
           traces:
             receivers: [jaeger, opencensus, otlp, zipkin]
             processors: [memory_limiter, k8sattributes, resourcedetection, batch]
             exporters: [otlphttp]
     volumes:
       - name: otel-certs
         secret:
           name: otel-certs
     volumeMounts:
       - name: otel-certs
         mountPath: /certs

   where:

   endpoint

   The Collector exporter is configured to export OTLP HTTP and points to the OpenTelemetry Collector from the central cluster.

6. Create the YAML file to define the OpenTelemetryCollector custom resource (CR) in the central cluster.

   The following is an example OpenTelemetryCollector custom resource for the central cluster:

   apiVersion: opentelemetry.io/v1beta1
   kind: OpenTelemetryCollector
   metadata:
     name: otlp-receiver
     namespace: observability
   spec:
     mode: "deployment"
     ingress:
       type: route
       route:
         termination: "passthrough"
     config:
       receivers:
         otlp:
           protocols:
             http:
               tls:
                 cert_file: /certs/server.crt
                 key_file: /certs/server.key
                 client_ca_file: /certs/ca.crt
       exporters:
         otlp/traces:
           endpoint: "tempo-<simplest>-distributor:4317"
           tls:
             insecure: true
       service:
         pipelines:
           traces:
             receivers: [otlp]
             processors: []
             exporters: [otlp/traces]
     volumes:
       - name: otel-certs
         secret:
           name: otel-certs
     volumeMounts:
       - name: otel-certs
         mountPath: /certs

   where:

   tls

   The Collector receiver requires the certificates listed in the first step.

   endpoint

   The Collector exporter is configured to export OTLP and points to the Tempo distributor endpoint, which in this example is "tempo-simplest-distributor:4317" and already created.