From c02e553ba4ba5ea1d91a5ef19fe41d4d1b5e3ee4 Mon Sep 17 00:00:00 2001 From: Kochetkov S Date: Wed, 24 Jun 2026 15:25:48 +0300 Subject: [PATCH] ++ add otel istio tracing config --- clusters/yc-k8s-test/kustomization.yaml | 4 +- .../yc-k8s-test/istio-config.yaml | 55 +++++ .../istio-pilot/yc-k8s-test/istio-pilot.yaml | 18 ++ .../yc-k8s-test/kustomization.yaml | 6 + .../yc-k8s-test/opentelemetry-collector.yaml | 195 ++++++++++++++++++ .../yc-k8s-test/kustomization.yaml | 4 + 6 files changed, 281 insertions(+), 1 deletion(-) create mode 100644 infrastructure/opentelemetry-collector/yc-k8s-test/kustomization.yaml create mode 100644 infrastructure/opentelemetry-collector/yc-k8s-test/opentelemetry-collector.yaml create mode 100644 infrastructure/opentelemetry-operator/yc-k8s-test/kustomization.yaml diff --git a/clusters/yc-k8s-test/kustomization.yaml b/clusters/yc-k8s-test/kustomization.yaml index dde9d1f..d3112b0 100644 --- a/clusters/yc-k8s-test/kustomization.yaml +++ b/clusters/yc-k8s-test/kustomization.yaml @@ -15,6 +15,8 @@ resources: - ../../infrastructure/minio/yc-k8s-test - ../../infrastructure/glitchtip/yc-k8s-test - ../../infrastructure/openobserve/yc-k8s-test + - ../../infrastructure/opentelemetry-operator/yc-k8s-test + - ../../infrastructure/opentelemetry-collector/yc-k8s-test - ../../infrastructure/rabbitmq/yc-k8s-test - ../../infrastructure/kafka/yc-k8s-test - ../../infrastructure/redis/yc-k8s-test @@ -61,4 +63,4 @@ resources: - ../../apps/processing/yc-k8s-test - ../../apps/message-hub/yc-k8s-test - ../../apps/transmittal/yc-k8s-test - - ../../apps/prescriptions/yc-k8s-test \ No newline at end of file + - ../../apps/prescriptions/yc-k8s-test diff --git a/infrastructure/istio-config/yc-k8s-test/istio-config.yaml b/infrastructure/istio-config/yc-k8s-test/istio-config.yaml index ae93e83..5bf9fc8 100644 --- a/infrastructure/istio-config/yc-k8s-test/istio-config.yaml +++ b/infrastructure/istio-config/yc-k8s-test/istio-config.yaml @@ -11,6 +11,8 @@ spec: env: contour environments: contour: + namespaces: + - name: attachments certManager: certificates: platform-tls: @@ -98,6 +100,59 @@ spec: name: letsencrypt-issuer-istio kind: ClusterIssuer istio: + requestAuthentications: + api-jwt: + namespace: istio-system + selector: + matchLabels: + istio: ingressgateway + jwtRules: + - issuer: https://zitadel.contour.infra.sarex.tech + jwksUri: https://zitadel.contour.infra.sarex.tech/oauth/v2/keys + forwardOriginalToken: true + fromHeaders: + - name: Identity + prefix: "Bearer " + - name: Authorization + prefix: "Bearer " + outputClaims: + company_ids: x-company-ids + sub: x-user-id + add-traceparent-filter: + - attachments + - bim + - cde + - checklists + - comparisons + - contracts + - control-interface + - cross-section + - django + - documentations + - drawings + - eav + - faas + - flows + - gateway + - inspections + - issues + - mapper + - measurements + - message-hub + - notes + - pm + - prescriptions + - processing + - projects + - remarks + - resources + - reviews + - rfi + - stamp-verification + - subscriptions + - system-log + - transmittal + - workspaces gateways: platform: name: platform-gateway diff --git a/infrastructure/istio-pilot/yc-k8s-test/istio-pilot.yaml b/infrastructure/istio-pilot/yc-k8s-test/istio-pilot.yaml index 061b753..f5b4d18 100644 --- a/infrastructure/istio-pilot/yc-k8s-test/istio-pilot.yaml +++ b/infrastructure/istio-pilot/yc-k8s-test/istio-pilot.yaml @@ -9,3 +9,21 @@ spec: dependsOn: - name: istio-base namespace: istio-system + - name: opentelemetry-collector + namespace: opentelemetry-collector + values: + traceSampling: 100 + meshConfig: + enableTracing: true + defaultConfig: + tracing: + sampling: 100 + custom_tags: + client_ip: + header: + name: x-forwarded-for + user.id: + header: + name: x-user-id + zipkin: + address: otel-collector.opentelemetry-collector.svc.cluster.local:9411 diff --git a/infrastructure/opentelemetry-collector/yc-k8s-test/kustomization.yaml b/infrastructure/opentelemetry-collector/yc-k8s-test/kustomization.yaml new file mode 100644 index 0000000..d14afa8 --- /dev/null +++ b/infrastructure/opentelemetry-collector/yc-k8s-test/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base +patches: + - path: opentelemetry-collector.yaml diff --git a/infrastructure/opentelemetry-collector/yc-k8s-test/opentelemetry-collector.yaml b/infrastructure/opentelemetry-collector/yc-k8s-test/opentelemetry-collector.yaml new file mode 100644 index 0000000..751aa58 --- /dev/null +++ b/infrastructure/opentelemetry-collector/yc-k8s-test/opentelemetry-collector.yaml @@ -0,0 +1,195 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: opentelemetry-collector + namespace: opentelemetry-collector +spec: + interval: 5m + timeout: 30m + dependsOn: + - name: openobserve + namespace: openobserve + install: + disableWait: true + remediation: + retries: 3 + upgrade: + disableWait: true + remediation: + retries: 3 + values: + mode: daemonset + fullnameOverride: otel-collector + serviceAccount: + create: true + name: openobserve-vault + podAnnotations: + vault.hashicorp.com/agent-init-first: "true" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: openobserve + vault.hashicorp.com/agent-inject-secret-openobserve-basic-auth: secrets/data/vault/apps/openobserve + vault.hashicorp.com/agent-inject-template-openobserve-basic-auth: |- + {{ "{{- with secret \"secrets/data/vault/apps/openobserve\" -}}" }} + Basic {{ "{{ index .Data.data \"OPENOBSERVE_BASIC_AUTH\" }}" }} + {{ "{{- end -}}" }} + tolerations: + - operator: Exists + rollout: + rollingUpdate: + maxUnavailable: 4 + presets: + logsCollection: + enabled: true + includeCollectorLogs: false + kubernetesAttributes: + enabled: true + alternateConfig: + exporters: + otlphttp/openobserve: + endpoint: http://openobserve-web.openobserve.svc.cluster.local:5080/api/default + headers: + Authorization: ${file:/vault/secrets/openobserve-basic-auth} + retry_on_failure: + enabled: true + sending_queue: + enabled: true + num_consumers: 5 + queue_size: 8192 + tls: + insecure: true + extensions: + health_check: + endpoint: ${env:MY_POD_IP}:13133 + processors: + batch: + send_batch_max_size: 2048 + send_batch_size: 1024 + timeout: 5s + filter/drop_timeouts: + logs: + exclude: + match_type: regexp + bodies: + - '^Timeouts: user.*' + k8sattributes: {} + resource: + attributes: + - action: insert + key: k8s.cluster.name + value: yc-k8s-test + - action: insert + key: deployment.environment + value: contour + - action: insert + key: host.name + from_attribute: k8s.node.name + transform/remove_body: + error_mode: ignore + trace_statements: + - delete_key(span.attributes, "body") + receivers: + filelog: + exclude: + - /var/log/pods/*/otel-collector/*.log + - /var/log/pods/*/otel-collector-*/*.log + - /var/log/pods/*/opentelemetry-collector-prod/*.log + - /var/log/pods/*/opentelemetry-collector-*/*.log + - /var/log/pods/kube-system_*/*/*.log + - /var/log/pods/istio-system_*/*/*.log + - /var/log/pods/*/*/istio-*/*.log + - /var/log/pods/*/istio-*/*.log + include: + - /var/log/pods/*/*/*.log + include_file_name: false + include_file_path: true + operators: + - id: container-parser + type: container + max_log_size: 102400 + - id: json-body-parser + type: json_parser + parse_from: body + parse_to: attributes + if: 'body matches "^\\s*\\{"' + on_error: send_quiet + - id: json-msg-parser + type: json_parser + parse_from: attributes.msg + parse_to: attributes + if: 'attributes.msg != nil and attributes.msg matches "^\\s*\\{"' + on_error: send_quiet + - id: severity-from-level + type: severity_parser + parse_from: attributes.level + if: 'attributes.level != nil' + overwrite_text: true + on_error: send_quiet + - id: trace-from-json + type: trace_parser + trace_id: + parse_from: attributes.trace_id + span_id: + parse_from: attributes.span_id + if: 'attributes.trace_id != nil and attributes.span_id != nil' + on_error: send_quiet + - id: user-id-from-request + type: copy + from: attributes.request.user_id + to: attributes.user_id + if: 'attributes.request != nil and attributes.request.user_id != nil' + on_error: send_quiet + - id: company-id-from-request + type: copy + from: attributes.request.company_id + to: attributes.company_id + if: 'attributes.request != nil and attributes.request.company_id != nil' + on_error: send_quiet + - id: message-to-body + type: copy + from: attributes.message + to: body + if: 'attributes.message != nil' + on_error: send_quiet + retry_on_failure: + enabled: true + start_at: end + otlp: + protocols: + grpc: + endpoint: 0.0.0.0:4317 + http: + endpoint: 0.0.0.0:4318 + zipkin: + endpoint: 0.0.0.0:9411 + service: + extensions: + - health_check + pipelines: + logs: + exporters: + - otlphttp/openobserve + processors: + - k8sattributes + - resource + - filter/drop_timeouts + - batch + receivers: + - filelog + traces: + exporters: + - otlphttp/openobserve + processors: + - k8sattributes + - resource + - transform/remove_body + - batch + receivers: + - otlp + - zipkin + telemetry: + logs: + level: info + metrics: + address: ${env:MY_POD_IP}:8888 diff --git a/infrastructure/opentelemetry-operator/yc-k8s-test/kustomization.yaml b/infrastructure/opentelemetry-operator/yc-k8s-test/kustomization.yaml new file mode 100644 index 0000000..27bb5cb --- /dev/null +++ b/infrastructure/opentelemetry-operator/yc-k8s-test/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ../base