++ add otel istio tracing config

clusters/yc-k8s-test/kustomization.yaml

@@ -15,6 +15,8 @@ resources:
   - ../../infrastructure/minio/yc-k8s-test
   - ../../infrastructure/glitchtip/yc-k8s-test
   - ../../infrastructure/openobserve/yc-k8s-test
+  - ../../infrastructure/opentelemetry-operator/yc-k8s-test
+  - ../../infrastructure/opentelemetry-collector/yc-k8s-test
   - ../../infrastructure/rabbitmq/yc-k8s-test
   - ../../infrastructure/kafka/yc-k8s-test
   - ../../infrastructure/redis/yc-k8s-test
@@ -61,4 +63,4 @@ resources:
   - ../../apps/processing/yc-k8s-test
   - ../../apps/message-hub/yc-k8s-test
   - ../../apps/transmittal/yc-k8s-test
-  - ../../apps/prescriptions/yc-k8s-test  
+  - ../../apps/prescriptions/yc-k8s-test

infrastructure/istio-config/yc-k8s-test/istio-config.yaml

@@ -11,6 +11,8 @@ spec:
       env: contour
     environments:
       contour:
+        namespaces:
+          - name: attachments
         certManager:
           certificates:
             platform-tls:
@@ -98,6 +100,59 @@ spec:
                 name: letsencrypt-issuer-istio
                 kind: ClusterIssuer    
         istio:
+          requestAuthentications:
+            api-jwt:
+              namespace: istio-system
+              selector:
+                matchLabels:
+                  istio: ingressgateway
+              jwtRules:
+                - issuer: https://zitadel.contour.infra.sarex.tech
+                  jwksUri: https://zitadel.contour.infra.sarex.tech/oauth/v2/keys
+                  forwardOriginalToken: true
+                  fromHeaders:
+                    - name: Identity
+                      prefix: "Bearer "
+                    - name: Authorization
+                      prefix: "Bearer "
+                  outputClaims:
+                    company_ids: x-company-ids
+                    sub: x-user-id
+          add-traceparent-filter:
+            - attachments
+            - bim
+            - cde
+            - checklists
+            - comparisons
+            - contracts
+            - control-interface
+            - cross-section
+            - django
+            - documentations
+            - drawings
+            - eav
+            - faas
+            - flows
+            - gateway
+            - inspections
+            - issues
+            - mapper
+            - measurements
+            - message-hub
+            - notes
+            - pm
+            - prescriptions
+            - processing
+            - projects
+            - remarks
+            - resources
+            - reviews
+            - rfi
+            - stamp-verification
+            - subscriptions
+            - system-log
+            - transmittal
+            - workspaces
           gateways:
             platform:
               name: platform-gateway

infrastructure/istio-pilot/yc-k8s-test/istio-pilot.yaml

@@ -9,3 +9,21 @@ spec:
   dependsOn:
     - name: istio-base
       namespace: istio-system
+    - name: opentelemetry-collector
+      namespace: opentelemetry-collector
+  values:
+    traceSampling: 100
+    meshConfig:
+      enableTracing: true
+      defaultConfig:
+        tracing:
+          sampling: 100
+          custom_tags:
+            client_ip:
+              header:
+                name: x-forwarded-for
+            user.id:
+              header:
+                name: x-user-id
+          zipkin:
+            address: otel-collector.opentelemetry-collector.svc.cluster.local:9411

infrastructure/opentelemetry-collector/yc-k8s-test/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: opentelemetry-collector.yaml

infrastructure/opentelemetry-collector/yc-k8s-test/opentelemetry-collector.yaml

@@ -0,0 +1,195 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: opentelemetry-collector
+  namespace: opentelemetry-collector
+spec:
+  interval: 5m
+  timeout: 30m
+  dependsOn:
+    - name: openobserve
+      namespace: openobserve
+  install:
+    disableWait: true
+    remediation:
+      retries: 3
+  upgrade:
+    disableWait: true
+    remediation:
+      retries: 3
+  values:
+    mode: daemonset
+    fullnameOverride: otel-collector
+    serviceAccount:
+      create: true
+      name: openobserve-vault
+    podAnnotations:
+      vault.hashicorp.com/agent-init-first: "true"
+      vault.hashicorp.com/agent-inject: "true"
+      vault.hashicorp.com/agent-pre-populate-only: "true"
+      vault.hashicorp.com/auth-path: auth/kubernetes
+      vault.hashicorp.com/role: openobserve
+      vault.hashicorp.com/agent-inject-secret-openobserve-basic-auth: secrets/data/vault/apps/openobserve
+      vault.hashicorp.com/agent-inject-template-openobserve-basic-auth: |-
+        {{ "{{- with secret \"secrets/data/vault/apps/openobserve\" -}}" }}
+        Basic {{ "{{ index .Data.data \"OPENOBSERVE_BASIC_AUTH\" }}" }}
+        {{ "{{- end -}}" }}
+    tolerations:
+      - operator: Exists
+    rollout:
+      rollingUpdate:
+        maxUnavailable: 4
+    presets:
+      logsCollection:
+        enabled: true
+        includeCollectorLogs: false
+      kubernetesAttributes:
+        enabled: true
+    alternateConfig:
+      exporters:
+        otlphttp/openobserve:
+          endpoint: http://openobserve-web.openobserve.svc.cluster.local:5080/api/default
+          headers:
+            Authorization: ${file:/vault/secrets/openobserve-basic-auth}
+          retry_on_failure:
+            enabled: true
+          sending_queue:
+            enabled: true
+            num_consumers: 5
+            queue_size: 8192
+          tls:
+            insecure: true
+      extensions:
+        health_check:
+          endpoint: ${env:MY_POD_IP}:13133
+      processors:
+        batch:
+          send_batch_max_size: 2048
+          send_batch_size: 1024
+          timeout: 5s
+        filter/drop_timeouts:
+          logs:
+            exclude:
+              match_type: regexp
+              bodies:
+                - '^Timeouts: user.*'
+        k8sattributes: {}
+        resource:
+          attributes:
+            - action: insert
+              key: k8s.cluster.name
+              value: yc-k8s-test
+            - action: insert
+              key: deployment.environment
+              value: contour
+            - action: insert
+              key: host.name
+              from_attribute: k8s.node.name
+        transform/remove_body:
+          error_mode: ignore
+          trace_statements:
+            - delete_key(span.attributes, "body")
+      receivers:
+        filelog:
+          exclude:
+            - /var/log/pods/*/otel-collector/*.log
+            - /var/log/pods/*/otel-collector-*/*.log
+            - /var/log/pods/*/opentelemetry-collector-prod/*.log
+            - /var/log/pods/*/opentelemetry-collector-*/*.log
+            - /var/log/pods/kube-system_*/*/*.log
+            - /var/log/pods/istio-system_*/*/*.log
+            - /var/log/pods/*/*/istio-*/*.log
+            - /var/log/pods/*/istio-*/*.log
+          include:
+            - /var/log/pods/*/*/*.log
+          include_file_name: false
+          include_file_path: true
+          operators:
+            - id: container-parser
+              type: container
+              max_log_size: 102400
+            - id: json-body-parser
+              type: json_parser
+              parse_from: body
+              parse_to: attributes
+              if: 'body matches "^\\s*\\{"'
+              on_error: send_quiet
+            - id: json-msg-parser
+              type: json_parser
+              parse_from: attributes.msg
+              parse_to: attributes
+              if: 'attributes.msg != nil and attributes.msg matches "^\\s*\\{"'
+              on_error: send_quiet
+            - id: severity-from-level
+              type: severity_parser
+              parse_from: attributes.level
+              if: 'attributes.level != nil'
+              overwrite_text: true
+              on_error: send_quiet
+            - id: trace-from-json
+              type: trace_parser
+              trace_id:
+                parse_from: attributes.trace_id
+              span_id:
+                parse_from: attributes.span_id
+              if: 'attributes.trace_id != nil and attributes.span_id != nil'
+              on_error: send_quiet
+            - id: user-id-from-request
+              type: copy
+              from: attributes.request.user_id
+              to: attributes.user_id
+              if: 'attributes.request != nil and attributes.request.user_id != nil'
+              on_error: send_quiet
+            - id: company-id-from-request
+              type: copy
+              from: attributes.request.company_id
+              to: attributes.company_id
+              if: 'attributes.request != nil and attributes.request.company_id != nil'
+              on_error: send_quiet
+            - id: message-to-body
+              type: copy
+              from: attributes.message
+              to: body
+              if: 'attributes.message != nil'
+              on_error: send_quiet
+          retry_on_failure:
+            enabled: true
+          start_at: end
+        otlp:
+          protocols:
+            grpc:
+              endpoint: 0.0.0.0:4317
+            http:
+              endpoint: 0.0.0.0:4318
+        zipkin:
+          endpoint: 0.0.0.0:9411
+      service:
+        extensions:
+          - health_check
+        pipelines:
+          logs:
+            exporters:
+              - otlphttp/openobserve
+            processors:
+              - k8sattributes
+              - resource
+              - filter/drop_timeouts
+              - batch
+            receivers:
+              - filelog
+          traces:
+            exporters:
+              - otlphttp/openobserve
+            processors:
+              - k8sattributes
+              - resource
+              - transform/remove_body
+              - batch
+            receivers:
+              - otlp
+              - zipkin
+        telemetry:
+          logs:
+            level: info
+          metrics:
+            address: ${env:MY_POD_IP}:8888

infrastructure/opentelemetry-operator/yc-k8s-test/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base