Open Telemetry quick start

OpenTelemetry is a Cloud Native Computing Foundation (CNCF) framework for observability. It enables your microservices to provide metrics, logs and traces.

SUSE Security Admission Controller’s components, using the OpenTelemetry SDK, report data to an OpenTelemetry collector — called the agent.

This guide explains how to deploy the OpenTelemetry collector in sidecar mode by using the official Kubernetes Helm chart.

This is a simple deployment pattern using OpenTelemetry. It’s final setup looks like this:

  • Each Pod of the Admission Controller stack (Policy Server, Controller) has an OpenTelemetry sidecar.

  • The sidecar receives tracing and monitoring information from the Admission Controller component via the OpenTelemetry Protocol (OTLP)

  • The OpenTelemetry collector:

    • Sends the trace events to a central Jaeger instance

    • Exposes Prometheus metrics on a specific port

The Admission Controller Helm chart doesn’t cover all the possible deployment scenarios of the OpenTelemetry collector. It’s also possible to configure Admission Controller to send data to an OpenTelemetry collector. Documentation for that scenario is in the custom OpenTelemetry guide.

You first deploy OpenTelemetry in a Kubernetes cluster, so you can use it in the following sections addressing specifically tracing and metrics.

Setting up a Kubernetes cluster

This section has step-by-step instructions for creating a Kubernetes cluster for the telemetry quick starts.

Feel free to skip this section if you already have a Kubernetes cluster available.

You can create a Kubernetes cluster for testing using minikube.

Minikube has many backends, for this case you can use the kvm2 driver which relies on libvirt.

Assuming libvirtd is correctly running on your machine, issue the following command:

minikube start --driver=kvm2

The command produces an output similar to the following:

$ minikube start --driver=kvm2
😄  minikube v1.23.2 on Opensuse-Leap 15.3
✨  Using the kvm2 driver based on user configuration
👍  Starting control plane node minikube in cluster minikube
🔥  Creating kvm2 VM (CPUs=2, Memory=6000MB, Disk=20000MB) ...
🐳  Preparing Kubernetes v1.22.2 on Docker 20.10.8 ...
    ▪ Generating certificates and keys ...
    ▪ Booting up control plane ...
    ▪ Configuring RBAC rules ...
🔎  Verifying Kubernetes components...
    ▪ Using image gcr.io/k8s-minikube/storage-provisioner:v5
🌟  Enabled addons: storage-provisioner, default-storageclass
🏄  Done! kubectl is now configured to use "minikube" cluster and "default" namespace by default

After the cluster is ready, you can continue with the rest of the guide.

SUSE Application Collection credentials

The telemetry guides install all the Helm charts and container images from the SUSE Application Collection. Log in to the registry with Helm, using your Application Collection credentials:

helm registry login dp.apps.rancher.io \
  --username <your-username> \
  --password <your-token>

The cluster also needs credentials to pull the container images. Before installing each Helm chart, the guides create an image pull secret named application-collection in the namespace where the chart is installed.

Install Traefik

The following telemetry guides use Traefik as the Ingress controller when exposing the Jaeger UI with Kubernetes Ingress resources.

Install Traefik by using its Helm chart from the SUSE Application Collection:

kubectl create namespace traefik

kubectl create secret docker-registry application-collection \
  --namespace traefik \
  --docker-server=dp.apps.rancher.io \
  --docker-username=<your-username> \
  --docker-password=<your-token>

helm install --wait \
  --namespace traefik \
  --version 41.7.1 \
  --set fullnameOverride=traefik \
  --set global.imagePullSecrets={application-collection} \
  traefik oci://dp.apps.rancher.io/charts/traefik-proxy

The fullnameOverride value sets the name of the Traefik Service and IngressClass to traefik.

The following guides create a standard Kubernetes Ingress with ingressClassName: traefik and route the Jaeger Query UI through the Traefik Service.

If you prefer not to install Traefik, the tracing guides also keep kubectl port-forward as a fallback to access Jaeger directly.

Install OpenTelemetry

See the dependency matrix for the latest supported component versions.

You use the OpenTelemetry Operator to manage the automatic injection of the OpenTelemetry Collector sidecar into the PolicyServer pod.

The OpenTelemetry Operator requires installation of cert-manager in the cluster.

kubectl create namespace cert-manager

kubectl create secret docker-registry application-collection \
  --namespace cert-manager \
  --docker-server=dp.apps.rancher.io \
  --docker-username=<your-username> \
  --docker-password=<your-token>

helm install --wait \
    --namespace cert-manager \
    --set crds.enabled=true \
    --set global.imagePullSecrets={application-collection} \
    --version 1.21.2 \
    cert-manager oci://dp.apps.rancher.io/charts/cert-manager

Once cert-manager is running, you can install the OpenTelemetry operator Helm chart:

kubectl create namespace open-telemetry

kubectl create secret docker-registry application-collection \
  --namespace open-telemetry \
  --docker-server=dp.apps.rancher.io \
  --docker-username=<your-username> \
  --docker-password=<your-token>

helm install --wait \
  --namespace open-telemetry \
  --version 0.124.1 \
  --set global.imagePullSecrets={application-collection} \
  --set manager.collectorImage.tag=0.160.0-contrib \
  my-opentelemetry-operator oci://dp.apps.rancher.io/charts/opentelemetry-operator

The manager.collectorImage.tag value selects the contrib distribution of the OpenTelemetry Collector image, which includes the exporters used in these guides.

OpenTelemetry integration

You can now move to the next chapters to enable application metrics (via Prometheus integration) and application tracing (via Jaeger integration).