From 31a7b37d16f39ed8de0d6a0d5633ea9d8597cdc1 Mon Sep 17 00:00:00 2001 From: Alex P Date: Mon, 9 Nov 2026 14:45:03 +0200 Subject: [PATCH] charts: stop OTLP push when no endpoint is set Fixes #76 Signed-off-by: Alex P --- .../substrate-atelet/templates/_helpers.tpl | 8 ++- charts/substrate/README.md | 2 +- charts/substrate/templates/_helpers.tpl | 8 ++- .../templates/k8s-credential-provider.yaml | 4 ++ .../substrate/tests/control_plane_test.yaml | 61 +++++++++++++++++++ charts/substrate/values.yaml | 2 +- 6 files changed, 77 insertions(+), 8 deletions(-) diff --git a/charts/substrate-atelet/templates/_helpers.tpl b/charts/substrate-atelet/templates/_helpers.tpl index f9905c8fda..7bf6b0e5b0 100644 --- a/charts/substrate-atelet/templates/_helpers.tpl +++ b/charts/substrate-atelet/templates/_helpers.tpl @@ -49,11 +49,13 @@ substrate release references. {{- end }} {{- range $signal := list "traces" "metrics" "logs" }} {{- $cfg := index $otel $signal }} -{{- if not $cfg.enabled }} -{{- /* Request no OTLP export with the SDK exporter name "none". +{{- if not (include "substrate.otel.signalEndpoint" (list $signal $)) }} +{{- /* Disabled, or enabled with no endpoint: request no OTLP export, since + otlp without one retries localhost:4317. Enabled metrics keep the + scraped endpoint with "prometheus"; otherwise the SDK name "none". Actor events still go to stdout. */}} - name: OTEL_{{ upper $signal }}_EXPORTER - value: none + value: {{ ternary "prometheus" "none" (and $cfg.enabled (eq $signal "metrics")) }} {{- else if $cfg.endpoint }} - name: OTEL_EXPORTER_OTLP_{{ upper $signal }}_ENDPOINT value: {{ $cfg.endpoint | quote }} diff --git a/charts/substrate/README.md b/charts/substrate/README.md index 35d7bc96c8..a695fd56d5 100644 --- a/charts/substrate/README.md +++ b/charts/substrate/README.md @@ -105,7 +105,7 @@ See `values.yaml` for the full set; the important keys: | `ateApi.authorization.bootstrapOwners` | `[]` | Global owners; empty defaults to the release's shared `ate-client` ServiceAccount | | `ateApi.extraArgs` | `[]` | Additional command-line arguments appended to the ateapi defaults | | `otel.endpoint` | `""` | Set to an OTLP endpoint to export traces, metrics, the actor lifecycle events and the router access log | -| `otel.traces.enabled` | `true` | Set to `false` to export no traces from the router; the Go components do not honor this yet | +| `otel.traces.enabled` | `true` | Set to `false` to export no traces from the Go components and the router | | `otel.traces.endpoint` | `""` | OTLP endpoint for traces, overriding `otel.endpoint` | | `otel.traces.samplingRatio` | `0.01` | Fraction of parentless requests that start a trace, applied to the Go components and the router | | `otel.metrics.enabled` | `true` | Set to `false` to disable OTLP metrics push; Prometheus scraping remains available | diff --git a/charts/substrate/templates/_helpers.tpl b/charts/substrate/templates/_helpers.tpl index 35d435d350..bb40dd0333 100644 --- a/charts/substrate/templates/_helpers.tpl +++ b/charts/substrate/templates/_helpers.tpl @@ -127,11 +127,13 @@ Usage: {{- end }} {{- range $signal := list "traces" "metrics" "logs" }} {{- $cfg := index $otel $signal }} -{{- if not $cfg.enabled }} -{{- /* Request no OTLP export with the SDK exporter name "none". +{{- if not (include "substrate.otel.signalEndpoint" (list $signal $)) }} +{{- /* Disabled, or enabled with no endpoint: request no OTLP export, since + otlp without one retries localhost:4317. Enabled metrics keep the + scraped endpoint with "prometheus"; otherwise the SDK name "none". Actor events still go to stdout. */}} - name: OTEL_{{ upper $signal }}_EXPORTER - value: none + value: {{ ternary "prometheus" "none" (and $cfg.enabled (eq $signal "metrics")) }} {{- else if $cfg.endpoint }} - name: OTEL_EXPORTER_OTLP_{{ upper $signal }}_ENDPOINT value: {{ $cfg.endpoint | quote }} diff --git a/charts/substrate/templates/k8s-credential-provider.yaml b/charts/substrate/templates/k8s-credential-provider.yaml index b2cd5290bb..b6215b8c85 100644 --- a/charts/substrate/templates/k8s-credential-provider.yaml +++ b/charts/substrate/templates/k8s-credential-provider.yaml @@ -92,6 +92,10 @@ spec: - "--namespace-policy-file=/etc/k8s-credential-provider/namespace-policy.yaml" - "--injector-identity=spiffe://cluster.local/ns/{{ .Release.Namespace }}/sa/{{ include "substrate.fullname" (list "atenet-egress" .) }}" - "--log-level=info" +{{- with include "substrate.otel.env" . }} + env: +{{- . | trim | nindent 8 }} +{{- end }} ports: - name: grpc containerPort: 50051 diff --git a/charts/substrate/tests/control_plane_test.yaml b/charts/substrate/tests/control_plane_test.yaml index 87646b96fc..5c69ce6045 100644 --- a/charts/substrate/tests/control_plane_test.yaml +++ b/charts/substrate/tests/control_plane_test.yaml @@ -206,6 +206,67 @@ tests: content: name: statusz containerPort: 4040 +- it: stops OTLP push without an endpoint but keeps the scraped metrics + template: ate-controller.yaml + documentSelector: + path: kind + value: Deployment + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: OTEL_TRACES_EXPORTER + value: none + - contains: + path: spec.template.spec.containers[0].env + content: + name: OTEL_METRICS_EXPORTER + value: prometheus + - contains: + path: spec.template.spec.containers[0].env + content: + name: OTEL_LOGS_EXPORTER + value: none +- it: stops the credential provider's OTLP push without an endpoint + template: k8s-credential-provider.yaml + documentSelector: + path: kind + value: Deployment + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: OTEL_TRACES_EXPORTER + value: none + - contains: + path: spec.template.spec.containers[0].env + content: + name: OTEL_METRICS_EXPORTER + value: prometheus +- it: exports the credential provider's telemetry to the configured endpoint + template: k8s-credential-provider.yaml + documentSelector: + path: kind + value: Deployment + set: + otel.endpoint: http://collector:4317 + otel.metrics.enabled: false + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: OTEL_EXPORTER_OTLP_ENDPOINT + value: http://collector:4317 + - contains: + path: spec.template.spec.containers[0].env + content: + name: OTEL_METRICS_EXPORTER + value: none + - notContains: + path: spec.template.spec.containers[0].env + content: + name: OTEL_TRACES_EXPORTER + value: none - it: denies ingress by default in the release namespace template: ate-system-networkpolicies.yaml documentSelector: diff --git a/charts/substrate/values.yaml b/charts/substrate/values.yaml index 5d0f7a4dce..f8e0c775d3 100644 --- a/charts/substrate/values.yaml +++ b/charts/substrate/values.yaml @@ -212,7 +212,7 @@ ateApiServerEnvVarsConfigMap: ate-api-server-envvars # A signal exports only when it is enabled and resolves to an endpoint. # # metrics.enabled disables OTLP metrics push from the Go components and router. -# traces.enabled takes effect on the router; Go components do not read it yet. +# traces.enabled disables OTLP trace push from the Go components and router. # logs.enabled gates OTLP actor events from ateapi and the ateworkers, plus the # router's access log. Actor events go to stdout when OTLP logs are disabled # or no endpoint resolves.