charts: stop OTLP push when no endpoint is set

charts/substrate-atelet/templates/_helpers.tpl

@@ -49,11 +49,13 @@ substrate release references.
 {{- end }}
 {{- range $signal := list "traces" "metrics" "logs" }}
 {{- $cfg := index $otel $signal }}
-{{- if not $cfg.enabled }}
-{{- /* Request no OTLP export with the SDK exporter name "none".
+{{- if not (include "substrate.otel.signalEndpoint" (list $signal $)) }}
+{{- /* Disabled, or enabled with no endpoint: request no OTLP export, since
+       otlp without one retries localhost:4317. Enabled metrics keep the
+       scraped endpoint with "prometheus"; otherwise the SDK name "none".
        Actor events still go to stdout. */}}
 - name: OTEL_{{ upper $signal }}_EXPORTER
-  value: none
+  value: {{ ternary "prometheus" "none" (and $cfg.enabled (eq $signal "metrics")) }}
 {{- else if $cfg.endpoint }}
 - name: OTEL_EXPORTER_OTLP_{{ upper $signal }}_ENDPOINT
   value: {{ $cfg.endpoint | quote }}

charts/substrate/README.md

@@ -105,7 +105,7 @@ See `values.yaml` for the full set; the important keys:
 | `ateApi.authorization.bootstrapOwners` | `[]` | Global owners; empty defaults to the release's shared `ate-client` ServiceAccount |
 | `ateApi.extraArgs` | `[]` | Additional command-line arguments appended to the ateapi defaults |
 | `otel.endpoint` | `""` | Set to an OTLP endpoint to export traces, metrics, the actor lifecycle events and the router access log |
-| `otel.traces.enabled` | `true` | Set to `false` to export no traces from the router; the Go components do not honor this yet |
+| `otel.traces.enabled` | `true` | Set to `false` to export no traces from the Go components and the router |
 | `otel.traces.endpoint` | `""` | OTLP endpoint for traces, overriding `otel.endpoint` |
 | `otel.traces.samplingRatio` | `0.01` | Fraction of parentless requests that start a trace, applied to the Go components and the router |
 | `otel.metrics.enabled` | `true` | Set to `false` to disable OTLP metrics push; Prometheus scraping remains available |

charts/substrate/templates/_helpers.tpl

@@ -127,11 +127,13 @@ Usage:
 {{- end }}
 {{- range $signal := list "traces" "metrics" "logs" }}
 {{- $cfg := index $otel $signal }}
-{{- if not $cfg.enabled }}
-{{- /* Request no OTLP export with the SDK exporter name "none".
+{{- if not (include "substrate.otel.signalEndpoint" (list $signal $)) }}
+{{- /* Disabled, or enabled with no endpoint: request no OTLP export, since
+       otlp without one retries localhost:4317. Enabled metrics keep the
+       scraped endpoint with "prometheus"; otherwise the SDK name "none".
        Actor events still go to stdout. */}}
 - name: OTEL_{{ upper $signal }}_EXPORTER
-  value: none
+  value: {{ ternary "prometheus" "none" (and $cfg.enabled (eq $signal "metrics")) }}
 {{- else if $cfg.endpoint }}
 - name: OTEL_EXPORTER_OTLP_{{ upper $signal }}_ENDPOINT
   value: {{ $cfg.endpoint | quote }}

charts/substrate/templates/k8s-credential-provider.yaml

@@ -92,6 +92,10 @@ spec:
         - "--namespace-policy-file=/etc/k8s-credential-provider/namespace-policy.yaml"
         - "--injector-identity=spiffe://cluster.local/ns/{{ .Release.Namespace }}/sa/{{ include "substrate.fullname" (list "atenet-egress" .) }}"
         - "--log-level=info"
+{{- with include "substrate.otel.env" . }}
+        env:
+{{- . | trim | nindent 8 }}
+{{- end }}
         ports:
         - name: grpc
           containerPort: 50051

charts/substrate/tests/control_plane_test.yaml

@@ -206,6 +206,67 @@ tests:
       content:
         name: statusz
         containerPort: 4040
+- it: stops OTLP push without an endpoint but keeps the scraped metrics
+  template: ate-controller.yaml
+  documentSelector:
+    path: kind
+    value: Deployment
+  asserts:
+  - contains:
+      path: spec.template.spec.containers[0].env
+      content:
+        name: OTEL_TRACES_EXPORTER
+        value: none
+  - contains:
+      path: spec.template.spec.containers[0].env
+      content:
+        name: OTEL_METRICS_EXPORTER
+        value: prometheus
+  - contains:
+      path: spec.template.spec.containers[0].env
+      content:
+        name: OTEL_LOGS_EXPORTER
+        value: none
+- it: stops the credential provider's OTLP push without an endpoint
+  template: k8s-credential-provider.yaml
+  documentSelector:
+    path: kind
+    value: Deployment
+  asserts:
+  - contains:
+      path: spec.template.spec.containers[0].env
+      content:
+        name: OTEL_TRACES_EXPORTER
+        value: none
+  - contains:
+      path: spec.template.spec.containers[0].env
+      content:
+        name: OTEL_METRICS_EXPORTER
+        value: prometheus
+- it: exports the credential provider's telemetry to the configured endpoint
+  template: k8s-credential-provider.yaml
+  documentSelector:
+    path: kind
+    value: Deployment
+  set:
+    otel.endpoint: http://collector:4317
+    otel.metrics.enabled: false
+  asserts:
+  - contains:
+      path: spec.template.spec.containers[0].env
+      content:
+        name: OTEL_EXPORTER_OTLP_ENDPOINT
+        value: http://collector:4317
+  - contains:
+      path: spec.template.spec.containers[0].env
+      content:
+        name: OTEL_METRICS_EXPORTER
+        value: none
+  - notContains:
+      path: spec.template.spec.containers[0].env
+      content:
+        name: OTEL_TRACES_EXPORTER
+        value: none
 - it: denies ingress by default in the release namespace
   template: ate-system-networkpolicies.yaml
   documentSelector:

charts/substrate/values.yaml

@@ -212,7 +212,7 @@ ateApiServerEnvVarsConfigMap: ate-api-server-envvars
 # A signal exports only when it is enabled and resolves to an endpoint.
 #
 # metrics.enabled disables OTLP metrics push from the Go components and router.
-# traces.enabled takes effect on the router; Go components do not read it yet.
+# traces.enabled disables OTLP trace push from the Go components and router.
 # logs.enabled gates OTLP actor events from ateapi and the ateworkers, plus the
 # router's access log. Actor events go to stdout when OTLP logs are disabled
 # or no endpoint resolves.