feat(otel): setup by jazzlyn · Pull Request #10155 · tyriis/home-ops

jazzlyn · 2026-08-21T21:15:01Z

tyriis-automation · 2026-08-21T21:16:35Z

✅MegaLinter analysis: Success

Descriptor	Linter	Files	Errors	Warnings	Elapsed time
✅ EDITORCONFIG	editorconfig-checker	18	0	0	0.29s
✅ REPOSITORY	betterleaks	yes	no	no	0.95s
✅ YAML	prettier	18	0	0	0.6s
✅ YAML	yamllint	18	0	0	0.86s

See detailed reports in MegaLinter artifacts
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

MegaLinter is provided by OX Security
Show us your support by starring ⭐ the repository

tyriis-automation · 2026-08-21T21:19:46Z

konflate — summary

Note

+33 added · 2 changed · −0 removed — 35 resources · 8 apps · 4 CRDs

Blast radius

Kustomization observability/grafana-instance — 1 dependent (Kustomization anubis-system/anubis-grafana)
Kustomization observability/loki — 1 dependent (Kustomization observability/promtail)
Kustomization observability/opentelemetry-operator — 1 dependent (Kustomization observability/opentelemetry-collector)

Warning

⚠ Caution

ClusterRoleBinding opentelemetry-operator-manager — new ClusterRoleBinding — grants cluster-wide permissions

Image changes

image	from	to
`docker.io/grafana/tempo`	`∅`	`2.10.8`
`ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator`	`∅`	`0.158.0`
`otel/opentelemetry-collector-contrib`	`∅`	`0.159.0`

View the full rendered diff →

_{konflate · rendered 2fb3586 · advisory, not a gate}

tyriis-automation · 2026-08-23T23:06:03Z

flate diff (main)

@@ spec.values.prometheus.prometheusSpec @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/observability/kube-prometheus-stack
! + one map entry added:
+ enableOTLPReceiver: true

@@ spec.values.loki.limits_config @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/observability/loki
! + one map entry added:
+ otlp_config:
+   ignore_defaults: true
+   resource_attributes:
+     attributes_config:
+     - action: index_label
+       attributes:
+       - service.name
+       - k8s.namespace.name
+       - k8s.pod.name
+       - k8s.container.name

@@ spec.enableOTLPReceiver @@
# monitoring.coreos.com/v1/Prometheus/observability/kube-prometheus-stack
! ± value change
- false
+ true

@@ data.config.yaml @@
# v1/ConfigMap/observability/loki
! ± value change in multiline text (one insert, no deletions)
  
  analytics:
    reporting_enabled: false
  auth_enabled: false
  
  [34 lines unchanged)]
  
    wal:
      flush_on_shutdown: true
  limits_config:
    max_cache_freshness_per_query: 10m
+   otlp_config:
+     ignore_defaults: true
+     resource_attributes:
+       attributes_config:
+       - action: index_label
+         attributes:
+         - service.name
+         - k8s.namespace.name
+         - k8s.pod.name
+         - k8s.container.name
    query_timeout: 300s
    reject_old_samples: true
    reject_old_samples_max_age: 168h
    retention_period: 30d
  
  [63 lines unchanged)]
  
        server_address: ""
    use_thanos_objstore: false
  tracing:
    enabled: false

@@ (root level) @@
# kustomize.toolkit.fluxcd.io/v1/Kustomization/observability/opentelemetry-operator
! + one document added:
+ apiVersion: kustomize.toolkit.fluxcd.io/v1
+ kind: Kustomization
+ metadata:
+   name: opentelemetry-operator
+   namespace: observability
+   labels:
+     kustomize.toolkit.fluxcd.io/name: flux-apps
+     kustomize.toolkit.fluxcd.io/namespace: flux-system
+ spec:
+   commonMetadata:
+     labels:
+       app.kubernetes.io/name: opentelemetry-operator
+   dependsOn:
+   - name: cert-manager
+     namespace: cert-manager
+   interval: 30m
+   path: ./kubernetes/main/apps/observability/opentelemetry/operator
+   prune: true
+   retryInterval: 1m
+   sourceRef:
+     name: flux-system
+     kind: GitRepository
+     namespace: flux-system
+   targetNamespace: observability
+   timeout: 5m
+   wait: true

@@ (root level) @@
# kustomize.toolkit.fluxcd.io/v1/Kustomization/observability/opentelemetry-collector
! + one document added:
+ apiVersion: kustomize.toolkit.fluxcd.io/v1
+ kind: Kustomization
+ metadata:
+   name: opentelemetry-collector
+   namespace: observability
+   labels:
+     kustomize.toolkit.fluxcd.io/name: flux-apps
+     kustomize.toolkit.fluxcd.io/namespace: flux-system
+ spec:
+   commonMetadata:
+     labels:
+       app.kubernetes.io/name: opentelemetry-collector
+   dependsOn:
+   - name: opentelemetry-operator
+     namespace: observability
+   - name: external-secrets-stores
+     namespace: secops
+   interval: 30m
+   path: ./kubernetes/main/apps/observability/opentelemetry/collector
+   prune: true
+   retryInterval: 1m
+   sourceRef:
+     name: flux-system
+     kind: GitRepository
+     namespace: flux-system
+   targetNamespace: observability
+   timeout: 5m
+   wait: true

@@ (root level) @@
# kustomize.toolkit.fluxcd.io/v1/Kustomization/observability/tempo
! + one document added:
+ apiVersion: kustomize.toolkit.fluxcd.io/v1
+ kind: Kustomization
+ metadata:
+   name: tempo
+   namespace: observability
+   labels:
+     kustomize.toolkit.fluxcd.io/name: flux-apps
+     kustomize.toolkit.fluxcd.io/namespace: flux-system
+ spec:
+   commonMetadata:
+     labels:
+       app.kubernetes.io/name: tempo
+   dependsOn:
+   - name: external-secrets-stores
+     namespace: secops
+   interval: 30m
+   path: ./kubernetes/main/apps/observability/tempo/app
+   prune: true
+   retryInterval: 1m
+   sourceRef:
+     name: flux-system
+     kind: GitRepository
+     namespace: flux-system
+   targetNamespace: observability
+   timeout: 5m
+   wait: true

@@ (root level) @@
# grafana.integreatly.org/v1beta1/GrafanaDatasource/observability/tempo
! + one document added:
+ apiVersion: grafana.integreatly.org/v1beta1
+ kind: GrafanaDatasource
+ metadata:
+   name: tempo
+   namespace: observability
+   labels:
+     app.kubernetes.io/name: grafana-instance
+     kustomize.toolkit.fluxcd.io/name: grafana-instance
+     kustomize.toolkit.fluxcd.io/namespace: observability
+ spec:
+   datasource:
+     name: tempo
+     url: "http://tempo.observability.svc.cluster.local:3200"
+     access: proxy
+     type: tempo
+   instanceSelector:
+     matchLabels:
+       grafana.internal/instance: grafana

@@ (root level) @@
# opentelemetry.io/v1beta1/OpenTelemetryCollector/observability/otel-collector
! + one document added:
+ apiVersion: opentelemetry.io/v1beta1
+ kind: OpenTelemetryCollector
+ metadata:
+   name: otel-collector
+   namespace: observability
+   labels:
+     app.kubernetes.io/name: opentelemetry-collector
+     kustomize.toolkit.fluxcd.io/name: opentelemetry-collector
+     kustomize.toolkit.fluxcd.io/namespace: observability
+ spec:
+   resources:
+     requests:
+       cpu: 10m
+       memory: 100Mi
+   image: "otel/opentelemetry-collector-contrib:0.159.0"
+   mode: daemonset
+   podSecurityContext:
+     fsGroup: 65532
+     runAsGroup: 65532
+     runAsNonRoot: true
+     runAsUser: 65532
+     seccompProfile:
+       type: RuntimeDefault
+   securityContext:
+     capabilities:
+       drop:
+       - ALL
+     readOnlyRootFilesystem: true
+   env:
+   - name: OTEL_BEARER_TOKEN
+     valueFrom:
+       secretKeyRef:
+         name: otel-collector
+         key: OTEL_BEARER_TOKEN
+   config:
+     exporters:
+       otlp/tempo:
+         endpoint: "tempo.observability.svc.cluster.local:4317"
+         tls:
+           insecure: true
+       otlphttp/loki:
+         endpoint: "http://loki-headless.observability.svc.cluster.local:3100/otlp"
+         tls:
+           insecure: true
+       otlphttp/prom:
+         endpoint: "http://prometheus-operated.observability.svc.cluster.local:9090/api/v1/otlp"
+         tls:
+           insecure: true
+     extensions:
+       bearertokenauth:
+         scheme: Bearer
+         token: "${env:OTEL_BEARER_TOKEN}"
+       health_check: {}
+     processors:
+       batch:
+         send_batch_size: 1024
+         timeout: 1s
+       memory_limiter:
+         check_interval: 5s
+         limit_mib: 1024
+     receivers:
+       otlp:
+         protocols:
+           grpc:
+             auth:
+               authenticator: bearertokenauth
+             endpoint: "0.0.0.0:4317"
+           http:
+             auth:
+               authenticator: bearertokenauth
+             endpoint: "0.0.0.0:4318"
+     service:
+       extensions:
+       - health_check
+       - bearertokenauth
+       pipelines:
+         logs:
+           exporters:
+           - otlphttp/loki
+           processors:
+           - memory_limiter
+           - batch
+           receivers:
+           - otlp
+         metrics:
+           exporters:
+           - otlphttp/prom
+           processors:
+           - memory_limiter
+           - batch
+           receivers:
+           - otlp
+         traces:
+           exporters:
+           - otlp/tempo
+           processors:
+           - memory_limiter
+           - batch
+           receivers:
+           - otlp
+       telemetry:
+         metrics:
+           address: "0.0.0.0:8888"

@@ (root level) @@
# external-secrets.io/v1/ExternalSecret/observability/otel-collector
! + one document added:
+ apiVersion: external-secrets.io/v1
+ kind: ExternalSecret
+ metadata:
+   name: otel-collector
+   namespace: observability
+   labels:
+     app.kubernetes.io/name: opentelemetry-collector
+     kustomize.toolkit.fluxcd.io/name: opentelemetry-collector
+     kustomize.toolkit.fluxcd.io/namespace: observability
+ spec:
+   dataFrom:
+   - extract:
+       key: infra/kubernetes/main/observability/opentelemetry
+   refreshInterval: 5m
+   secretStoreRef:
+     name: openbao-backend
+     kind: ClusterSecretStore
+   target:
+     name: otel-collector
+     creationPolicy: Owner
+     template:
+       data:
+         OTEL_BEARER_TOKEN: "{{ .OTEL_BEARER_TOKEN }}"
+       engineVersion: v2

@@ (root level) @@
# gateway.networking.k8s.io/v1/HTTPRoute/observability/otel-collector
! + one document added:
+ apiVersion: gateway.networking.k8s.io/v1
+ kind: HTTPRoute
+ metadata:
+   name: otel-collector
+   namespace: observability
+   annotations:
+     external-dns/unifi: "true"
+   labels:
+     app.kubernetes.io/name: opentelemetry-collector
+     kustomize.toolkit.fluxcd.io/name: opentelemetry-collector
+     kustomize.toolkit.fluxcd.io/namespace: observability
+ spec:
+   hostnames:
+   - otel.techtales.io
+   parentRefs:
+   - name: envoy
+     namespace: networking
+     sectionName: https
+   rules:
+   - backendRefs:
+     - name: otel-collector-collector
+       port: 4318
+     matches:
+     - path:
+         type: PathPrefix
+         value: /

@@ (root level) @@
# monitoring.coreos.com/v1/ServiceMonitor/observability/otel-collector
! + one document added:
+ apiVersion: monitoring.coreos.com/v1
+ kind: ServiceMonitor
+ metadata:
+   name: otel-collector
+   namespace: observability
+   labels:
+     app.kubernetes.io/name: opentelemetry-collector
+     kustomize.toolkit.fluxcd.io/name: opentelemetry-collector
+     kustomize.toolkit.fluxcd.io/namespace: observability
+ spec:
+   endpoints:
+   - interval: 30s
+     path: /metrics
+     targetPort: 8888
+   selector:
+     matchLabels:
+       app.kubernetes.io/managed-by: opentelemetry-operator
+       app.kubernetes.io/name: otel-collector

@@ (root level) @@
# source.toolkit.fluxcd.io/v1/OCIRepository/observability/opentelemetry-operator
! + one document added:
+ apiVersion: source.toolkit.fluxcd.io/v1
+ kind: OCIRepository
+ metadata:
+   name: opentelemetry-operator
+   namespace: observability
+   labels:
+     app.kubernetes.io/name: opentelemetry-operator
+     kustomize.toolkit.fluxcd.io/name: opentelemetry-operator
+     kustomize.toolkit.fluxcd.io/namespace: observability
+ spec:
+   url: "oci://ghcr.io/open-telemetry/opentelemetry-helm-charts/opentelemetry-operator"
+   interval: 30m
+   layerSelector:
+     mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+     operation: copy
+   ref:
+     tag: "0.122.0"

@@ (root level) @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/observability/opentelemetry-operator
! + one document added:
+ apiVersion: helm.toolkit.fluxcd.io/v2
+ kind: HelmRelease
+ metadata:
+   name: opentelemetry-operator
+   namespace: observability
+   labels:
+     app.kubernetes.io/name: opentelemetry-operator
+     kustomize.toolkit.fluxcd.io/name: opentelemetry-operator
+     kustomize.toolkit.fluxcd.io/namespace: observability
+ spec:
+   chartRef:
+     name: opentelemetry-operator
+     kind: OCIRepository
+   install:
+     remediation:
+       retries: -1
+   interval: 30m
+   uninstall:
+     keepHistory: false
+   upgrade:
+     cleanupOnFail: true
+     remediation:
+       retries: 3
+   values:
+     admissionWebhooks:
+       certManager:
+         enabled: true
+     manager:
+       resources:
+         requests:
+           cpu: 10m
+           memory: 64Mi
+       serviceMonitor:
+         enabled: true

@@ (root level) @@
# source.toolkit.fluxcd.io/v1/OCIRepository/observability/tempo
! + one document added:
+ apiVersion: source.toolkit.fluxcd.io/v1
+ kind: OCIRepository
+ metadata:
+   name: tempo
+   namespace: observability
+   labels:
+     app.kubernetes.io/name: tempo
+     kustomize.toolkit.fluxcd.io/name: tempo
+     kustomize.toolkit.fluxcd.io/namespace: observability
+ spec:
+   url: "oci://ghcr.io/grafana-community/helm-charts/tempo"
+   interval: 30m
+   layerSelector:
+     mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+     operation: copy
+   ref:
+     tag: "2.2.4"

@@ (root level) @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/observability/tempo
! + one document added:
+ apiVersion: helm.toolkit.fluxcd.io/v2
+ kind: HelmRelease
+ metadata:
+   name: tempo
+   namespace: observability
+   labels:
+     app.kubernetes.io/name: tempo
+     kustomize.toolkit.fluxcd.io/name: tempo
+     kustomize.toolkit.fluxcd.io/namespace: observability
+ spec:
+   chartRef:
+     name: tempo
+     kind: OCIRepository
+   install:
+     remediation:
+       retries: -1
+   interval: 30m
+   uninstall:
+     keepHistory: false
+   upgrade:
+     cleanupOnFail: true
+     remediation:
+       retries: 3
+   values:
+     fullnameOverride: tempo
+     serviceMonitor:
+       enabled: true
+     tempo:
+       resources:
+         requests:
+           cpu: 10m
+           memory: 100Mi
+       reportingEnabled: false
+       tag: "2.10.8"
+       metricsGenerator:
+         enabled: false
+       storage:
+         trace:
+           backend: s3
+           s3:
+             bucket: tempo
+             forcepathstyle: true
+             insecure: true
+       receivers:
+         otlp:
+           protocols:
+             grpc:
+               endpoint: "0.0.0.0:4317"
+             http:
+               endpoint: "0.0.0.0:4318"
+   valuesFrom:
+   - name: tempo-s3
+     kind: Secret
+     targetPath: tempo.storage.trace.s3.bucket
+     valuesKey: S3_BUCKET_NAME
+   - name: tempo-s3
+     kind: Secret
+     targetPath: tempo.storage.trace.s3.endpoint
+     valuesKey: S3_BUCKET_HOST
+   - name: tempo-s3
+     kind: Secret
+     targetPath: tempo.storage.trace.s3.region
+     valuesKey: S3_BUCKET_REGION
+   - name: tempo-s3
+     kind: Secret
+     targetPath: tempo.storage.trace.s3.access_key
+     valuesKey: S3_ACCESS_KEY
+   - name: tempo-s3
+     kind: Secret
+     targetPath: tempo.storage.trace.s3.secret_key
+     valuesKey: S3_SECRET_KEY

@@ (root level) @@
# external-secrets.io/v1/ExternalSecret/observability/tempo-s3
! + one document added:
+ apiVersion: external-secrets.io/v1
+ kind: ExternalSecret
+ metadata:
+   name: tempo-s3
+   namespace: observability
+   labels:
+     app.kubernetes.io/name: tempo
+     kustomize.toolkit.fluxcd.io/name: tempo
+     kustomize.toolkit.fluxcd.io/namespace: observability
+ spec:
+   dataFrom:
+   - extract:
+       key: infra/kubernetes/main/observability/tempo
+   refreshInterval: 5m
+   secretStoreRef:
+     name: openbao-backend
+     kind: ClusterSecretStore
+   target:
+     name: tempo-s3
+     creationPolicy: Owner
+     template:
+       data:
+         S3_ACCESS_KEY: "{{ .S3_ACCESS_KEY }}"
+         S3_BUCKET_HOST: "{{ .S3_BUCKET_HOST }}"
+         S3_BUCKET_NAME: "{{ .S3_BUCKET_NAME }}"
+         S3_BUCKET_REGION: "{{ .S3_BUCKET_REGION }}"
+         S3_SECRET_KEY: "{{ .S3_SECRET_KEY }}"
+       engineVersion: v2

@@ (root level) @@
# v1/ServiceAccount/observability/opentelemetry-operator
! + one document added:
+ apiVersion: v1
+ kind: ServiceAccount
+ metadata:
+   name: opentelemetry-operator
+   namespace: observability
+   labels:
+     app.kubernetes.io/component: controller-manager
+     app.kubernetes.io/instance: opentelemetry-operator
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: opentelemetry-operator
+     app.kubernetes.io/part-of: opentelemetry-operator
+     helm.toolkit.fluxcd.io/name: opentelemetry-operator
+     helm.toolkit.fluxcd.io/namespace: observability
+ automountServiceAccountToken: true

@@ (root level) @@
# rbac.authorization.k8s.io/v1/ClusterRole/opentelemetry-operator-manager
! + one document added:
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: ClusterRole
+ metadata:
+   name: opentelemetry-operator-manager
+   labels:
+     app.kubernetes.io/component: controller-manager
+     app.kubernetes.io/instance: opentelemetry-operator
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: opentelemetry-operator
+     app.kubernetes.io/part-of: opentelemetry-operator
+     helm.toolkit.fluxcd.io/name: opentelemetry-operator
+     helm.toolkit.fluxcd.io/namespace: observability
+ rules:
+ - resources:
+   - configmaps
+   - persistentvolumeclaims
+   - persistentvolumes
+   - pods
+   - serviceaccounts
+   - services
+   apiGroups:
+   - 
+   verbs:
+   - create
+   - delete
+   - get
+   - list
+   - patch
+   - update
+   - watch
+ - resources:
+   - events
+   apiGroups:
+   - 
+   verbs:
+   - create
+   - get
+   - list
+   - patch
+   - watch
+ - resources:
+   - namespaces
+   apiGroups:
+   - 
+   verbs:
+   - list
+   - watch
+ - resources:
+   - namespaces/status
+   apiGroups:
+   - 
+   verbs:
+   - get
+   - list
+   - watch
+ - resources:
+   - nodes/spec
+   apiGroups:
+   - 
+   verbs:
+   - get
+   - list
+   - watch
+ - resources:
+   - pods/status
+   apiGroups:
+   - 
+   verbs:
+   - get
+   - list
+   - watch
+ - resources:
+   - replicationcontrollers
+   apiGroups:
+   - 
+   verbs:
+   - get
+   - list
+   - watch
+ - resources:
+   - replicationcontrollers/status
+   apiGroups:
+   - 
+   verbs:
+   - get
+   - list
+   - watch
+ - resources:
+   - resourcequotas
+   apiGroups:
+   - 
+   verbs:
+   - get
+   - list
+   - watch
+ - resources:
+   - daemonsets
+   - deployments
+   - statefulsets
+   apiGroups:
+   - apps
+   verbs:
+   - create
+   - delete
+   - get
+   - list
+   - patch
+   - update
+   - watch
+ - resources:
+   - replicasets
+   apiGroups:
+   - apps
+   - extensions
+   verbs:
+   - get
+   - list
+   - watch
+ - resources:
+   - daemonsets
+   apiGroups:
+   - extensions
+   verbs:
+   - get
+   - list
+   - watch
+ - resources:
+   - deployments
+   apiGroups:
+   - extensions
+   verbs:
+   - get
+   - list
+   - watch
+ - resources:
+   - horizontalpodautoscalers
+   apiGroups:
+   - autoscaling
+   verbs:
+   - create
+   - delete
+   - get
+   - list
+   - patch
+   - update
+   - watch
+ - resources:
+   - jobs
+   apiGroups:
+   - batch
+   verbs:
+   - get
+   - list
+   - watch
+ - resources:
+   - cronjobs
+   apiGroups:
+   - batch
+   verbs:
+   - get
+   - list
+   - watch
+ - resources:
+   - nodes/pods
+   apiGroups:
+   - 
+   verbs:
+   - get
+ - resources:
+   - nodes/stats
+   apiGroups:
+   - 
+   verbs:
+   - get
+ - resources:
+   - infrastructures
+   - infrastructures/status
+   apiGroups:
+   - config.openshift.io
+   verbs:
+   - get
+   - list
+   - watch
+ - resources:
+   - clusterserviceversions
+   apiGroups:
+   - operators.coreos.com
+   verbs:
+   - get
+   - list
+   - patch
+   - update
+   - watch
+ - resources:
+   - leases
+   apiGroups:
+   - coordination.k8s.io
+   verbs:
+   - create
+   - get
+   - list
+   - update
+ - resources:
+   - endpointslices
+   apiGroups:
+   - discovery.k8s.io
+   verbs:
+   - get
+   - list
+ - resources:
+   - events
+   apiGroups:
+   - events.k8s.io
+   verbs:
+   - create
+   - list
+   - patch
+   - watch
+ - resources:
+   - httproutes
+   apiGroups:
+   - gateway.networking.k8s.io
+   verbs:
+   - create
+   - delete
+   - get
+   - list
+   - patch
+   - update
+   - watch
+ - resources:
+   - podmonitors
+   - servicemonitors
+   apiGroups:
+   - monitoring.coreos.com
+   verbs:
+   - create
+   - delete
+   - get
+   - list
+   - patch
+   - update
+   - watch
+ - resources:
+   - ingresses
+   - networkpolicies
+   apiGroups:
+   - networking.k8s.io
+   verbs:
+   - create
+   - delete
+   - get
+   - list
+   - patch
+   - update
+   - watch
+ - resources:
+   - instrumentations
+   apiGroups:
+   - opentelemetry.io
+   verbs:
+   - get
+   - list
+   - patch
+   - update
+   - watch
+ - resources:
+   - opampbridges
+   apiGroups:
+   - opentelemetry.io
+   verbs:
+   - create
+   - delete
+   - get
+   - list
+   - patch
+   - update
+   - watch
+ - resources:
+   - opampbridges/finalizers
+   apiGroups:
+   - opentelemetry.io
+   verbs:
+   - update
+ - resources:
+   - instrumentations/status
+   - opampbridges/status
+   apiGroups:
+   - opentelemetry.io
+   verbs:
+   - get
+   - patch
+   - update
+ - resources:
+   - opentelemetrycollectors
+   apiGroups:
+   - opentelemetry.io
+   verbs:
+   - get
+   - list
+   - patch
+   - update
+   - watch
+ - resources:
+   - opentelemetrycollectors/finalizers
+   apiGroups:
+   - opentelemetry.io
+   verbs:
+   - get
+   - patch
+   - update
+ - resources:
+   - opentelemetrycollectors/status
+   apiGroups:
+   - opentelemetry.io
+   verbs:
+   - get
+   - patch
+   - update
+ - resources:
+   - poddisruptionbudgets
+   apiGroups:
+   - policy
+   verbs:
+   - create
+   - delete
+   - get
+   - list
+   - patch
+   - update
+   - watch
+ - resources:
+   - routes
+   - routes/custom-host
+   apiGroups:
+   - route.openshift.io
+   verbs:
+   - create
+   - delete
+   - get
+   - list
+   - patch
+   - update
+   - watch
+ - resources:
+   - targetallocators
+   apiGroups:
+   - opentelemetry.io
+   verbs:
+   - create
+   - delete
+   - get
+   - list
+   - patch
+   - update
+   - watch
+ - resources:
+   - targetallocators/status
+   apiGroups:
+   - opentelemetry.io
+   verbs:
+   - get
+   - patch
+   - update
+ - resources:
+   - targetallocators/finalizers
+   apiGroups:
+   - opentelemetry.io
+   verbs:
+   - get
+   - patch
+   - update
+ - resources:
+   - issuers
+   - certificaterequests
+   - certificates
+   apiGroups:
+   - cert-manager.io
+   verbs:
+   - create
+   - get
+   - list
+   - watch
+   - update
+   - patch
+   - delete
+ - resources:
+   - tokenreviews
+   apiGroups:
+   - authentication.k8s.io
+   verbs:
+   - create
+ - resources:
+   - subjectaccessreviews
+   apiGroups:
+   - authorization.k8s.io
+   verbs:
+   - create

@@ (root level) @@
# rbac.authorization.k8s.io/v1/ClusterRole/opentelemetry-operator-metrics
! + one document added:
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: ClusterRole
+ metadata:
+   name: opentelemetry-operator-metrics
+   labels:
+     app.kubernetes.io/component: controller-manager
+     app.kubernetes.io/instance: opentelemetry-operator
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: opentelemetry-operator
+     app.kubernetes.io/part-of: opentelemetry-operator
+     helm.toolkit.fluxcd.io/name: opentelemetry-operator
+     helm.toolkit.fluxcd.io/namespace: observability
+ rules:
+ - nonResourceURLs:
+   - /metrics
+   verbs:
+   - get

@@ (root level) @@
# rbac.authorization.k8s.io/v1/ClusterRoleBinding/opentelemetry-operator-manager
! + one document added:
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: ClusterRoleBinding
+ metadata:
+   name: opentelemetry-operator-manager
+   labels:
+     app.kubernetes.io/component: controller-manager
+     app.kubernetes.io/instance: opentelemetry-operator
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: opentelemetry-operator
+     app.kubernetes.io/part-of: opentelemetry-operator
+     helm.toolkit.fluxcd.io/name: opentelemetry-operator
+     helm.toolkit.fluxcd.io/namespace: observability
+ roleRef:
+   name: opentelemetry-operator-manager
+   apiGroup: rbac.authorization.k8s.io
+   kind: ClusterRole
+ subjects:
+ - name: opentelemetry-operator
+   kind: ServiceAccount
+   namespace: observability

@@ (root level) @@
# rbac.authorization.k8s.io/v1/Role/observability/opentelemetry-operator-leader-election
! + one document added:
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: Role
+ metadata:
+   name: opentelemetry-operator-leader-election
+   namespace: observability
+   labels:
+     app.kubernetes.io/component: controller-manager
+     app.kubernetes.io/instance: opentelemetry-operator
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: opentelemetry-operator
+     app.kubernetes.io/part-of: opentelemetry-operator
+     helm.toolkit.fluxcd.io/name: opentelemetry-operator
+     helm.toolkit.fluxcd.io/namespace: observability
+ rules:
+ - resources:
+   - configmaps
+   - pods
+   - serviceaccounts
+   - services
+   apiGroups:
+   - 
+   verbs:
+   - create
+   - delete
+   - get
+   - list
+   - patch
+   - update
+   - watch
+ - resources:
+   - events
+   apiGroups:
+   - 
+   verbs:
+   - create
+   - patch
+ - resources:
+   - namespaces
+   - secrets
+   apiGroups:
+   - 
+   verbs:
+   - get
+   - list
+   - watch
+ - resources:
+   - daemonsets
+   - deployments
+   - statefulsets
+   apiGroups:
+   - apps
+   verbs:
+   - create
+   - delete
+   - get
+   - list
+   - patch
+   - update
+   - watch
+ - resources:
+   - replicasets
+   apiGroups:
+   - apps
+   verbs:
+   - get
+   - list
+   - watch
+ - resources:
+   - horizontalpodautoscalers
+   apiGroups:
+   - autoscaling
+   verbs:
+   - create
+   - delete
+   - get
+   - list
+   - patch
+   - update
+   - watch
+ - resources:
+   - jobs
+   apiGroups:
+   - batch
+   verbs:
+   - get
+   - list
+   - watch
+ - resources:
+   - infrastructures
+   - infrastructures/status
+   apiGroups:
+   - config.openshift.io
+   verbs:
+   - get
+   - list
+   - watch
+ - resources:
+   - leases
+   apiGroups:
+   - coordination.k8s.io
+   verbs:
+   - create
+   - get
+   - list
+   - update
+ - resources:
+   - podmonitors
+   - servicemonitors
+   apiGroups:
+   - monitoring.coreos.com
+   verbs:
+   - create
+   - delete
+   - get
+   - list
+   - patch
+   - update
+   - watch
+ - resources:
+   - ingresses
+   apiGroups:
+   - networking.k8s.io
+   verbs:
+   - create
+   - delete
+   - get
+   - list
+   - patch
+   - update
+   - watch
+ - resources:
+   - instrumentations
+   - opentelemetrycollectors
+   apiGroups:
+   - opentelemetry.io
+   verbs:
+   - get
+   - list
+   - patch
+   - update
+   - watch
+ - resources:
+   - opampbridges
+   - targetallocators
+   apiGroups:
+   - opentelemetry.io
+   verbs:
+   - create
+   - delete
+   - get
+   - list
+   - patch
+   - update
+   - watch
+ - resources:
+   - opampbridges/finalizers
+   apiGroups:
+   - opentelemetry.io
+   verbs:
+   - update
+ - resources:
+   - opampbridges/status
+   - opentelemetrycollectors/finalizers
+   - opentelemetrycollectors/status
+   - targetallocators/status
+   - targetallocators/finalizers
+   apiGroups:
+   - opentelemetry.io
+   verbs:
+   - get
+   - patch
+   - update
+ - resources:
+   - poddisruptionbudgets
+   apiGroups:
+   - policy
+   verbs:
+   - create
+   - delete
+   - get
+   - list
+   - patch
+   - update
+   - watch
+ - resources:
+   - routes
+   - routes/custom-host
+   apiGroups:
+   - route.openshift.io
+   verbs:
+   - create
+   - delete
+   - get
+   - list
+   - patch
+   - update
+   - watch

@@ (root level) @@
# rbac.authorization.k8s.io/v1/RoleBinding/observability/opentelemetry-operator-leader-election
! + one document added:
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: RoleBinding
+ metadata:
+   name: opentelemetry-operator-leader-election
+   namespace: observability
+   labels:
+     app.kubernetes.io/component: controller-manager
+     app.kubernetes.io/instance: opentelemetry-operator
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: opentelemetry-operator
+     app.kubernetes.io/part-of: opentelemetry-operator
+     helm.toolkit.fluxcd.io/name: opentelemetry-operator
+     helm.toolkit.fluxcd.io/namespace: observability
+ roleRef:
+   name: opentelemetry-operator-leader-election
+   apiGroup: rbac.authorization.k8s.io
+   kind: Role
+ subjects:
+ - name: opentelemetry-operator
+   kind: ServiceAccount
+   namespace: observability

@@ (root level) @@
# v1/Service/observability/opentelemetry-operator
! + one document added:
+ apiVersion: v1
+ kind: Service
+ metadata:
+   name: opentelemetry-operator
+   namespace: observability
+   labels:
+     app.kubernetes.io/component: controller-manager
+     app.kubernetes.io/instance: opentelemetry-operator
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: opentelemetry-operator
+     app.kubernetes.io/part-of: opentelemetry-operator
+     helm.toolkit.fluxcd.io/name: opentelemetry-operator
+     helm.toolkit.fluxcd.io/namespace: observability
+ spec:
+   ports:
+   - name: metrics
+     port: 8443
+     protocol: TCP
+     targetPort: metrics
+   selector:
+     app.kubernetes.io/component: controller-manager
+     app.kubernetes.io/name: opentelemetry-operator

@@ (root level) @@
# v1/Service/observability/opentelemetry-operator-webhook
! + one document added:
+ apiVersion: v1
+ kind: Service
+ metadata:
+   name: opentelemetry-operator-webhook
+   namespace: observability
+   labels:
+     app.kubernetes.io/component: controller-manager
+     app.kubernetes.io/instance: opentelemetry-operator
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: opentelemetry-operator
+     app.kubernetes.io/part-of: opentelemetry-operator
+     helm.toolkit.fluxcd.io/name: opentelemetry-operator
+     helm.toolkit.fluxcd.io/namespace: observability
+ spec:
+   ports:
+   - port: 443
+     protocol: TCP
+     targetPort: webhook-server
+   selector:
+     app.kubernetes.io/component: controller-manager
+     app.kubernetes.io/name: opentelemetry-operator

@@ (root level) @@
# apps/v1/Deployment/observability/opentelemetry-operator
! + one document added:
+ apiVersion: apps/v1
+ kind: Deployment
+ metadata:
+   name: opentelemetry-operator
+   namespace: observability
+   labels:
+     app.kubernetes.io/component: controller-manager
+     app.kubernetes.io/instance: opentelemetry-operator
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: opentelemetry-operator
+     app.kubernetes.io/part-of: opentelemetry-operator
+     helm.toolkit.fluxcd.io/name: opentelemetry-operator
+     helm.toolkit.fluxcd.io/namespace: observability
+ spec:
+   replicas: 1
+   revisionHistoryLimit: 10
+   selector:
+     matchLabels:
+       app.kubernetes.io/component: controller-manager
+       app.kubernetes.io/name: opentelemetry-operator
+   template:
+     metadata:
+       annotations:
+         kubectl.kubernetes.io/default-container: manager
+       labels:
+         app.kubernetes.io/component: controller-manager
+         app.kubernetes.io/instance: opentelemetry-operator
+         app.kubernetes.io/managed-by: Helm
+         app.kubernetes.io/name: opentelemetry-operator
+         app.kubernetes.io/part-of: opentelemetry-operator
+     spec:
+       automountServiceAccountToken: true
+       containers:
+       - name: manager
+         image: "ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator:0.158.0"
+         imagePullPolicy: IfNotPresent
+         args:
+         - "--metrics-addr=0.0.0.0:8443"
+         - "--metrics-secure=true"
+         - "--enable-leader-election"
+         - "--health-probe-addr=:8081"
+         - "--webhook-port=9443"
+         - "--collector-image=ghcr.io/open-telemetry/opentelemetry-collector-releases/opentelemetry-collector-k8s:0.158.0"
+         - "--feature-gates=-operator.networkpolicy"
+         command:
+         - /manager
+         livenessProbe:
+           httpGet:
+             path: /healthz
+             port: 8081
+           initialDelaySeconds: 15
+           periodSeconds: 20
+         ports:
+         - name: metrics
+           containerPort: 8443
+           protocol: TCP
+         - name: webhook-server
+           containerPort: 9443
+           protocol: TCP
+         readinessProbe:
+           httpGet:
+             path: /readyz
+             port: 8081
+           initialDelaySeconds: 5
+           periodSeconds: 10
+         resources:
+           requests:
+             cpu: 10m
+             memory: 64Mi
+         volumeMounts:
+         - name: cert
+           mountPath: /tmp/k8s-webhook-server/serving-certs
+           readOnly: true
+         securityContext:
+           allowPrivilegeEscalation: false
+           capabilities:
+             drop:
+             - ALL
+           runAsNonRoot: true
+           seccompProfile:
+             type: RuntimeDefault
+         env:
+         - name: NAMESPACE
+           valueFrom:
+             fieldRef:
+               fieldPath: metadata.namespace
+         - name: SERVICE_ACCOUNT_NAME
+           valueFrom:
+             fieldRef:
+               fieldPath: spec.serviceAccountName
+         - name: ENABLE_WEBHOOKS
+           value: "true"
+       hostNetwork: false
+       nodeSelector:
+         kubernetes.io/os: linux
+       securityContext:
+         fsGroup: 65532
+         runAsGroup: 65532
+         runAsNonRoot: true
+         runAsUser: 65532
+       serviceAccountName: opentelemetry-operator
+       terminationGracePeriodSeconds: 10
+       volumes:
+       - name: cert
+         secret:
+           defaultMode: 420
+           secretName: opentelemetry-operator-controller-manager-service-cert

@@ (root level) @@
# admissionregistration.k8s.io/v1/MutatingWebhookConfiguration/opentelemetry-operator-mutation
! + one document added:
+ apiVersion: admissionregistration.k8s.io/v1
+ kind: MutatingWebhookConfiguration
+ metadata:
+   name: opentelemetry-operator-mutation
+   annotations:
+     cert-manager.io/inject-ca-from: observability/opentelemetry-operator-serving-cert
+   labels:
+     app.kubernetes.io/component: webhook
+     app.kubernetes.io/instance: opentelemetry-operator
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: opentelemetry-operator
+     app.kubernetes.io/part-of: opentelemetry-operator
+     helm.toolkit.fluxcd.io/name: opentelemetry-operator
+     helm.toolkit.fluxcd.io/namespace: observability
+ webhooks:
+ - name: minstrumentation.kb.io
+   failurePolicy: Fail
+   sideEffects: None
+   timeoutSeconds: 10
+   admissionReviewVersions:
+   - v1
+   clientConfig:
+     service:
+       name: opentelemetry-operator-webhook
+       namespace: observability
+       path: /mutate-opentelemetry-io-v1alpha1-instrumentation
+       port: 443
+   rules:
+   - resources:
+     - instrumentations
+     scope: Namespaced
+     apiGroups:
+     - opentelemetry.io
+     apiVersions:
+     - v1alpha1
+     operations:
+     - CREATE
+     - UPDATE
+ - name: mopentelemetrycollectorbeta.kb.io
+   failurePolicy: Fail
+   sideEffects: None
+   timeoutSeconds: 10
+   admissionReviewVersions:
+   - v1
+   clientConfig:
+     service:
+       name: opentelemetry-operator-webhook
+       namespace: observability
+       path: /mutate-opentelemetry-io-v1beta1-opentelemetrycollector
+       port: 443
+   rules:
+   - resources:
+     - opentelemetrycollectors
+     scope: Namespaced
+     apiGroups:
+     - opentelemetry.io
+     apiVersions:
+     - v1beta1
+     operations:
+     - CREATE
+     - UPDATE
+ - name: mpod.kb.io
+   failurePolicy: Ignore
+   sideEffects: None
+   timeoutSeconds: 10
+   admissionReviewVersions:
+   - v1
+   clientConfig:
+     service:
+       name: opentelemetry-operator-webhook
+       namespace: observability
+       path: /mutate-v1-pod
+       port: 443
+   rules:
+   - resources:
+     - pods
+     scope: Namespaced
+     apiGroups:
+     - 
+     apiVersions:
+     - v1
+     operations:
+     - CREATE

@@ (root level) @@
# admissionregistration.k8s.io/v1/ValidatingWebhookConfiguration/opentelemetry-operator-validation
! + one document added:
+ apiVersion: admissionregistration.k8s.io/v1
+ kind: ValidatingWebhookConfiguration
+ metadata:
+   name: opentelemetry-operator-validation
+   annotations:
+     cert-manager.io/inject-ca-from: observability/opentelemetry-operator-serving-cert
+   labels:
+     app.kubernetes.io/component: webhook
+     app.kubernetes.io/instance: opentelemetry-operator
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: opentelemetry-operator
+     app.kubernetes.io/part-of: opentelemetry-operator
+     helm.toolkit.fluxcd.io/name: opentelemetry-operator
+     helm.toolkit.fluxcd.io/namespace: observability
+ webhooks:
+ - name: vinstrumentationcreateupdate.kb.io
+   failurePolicy: Fail
+   sideEffects: None
+   timeoutSeconds: 10
+   admissionReviewVersions:
+   - v1
+   clientConfig:
+     service:
+       name: opentelemetry-operator-webhook
+       namespace: observability
+       path: /validate-opentelemetry-io-v1alpha1-instrumentation
+       port: 443
+   rules:
+   - resources:
+     - instrumentations
+     scope: Namespaced
+     apiGroups:
+     - opentelemetry.io
+     apiVersions:
+     - v1alpha1
+     operations:
+     - CREATE
+     - UPDATE
+ - name: vinstrumentationdelete.kb.io
+   failurePolicy: Ignore
+   sideEffects: None
+   timeoutSeconds: 10
+   admissionReviewVersions:
+   - v1
+   clientConfig:
+     service:
+       name: opentelemetry-operator-webhook
+       namespace: observability
+       path: /validate-opentelemetry-io-v1alpha1-instrumentation
+       port: 443
+   rules:
+   - resources:
+     - instrumentations
+     scope: Namespaced
+     apiGroups:
+     - opentelemetry.io
+     apiVersions:
+     - v1alpha1
+     operations:
+     - DELETE
+ - name: vopentelemetrycollectorcreateupdatebeta.kb.io
+   failurePolicy: Fail
+   sideEffects: None
+   timeoutSeconds: 10
+   admissionReviewVersions:
+   - v1
+   clientConfig:
+     service:
+       name: opentelemetry-operator-webhook
+       namespace: observability
+       path: /validate-opentelemetry-io-v1beta1-opentelemetrycollector
+       port: 443
+   rules:
+   - resources:
+     - opentelemetrycollectors
+     scope: Namespaced
+     apiGroups:
+     - opentelemetry.io
+     apiVersions:
+     - v1beta1
+     operations:
+     - CREATE
+     - UPDATE
+ - name: vopentelemetrycollectordeletebeta.kb.io
+   failurePolicy: Ignore
+   sideEffects: None
+   timeoutSeconds: 10
+   admissionReviewVersions:
+   - v1
+   clientConfig:
+     service:
+       name: opentelemetry-operator-webhook
+       namespace: observability
+       path: /validate-opentelemetry-io-v1beta1-opentelemetrycollector
+       port: 443
+   rules:
+   - resources:
+     - opentelemetrycollectors
+     scope: Namespaced
+     apiGroups:
+     - opentelemetry.io
+     apiVersions:
+     - v1beta1
+     operations:
+     - DELETE

@@ (root level) @@
# cert-manager.io/v1/Certificate/observability/opentelemetry-operator-serving-cert
! + one document added:
+ apiVersion: cert-manager.io/v1
+ kind: Certificate
+ metadata:
+   name: opentelemetry-operator-serving-cert
+   namespace: observability
+   labels:
+     app.kubernetes.io/component: webhook
+     app.kubernetes.io/instance: opentelemetry-operator
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: opentelemetry-operator
+     app.kubernetes.io/part-of: opentelemetry-operator
+     helm.toolkit.fluxcd.io/name: opentelemetry-operator
+     helm.toolkit.fluxcd.io/namespace: observability
+ spec:
+   dnsNames:
+   - opentelemetry-operator-webhook.observability.svc
+   - opentelemetry-operator-webhook.observability.svc.cluster.local
+   issuerRef:
+     name: opentelemetry-operator-selfsigned-issuer
+     kind: Issuer
+   secretName: opentelemetry-operator-controller-manager-service-cert
+   subject:
+     organizationalUnits:
+     - opentelemetry-operator

@@ (root level) @@
# cert-manager.io/v1/Issuer/observability/opentelemetry-operator-selfsigned-issuer
! + one document added:
+ apiVersion: cert-manager.io/v1
+ kind: Issuer
+ metadata:
+   name: opentelemetry-operator-selfsigned-issuer
+   namespace: observability
+   labels:
+     app.kubernetes.io/component: webhook
+     app.kubernetes.io/instance: opentelemetry-operator
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: opentelemetry-operator
+     app.kubernetes.io/part-of: opentelemetry-operator
+     helm.toolkit.fluxcd.io/name: opentelemetry-operator
+     helm.toolkit.fluxcd.io/namespace: observability
+ spec:
+   selfSigned: {}

@@ (root level) @@
# monitoring.coreos.com/v1/ServiceMonitor/observability/opentelemetry-operator
! + one document added:
+ apiVersion: monitoring.coreos.com/v1
+ kind: ServiceMonitor
+ metadata:
+   name: opentelemetry-operator
+   namespace: observability
+   labels:
+     app.kubernetes.io/component: controller-manager
+     app.kubernetes.io/instance: opentelemetry-operator
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: opentelemetry-operator
+     app.kubernetes.io/part-of: opentelemetry-operator
+     helm.toolkit.fluxcd.io/name: opentelemetry-operator
+     helm.toolkit.fluxcd.io/namespace: observability
+ spec:
+   endpoints:
+   - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+     port: metrics
+     scheme: https
+     tlsConfig:
+       insecureSkipVerify: true
+   namespaceSelector:
+     matchNames:
+     - observability
+   selector:
+     matchLabels:
+       app.kubernetes.io/component: controller-manager
+       app.kubernetes.io/name: opentelemetry-operator

@@ (root level) @@
# v1/ServiceAccount/observability/tempo
! + one document added:
+ apiVersion: v1
+ kind: ServiceAccount
+ metadata:
+   name: tempo
+   namespace: observability
+   labels:
+     app.kubernetes.io/instance: tempo
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: tempo
+     helm.toolkit.fluxcd.io/name: tempo
+     helm.toolkit.fluxcd.io/namespace: observability
+ automountServiceAccountToken: true

@@ (root level) @@
# v1/ConfigMap/observability/tempo
! + one document added:
+ apiVersion: v1
+ kind: ConfigMap
+ metadata:
+   name: tempo
+   namespace: observability
+   labels:
+     app.kubernetes.io/instance: tempo
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: tempo
+     helm.toolkit.fluxcd.io/name: tempo
+     helm.toolkit.fluxcd.io/namespace: observability
+ data:
+   overrides.yaml: |
+     overrides:
+       {}
+     
+   tempo.yaml: |
+     stream_over_http_enabled: false
+     memberlist:
+       cluster_label: "tempo.observability"
+     multitenancy_enabled: false
+     usage_report:
+       reporting_enabled: false
+     compactor:
+       compaction:
+         block_retention: 24h
+     distributor:
+       receivers:
+             jaeger:
+               protocols:
+                 grpc:
+                   endpoint: 0.0.0.0:14250
+                 thrift_binary:
+                   endpoint: 0.0.0.0:6832
+                 thrift_compact:
+                   endpoint: 0.0.0.0:6831
+                 thrift_http:
+                   endpoint: 0.0.0.0:14268
+             otlp:
+               protocols:
+                 grpc:
+                   endpoint: 0.0.0.0:4317
+                 http:
+                   endpoint: 0.0.0.0:4318
+     ingester:
+           {}
+     server:
+           http_listen_port: 3200
+     storage:
+           trace:
+             backend: s3
+             local:
+               path: /var/tempo/traces
+             s3:
+               access_key: ..PLACEHOLDER_S3_ACCESS_KEY..
+               bucket: tempo
+               endpoint: ..PLACEHOLDER_S3_BUCKET_HOST..
+               forcepathstyle: true
+               insecure: true
+               region: ..PLACEHOLDER_S3_BUCKET_REGION..
+               secret_key: ..PLACEHOLDER_S3_SECRET_KEY..
+             wal:
+               path: /var/tempo/wal
+     querier:
+           {}
+     query_frontend:
+           {}
+     overrides:
+           defaults: {}
+           per_tenant_override_config: /conf/overrides.yaml

@@ (root level) @@
# v1/Service/observability/tempo
! + one document added:
+ apiVersion: v1
+ kind: Service
+ metadata:
+   name: tempo
+   namespace: observability
+   labels:
+     app.kubernetes.io/instance: tempo
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: tempo
+     helm.toolkit.fluxcd.io/name: tempo
+     helm.toolkit.fluxcd.io/namespace: observability
+ spec:
+   type: ClusterIP
+   selector:
+     app.kubernetes.io/instance: tempo
+     app.kubernetes.io/name: tempo
+   ports:
+   - name: tempo-jaeger-thrift-compact
+     port: 6831
+     protocol: UDP
+     targetPort: 6831
+   - name: tempo-jaeger-thrift-binary
+     port: 6832
+     protocol: UDP
+     targetPort: 6832
+   - name: tempo-prom-metrics
+     port: 3200
+     protocol: TCP
+     targetPort: 3200
+   - name: tempo-jaeger-thrift-http
+     port: 14268
+     protocol: TCP
+     targetPort: 14268
+   - name: grpc-tempo-jaeger
+     port: 14250
+     protocol: TCP
+     targetPort: 14250
+   - name: tempo-zipkin
+     port: 9411
+     protocol: TCP
+     targetPort: 9411
+   - name: tempo-otlp-legacy
+     port: 55680
+     protocol: TCP
+     targetPort: 55680
+   - name: tempo-otlp-http-legacy
+     port: 55681
+     protocol: TCP
+     targetPort: 55681
+   - name: grpc-tempo-otlp
+     port: 4317
+     protocol: TCP
+     targetPort: 4317
+   - name: tempo-otlp-http
+     port: 4318
+     protocol: TCP
+     targetPort: 4318

@@ (root level) @@
# apps/v1/StatefulSet/observability/tempo
! + one document added:
+ apiVersion: apps/v1
+ kind: StatefulSet
+ metadata:
+   name: tempo
+   namespace: observability
+   labels:
+     app.kubernetes.io/instance: tempo
+     app.kubernetes.io/managed-by: Helm
+     app.kubernetes.io/name: tempo
+     helm.toolkit.fluxcd.io/name: tempo
+     helm.toolkit.fluxcd.io/namespace: observability
+ spec:
+   replicas: 1
+   selector:
+     matchLabels:
+       app.kubernetes.io/instance: tempo
+       app.kubernetes.io/name: tempo
+   serviceName: tempo-headless
+   template:
+     metadata:
+       labels:
+         app.kubernetes.io/instance: tempo
+         app.kubernetes.io/name: tempo
+     spec:
+       automountServiceAccountToken: true
+       containers:
+       - name: tempo
+         env: null
+         image: "docker.io/grafana/tempo:2.10.8"
+         imagePullPolicy: IfNotPresent
+         args:
+         - "-config.file=/conf/tempo.yaml"
+         - "-mem-ballast-size-mbs=1024"
+         livenessProbe:
+           failureThreshold: 3
+           httpGet:
+             path: /ready
+             port: 3200
+           initialDelaySeconds: 30
+           periodSeconds: 10
+           successThreshold: 1
+           timeoutSeconds: 5
+         ports:
+         - name: prom-metrics
+           containerPort: 3200
+         - name: jaeger-thrift-c
+           containerPort: 6831
+           protocol: UDP
+         - name: jaeger-thrift-b
+           containerPort: 6832
+           protocol: UDP
+         - name: jaeger-thrift-h
+           containerPort: 14268
+         - name: jaeger-grpc
+           containerPort: 14250
+         - name: zipkin
+           containerPort: 9411
+         - name: otlp-legacy
+           containerPort: 55680
+         - name: otlp-grpc
+           containerPort: 4317
+         - name: otlp-httplegacy
+           containerPort: 55681
+         - name: otlp-http
+           containerPort: 4318
+         readinessProbe:
+           failureThreshold: 3
+           httpGet:
+             path: /ready
+             port: 3200
+           initialDelaySeconds: 20
+           periodSeconds: 10
+           successThreshold: 1
+           timeoutSeconds: 5
+         resources:
+           requests:
+             cpu: 10m
+             memory: 100Mi
+         volumeMounts:
+         - name: tempo-conf
+           mountPath: /conf
+       securityContext:
+         fsGroup: 10001
+         runAsGroup: 10001
+         runAsNonRoot: true
+         runAsUser: 10001
+       serviceAccountName: tempo
+       volumes:
+       - name: tempo-conf
+         configMap:
+           name: tempo
+   updateStrategy:
+     type: RollingUpdate

@@ (root level) @@
# monitoring.coreos.com/v1/ServiceMonitor/observability/tempo
! + one document added:
+ apiVersion: monitoring.coreos.com/v1
+ kind: ServiceMonitor
+ metadata:
+   name: tempo
+   namespace: observability
+   labels:
+     app: tempo
+     helm.toolkit.fluxcd.io/name: tempo
+     helm.toolkit.fluxcd.io/namespace: observability
+     heritage: Helm
+ spec:
+   endpoints:
+   - port: tempo-prom-metrics
+   namespaceSelector:
+     matchNames:
+     - observability
+   selector:
+     matchLabels:
+       app.kubernetes.io/instance: tempo
+       app.kubernetes.io/managed-by: Helm
+       app.kubernetes.io/name: tempo
+       app.kubernetes.io/version: "2.10.8"
+       helm.sh/chart: tempo-2.2.4

sonarqubecloud · 2026-08-23T23:13:55Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

jazzlyn added 5 commits August 12, 2026 00:50

docs(otel): add observability stack design spec

5382361

docs(otel): update observability spec for phase-1 rollout #9987

5573137

docs(otel): address architect review on observability spec #9987

7ce1b81

docs(otel): adopt native otlp metrics in phase 1 #9987

0d7b8c2

docs(otel): clarify diagram label and scatter note #9987

f68b633

jazzlyn added 6 commits August 22, 2026 20:16

Merge branch 'main' into feature/otel-observability

8580e47

docs(otel): add collector wiring and loki otlp notes #9987

098fb42

feat(otel): add opentelemetry operator and collector #9987

b2f8fa0

feat(tempo): add tempo deployment #9987

017d6f0

feat(observability): wire otel and tempo backends #9987

75bd58a

docs(otel): add phase 1 implementation plan #9987

989cb25

tyriis-automation Bot added area/kubernetes cluster/main labels Aug 23, 2026

docs(otel): sync plan with implementation #9987

2fb3586

jazzlyn marked this pull request as ready for review August 23, 2026 23:14

jazzlyn requested a review from tyriis August 23, 2026 23:14

Navigation Menu

feat(otel): setup - #10155

feat(otel): setup#10155
jazzlyn wants to merge 12 commits into
mainfrom
feature/otel-observability

jazzlyn commented Aug 21, 2026

Uh oh!

tyriis-automation Bot commented Aug 21, 2026 •

edited

Loading

Uh oh!

tyriis-automation Bot commented Aug 21, 2026 •

edited

Loading

Uh oh!

tyriis-automation Bot commented Aug 23, 2026 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented Aug 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

jazzlyn commented Aug 21, 2026

Uh oh!

tyriis-automation Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅MegaLinter analysis: Success

Uh oh!

tyriis-automation Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

konflate — summary

Uh oh!

tyriis-automation Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

flate diff (main)

Uh oh!

sonarqubecloud Bot commented Aug 23, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

tyriis-automation Bot commented Aug 21, 2026 •

edited

Loading

tyriis-automation Bot commented Aug 21, 2026 •

edited

Loading

tyriis-automation Bot commented Aug 23, 2026 •

edited

Loading