Skip to content

Implement envoy route config for opentelemetry-collector #5016

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Warashi merged 2 commits into from
Jul 8, 2024
Merged

Implement envoy route config for opentelemetry-collector #5016

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
faf1cb7
Implement envoy route config for opentelemetry-collector
Warashi Jul 2, 2024
9b35adc
Add annotation for gateway to rollout when its config changes
Warashi Jul 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions manifests/pipecd/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@ spec:
labels:
{{- include "pipecd.selectorLabels" . | nindent 8 }}
app.kubernetes.io/component: gateway
annotations:
checksum/config: {{ include (print $.Template.BasePath "/envoy-configmap.yaml") . | sha256sum }} # ref; https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments
spec:
{{- if or .Values.serviceAccount.create .Values.serviceAccount.name }}
serviceAccountName: {{ include "pipecd.serviceAccountName" . }}
Expand Down
75 changes: 74 additions & 1 deletion manifests/pipecd/templates/envoy-configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ data:
socket_address:
address: 0.0.0.0
port_value: 9090
filter_chains:
filter_chains: # We cannot turn off ext_authz by default, so we have to turn it off in config for each route that doesn't need authz.
- filters:
- name: envoy.filters.network.http_connection_manager
typed_config:
Expand All @@ -32,6 +32,14 @@ data:
typed_config:
"@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
http_filters:
- name: envoy.filters.http.ext_authz
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
grpc_service:
envoy_grpc:
cluster_name: grpc-envoy-ext-authz
transport_api_version: V3
include_peer_certificate: false
- name: envoy.filters.http.grpc_web
{{- if .Values.cors.enabled }}
- name: envoy.filters.http.cors
Expand Down Expand Up @@ -66,38 +74,71 @@ data:
grpc:
route:
cluster: grpc-piped-service
typed_per_filter_config:
envoy.filters.http.ext_authz:
"@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
disabled: true
- match:
prefix: /pipe.api.service.pipedservice.PipedService/
grpc:
route:
cluster: grpc-piped-service
prefix_rewrite: /grpc.service.pipedservice.PipedService/
typed_per_filter_config:
envoy.filters.http.ext_authz:
"@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
disabled: true
- match:
prefix: /grpc.service.webservice.WebService/
grpc:
route:
cluster: grpc-web-service
typed_per_filter_config:
envoy.filters.http.ext_authz:
"@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
disabled: true
- match:
prefix: /pipe.api.service.webservice.WebService/
grpc:
route:
cluster: grpc-web-service
prefix_rewrite: /grpc.service.webservice.WebService/
typed_per_filter_config:
envoy.filters.http.ext_authz:
"@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
disabled: true
- match:
prefix: /grpc.service.apiservice.APIService/
grpc:
route:
cluster: grpc-api-service
typed_per_filter_config:
envoy.filters.http.ext_authz:
"@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
disabled: true
- match:
prefix: /pipe.api.service.apiservice.APIService/
grpc:
route:
cluster: grpc-api-service
prefix_rewrite: /grpc.service.apiservice.APIService/
typed_per_filter_config:
envoy.filters.http.ext_authz:
"@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
disabled: true
- match: # We want to protect the opentelemetry service with envoy ext_authz, so this route must not turn off ext_authz.
prefix: "/opentelemetry.proto.collector.trace.v1.TraceService/"
Comment on lines +129 to +130
Copy link
Member

@ffjlabo ffjlabo Jul 8, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[ask] Is this it? Just to be sure.
https://github.com/open-telemetry/opentelemetry-proto/blob/ff457cecf46cf219602e587d86d66f3b8cb3efe6/opentelemetry/proto/collector/trace/v1/trace_service.proto#L30

Piped calls the rpc method in the opentelemetry.proto.collector.trace.v1.TraceService to send the data to opentelemetry-collector.

Copy link
Member Author

@Warashi Warashi Jul 8, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes. You are right!

Copy link
Member

@ffjlabo ffjlabo Jul 8, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, I got it.

grpc:
route:
cluster: opentelemetry-collector
- match:
prefix: /
route:
cluster: server-http
typed_per_filter_config:
envoy.filters.http.ext_authz:
"@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
disabled: true
{{- if .Values.gateway.internalTLS.enabled }}
transport_socket:
name: envoy.transport_socket.tls
Expand Down Expand Up @@ -175,3 +216,35 @@ data:
port_value: 9082
track_cluster_stats:
request_response_sizes: true
- name: grpc-envoy-ext-authz
http2_protocol_options: {}
connect_timeout: 0.25s
type: STRICT_DNS
lb_policy: ROUND_ROBIN
load_assignment:
cluster_name: grpc-envoy-ext-authz
endpoints:
- lb_endpoints:
- endpoint:
address:
socket_address:
address: {{ include "pipecd.fullname" . }}-server
port_value: 9086
track_cluster_stats:
request_response_sizes: true
- name: opentelemetry-collector
http2_protocol_options: {}
connect_timeout: 0.25s
type: STRICT_DNS
lb_policy: ROUND_ROBIN
load_assignment:
cluster_name: opentelemetry-collector
endpoints:
- lb_endpoints:
- endpoint:
address:
socket_address:
address: {{ include "pipecd.fullname" . }}-opentelemetry-collector
port_value: 4317
track_cluster_stats:
request_response_sizes: true