Repository navigation
docs(observability): add OpenTelemetry export guide and group log export destinations - #3063
Conversation
✅ Deploy Preview for calico-docs-preview-next ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview succeeded!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
…enTelemetry Document the LogCollector openTelemetry section: exporting flow, DNS, and audit logs and federated component metrics over OTLP, exporter auth headers and per-exporter TLS, Collector resource overrides, and how to turn export off. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…h logs section The page covers metrics as well as logs and isn't tied to Elasticsearch, so it belongs at the top level of observability. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…try to them Move Archive logs out of observability/elastic/ next to the OpenTelemetry guide, add OpenTelemetry to the destination lists and as a tab on the Archive logs page, and add a commented redirect for 3.24 EP3. Drop the "only Splunk Enterprise is supported" note: the operator posts to any Splunk HTTP Event Collector endpoint, which Splunk Cloud Platform also provides. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…t in OpenTelemetry export
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… identifier Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…sters, and restarts Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
b5c1960 to
da6f760
Compare
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…rt and what older clusters do with the field Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ctauchen
left a comment
ctauchen
left a comment
There was a problem hiding this comment.
Sorry for the slow turnaround on this one, Tian. It sat with me far longer than it should have.
I've been through the new page against the operator API reference on the branch, and it holds up field by field. The test plan covers the two tickets well. Three small fixes and one question below.
The one thing that needs doing first is a rebase. The branch is 52 commits behind main and conflicts on the archive page. Main added a content_type: unclassified line to the old file in the meantime, so when you resolve the conflict, keep that line on the moved page. Everything else in the PR should rebase cleanly.
| For more information, see [Configure Prometheus](../operations/monitor/prometheus/configure-prometheus.mdx). | ||
| - Your backend must accept OTLP over `https`, using either gRPC or HTTP. | ||
| The Collector never sends telemetry or credentials over plain HTTP. | ||
| - If an exporter's endpoint is a domain name rather than an IP address, your license must also include egress access control. |
There was a problem hiding this comment.
Say what happens without the feature: "Without that feature, the operator skips the egress rule for that exporter, and the Collector's network policy blocks the export."
There was a problem hiding this comment.
Done. I also added a line saying where the user sees it: the operator sets the log-collector-otel TigeraStatus to DEGRADED and names the exporter.
docs/calico-enterprise/observability/opentelemetry.mdx
Lines 45 to 48 in 360d165
…ctor edit sentence, and OpenTelemetry page wording Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
# Conflicts: # calico-enterprise/observability/archive-storage.mdx
Product Version(s):
Calico Enterprise 3.24 EP3 (
next)Issue:
EV-7414
EV-7418
Link to docs preview:
What
observability/opentelemetry: export flow, DNS, and audit logs and component metrics over OTLP through the operator-managed OpenTelemetry Collector (LogCollectorspec.openTelemetry).observability/elastic/toobservability/, next to the new page, and gets an OpenTelemetry tab. OpenTelemetry is added to the destination lists in the logs overview and the install options table.Why
The
openTelemetryAPI is in the operator reference with no user guide. Export destinations also sat under the Elasticsearch section although they don't depend on it.Behavior change
/calico-enterprise/3.24/observability/elastic/archive-storagemoves to/calico-enterprise/3.24/observability/archive-storageat EP3. A commented redirect is instatic/_redirects; uncomment it when EP3 publishes.Test plan
Built
nextlocally on the first commit: no broken links. Later builds were killed by the OOM killer on my machine, so this PR's preview build is the full link check.Checked every relative link, landing-page card, and sidebar entry in the changed files points to an existing page.
Reviewed the changed pages on a local dev server.
CNX-T6268 (1.0): on a 3.24 EP3 management and managed cluster pair, exported both clusters to an OTLP receiver with debug output. Neither logs (resource attribute
service.nameonly) nor metrics (prometheusandprometheus_replicalabels are the same in both clusters) carry a cluster identifier. The page now says so.EV-7414: on the same managed cluster, with an exporter whose endpoint does not resolve,
log-collector-otelstayed Available,otelcol_exporter_queue_sizerose at once,otelcol_exporter_send_failed_*first appeared in Prometheus about 5 minutes later, and the Collector loggedExporting failedatinfo. Changinglogs.typesreplaced all 5calico-fluent-bitpods while the Collector pod kept running. The 60%/80% memory thresholds, the single Fluent Bit retry, and the Collector ServiceMonitor were checked in the operator source.EV-7418: with the managed cluster on v3.23.2,
kubectl apply --server-siderejectedspec.openTelemetryandkubectl patch --type=mergewarned and dropped it; after upgrading to EP3 the same config exported. Server dry-runs of an unknown LogCollector field on Kubernetes 1.36 showedkubectl applyandkubectl replacereject it too, and onlykubectl patchwarns. The page now states the minimum release and this behavior.SME review:
DOCS review:
Merge checklist: