otel-agent-mtls.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: otel-agent-conf
  labels:
    app: opentelemetry
    component: otel-agent-conf
  namespace: otel-system
data:
  otel-agent-config: |
    receivers:
      otlp:
        protocols:
          grpc:
          http:
      prometheus:
        config:
          scrape_configs:
            - job_name: 'db_jmx_metrics'
              tls_config:
                ca_file: /etc/istio-output-certs/root-cert.pem
                cert_file: /etc/istio-output-certs/cert-chain.pem
                insecure_skip_verify: true
                key_file: /etc/istio-output-certs/key.pem
              scheme: https 
              scrape_interval: 15s
              metrics_path: '/prometheus/metrics'
              kubernetes_sd_configs:
                - role: endpoints
                  namespaces:
                    names:
                      - day2-operations
              relabel_configs:
                - action: keep
                  source_labels:
                    - __meta_kubernetes_service_label_app
                  regex: day2-service   
                - action: keep
                  source_labels:
                    - __meta_kubernetes_endpoint_port_name
                  regex: http-web                              
            - job_name: 'prometheus-federate'
              scrape_timeout: 30s
              honor_labels: false
              metrics_path: '/federate'
              params:
                'match[]':
                  - '{__name__=~"event(.*)"}'
                  - '{__name__=~"loki(.*)",__name__!="loki_ingester_checkpoint_duration_seconds"}'
                  - '{__name__=~"fluentbit(.*)"}'
                  - '{__name__=~"servicecatalog(.*)"}'
                  - '{__name__=~"controller_runtime(.*)"}'
              kubernetes_sd_configs:
                - role: endpoints
                  namespaces:
                    names:
                      - kyma-system
              relabel_configs:
                - action: keep
                  source_labels:
                    - __meta_kubernetes_service_label_app
                  regex: monitoring-prometheus
                - action: keep
                  source_labels:
                    - __meta_kubernetes_endpoint_port_name
                  regex: http-web
    exporters:
      dynatrace:
        endpoint: "${API_ENDPOINT}"
        api_token: "${API_TOKEN}"
    processors:
      batch:
        # Batch size must be less than or equal to 1000
        send_batch_size: 500
        send_batch_max_size: 500
        timeout: 30s
      memory_limiter:
        # Same as --mem-ballast-size-mib CLI argument
        # ballast_size_mib: 165
        # 80% of maximum memory up to 2G
        limit_mib: 400
        # 25% of limit up to 2G
        spike_limit_mib: 100
        check_interval: 5s
    service:
      telemetry:
        logs:
          level: INFO # DEBUG
      pipelines:
        metrics:
          receivers: [prometheus]
          processors: [memory_limiter, batch]
          exporters: [dynatrace]
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: otel-agent
  namespace: otel-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: otel-agent
rules:
  - apiGroups: [""]
    resources:
      - nodes
      - nodes/metrics
      - services
      - endpoints
      - pods
    verbs: ["get", "list", "watch"]
  - apiGroups:
      - extensions
      - networking.k8s.io
    resources:
      - ingresses
    verbs: ["get", "list", "watch"]
  - nonResourceURLs: ["/metrics", "/metrics/cadvisor"]
    verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: otel-agent
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: otel-agent
subjects:
  - kind: ServiceAccount
    name: otel-agent
    namespace: otel-system
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: otel-agent
  labels:
    app: opentelemetry
    component: otel-agent
  namespace: otel-system
spec:
  selector:
    matchLabels:
      app: opentelemetry
      component: otel-agent
  template:
    metadata:
      labels:
        app: opentelemetry
        component: otel-agent
        sidecar.istio.io/inject: "true"        
      annotations:
        proxy.istio.io/config: |
          # configure an env variable `OUTPUT_CERTS` to write certificates to the given folder
          proxyMetadata:
            OUTPUT_CERTS: /etc/istio-output-certs
        sidecar.istio.io/userVolumeMount: '[{"name": "istio-certs", "mountPath": "/etc/istio-output-certs"}]'
        traffic.sidecar.istio.io/includeInboundPorts: ""
        traffic.sidecar.istio.io/includeOutboundIPRanges: ""
    spec:
      containers:
      - name: otel-agent
        image: otel/opentelemetry-collector-contrib:latest
        args:
          - --config=/etc/otel/config.yaml        
        env:
        - name: API_TOKEN
          valueFrom:
            secretKeyRef:
              name: dynakube
              key: API_TOKEN
        - name: API_ENDPOINT
          valueFrom:
            secretKeyRef:
              name: dynakube
              key: API_ENDPOINT
        resources:
          limits:
            cpu: 500m
            memory: 500Mi
          requests:
            cpu: 100m
            memory: 100Mi
        volumeMounts:
        - mountPath: /etc/otel/config.yaml
          name: data
          subPath: otel-agent-config
          readOnly: true
        - mountPath: /etc/istio-output-certs
          name: istio-certs
          readOnly: true
      volumes:
      - name: data
        configMap:
          name: otel-agent-conf
      - name: istio-certs
        emptyDir: {}
      serviceAccountName: otel-agent