Skip to content

Conversation

@Nexusrex18
Copy link

What this PR fixes

When deploying the gateway-addons-helm chart with only OpenTelemetry Collector enabled (opentelemetry-collector.enabled: true), the collector pod logs RBAC errors because no ClusterRole/ClusterRoleBinding is created for the otel-collector service account.

Error example from issue #7726:
pods is forbidden: User "system:serviceaccount:gateway-api-resources:otel-collector" cannot list resource "pods" at the cluster scope replicasets.apps is forbidden: User "system:serviceaccount:gateway-api-resources:otel-collector" cannot list resource "replicasets" namespaces "kube-system" is forbidden: User "system:serviceaccount:gateway-api-resources:otel-collector" cannot list resource "namespaces"

Root cause

The OpenTelemetry Collector subchart only creates RBAC when either:

  1. clusterRole.create: true OR
  2. One of the presets is enabled (like kubernetesAttributes.enabled: true)

The gateway-addons-helm chart's default values don't enable any presets, so when users enable only the collector, they get no RBAC.

Solution

Enable the kubernetesAttributes preset by default in the OpenTelemetry Collector configuration. This preset provides exactly the permissions shown in the error logs:

  • pods and namespaces (for Kubernetes discovery)
  • replicasets (for pod owner references)

The change adds 5 lines after fullnameOverride: otel-collector in values.yaml:

  # Enable kubernetesAttributes preset to ensure RBAC is created
  # when the collector is enabled (required for k8s discovery)
  presets:
    kubernetesAttributes:
      enabled: true

@Nexusrex18 Nexusrex18 requested a review from a team as a code owner December 20, 2025 23:23
@codecov
Copy link

codecov bot commented Dec 21, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.51%. Comparing base (895a853) to head (55d6aaf).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #7791      +/-   ##
==========================================
- Coverage   72.52%   72.51%   -0.01%     
==========================================
  Files         235      235              
  Lines       34859    34859              
==========================================
- Hits        25280    25279       -1     
- Misses       7772     7774       +2     
+ Partials     1807     1806       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@Nexusrex18 Nexusrex18 force-pushed the fix/addons-otel-collector-rbac branch from b2bbbba to 55d6aaf Compare December 23, 2025 15:02
@zirain
Copy link
Member

zirain commented Dec 23, 2025

please run make -k gen-check locally and commit the changes to make CI happy.

…Telemetry Collector

The OpenTelemetry Collector configuration requires Kubernetes permissions
for pod/namespace discovery, but the necessary RBAC is not created because
the kubernetesAttributes preset is not enabled by default.

This enables the kubernetesAttributes preset which creates the necessary
ClusterRole and ClusterRoleBinding for the otel-collector service account.

Fixes envoyproxy#7726

Signed-off-by: Nexusrex18 <[email protected]>
@Nexusrex18 Nexusrex18 force-pushed the fix/addons-otel-collector-rbac branch from 55d6aaf to c894947 Compare December 24, 2025 22:02
@Nexusrex18
Copy link
Author

@zirain done the changes

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants