Skip to content

feat(helm): authenticate OTLP log export to a hosted collector #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mattj-monad merged 1 commit into from
Oct 4, 2026
Merged

feat(helm): authenticate OTLP log export to a hosted collector #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions deploy/helm/openshell/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -451,6 +451,8 @@ discovery endpoint or its TLS CA.
| server.oidc.userRole | string | `""` | Role name for standard user access. |
| server.otlp.endpoint | string | `""` | OTLP/gRPC collector endpoint, conventionally using port 4317. |
| server.otlp.exportLogs | bool | `false` | Also export gateway and sandbox logs (including OCSF events) as OTLP log records to the same endpoint. Drops are reported downstream as telemetry_gap records. |
| server.otlp.headersSecret.key | string | `""` | Key within that Secret. Defaults to OTEL_EXPORTER_OTLP_HEADERS. |
| server.otlp.headersSecret.name | string | `""` | Name of an existing Secret holding the OTLP header string. Empty disables the env var entirely. |
| server.otlp.ocsfFullPayload | bool | `true` | Carry the structured OCSF document (ocsf.raw) on exported OCSF records. Set false to export only the shorthand line. |
| server.otlp.serviceName | string | `""` | Gateway OpenTelemetry service name. Empty uses openshell-gateway. |
| server.policyValidationFailureMode | string | `"fail_closed"` | Posture when a candidate sandbox policy fails validation. `fail_closed` deactivates the previous policy; `retain_last_valid` keeps it active. |
Expand Down
14 changes: 14 additions & 0 deletions deploy/helm/openshell/templates/_gateway-workload.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,6 +122,20 @@ spec:
- name: SSL_CERT_FILE
value: /etc/openshell-tls/oidc-ca/ca.crt
{{- end }}
{{- with .Values.server.otlp.headersSecret }}
{{- if .name }}
# OTLP collector authentication. The gateway reads the standard
# OpenTelemetry header variables; there is no `headers` field in the
# gateway TOML, so a hosted collector can only be authenticated through
# the process environment. Sourced from a Secret so the token is never
# a chart value or a rendered manifest literal.
- name: OTEL_EXPORTER_OTLP_HEADERS
valueFrom:
secretKeyRef:
name: {{ .name | quote }}
key: {{ .key | default "OTEL_EXPORTER_OTLP_HEADERS" | quote }}
{{- end }}
{{- end }}
- name: OPENSHELL_TELEMETRY_ENABLED
value: {{ .Values.server.telemetryEnabled | quote }}
{{- if .Values.server.providerTokenGrants.spiffe.enabled }}
Expand Down
13 changes: 13 additions & 0 deletions deploy/helm/openshell/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -270,6 +270,19 @@ server:
endpoint: ""
# -- Gateway OpenTelemetry service name. Empty uses openshell-gateway.
serviceName: ""
# Authentication for a hosted OTLP collector.
#
# The gateway authenticates through the standard OpenTelemetry header
# variables -- there is no `headers` field in the gateway TOML -- so this
# has to reach the process as an environment variable. Reference a Secret
# holding the full header string, for example
# `authorization=Bearer <token>`, rather than putting a token in values.
headersSecret:
# -- Name of an existing Secret holding the OTLP header string. Empty
# disables the env var entirely.
name: ""
# -- Key within that Secret. Defaults to OTEL_EXPORTER_OTLP_HEADERS.
key: ""
# -- Also export gateway and sandbox logs (including OCSF events) as OTLP
# log records to the same endpoint. Drops are reported downstream as
# telemetry_gap records.
Expand Down
Loading