# OTLP collector for the cluster. The API's OTEL_EXPORTER_OTLP_ENDPOINT
# points here.
#
# Traces only. The log pipeline in observability/otel-collector/config.yaml
# needs a DaemonSet with hostPath access to /var/log/pods plus RBAC, and Loki
# isn't in the cluster yet.
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: nereus-otel-collector
  labels:
    app.kubernetes.io/name: nereus-otel-collector
data:
  config.yaml: |
    receivers:
      otlp:
        protocols:
          grpc:
            endpoint: 0.0.0.0:4317

    processors:
      memory_limiter:
        check_interval: 1s
        limit_mib: 256
      batch:
        timeout: 5s

    exporters:
      otlp/tempo:
        endpoint: tempo.observability.svc.cluster.local:4317
        tls:
          insecure: true
      # Keeps traces visible in `kubectl logs` until Tempo is deployed.
      debug:
        verbosity: basic

    service:
      pipelines:
        traces:
          receivers: [otlp]
          processors: [memory_limiter, batch]
          exporters: [otlp/tempo, debug]
---
apiVersion: v1
kind: Service
metadata:
  name: nereus-otel-collector
  labels:
    app.kubernetes.io/name: nereus-otel-collector
spec:
  selector:
    app.kubernetes.io/name: nereus-otel-collector
  ports:
    - name: otlp-grpc
      port: 4317
      targetPort: otlp-grpc
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nereus-otel-collector
  labels:
    app.kubernetes.io/name: nereus-otel-collector
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: nereus-otel-collector
  template:
    metadata:
      labels:
        app.kubernetes.io/name: nereus-otel-collector
      annotations:
        # Restarts the pod when the config changes; the collector doesn't reload.
        checksum/config: placeholder
    spec:
      securityContext:
        runAsUser: 10001
        runAsGroup: 10001
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: otel-collector
          image: otel/opentelemetry-collector-contrib:0.159.0
          args: ["--config=/conf/config.yaml"]
          ports:
            - name: otlp-grpc
              containerPort: 4317
          volumeMounts:
            - name: config
              mountPath: /conf
              readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
            readOnlyRootFilesystem: true
          resources:
            requests:
              cpu: 50m
              memory: 128Mi
            limits:
              memory: 384Mi
      volumes:
        - name: config
          configMap:
            name: nereus-otel-collector