opentelemetry-operator

Renders OpenTelemetry Operator collectors, Instrumentations, TargetAllocators and OpAMPBridges from inventory parameters.

kubernetes operators observability

Latest: 1.1.0 · 2026-10-16
License: Apache-2.0
Owners: Moep90
Source: github.com/kadet-hub/generators · 0 repo stars, shared by 35 generators
Thumbs up: 👍 0 on GitHub Discussions
Popularity: 18 · 462 pulls

Request a feature Report a problem

Badge

Show the latest listed version in your README. shields.io draws the badge from this page's badge.json, which every catalog build updates; once no version is listed, it reads "not listed".

[![kadet-hub](https://img.shields.io/endpoint?url=https://kadet-hub.org/generators/opentelemetry-operator/badge.json)](https://kadet-hub.org/generators/opentelemetry-operator/)

OpenTelemetry Operator Generator

Published on kadet-hub: pin a released version by digest from its catalog page.

Kapitan kadet generator for OpenTelemetry Operator resources (opentelemetry.io). Built for OpenTelemetry Operator 0.161.0.

OpenTelemetryCollector (v1beta1): a managed collector as Deployment, DaemonSet, StatefulSet or sidecar
Instrumentation (v1alpha1): auto-instrumentation injection settings
TargetAllocator (v1alpha1): standalone Prometheus target distribution for collectors
OpAMPBridge (v1alpha1): OpAMP management of collectors

ClusterObservability is not rendered; it needs the alpha operator feature gate operator.clusterobservability. The operator install, RBAC, Secrets and the instrumented workloads belong in the helm or kubernetes generator.

Usage

Kapitan Configuration

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/opentelemetry-operator@sha256:<digest>
        output_path: lib/opentelemetry-operator
    compile:
      - output_path: manifests/opentelemetry-operator/
        input_type: kadet
        output_type: yml
        input_paths:
          - lib/opentelemetry-operator

Inventory Contract

All keys live under parameters.generators.opentelemetry_operator.

Key	Kind	Output key
`namespace`		Default namespace. Falls back to `parameters.namespace`, then `default`.
`collectors.<name>`	OpenTelemetryCollector	`<namespace>/<name>-otelcol`
`instrumentations.<name>`	Instrumentation	`<namespace>/<name>-otelinst`
`target_allocators.<name>`	TargetAllocator	`<namespace>/<name>-targetallocator`
`opamp_bridges.<name>`	OpAMPBridge	`<namespace>/<name>-opampbridge`

Every resource accepts namespace, labels, annotations and a spec dict that passes through to the resource spec. Precedence is generator defaults < spec < flat keys and shorthands: a flat key wins over the same field in spec and logs a warning.

Flat keys are the snake_case spelling of every top-level CRD spec field of the rendered version, for example mode, config, target_allocator, pod_dns_config, host_pid, prometheus_cr, apache_httpd or components_allowed. Values pass through unchanged: the collector config is free-form collector YAML and its keys are never translated.

Collector ${env:VAR} references must be escaped as \${env:VAR} in an interpolating inventory backend such as omegaconf, which otherwise tries to resolve them.

Shorthands and Defaults

Input	Result	Source
collector `target_allocator: <name>`	label `opentelemetry.io/target-allocator: <name>`; a dict still passes through to the embedded `targetAllocator`	A standalone TargetAllocator is linked by this label on the collector (TargetAllocator CRD).
collector without `mode` that uses a target allocator (that label, or `targetAllocator.enabled: true`)	`mode: statefulset`	The target allocator supports only `statefulset` and `daemonset` (note); the operator defaults `mode` to `deployment` (webhook) and rejects an embedded target allocator in that mode (validation).

The per-node allocation strategy needs mode: daemonset; set it explicitly. The operator looks up a standalone TargetAllocator in the collector’s namespace (controller), so keep both in the same namespace.

All other unset keys are not emitted, so the operator’s defaults apply: mode: deployment, replicas: 1, upgradeStrategy: automatic, managementState: managed, the collector config defaults, the auto-instrumentation images and resources, and the TargetAllocator allocationStrategy: consistent-hashing. These are deliberately left without a generator default:

prometheus_cr selectors. Without serviceMonitorSelector and podMonitorSelector the TargetAllocator discovers no monitors; {} selects every monitor in the cluster, which on a shared cluster lets a monitor author read the collector’s credentials (selectors, security).
OpAMPBridge capabilities. The CRD requires them and they decide what the OpAMP server may do: the Reports* capabilities only report, AcceptsRemoteConfig lets the server rewrite collector configs in the cluster, so the inventory sets them deliberately (OpAMPBridge CRD).
OpAMP labels on collectors. A bridge reports or manages only collectors labeled opentelemetry.io/opamp-reporting: "true" or opentelemetry.io/opamp-managed: "true" (or the bridge name); set them in labels (collector labels).

Example

parameters:
  generators:
    opentelemetry_operator:
      namespace: observability
      collectors:
        gateway:
          replicas: 2
          labels:
            opentelemetry.io/opamp-managed: bridge
          config:
            receivers:
              otlp:
                protocols:
                  grpc:
                    endpoint: 0.0.0.0:4317
                  http:
                    endpoint: 0.0.0.0:4318
            processors:
              batch: {}
            exporters:
              otlphttp:
                endpoint: http://tempo.observability.svc:4318
            service:
              pipelines:
                traces:
                  receivers: [otlp]
                  processors: [batch]
                  exporters: [otlphttp]
        metrics:
          target_allocator: metrics
          config:
            receivers:
              prometheus:
                config:
                  scrape_configs: []
            exporters:
              debug: {}
            service:
              pipelines:
                metrics:
                  receivers: [prometheus]
                  exporters: [debug]
      target_allocators:
        metrics:
          prometheus_cr:
            enabled: true
            podMonitorSelector:
              matchLabels:
                team: platform
            serviceMonitorSelector:
              matchLabels:
                team: platform
      instrumentations:
        default:
          namespace: web
          exporter:
            endpoint: http://gateway-collector.observability.svc:4318
          propagators: [tracecontext, baggage]
          sampler:
            type: parentbased_traceidratio
            argument: "0.25"
      opamp_bridges:
        bridge:
          endpoint: ws://opamp-server.observability.svc:4320/v1/opamp
          capabilities:
            ReportsEffectiveConfig: true
            ReportsHealth: true

This renders observability/gateway-otelcol, observability/metrics-otelcol (labeled for the metrics TargetAllocator, mode: statefulset), observability/metrics-targetallocator, web/default-otelinst and observability/bridge-opampbridge.

Versions

Add a version's inventory entry, then compile with the consumer workflow, which verifies the artifact and runs Kapitan in the sandbox.

Free of charge, as is and on a best-effort basis: use at your own risk, and review the compiled output before you apply it. Terms

This catalog was built from index serial 47. Set index_serial: 47 in .kapitan-sandbox.yaml and the consumer workflow refuses any older index, so a rolled-back index cannot bring back a yanked version.

Checks find known patterns; they do not prove a generator safe. What a listing covers

Version	Built for (schema-checked)
1.1.0	OpenTelemetry Operator 0.161.0
1.0.2	OpenTelemetry Operator 0.160.0
1.0.1	OpenTelemetry Operator 0.160.0
1.0.0	OpenTelemetry Operator 0.160.0

1.1.0# 2026-10-16

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/opentelemetry-operator:1.1.0@sha256:6b3a7928edbd966b3d473fe3b0246c69b01b7f4635c9e0171570cf50c38d650a
        output_path: lib/opentelemetry-operator

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/opentelemetry-operator@sha256:6b3a7928edbd966b3d473fe3b0246c69b01b7f4635c9e0171570cf50c38d650a \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3274970246, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: reclass-rs, omegaconf
With --cache: passed
krab: compatible
Built for (schema-checked): OpenTelemetry Operator 0.161.0
Source: opentelemetry-operator-v1.1.0 · dcbe958a17a0ceddd7c4d0ba829fdf789d64e156 · opentelemetry-operator
Binaries: none
Output capabilities: none
Digest: sha256:6b3a7928edbd966b3d473fe3b0246c69b01b7f4635c9e0171570cf50c38d650a

Checks

Checked by the release run on 2026-10-16, gate at a31e96336fac.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

Fixture output against 1.0.2: 1 file, 2 hunks.

--- a/compiled/complete/manifests/observability/gateway-otelcol.yaml
+++ b/compiled/complete/manifests/observability/gateway-otelcol.yaml
@@ -52,6 +52,8 @@
         fieldRef:
           fieldPath: status.podIP
   image: otel/opentelemetry-collector-contrib:0.160.0
+  imagePullSecrets:
+    - name: registry-credentials
   ingress:
     hostname: otlp.example.com
     type: ingress
@@ -64,3 +66,4 @@
     requests:
       cpu: 100m
       memory: 256Mi
+  revisionHistoryLimit: 3

Output diff

1.0.2# 2026-10-14

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/opentelemetry-operator:1.0.2@sha256:f55e93136e59bb56d3525561f0eaad5d797122bea8f90c34128a167437f0109d
        output_path: lib/opentelemetry-operator

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/opentelemetry-operator@sha256:f55e93136e59bb56d3525561f0eaad5d797122bea8f90c34128a167437f0109d \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3250301497, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): OpenTelemetry Operator 0.160.0
Source: opentelemetry-operator-v1.0.2 · e4891e8fd85ca0a19ebf361e8b54fd6473fd8a2f · opentelemetry-operator
Binaries: none
Output capabilities: none
Digest: sha256:f55e93136e59bb56d3525561f0eaad5d797122bea8f90c34128a167437f0109d

Checks

Checked by the release run on 2026-10-14, gate at fe9998b5168d.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

1.0.1# 2026-10-13

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/opentelemetry-operator:1.0.1@sha256:6939c855a6b26475a36591de574abfb6e64e3831f11d68ce1d67f8fc7b106bc3
        output_path: lib/opentelemetry-operator

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/opentelemetry-operator@sha256:6939c855a6b26475a36591de574abfb6e64e3831f11d68ce1d67f8fc7b106bc3 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3244142103, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): OpenTelemetry Operator 0.160.0
Source: opentelemetry-operator-v1.0.1 · 9166cb30e0ae4874bc8f229c6a6823eff7451d04 · opentelemetry-operator
Binaries: none
Output capabilities: none
Digest: sha256:6939c855a6b26475a36591de574abfb6e64e3831f11d68ce1d67f8fc7b106bc3

Checks

Checked by the release run on 2026-10-13, gate at ba634ff54963.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

1.0.0# 2026-10-11

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/opentelemetry-operator:1.0.0@sha256:0666790b067de758970e192857ca5948525cf87d3ec25487f2549c588a7bcae8
        output_path: lib/opentelemetry-operator

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/opentelemetry-operator@sha256:0666790b067de758970e192857ca5948525cf87d3ec25487f2549c588a7bcae8 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3211169746, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): OpenTelemetry Operator 0.160.0
Source: opentelemetry-operator-v1.0.0 · 91b3915d464dd9327ffce043f5ae528c26de7dff · opentelemetry-operator
Binaries: none
Output capabilities: none
Digest: sha256:0666790b067de758970e192857ca5948525cf87d3ec25487f2549c588a7bcae8

Checks

Checked by the release run on 2026-10-11, gate at 994707bbec61.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.