Skip to content

Feat/add otel support #7642

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 14 commits into
base: main
Choose a base branch
from
Draft

Feat/add otel support #7642

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
472eca4
accept otel configmap keys
haywoodsh Apr 11, 2025
1f0c5bd
add otel-module to NIC images
pdabelf5 Apr 11, 2025
af6de29
remove unused config map keys
haywoodsh Apr 14, 2025
814dcbd
update templates to add OSS support
pdabelf5 Apr 14, 2025
f8c73cc
accept otel configmap keys
haywoodsh Apr 11, 2025
9d6b684
add otel-module to NIC images
pdabelf5 Apr 11, 2025
0c9c7f5
remove unused config map keys
haywoodsh Apr 14, 2025
6b54b52
remove unused otel flag
pdabelf5 Apr 29, 2025
2e286cb
rename mgmt trusted secret function
pdabelf5 Apr 29, 2025
2bdf259
add CA to Otel exporter on startup
pdabelf5 Apr 29, 2025
8c598c6
add runtime config for Otel CA cert updates
pdabelf5 Apr 29, 2025
327201a
add nil check
pdabelf5 Apr 29, 2025
d3d9883
remove unsupported image architectures
pdabelf5 Apr 30, 2025
22e590f
Merge branch 'main' into feat/add-otel-support
pdabelf5 May 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/data/matrix-images-oss.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,12 @@
"alpine"
],
"platforms": [
"linux/arm, linux/arm64, linux/amd64, linux/ppc64le, linux/s390x"
"linux/arm64, linux/amd64"
],
"include": [
{
"image": "ubi",
"platforms": "linux/arm64, linux/amd64, linux/ppc64le, linux/s390x"
"platforms": "linux/arm64, linux/amd64"
}
]
}
34 changes: 22 additions & 12 deletions build/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,15 +21,25 @@ FROM golang:1.24-alpine@sha256:7772cb5322baa875edd74705556d08f0eeca7b9c4b5367754
############################################# Base image for Alpine #############################################
FROM nginx:1.27.4-alpine@sha256:4ff102c5d78d254a6f0da062b3cf39eaf07f01eec0927fd21e219d0af8bc0591 AS alpine

RUN apk add --no-cache libcap libstdc++
RUN printf "%s%s%s\n" "http://nginx.org/packages/mainline/alpine/v" `egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release` "/main" >> /etc/apk/repositories \
&& apk add --no-cache libcap libstdc++ nginx-module-otel \
&& sed -i -e '/nginx.org/d' /etc/apk/repositories


############################################# Base image for Debian #############################################
FROM nginx:1.27.4@sha256:09369da6b10306312cd908661320086bf87fbae1b6b0c49a1f50ba531fef2eab AS debian
FROM nginx:1.27.4@sha256:124b44bfc9ccd1f3cedf4b592d4d1e8bddb78b51ec2ed5056c52d3692baebc19 AS debian

RUN apt-get update \
&& apt-get install --no-install-recommends --no-install-suggests -y libcap2-bin

&& apt-get install --no-install-recommends --no-install-suggests -y \
libcap2-bin curl gnupg2 ca-certificates lsb-release debian-archive-keyring \
&& curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor > /usr/share/keyrings/nginx-archive-keyring.gpg \
&& echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
http://nginx.org/packages/mainline/debian `lsb_release -cs` nginx" > /etc/apt/sources.list.d/nginx.list \
&& printf "%s" "Package: *\nPin: origin nginx.org\nPin: release o=nginx\nPin-Priority: 900\n" > /etc/apt/preferences.d/99nginx \
&& apt-get update \
&& apt-get install --no-install-recommends --no-install-suggests -y nginx-module-otel \
&& apt-get purge --auto-remove -y gnupg2 lsb-release curl \
&& rm -rf /var/lib/apt/lists/* /etc/apt/preferences.d/99nginx /etc/apt/sources.list.d/nginx.list

############################################# NGINX files #############################################
FROM scratch AS nginx-files
Expand Down Expand Up @@ -109,7 +119,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/apk/cert.pem,mode=0644 \
--mount=type=bind,from=nginx-files,src=tracking.info,target=/tmp/nginx/reporting/tracking.info \
export $(cat /tmp/user_agent) \
&& printf "%s\n" "https://${PACKAGE_REPO}/plus/${NGINX_PLUS_VERSION}/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
&& apk add --no-cache nginx-plus nginx-plus-module-njs nginx-plus-module-fips-check libcap libcurl \
&& apk add --no-cache nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check libcap libcurl \
&& mkdir -p /etc/nginx/reporting/ && cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
&& ldconfig /usr/local/lib/ \
&& sed -i -e '/nginx.com/d' /etc/apk/repositories
Expand Down Expand Up @@ -151,7 +161,7 @@ RUN --mount=type=bind,from=alpine-fips-3.19,target=/tmp/fips/ \
&& printf "%s\n" "https://${PACKAGE_REPO}/app-protect/${NGINX_PLUS_VERSION}/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
&& printf "%s\n" "https://pkgs.nginx.com/app-protect-security-updates/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
&& printf "%s\n" "https://${PACKAGE_REPO}/nginx-agent/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
&& apk add --no-cache libcap-utils libcurl nginx-plus nginx-plus-module-njs nginx-plus-module-fips-check \
&& apk add --no-cache libcap-utils libcurl nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check \
&& if [ "${NGINX_AGENT}" = "true" ]; then apk add --no-cache nginx-agent; fi \
&& mkdir -p /usr/ssl \
&& cp -av /tmp/fips/usr/lib/ossl-modules/fips.so /usr/lib/ossl-modules/fips.so \
Expand Down Expand Up @@ -187,7 +197,7 @@ RUN --mount=type=bind,from=alpine-fips-3.19,target=/tmp/fips/ \
printf "%s\n" "https://${PACKAGE_REPO}/plus/${NGINX_PLUS_VERSION}/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
&& printf "%s\n" "https://${PACKAGE_REPO}/app-protect-x-plus/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
&& printf "%s\n" "https://${PACKAGE_REPO}/nginx-agent/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
&& apk add --no-cache libcap-utils libcurl nginx-plus nginx-plus-module-njs nginx-plus-module-fips-check \
&& apk add --no-cache libcap-utils libcurl nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check \
&& if [ "${NGINX_AGENT}" = "true" ]; then apk add --no-cache nginx-agent; fi \
&& mkdir -p /usr/ssl \
&& cp -av /tmp/fips/usr/lib/ossl-modules/fips.so /usr/lib/ossl-modules/fips.so \
Expand Down Expand Up @@ -226,7 +236,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
&& gpg --dearmor -o /usr/share/keyrings/app-protect-archive-keyring.gpg /tmp/app-protect-security-updates.key \
&& cp /tmp/nginx-plus.sources /etc/apt/sources.list.d/nginx-plus.sources \
&& apt-get update \
&& apt-get install --no-install-recommends --no-install-suggests -y nginx-plus nginx-plus-module-njs nginx-plus-module-fips-check \
&& apt-get install --no-install-recommends --no-install-suggests -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check \
&& apt-get purge --auto-remove -y gpg \
&& mkdir -p /etc/nginx/reporting/ \
&& cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
Expand Down Expand Up @@ -346,7 +356,7 @@ RUN --mount=type=bind,from=nginx-files,src=nginx_signing.key,target=/tmp/nginx_s
printf "%s\n" "[nginx]" "name=nginx repo" \
"baseurl=https://nginx.org/packages/mainline/centos/9/\$basearch/" \
"gpgcheck=1" "enabled=1" "module_hotfixes=true" > /etc/yum.repos.d/nginx.repo \
&& microdnf --nodocs install -y nginx nginx-module-njs nginx-module-image-filter nginx-module-xslt \
&& microdnf --nodocs install -y nginx nginx-module-njs nginx-module-otel nginx-module-image-filter nginx-module-xslt \
&& rm /etc/yum.repos.d/nginx.repo; \
fi \
&& ubi-clean.sh
Expand All @@ -368,7 +378,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
--mount=type=bind,from=nginx-files,src=tracking.info,target=/tmp/nginx/reporting/tracking.info \
mkdir -p /etc/nginx/reporting/ && cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
&& ubi-setup.sh \
&& microdnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-fips-check \
&& microdnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check \
&& ubi-clean.sh


Expand Down Expand Up @@ -473,7 +483,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
&& groupadd --system --gid 101 nginx \
&& useradd --system --gid nginx --no-create-home --home-dir /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \
&& rpm --import /tmp/nginx_signing.key \
&& dnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-fips-check \
&& dnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check \
&& if [ "${NGINX_AGENT}" = "true" ]; then dnf --nodocs install -y nginx-agent; fi \
&& sed -i 's/\(def in_container():\)/\1\n return False/g' /usr/lib64/python*/*-packages/rhsm/config.py \
&& subscription-manager register --org=${RHEL_ORGANIZATION} --activationkey=${RHEL_ACTIVATION_KEY} || true \
Expand Down Expand Up @@ -520,7 +530,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
&& groupadd --system --gid 101 nginx \
&& useradd --system --gid nginx --no-create-home --home-dir /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \
&& rpm --import /tmp/nginx_signing.key \
&& dnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-fips-check \
&& dnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check \
&& if [ "${NGINX_AGENT}" = "true" ]; then dnf --nodocs install -y nginx-agent; fi \
## end of duplicated code
&& sed -i 's/\(def in_container():\)/\1\n return False/g' /usr/lib64/python*/*-packages/rhsm/config.py \
Expand Down
26 changes: 24 additions & 2 deletions cmd/nginx-ingress/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,7 +159,7 @@
logEventAndExit(ctx, eventRecorder, pod, secretErrorReason, err)
}

if err := processTrustedCertSecret(kubeClient, nginxManager, mgmtCfgParams, controllerNamespace); err != nil {
if err := processMgmtTrustedCertSecret(kubeClient, nginxManager, mgmtCfgParams, controllerNamespace); err != nil {

Check warning on line 162 in cmd/nginx-ingress/main.go

View check run for this annotation

Codecov / codecov/patch

cmd/nginx-ingress/main.go#L162 

Added line #L162 was not covered by tests
logEventAndExit(ctx, eventRecorder, pod, secretErrorReason, err)
}

Expand All @@ -182,13 +182,18 @@
if err != nil {
logEventAndExit(ctx, eventRecorder, pod, secretErrorReason, err)
}

globalConfigurationValidator := createGlobalConfigurationValidator()

mustProcessGlobalConfiguration(ctx)

cfgParams := configs.NewDefaultConfigParams(ctx, *nginxPlus)
cfgParams = processConfigMaps(kubeClient, cfgParams, nginxManager, templateExecutor, eventRecorder)

if err := processOtelTrustedCertSecret(kubeClient, nginxManager, cfgParams, controllerNamespace); err != nil {
logEventAndExit(ctx, eventRecorder, pod, secretErrorReason, err)
}

Check warning on line 195 in cmd/nginx-ingress/main.go

View check run for this annotation

Codecov / codecov/patch

cmd/nginx-ingress/main.go#L193-L195 

Added lines #L193 - L195 were not covered by tests

staticCfgParams := &configs.StaticConfigParams{
DisableIPV6: *disableIPV6,
DefaultHTTPListenerPort: *defaultHTTPListenerPort,
Expand Down Expand Up @@ -364,7 +369,7 @@
return nil
}

func processTrustedCertSecret(kubeClient *kubernetes.Clientset, nginxManager nginx.Manager, mgmtCfgParams *configs.MGMTConfigParams, controllerNamespace string) error {
func processMgmtTrustedCertSecret(kubeClient *kubernetes.Clientset, nginxManager nginx.Manager, mgmtCfgParams *configs.MGMTConfigParams, controllerNamespace string) error {

Check warning on line 372 in cmd/nginx-ingress/main.go

View check run for this annotation

Codecov / codecov/patch

cmd/nginx-ingress/main.go#L372 

Added line #L372 was not covered by tests
if mgmtCfgParams.Secrets.TrustedCert == "" {
return nil
}
Expand All @@ -385,6 +390,23 @@
return nil
}

func processOtelTrustedCertSecret(kubeClient *kubernetes.Clientset, nginxManager nginx.Manager, cfgParams *configs.ConfigParams, controllerNamespace string) error {
if cfgParams.MainOtelExporterTrustedCA == "" {
return nil
}

Check warning on line 396 in cmd/nginx-ingress/main.go

View check run for this annotation

Codecov / codecov/patch

cmd/nginx-ingress/main.go#L393-L396 

Added lines #L393 - L396 were not covered by tests

trustedCertSecretNsName := controllerNamespace + "/" + cfgParams.MainOtelExporterTrustedCA

secret, err := getAndValidateSecret(kubeClient, trustedCertSecretNsName, secrets.SecretTypeCA)
if err != nil {
return fmt.Errorf("error trying to get the trusted cert secret %v: %w", trustedCertSecretNsName, err)
}

Check warning on line 403 in cmd/nginx-ingress/main.go

View check run for this annotation

Codecov / codecov/patch

cmd/nginx-ingress/main.go#L398-L403 

Added lines #L398 - L403 were not covered by tests

caBytes, _ := configs.GenerateCAFileContent(secret)
nginxManager.CreateSecret(fmt.Sprintf("%s-%s-%s", controllerNamespace, cfgParams.MainOtelExporterTrustedCA, configs.CACrtKey), caBytes, nginx.ReadWriteOnlyFileMode)
return nil

Check warning on line 407 in cmd/nginx-ingress/main.go

View check run for this annotation

Codecov / codecov/patch

cmd/nginx-ingress/main.go#L405-L407 

Added lines #L405 - L407 were not covered by tests
}

func mustCreateConfigAndKubeClient(ctx context.Context) (*rest.Config, *kubernetes.Clientset) {
l := nl.LoggerFromContext(ctx)
var config *rest.Config
Expand Down
7 changes: 7 additions & 0 deletions internal/configs/config_params.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,13 @@ type ConfigParams struct {
MainLogFormat []string
MainLogFormatEscaping string
MainMainSnippets []string
MainOtelLoadModule bool
MainOtelGlobalTraceEnabled bool
MainOtelExporterEndpoint string
MainOtelExporterTrustedCA string
MainOtelExporterHeaderName string
MainOtelExporterHeaderValue string
MainOtelServiceName string
MainServerNamesHashBucketSize string
MainServerNamesHashMaxSize string
MainStreamLogFormat []string
Expand Down
108 changes: 108 additions & 0 deletions internal/configs/configmaps.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -530,6 +530,102 @@
}
}

if otelExporterEndpoint, exists := cfgm.Data["otel-exporter-endpoint"]; exists {
otelExporterEndpoint = strings.TrimSpace(otelExporterEndpoint)
if otelExporterEndpoint != "" {
cfgParams.MainOtelExporterEndpoint = otelExporterEndpoint
}

Check warning on line 537 in internal/configs/configmaps.go

View check run for this annotation

Codecov / codecov/patch

internal/configs/configmaps.go#L534-L537 

Added lines #L534 - L537 were not covered by tests
}

if otelExporterTrustedCA, exists := cfgm.Data["otel-exporter-trusted-ca"]; exists {
otelExporterTrustedCA = strings.TrimSpace(otelExporterTrustedCA)
if otelExporterTrustedCA != "" {
cfgParams.MainOtelExporterTrustedCA = otelExporterTrustedCA
}

Check warning on line 544 in internal/configs/configmaps.go

View check run for this annotation

Codecov / codecov/patch

internal/configs/configmaps.go#L541-L544 

Added lines #L541 - L544 were not covered by tests
}

if otelExporterHeaderName, exists := cfgm.Data["otel-exporter-header-name"]; exists {
otelExporterHeaderName = strings.TrimSpace(otelExporterHeaderName)
if otelExporterHeaderName != "" {
cfgParams.MainOtelExporterHeaderName = otelExporterHeaderName
}

Check warning on line 551 in internal/configs/configmaps.go

View check run for this annotation

Codecov / codecov/patch

internal/configs/configmaps.go#L548-L551 

Added lines #L548 - L551 were not covered by tests
}

if otelExporterHeaderValue, exists := cfgm.Data["otel-exporter-header-value"]; exists {
otelExporterHeaderValue = strings.TrimSpace(otelExporterHeaderValue)
if otelExporterHeaderValue != "" {
cfgParams.MainOtelExporterHeaderValue = otelExporterHeaderValue
}

Check warning on line 558 in internal/configs/configmaps.go

View check run for this annotation

Codecov / codecov/patch

internal/configs/configmaps.go#L555-L558 

Added lines #L555 - L558 were not covered by tests
}

if otelServiceName, exists := cfgm.Data["otel-service-name"]; exists {
otelServiceName = strings.TrimSpace(otelServiceName)
if otelServiceName != "" {
cfgParams.MainOtelServiceName = otelServiceName
}

Check warning on line 565 in internal/configs/configmaps.go

View check run for this annotation

Codecov / codecov/patch

internal/configs/configmaps.go#L562-L565 

Added lines #L562 - L565 were not covered by tests
}

if otelGlobalTraceEnabled, exists, err := GetMapKeyAsBool(cfgm.Data, "otel-global-trace-enabled", cfgm); exists {
if err != nil {
nl.Error(l, err)
eventLog.Event(cfgm, v1.EventTypeWarning, nl.EventReasonInvalidValue, err.Error())
configOk = false
}
cfgParams.MainOtelGlobalTraceEnabled = otelGlobalTraceEnabled

Check warning on line 574 in internal/configs/configmaps.go

View check run for this annotation

Codecov / codecov/patch

internal/configs/configmaps.go#L569-L574 

Added lines #L569 - L574 were not covered by tests
}

if cfgParams.MainOtelExporterEndpoint != "" {
cfgParams.MainOtelLoadModule = true
}

Check warning on line 579 in internal/configs/configmaps.go

View check run for this annotation

Codecov / codecov/patch

internal/configs/configmaps.go#L578-L579 

Added lines #L578 - L579 were not covered by tests

if otelExporterEndpoint, exists := cfgm.Data["otel-exporter-endpoint"]; exists {
otelExporterEndpoint = strings.TrimSpace(otelExporterEndpoint)
if otelExporterEndpoint != "" {
cfgParams.MainOtelExporterEndpoint = otelExporterEndpoint
}

Check warning on line 585 in internal/configs/configmaps.go

View check run for this annotation

Codecov / codecov/patch

internal/configs/configmaps.go#L582-L585 

Added lines #L582 - L585 were not covered by tests
}

if otelExporterTrustedCA, exists := cfgm.Data["otel-exporter-trusted-ca"]; exists {
otelExporterTrustedCA = strings.TrimSpace(otelExporterTrustedCA)
if otelExporterTrustedCA != "" {
cfgParams.MainOtelExporterTrustedCA = otelExporterTrustedCA
}

Check warning on line 592 in internal/configs/configmaps.go

View check run for this annotation

Codecov / codecov/patch

internal/configs/configmaps.go#L589-L592 

Added lines #L589 - L592 were not covered by tests
}

if otelExporterHeaderName, exists := cfgm.Data["otel-exporter-header-name"]; exists {
otelExporterHeaderName = strings.TrimSpace(otelExporterHeaderName)
if otelExporterHeaderName != "" {
cfgParams.MainOtelExporterHeaderName = otelExporterHeaderName
}

Check warning on line 599 in internal/configs/configmaps.go

View check run for this annotation

Codecov / codecov/patch

internal/configs/configmaps.go#L596-L599 

Added lines #L596 - L599 were not covered by tests
}

if otelExporterHeaderValue, exists := cfgm.Data["otel-exporter-header-value"]; exists {
otelExporterHeaderValue = strings.TrimSpace(otelExporterHeaderValue)
if otelExporterHeaderValue != "" {
cfgParams.MainOtelExporterHeaderValue = otelExporterHeaderValue
}

Check warning on line 606 in internal/configs/configmaps.go

View check run for this annotation

Codecov / codecov/patch

internal/configs/configmaps.go#L603-L606 

Added lines #L603 - L606 were not covered by tests
}

if otelServiceName, exists := cfgm.Data["otel-service-name"]; exists {
otelServiceName = strings.TrimSpace(otelServiceName)
if otelServiceName != "" {
cfgParams.MainOtelServiceName = otelServiceName
}

Check warning on line 613 in internal/configs/configmaps.go

View check run for this annotation

Codecov / codecov/patch

internal/configs/configmaps.go#L610-L613 

Added lines #L610 - L613 were not covered by tests
}

if otelGlobalTraceEnabled, exists, err := GetMapKeyAsBool(cfgm.Data, "otel-global-trace-enabled", cfgm); exists {
if err != nil {
nl.Error(l, err)
eventLog.Event(cfgm, v1.EventTypeWarning, nl.EventReasonInvalidValue, err.Error())
configOk = false
}
cfgParams.MainOtelGlobalTraceEnabled = otelGlobalTraceEnabled

Check warning on line 622 in internal/configs/configmaps.go

View check run for this annotation

Codecov / codecov/patch

internal/configs/configmaps.go#L617-L622 

Added lines #L617 - L622 were not covered by tests
}

if cfgParams.MainOtelExporterEndpoint != "" {
cfgParams.MainOtelLoadModule = true
}

Check warning on line 627 in internal/configs/configmaps.go

View check run for this annotation

Codecov / codecov/patch

internal/configs/configmaps.go#L626-L627 

Added lines #L626 - L627 were not covered by tests

if hasAppProtect {
if appProtectFailureModeAction, exists := cfgm.Data["app-protect-failure-mode-action"]; exists {
if appProtectFailureModeAction == "pass" || appProtectFailureModeAction == "drop" {
Expand Down Expand Up @@ -892,6 +988,11 @@
ResolverValid: config.ZoneSync.ResolverValid,
}

mainOtelExporterTrustedCA := ""
if config.MainOtelExporterTrustedCA != "" {
mainOtelExporterTrustedCA = fmt.Sprintf("%s-%s-%s", os.Getenv("POD_NAMESPACE"), config.MainOtelExporterTrustedCA, CACrtKey)
}

Check warning on line 994 in internal/configs/configmaps.go

View check run for this annotation

Codecov / codecov/patch

internal/configs/configmaps.go#L993-L994 

Added lines #L993 - L994 were not covered by tests

nginxCfg := &version1.MainConfig{
AccessLog: config.MainAccessLog,
DefaultServerAccessLogOff: config.DefaultServerAccessLogOff,
Expand All @@ -913,6 +1014,13 @@
NginxStatus: staticCfgParams.NginxStatus,
NginxStatusAllowCIDRs: staticCfgParams.NginxStatusAllowCIDRs,
NginxStatusPort: staticCfgParams.NginxStatusPort,
MainOtelLoadModule: config.MainOtelLoadModule,
MainOtelGlobalTraceEnabled: config.MainOtelGlobalTraceEnabled,
MainOtelExporterEndpoint: config.MainOtelExporterEndpoint,
MainOtelExporterTrustedCA: mainOtelExporterTrustedCA,
MainOtelExporterHeaderName: config.MainOtelExporterHeaderName,
MainOtelExporterHeaderValue: config.MainOtelExporterHeaderValue,
MainOtelServiceName: config.MainOtelServiceName,
ProxyProtocol: config.ProxyProtocol,
ResolverAddresses: config.ResolverAddresses,
ResolverIPV6: config.ResolverIPV6,
Expand Down
5 changes: 4 additions & 1 deletion internal/configs/configurator.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -826,8 +826,11 @@
// AddOrUpdateCASecret writes the secret content to disk returning the files added/updated
func (cnf *Configurator) AddOrUpdateCASecret(secret *api_v1.Secret, crtFileName, crlFileName string) string {
crtData, crlData := GenerateCAFileContent(secret)
crlFilePath := ""

Check warning on line 829 in internal/configs/configurator.go

View check run for this annotation

Codecov / codecov/patch

internal/configs/configurator.go#L829 

Added line #L829 was not covered by tests
crtFilePath := cnf.nginxManager.CreateSecret(crtFileName, crtData, nginx.ReadWriteOnlyFileMode)
crlFilePath := cnf.nginxManager.CreateSecret(crlFileName, crlData, nginx.ReadWriteOnlyFileMode)
if len(crlData) > 0 {
crlFilePath = cnf.nginxManager.CreateSecret(crlFileName, crlData, nginx.ReadWriteOnlyFileMode)
}

Check warning on line 833 in internal/configs/configurator.go

View check run for this annotation

Codecov / codecov/patch

internal/configs/configurator.go#L831-L833 

Added lines #L831 - L833 were not covered by tests
return fmt.Sprintf("%s %s", crtFilePath, crlFilePath)
}

Expand Down
7 changes: 7 additions & 0 deletions internal/configs/version1/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -240,6 +240,13 @@ type MainConfig struct {
NginxStatus bool
NginxStatusAllowCIDRs []string
NginxStatusPort int
MainOtelLoadModule bool
MainOtelGlobalTraceEnabled bool
MainOtelExporterEndpoint string
MainOtelExporterTrustedCA string
MainOtelExporterHeaderName string
MainOtelExporterHeaderValue string
MainOtelServiceName string
ProxyProtocol bool
ResolverAddresses []string
ResolverIPV6 bool
Expand Down
Loading
Loading