Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

First sidecar module: OpenTelemetry #8013

Merged
merged 11 commits into from
Jan 16, 2022
Merged

First sidecar module: OpenTelemetry #8013

merged 11 commits into from
Jan 16, 2022

Conversation

dmathieu
Copy link
Contributor

@dmathieu dmathieu commented Dec 6, 2021

What this PR does / why we need it:

This PR reuses the principles laid in #7593 to setup a sidecar module for OpenTelemetry, so the base image can be made much smaller, and only run core.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation only

How Has This Been Tested?

I manually built this image locally, and the helm changes have E2E tests.

Checklist:

  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.
  • I've read the CONTRIBUTION guide
  • I have added tests to cover my changes.
  • All new and existing tests passed.

@k8s-ci-robot k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. needs-kind Indicates a PR lacks a `kind/foo` label and requires one. labels Dec 6, 2021
@k8s-ci-robot
Copy link
Contributor

Hi @dmathieu. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot k8s-ci-robot added needs-priority size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Dec 6, 2021
@k8s-ci-robot k8s-ci-robot requested review from bowei and cpanato December 6, 2021 13:39
@k8s-ci-robot k8s-ci-robot added the area/helm Issues or PRs related to helm charts label Dec 6, 2021
@dmathieu dmathieu marked this pull request as ready for review December 6, 2021 13:40
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 6, 2021
@dmathieu
Copy link
Contributor Author

dmathieu commented Dec 6, 2021

/assign @rikatz

@rikatz
Copy link
Contributor

rikatz commented Dec 6, 2021

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Dec 6, 2021
@dmathieu
Copy link
Contributor Author

dmathieu commented Dec 7, 2021

If somebody wishes to try this locally, I've built and pushed the otel image to DockerHub. The following helm values will allow running:

controller:
  kind: DaemonSet
  image:
    repository: ingress-controller/controller
    tag: 1.0.0-dev
  service:
    type: ClusterIP
  extraModules:
    - name: opentelemetry
      image: dmathieu/nginx-otel

@strongjz
Copy link
Member

strongjz commented Dec 7, 2021

/kind feature
/priority longterm-important
/triage accepted

@k8s-ci-robot k8s-ci-robot added kind/feature Categorizes issue or PR as related to a new feature. triage/accepted Indicates an issue or PR is ready to be actively worked on. labels Dec 7, 2021
@k8s-ci-robot
Copy link
Contributor

@strongjz: The label(s) priority/longterm-important cannot be applied, because the repository doesn't have them.

In response to this:

/kind feature
/priority longterm-important
/triage accepted

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot k8s-ci-robot removed needs-kind Indicates a PR lacks a `kind/foo` label and requires one. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Dec 7, 2021
@iamNoah1
Copy link
Contributor

iamNoah1 commented Dec 7, 2021

/priority important-longterm

@k8s-ci-robot k8s-ci-robot added priority/important-longterm Important over the long term, but may not be staffed and/or may need multiple releases to complete. and removed needs-priority labels Dec 7, 2021
@rikatz rikatz added this to the v1.2.0 milestone Dec 23, 2021
@dmathieu dmathieu requested a review from rikatz January 5, 2022 11:06
@rikatz
Copy link
Contributor

rikatz commented Jan 16, 2022

/label tide/merge-method-squash
/lgtm
/approve
Thanks!

@k8s-ci-robot k8s-ci-robot added tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. lgtm "Looks good to me", indicates that a PR is ready to be merged. labels Jan 16, 2022
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dmathieu, rikatz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 16, 2022
@k8s-ci-robot k8s-ci-robot merged commit 15b0aba into kubernetes:main Jan 16, 2022
@dmathieu dmathieu deleted the otel-sidecar branch January 17, 2022 09:25
@cskinfill
Copy link
Contributor

now that this is merged, i was looking for documentation on how to use it. the existing docs at https://kubernetes.github.io/ingress-nginx/user-guide/third-party-addons/opentracing/ only reference opentracing.

@rcjsuen
Copy link

rcjsuen commented Jan 21, 2022

I think we then need #7621 based on #5883 (comment).

@dmathieu
Copy link
Contributor Author

Yeah, we need it. I'm planning to start porting that PR within the next few days.

@kuzaxak
Copy link

kuzaxak commented Jan 30, 2022

Hi, tested it with a sidecar module. Receiving an error:
"/modules_mount/etc/nginx/modules/modules/otel_ngx_module.so" failed (Error relocating /modules_mount/etc/nginx/modules/modules/otel_ngx_module.so: _ZN13opentelemetry5proto5trace2v14Span8CopyFromERKS3_: symbol not found)

Looks like some dependency wasn't added to the package.

Full output of ldd:

cp /modules_mount/etc/nginx/modules/modules/otel_ngx_module.so /etc/nginx/modules/otel_ngx_module.so

ldd /etc/nginx/modules/otel_ngx_module.so
        /lib/ld-musl-x86_64.so.1 (0x7fcabcfd6000)
        /usr/local/lib/libmimalloc.so => /usr/local/lib/libmimalloc.so (0x7fcabcf0d000)
        libstdc++.so.6 => /usr/lib/libstdc++.so.6 (0x7fcabcd6c000)
        libgcc_s.so.1 => /usr/lib/libgcc_s.so.1 (0x7fcabcd52000)
        libc.musl-x86_64.so.1 => /lib/ld-musl-x86_64.so.1 (0x7fcabcfd6000)
Error relocating /etc/nginx/modules/otel_ngx_module.so: ngx_array_create: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN13opentelemetry5proto5trace2v14Span8CopyFromERKS3_: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN13opentelemetry5proto8resource2v18Resource8CopyFromERKS3_: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN13opentelemetry5proto8resource2v18ResourceC1EPN6google8protobuf5ArenaE: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN6google8protobuf5Arena18CreateMaybeMessageIN13opentelemetry5proto5trace2v113ResourceSpansEJEEEPT_PS1_DpOT0_: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: ngx_http_get_indexed_variable: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN13opentelemetry5proto8resource2v18Resource12InternalSwapEPS3_: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN13opentelemetry5proto5trace2v14SpanD1Ev: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN4grpc13CreateChannelERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEERKSt10shared_ptrINS_18ChannelCredentialsEE: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: pcre_exec: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN6google8protobuf5Arena18CreateMaybeMessageIN13opentelemetry5proto6common2v18AnyValueEJEEEPT_PS1_DpOT0_: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: ngx_http_script_run: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: ngx_http_add_variable: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN13opentelemetry5proto6common2v18AnyValue11clear_valueEv: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN13opentelemetry5proto5trace2v14SpanC1EPN6google8protobuf5ArenaE: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN6google8protobuf5Arena18CreateMaybeMessageIN13opentelemetry5proto5trace2v16StatusEJEEEPT_PS1_DpOT0_: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN13opentelemetry5proto9collector5trace2v126ExportTraceServiceResponseC1EPN6google8protobuf5ArenaE: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN6google8protobuf8internal20RepeatedPtrFieldBase7ReserveEi: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN13opentelemetry5proto8resource2v18ResourceD1Ev: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN6google8protobuf5Arena18CreateMaybeMessageIN13opentelemetry5proto5trace2v19Span_LinkEJEEEPT_PS1_DpOT0_: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN13opentelemetry5proto6common2v122InstrumentationLibraryD1Ev: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN4grpc26InsecureChannelCredentialsEv: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: ngx_http_get_variable_index: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN13opentelemetry5proto9collector5trace2v125ExportTraceServiceRequestC1EPN6google8protobuf5ArenaE: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN13opentelemetry5proto6common2v122InstrumentationLibrary12InternalSwapEPS3_: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: ngx_http_script_compile: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN13opentelemetry5proto9collector5trace2v126ExportTraceServiceResponseD1Ev: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: ngx_palloc: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN6google8protobuf5Arena18CreateMaybeMessageIN13opentelemetry5proto5trace2v127InstrumentationLibrarySpansEJEEEPT_PS1_DpOT0_: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN6google8protobuf5Arena18CreateMaybeMessageIN13opentelemetry5proto5trace2v110Span_EventEJEEEPT_PS1_DpOT0_: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN6google8protobuf5Arena18CreateMaybeMessageIN13opentelemetry5proto6common2v110ArrayValueEJEEEPT_PS1_DpOT0_: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN6google8protobuf5Arena18CreateMaybeMessageIN13opentelemetry5proto6common2v18KeyValueEJEEEPT_PS1_DpOT0_: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN6google8protobuf5Arena18CreateMaybeMessageIN13opentelemetry5proto6common2v122InstrumentationLibraryEJEEEPT_PS1_DpOT0_: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN13opentelemetry2v13sdk6common6Random20GenerateRandomBufferENS0_5nostd4spanIhLm18446744073709551615EEE: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: ngx_pool_cleanup_add: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: ngx_array_push: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: ngx_pcalloc: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: ngx_atoi: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN13opentelemetry5proto6common2v122InstrumentationLibraryC1EPN6google8protobuf5ArenaE: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: ngx_log_error_core: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN4grpc13ClientContextC1Ev: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: ngx_http_script_variables_count: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN6google8protobuf8internal14ArenaStringPtr3SetENS2_12EmptyDefaultERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEPNS0_5ArenaE: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN6google8protobuf8internal14ArenaStringPtr3SetENS2_12EmptyDefaultEONSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEPNS0_5ArenaE: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: ngx_strncasecmp: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN13opentelemetry5proto9collector5trace2v112TraceService7NewStubERKSt10shared_ptrIN4grpc16ChannelInterfaceEERKNS6_11StubOptionsE: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN6google8protobuf5Arena18CreateMaybeMessageIN13opentelemetry5proto5trace2v14SpanEJEEEPT_PS1_DpOT0_: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: ngx_regex_compile: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN13opentelemetry5proto6common2v122InstrumentationLibrary8CopyFromERKS3_: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN4grpc14SslCredentialsERKNS_21SslCredentialsOptionsE: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: ngx_conf_log_error: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN6google8protobuf5Arena18CreateMaybeMessageIN13opentelemetry5proto8resource2v18ResourceEJEEEPT_PS1_DpOT0_: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN13opentelemetry5proto9collector5trace2v125ExportTraceServiceRequestD1Ev: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN4grpc13ClientContextD1Ev: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: ngx_http_module: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: ngx_http_core_module: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: _ZN6google8protobuf8internal26fixed_address_empty_stringB5cxx11E: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: ngx_conf_set_flag_slot: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: ngx_conf_set_flag_slot: symbol not found
Error relocating /etc/nginx/modules/otel_ngx_module.so: ngx_conf_set_flag_slot: symbol not found

@tao12345666333 tao12345666333 mentioned this pull request Feb 27, 2022
strongjz added a commit that referenced this pull request Mar 1, 2022
Images dir was merged in before the test-infra prow job, so the image was never built. 

#8013 Jan 16

https://github.com/kubernetes/test-infra/pull/25344/files Prow job 4 days ago.
k8s-ci-robot pushed a commit that referenced this pull request Mar 1, 2022
Images dir was merged in before the test-infra prow job, so the image was never built. 

#8013 Jan 16

https://github.com/kubernetes/test-infra/pull/25344/files Prow job 4 days ago.
kundan2707 added a commit to kundan2707/ingress-nginx that referenced this pull request Mar 17, 2022
remove 0.46.0 from supported versions table (kubernetes#8258)

Minor fix for missing pathType property (kubernetes#8244)

Updated confusing error (kubernetes#8262)

Add a certificate info metric (kubernetes#8253)

When the ingress controller loads certificates  (new ones or following a
secret update), it performs a series of check to ensure its validity.

In our systems, we detected a case where, when the secret object is
compromised, for example when the certificate does not match the secret
key, different pods of the ingress controller are serving a different
version of the certificate.

This behaviour is due to the cache mechanism of the ingress controller,
keeping the last known certificate in case of corruption. When this
happens, old ingress-controller pods will keep serving the old one,
while new pods, by failing to load the corrupted certificates, would
use the default certificate, causing invalid certificates for its
clients.

This generates a random error on the client side, depending on the
actual pod instance it reaches.

In order to allow detecting occurences of those situations, add a metric
to expose, for all ingress controlller pods, detailed informations of
the currently loaded certificate.

This will, for example, allow setting an alert when there is a
certificate discrepency across all ingress controller pods using a query
similar to `sum(nginx_ingress_controller_ssl_certificate_info{host="name.tld"})by(serial_number)`

This also allows to catch other exceptions loading certificates (failing
to load the certificate from the k8s API, ...

Co-authored-by: Daniel Ricart <danielricart@users.noreply.github.com>

Co-authored-by: Daniel Ricart <danielricart@users.noreply.github.com>

Issue#8241 (kubernetes#8273)

* replace daemon set for deployment manifest

* nit

Start Release process for v1.1.2 (kubernetes#8275)

Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>

Add fsGroup value to admission-webhooks/job-patch charts (kubernetes#8267)

* added fsGroup to admission createSecret and patchWebhook job

* added fsGroup to admission createSecret and patchWebhook job

* modified helm/README.md to add value for fsGroup

* fixed patch job values ordering

* remove manually edited README for replacement with helm-docs generated version

* re-adding charts/README.md generated by helm-docs

Add OpenSSF Best practices badge (kubernetes#8277)

fix: deny locations with invalid auth-url annotation (kubernetes#8256)

* fix: deny locations with invalid auth-url annotation

Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

* Delete duplicate test

Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

force prow job by changing something in images/ot dir (kubernetes#8281)

Images dir was merged in before the test-infra prow job, so the image was never built.

kubernetes#8013 Jan 16

https://github.com/kubernetes/test-infra/pull/25344/files Prow job 4 days ago.

Fix OpenTelemetry sidecar image build (kubernetes#8286)

* fix wrong checksum for nginx image

* fix wrong platform. Arm64 has grpc, when arm doesn't

update tag for image (kubernetes#8290)

remove git tag env from cloud build

the latest git tag is from helm, so force the make file use of TAG ?=v$(shell date +%m%d%Y)-$(shell git rev-parse --short HEAD)

release-v1.1.2-continued (kubernetes#8294)

* v1.1.2 release

Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>

* release-v1.1.2-continued

Co-authored-by: Jintao Zhang <zhangjintao9020@gmail.com>

docs: fix changelog formatting (kubernetes#8302)

leaving it the git tag (kubernetes#8311)

fixing the git tag for the image version, it is what it is .

Missing annotations (kubernetes#8288)

Not quite sure but It seems that `nginx.ingress.kubernetes.io/canary-by-header` is missing.

Names cannot contain _ (underscore)! So I changed it to -. (kubernetes#8300)

* The name can't use _(underscore)! So fix it!

The name can't use _(underscore)! So fix it!

* Fix configMap name can't use _(underscore)

Fix configMap name can't use _(underscore)

Pinned GitHub workflows by SHA (kubernetes#8334)

- Pinned actions by SHA https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies
- Included permissions for some of the actions. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions

Dependabot can upgrade pinned version of actions.

Update monitoring.md (kubernetes#8324)

Added missing repo on "helm upgrade" command

Add the shareProcessNamespace as a configurable setting. (kubernetes#8287)

Nginx v1.19.10 (kubernetes#8307)

kubectl code overview info
rchshld pushed a commit to joomcode/ingress-nginx that referenced this pull request May 19, 2023
* remove opentelemetry from main nginx image

* add opentelemetry sidecar image

* handle extra modules in helm chart

* fix running helm chart

* mount the modules volume in the init container

* merge the mounted folder

* fix the otel image

* fix licence year

* fix cloudbuild image

* use the same nginx version as in the main image

* only retrieve /etc/nginx/modules for now
rchshld pushed a commit to joomcode/ingress-nginx that referenced this pull request May 19, 2023
Images dir was merged in before the test-infra prow job, so the image was never built. 

kubernetes#8013 Jan 16

https://github.com/kubernetes/test-infra/pull/25344/files Prow job 4 days ago.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/helm Issues or PRs related to helm charts cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. priority/important-longterm Important over the long term, but may not be staffed and/or may need multiple releases to complete. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. triage/accepted Indicates an issue or PR is ready to be actively worked on.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

8 participants