Ingest cluster receiver events into index defined in annotation

.chloggen/ingest_cluster_receiver_events_into_index_from_annotation.yaml

@@ -0,0 +1,12 @@
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: 'enhancement'
+# The name of the component, or a single word describing the area of concern, (e.g. agent, clusterReceiver, gateway, operator, chart, other)
+component: clusterReceiver
+# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: configure k8s attributes processor for cluster receiver to ingest events into index defined in namespace annotation
+# One or more tracking issues related to the change
+issues: [1481]
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:

docs/advanced-configuration.md

@@ -559,6 +559,7 @@ Manage Splunk OTel Collector Logging with these supported annotations.
 
 * Use `splunk.com/index` annotation on pod and/or namespace to tell which Splunk platform indexes to ingest to. Pod annotation will take precedence over namespace annotation when both are annotated.
   For example, the following command will make logs from `kube-system` namespace to be sent to `k8s_events` index: `kubectl annotate namespace kube-system splunk.com/index=k8s_events`
+  **Please Note:** Cluster receiver supports only namespace index annotations, pod index annotations are not supported.
 * Use `splunk.com/metricsIndex` annotation on pod and/or namespace to tell which Splunk platform metric indexes to ingest to. Pod annotation will take precedence over namespace annotation when both are annotated.
 * Filter logs using pod and/or namespace annotation
   * If `logsCollection.containers.useSplunkIncludeAnnotation` is `false` (default: false), set `splunk.com/exclude` annotation to `true` on pod and/or namespace to exclude its logs from ingested.

examples/collector-cluster-receiver-only/rendered_manifests/configmap-cluster-receiver.yaml

@@ -130,6 +130,7 @@ data:
           - resourcedetection
           - resource
           - transform/add_sourcetype
+          - k8sattributes/clusterReceiver
           receivers:
           - k8sobjects
         metrics:

examples/collector-cluster-receiver-only/rendered_manifests/deployment-cluster-receiver.yaml

@@ -31,7 +31,7 @@ spec:
         component: otel-k8s-cluster-receiver
         release: default
       annotations:
-        checksum/config: c9ed91daa196038bd9df714e679f9472c009405ca19d21f51f4d397b8e2066b4
+        checksum/config: 004d88a7822945a4e1314128a9ea760fb99c20fb8761d3884bab0646200cfe22
     spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:

helm-charts/splunk-otel-collector/templates/config/_common.tpl

@@ -211,6 +211,36 @@ k8sattributes:
       {{- include "splunk-otel-collector.addExtraLabels" . | nindent 6 }}
     {{- end }}
 {{- end }}
+{{- define "splunk-otel-collector.k8sClusterReceiverAttributesProcessor" -}}
+k8sattributes/clusterReceiver:
+  pod_association:
+    - sources:
+      - from: resource_attribute
+        name: k8s.namespace.name
+    - sources:
+      - from: resource_attribute
+        name: k8s.node.name
+  extract:
+    metadata:
+      - k8s.namespace.name
+      - k8s.node.name
+      - k8s.pod.name
+      - k8s.pod.uid
+      - container.id
+      - container.image.name
+      - container.image.tag
+    {{- if eq (include "splunk-otel-collector.splunkPlatformEnabled" .) "true"}}
+    annotations:
+      - key: splunk.com/sourcetype
+        from: pod
+      - key: splunk.com/index
+        tag_name: com.splunk.index
+        from: namespace
+      - key: splunk.com/index
+        tag_name: com.splunk.index
+        from: pod
+    {{- end}}
+{{- end }}
 
 {{/*
 Common config for K8s attributes processor adding k8s metadata to metrics resource attributes.

helm-charts/splunk-otel-collector/templates/config/_otel-k8s-cluster-receiver-config.tpl

@@ -117,6 +117,10 @@ processors:
           - set(resource.attributes["com.splunk.sourcetype"], Concat(["kube:object:", attributes["k8s.resource.name"]], ""))
   {{- end }}
 
+  {{- if and $clusterReceiver.eventsEnabled (eq (include "splunk-otel-collector.logsEnabled" .) "true") }}
+  {{- include "splunk-otel-collector.k8sClusterReceiverAttributesProcessor" . | nindent 2 }}
+  {{- end }}
+
   # Resource attributes specific to the collector itself.
   resource/add_collector_k8s:
     attributes:
@@ -290,6 +294,7 @@ service:
         {{- if .Values.environment }}
         - resource/add_environment
         {{- end }}
+        - k8sattributes/clusterReceiver
       exporters:
         {{- if (eq (include "splunk-otel-collector.o11yLogsEnabled" .) "true") }}
         - splunk_hec/o11y
@@ -312,6 +317,7 @@ service:
         {{- if .Values.environment }}
         - resource/add_environment
         {{- end }}
+        - k8sattributes/clusterReceiver
       exporters:
         {{- if (eq (include "splunk-otel-collector.o11yLogsEnabled" .) "true") }}
         - splunk_hec/o11y
@@ -333,6 +339,7 @@ service:
         {{- if .Values.clusterName }}
         - resource/add_event_k8s
         {{- end }}
+        - k8sattributes/clusterReceiver
       exporters:
         - signalfx
     {{- end }}