Ingest cluster receiver events into index defined in annotation

.chloggen/ingest_cluster_receiver_events_into_index_from_annotation.yaml

@@ -0,0 +1,12 @@
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: 'enhancement'
+# The name of the component, or a single word describing the area of concern, (e.g. agent, clusterReceiver, gateway, operator, chart, other)
+component: clusterReceiver
+# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: configure k8s attributes processor for cluster receiver to ingest events into index defined in namespace annotation
+# One or more tracking issues related to the change
+issues: [1481]
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:

docs/advanced-configuration.md

@@ -559,6 +559,7 @@ Manage Splunk OTel Collector Logging with these supported annotations.
 
 * Use `splunk.com/index` annotation on pod and/or namespace to tell which Splunk platform indexes to ingest to. Pod annotation will take precedence over namespace annotation when both are annotated.
   For example, the following command will make logs from `kube-system` namespace to be sent to `k8s_events` index: `kubectl annotate namespace kube-system splunk.com/index=k8s_events`
+  **Please Note:** Cluster receiver supports only namespace index annotations, pod index annotations are not supported.
 * Use `splunk.com/metricsIndex` annotation on pod and/or namespace to tell which Splunk platform metric indexes to ingest to. Pod annotation will take precedence over namespace annotation when both are annotated.
 * Filter logs using pod and/or namespace annotation
   * If `logsCollection.containers.useSplunkIncludeAnnotation` is `false` (default: false), set `splunk.com/exclude` annotation to `true` on pod and/or namespace to exclude its logs from ingested.

examples/add-filter-processor/rendered_manifests/configmap-cluster-receiver.yaml

@@ -30,6 +30,32 @@ data:
     processors:
       batch:
         send_batch_max_size: 32768
+      k8sattributes/clusterReceiver:
+        extract:
+          annotations:
+          - from: pod
+            key: splunk.com/sourcetype
+          - from: namespace
+            key: splunk.com/index
+            tag_name: com.splunk.index
+          - from: pod
+            key: splunk.com/index
+            tag_name: com.splunk.index
+          metadata:
+          - k8s.namespace.name
+          - k8s.node.name
+          - k8s.pod.name
+          - k8s.pod.uid
+          - container.id
+          - container.image.name
+          - container.image.tag
+        pod_association:
+        - sources:
+          - from: resource_attribute
+            name: k8s.namespace.name
+        - sources:
+          - from: resource_attribute
+            name: k8s.node.name
       memory_limiter:
         check_interval: 2s
         limit_mib: ${SPLUNK_MEMORY_LIMIT_MIB}

examples/add-filter-processor/rendered_manifests/deployment-cluster-receiver.yaml

@@ -31,7 +31,7 @@ spec:
         component: otel-k8s-cluster-receiver
         release: default
       annotations:
-        checksum/config: 9ff6ceca7dd6b274cbbd8ae34c19e7233b545980b243434eb8f9b4561391764b
+        checksum/config: d0c7b4e3295c0315ba555b5cfb41ccaa758673a24e78c60a5736d73446364aa4
     spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:

examples/add-kafkametrics-receiver/rendered_manifests/configmap-cluster-receiver.yaml

@@ -30,6 +30,32 @@ data:
     processors:
       batch:
         send_batch_max_size: 32768
+      k8sattributes/clusterReceiver:
+        extract:
+          annotations:
+          - from: pod
+            key: splunk.com/sourcetype
+          - from: namespace
+            key: splunk.com/index
+            tag_name: com.splunk.index
+          - from: pod
+            key: splunk.com/index
+            tag_name: com.splunk.index
+          metadata:
+          - k8s.namespace.name
+          - k8s.node.name
+          - k8s.pod.name
+          - k8s.pod.uid
+          - container.id
+          - container.image.name
+          - container.image.tag
+        pod_association:
+        - sources:
+          - from: resource_attribute
+            name: k8s.namespace.name
+        - sources:
+          - from: resource_attribute
+            name: k8s.node.name
       memory_limiter:
         check_interval: 2s
         limit_mib: ${SPLUNK_MEMORY_LIMIT_MIB}

examples/add-kafkametrics-receiver/rendered_manifests/deployment-cluster-receiver.yaml

@@ -31,7 +31,7 @@ spec:
         component: otel-k8s-cluster-receiver
         release: default
       annotations:
-        checksum/config: 9ff6ceca7dd6b274cbbd8ae34c19e7233b545980b243434eb8f9b4561391764b
+        checksum/config: d0c7b4e3295c0315ba555b5cfb41ccaa758673a24e78c60a5736d73446364aa4
     spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:

examples/add-receiver-creator/rendered_manifests/configmap-cluster-receiver.yaml

@@ -30,6 +30,32 @@ data:
     processors:
       batch:
         send_batch_max_size: 32768
+      k8sattributes/clusterReceiver:
+        extract:
+          annotations:
+          - from: pod
+            key: splunk.com/sourcetype
+          - from: namespace
+            key: splunk.com/index
+            tag_name: com.splunk.index
+          - from: pod
+            key: splunk.com/index
+            tag_name: com.splunk.index
+          metadata:
+          - k8s.namespace.name
+          - k8s.node.name
+          - k8s.pod.name
+          - k8s.pod.uid
+          - container.id
+          - container.image.name
+          - container.image.tag
+        pod_association:
+        - sources:
+          - from: resource_attribute
+            name: k8s.namespace.name
+        - sources:
+          - from: resource_attribute
+            name: k8s.node.name
       memory_limiter:
         check_interval: 2s
         limit_mib: ${SPLUNK_MEMORY_LIMIT_MIB}

examples/add-receiver-creator/rendered_manifests/deployment-cluster-receiver.yaml

@@ -31,7 +31,7 @@ spec:
         component: otel-k8s-cluster-receiver
         release: default
       annotations:
-        checksum/config: 9ff6ceca7dd6b274cbbd8ae34c19e7233b545980b243434eb8f9b4561391764b
+        checksum/config: d0c7b4e3295c0315ba555b5cfb41ccaa758673a24e78c60a5736d73446364aa4
     spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:

examples/add-sampler/rendered_manifests/configmap-cluster-receiver.yaml

@@ -30,6 +30,32 @@ data:
     processors:
       batch:
         send_batch_max_size: 32768
+      k8sattributes/clusterReceiver:
+        extract:
+          annotations:
+          - from: pod
+            key: splunk.com/sourcetype
+          - from: namespace
+            key: splunk.com/index
+            tag_name: com.splunk.index
+          - from: pod
+            key: splunk.com/index
+            tag_name: com.splunk.index
+          metadata:
+          - k8s.namespace.name
+          - k8s.node.name
+          - k8s.pod.name
+          - k8s.pod.uid
+          - container.id
+          - container.image.name
+          - container.image.tag
+        pod_association:
+        - sources:
+          - from: resource_attribute
+            name: k8s.namespace.name
+        - sources:
+          - from: resource_attribute
+            name: k8s.node.name
       memory_limiter:
         check_interval: 2s
         limit_mib: ${SPLUNK_MEMORY_LIMIT_MIB}

examples/add-sampler/rendered_manifests/deployment-cluster-receiver.yaml

@@ -31,7 +31,7 @@ spec:
         component: otel-k8s-cluster-receiver
         release: default
       annotations:
-        checksum/config: 9ff6ceca7dd6b274cbbd8ae34c19e7233b545980b243434eb8f9b4561391764b
+        checksum/config: d0c7b4e3295c0315ba555b5cfb41ccaa758673a24e78c60a5736d73446364aa4
     spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:

examples/autodetect-istio/rendered_manifests/configmap-cluster-receiver.yaml

@@ -30,6 +30,32 @@ data:
     processors:
       batch:
         send_batch_max_size: 32768
+      k8sattributes/clusterReceiver:
+        extract:
+          annotations:
+          - from: pod
+            key: splunk.com/sourcetype
+          - from: namespace
+            key: splunk.com/index
+            tag_name: com.splunk.index
+          - from: pod
+            key: splunk.com/index
+            tag_name: com.splunk.index
+          metadata:
+          - k8s.namespace.name
+          - k8s.node.name
+          - k8s.pod.name
+          - k8s.pod.uid
+          - container.id
+          - container.image.name
+          - container.image.tag
+        pod_association:
+        - sources:
+          - from: resource_attribute
+            name: k8s.namespace.name
+        - sources:
+          - from: resource_attribute
+            name: k8s.node.name
       memory_limiter:
         check_interval: 2s
         limit_mib: ${SPLUNK_MEMORY_LIMIT_MIB}

examples/autodetect-istio/rendered_manifests/deployment-cluster-receiver.yaml

@@ -31,7 +31,7 @@ spec:
         component: otel-k8s-cluster-receiver
         release: default
       annotations:
-        checksum/config: 9ff6ceca7dd6b274cbbd8ae34c19e7233b545980b243434eb8f9b4561391764b
+        checksum/config: d0c7b4e3295c0315ba555b5cfb41ccaa758673a24e78c60a5736d73446364aa4
         sidecar.istio.io/inject: "false"
     spec:
       serviceAccountName: default-splunk-otel-collector

examples/collector-all-modes/rendered_manifests/configmap-cluster-receiver.yaml

@@ -30,6 +30,32 @@ data:
     processors:
       batch:
         send_batch_max_size: 32768
+      k8sattributes/clusterReceiver:
+        extract:
+          annotations:
+          - from: pod
+            key: splunk.com/sourcetype
+          - from: namespace
+            key: splunk.com/index
+            tag_name: com.splunk.index
+          - from: pod
+            key: splunk.com/index
+            tag_name: com.splunk.index
+          metadata:
+          - k8s.namespace.name
+          - k8s.node.name
+          - k8s.pod.name
+          - k8s.pod.uid
+          - container.id
+          - container.image.name
+          - container.image.tag
+        pod_association:
+        - sources:
+          - from: resource_attribute
+            name: k8s.namespace.name
+        - sources:
+          - from: resource_attribute
+            name: k8s.node.name
       memory_limiter:
         check_interval: 2s
         limit_mib: ${SPLUNK_MEMORY_LIMIT_MIB}

examples/collector-all-modes/rendered_manifests/deployment-cluster-receiver.yaml

@@ -31,7 +31,7 @@ spec:
         component: otel-k8s-cluster-receiver
         release: default
       annotations:
-        checksum/config: 9ff6ceca7dd6b274cbbd8ae34c19e7233b545980b243434eb8f9b4561391764b
+        checksum/config: d0c7b4e3295c0315ba555b5cfb41ccaa758673a24e78c60a5736d73446364aa4
     spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:

examples/collector-cluster-receiver-only/rendered_manifests/configmap-cluster-receiver.yaml

@@ -36,6 +36,32 @@ data:
     processors:
       batch:
         send_batch_max_size: 32768
+      k8sattributes/clusterReceiver:
+        extract:
+          annotations:
+          - from: pod
+            key: splunk.com/sourcetype
+          - from: namespace
+            key: splunk.com/index
+            tag_name: com.splunk.index
+          - from: pod
+            key: splunk.com/index
+            tag_name: com.splunk.index
+          metadata:
+          - k8s.namespace.name
+          - k8s.node.name
+          - k8s.pod.name
+          - k8s.pod.uid
+          - container.id
+          - container.image.name
+          - container.image.tag
+        pod_association:
+        - sources:
+          - from: resource_attribute
+            name: k8s.namespace.name
+        - sources:
+          - from: resource_attribute
+            name: k8s.node.name
       memory_limiter:
         check_interval: 2s
         limit_mib: ${SPLUNK_MEMORY_LIMIT_MIB}
@@ -130,6 +156,7 @@ data:
           - resourcedetection
           - resource
           - transform/add_sourcetype
+          - k8sattributes/clusterReceiver
           receivers:
           - k8sobjects
         metrics:

examples/collector-cluster-receiver-only/rendered_manifests/deployment-cluster-receiver.yaml

@@ -31,7 +31,7 @@ spec:
         component: otel-k8s-cluster-receiver
         release: default
       annotations:
-        checksum/config: 151dfd43f36e80a6d89c8a4b75a0e1567600d9b6d73ef2767c9e94bf7bfbc324
+        checksum/config: 76714f5932f6a193d83b672693f56a3abe4c5d36c5d57a7f8202313eeb7cf94b
     spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:

examples/controlplane-histogram-metrics/rendered_manifests/configmap-cluster-receiver.yaml

@@ -30,6 +30,32 @@ data:
     processors:
       batch:
         send_batch_max_size: 32768
+      k8sattributes/clusterReceiver:
+        extract:
+          annotations:
+          - from: pod
+            key: splunk.com/sourcetype
+          - from: namespace
+            key: splunk.com/index
+            tag_name: com.splunk.index
+          - from: pod
+            key: splunk.com/index
+            tag_name: com.splunk.index
+          metadata:
+          - k8s.namespace.name
+          - k8s.node.name
+          - k8s.pod.name
+          - k8s.pod.uid
+          - container.id
+          - container.image.name
+          - container.image.tag
+        pod_association:
+        - sources:
+          - from: resource_attribute
+            name: k8s.namespace.name
+        - sources:
+          - from: resource_attribute
+            name: k8s.node.name
       memory_limiter:
         check_interval: 2s
         limit_mib: ${SPLUNK_MEMORY_LIMIT_MIB}

examples/controlplane-histogram-metrics/rendered_manifests/deployment-cluster-receiver.yaml

@@ -31,7 +31,7 @@ spec:
         component: otel-k8s-cluster-receiver
         release: default
       annotations:
-        checksum/config: 9ff6ceca7dd6b274cbbd8ae34c19e7233b545980b243434eb8f9b4561391764b
+        checksum/config: d0c7b4e3295c0315ba555b5cfb41ccaa758673a24e78c60a5736d73446364aa4
     spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:

examples/crio-logging/rendered_manifests/configmap-cluster-receiver.yaml

@@ -30,6 +30,32 @@ data:
     processors:
       batch:
         send_batch_max_size: 32768
+      k8sattributes/clusterReceiver:
+        extract:
+          annotations:
+          - from: pod
+            key: splunk.com/sourcetype
+          - from: namespace
+            key: splunk.com/index
+            tag_name: com.splunk.index
+          - from: pod
+            key: splunk.com/index
+            tag_name: com.splunk.index
+          metadata:
+          - k8s.namespace.name
+          - k8s.node.name
+          - k8s.pod.name
+          - k8s.pod.uid
+          - container.id
+          - container.image.name
+          - container.image.tag
+        pod_association:
+        - sources:
+          - from: resource_attribute
+            name: k8s.namespace.name
+        - sources:
+          - from: resource_attribute
+            name: k8s.node.name
       memory_limiter:
         check_interval: 2s
         limit_mib: ${SPLUNK_MEMORY_LIMIT_MIB}