Skip to content

Apply namespace filter for OBI #1221

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jakub-racek-swi merged 6 commits into from
Dec 10, 2025
Merged

Apply namespace filter for OBI #1221

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
1e2095f
Apply namespace filter in OBI configmap
jakub-racek-swi Dec 3, 2025
805f649
exclude all when include is set
jakub-racek-swi Dec 4, 2025
cf770be
adding additional pipeline filter to support regexes
jakub-racek-swi Dec 4, 2025
2956cfd
Update configmap.yaml
jakub-racek-swi Dec 10, 2025
6335c93
Merge branch 'master' into obi-namespace-filter
jakub-racek-swi Dec 10, 2025
f659aee
Merge branch 'master' into obi-namespace-filter
jakub-racek-swi Dec 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions deploy/helm/gateway-collector-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,6 +128,14 @@ processors:
- 'type == METRIC_DATA_TYPE_HISTOGRAM'
{{- end }}

{{- if eq (include "isNamespacesFilterEnabled" .) "true" }}
filter/namespaces-relationships:
error_mode: ignore
metrics:
datapoint:
{{- include "namespacesFilterRelationships" . | nindent 8 }}
{{- end }}

transform/obi-keep-only-entity-relation-attributes:
metric_statements:
- keep_matching_keys(resource.attributes, "^(sw\\.k8s\\.cluster\\.uid)|(source\\..*)|(dest\\..*)|(obi)|(tcp)|(http)|(grpc)$")
Expand Down Expand Up @@ -726,6 +734,9 @@ service:
- transform/obi-relationship-types
- groupbyattrs/obi-relationship-types
- groupbyattrs/obi-entity-ids-after-transform
{{- if eq (include "isNamespacesFilterEnabled" .) "true" }}
- filter/namespaces-relationships
{{- end }}
- resource
exporters:
- forward/metrics_common
Expand Down
37 changes: 37 additions & 0 deletions deploy/helm/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -384,6 +384,43 @@ Usage:
{{- end -}}
{{- end -}}

{{/*
Returns namespace filters for relationship metrics (OBI and Istio)
Only filters when BOTH source AND destination should be filtered
It preserves relationships where at least one end is in a monitored namespace

Usage:
{{- include "namespacesFilterRelationships" . | nindent 8 }}
*/}}
{{- define "namespacesFilterRelationships" -}}
{{- range .Values.cluster.filter.exclude_namespaces }}
- resource.attributes["source.k8s.namespace.name"] == "{{ . }}" and resource.attributes["dest.k8s.namespace.name"] == "{{ . }}"
{{- end }}
{{- range .Values.cluster.filter.exclude_namespaces_regex }}
- IsMatch(resource.attributes["source.k8s.namespace.name"], "{{ . }}") and IsMatch(resource.attributes["dest.k8s.namespace.name"], "{{ . }}")
{{- end }}
# include namespaces have to be merged to one condition with ORs and ANDs
{{- if or (not (empty .Values.cluster.filter.include_namespaces)) (not (empty .Values.cluster.filter.include_namespaces_regex)) -}}
{{- $srcConditions := list }}
{{- $dstConditions := list }}
{{- range .Values.cluster.filter.include_namespaces }}
{{- $value := . }}
{{- $srcConditions = append $srcConditions (printf `resource.attributes["source.k8s.namespace.name"] == "%s"` $value) }}
{{- $dstConditions = append $dstConditions (printf `resource.attributes["dest.k8s.namespace.name"] == "%s"` $value) }}
{{- end }}
{{- range .Values.cluster.filter.include_namespaces_regex }}
{{- $value := . }}
{{- $srcConditions = append $srcConditions (printf `IsMatch(resource.attributes["source.k8s.namespace.name"], "%s")` $value) }}
{{- $dstConditions = append $dstConditions (printf `IsMatch(resource.attributes["dest.k8s.namespace.name"], "%s")` $value) }}
{{- end }}
{{- $srcConditions = append $srcConditions `resource.attributes["source.k8s.namespace.name"] == nil` }}
{{- $dstConditions = append $dstConditions `resource.attributes["dest.k8s.namespace.name"] == nil` }}
{{- $srcJoined := join " or " $srcConditions }}
{{- $dstJoined := join " or " $dstConditions }}
- not({{ $srcJoined }}) and not({{ $dstJoined }})
{{- end -}}
{{- end -}}

{{/*
Calculate max_staleness for cumulativetodelta processor
If max_staleness is explicitly set, use it. Otherwise, default to thrice the scrape_interval
Expand Down
14 changes: 14 additions & 0 deletions deploy/helm/templates/obi/configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,11 +32,25 @@ data:
{{- if not .Values.network_topology.config.discovery }}
discovery:
instrument:
{{- if (not (empty .Values.cluster.filter.include_namespaces))}}
{{- range .Values.cluster.filter.include_namespaces }}
- k8s_namespace: {{ quote . }}
{{- end }}
{{- else }}
- k8s_namespace: "*"
{{- end }}
exclude_instrument:
- exe_path: "{*otelcol*|*obi*}"
- k8s_pod_annotations:
sw.ebpf.instrumentation/exclude: "true"
{{- if (not (empty .Values.cluster.filter.include_namespaces))}}
- k8s_namespace: "*"
{{- end }}
{{- if or (not (empty .Values.cluster.filter.exclude_namespaces)) (not (empty .Values.cluster.filter.exclude_namespaces_regex)) }}
Copy link
Contributor

@pstranak-sw pstranak-sw Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't see exclude_namespaces_regex used, only checked in this condition.

Copy link
Contributor Author

@jakub-racek-swi jakub-racek-swi Dec 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I removed that check, it should behave as expected now.

{{- range .Values.cluster.filter.exclude_namespaces }}
- k8s_namespace: {{ quote . }}
{{- end }}
{{- end }}
Copy link
Contributor

@murad-sw murad-sw Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if we both include and exclude some namespaces, then we will see this:

- k8s_namespace: "*"
- k8s_namespace: XYZ

or maybe I'm missing something?

Copy link
Contributor Author

@jakub-racek-swi jakub-racek-swi Dec 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@murad-sw Having configured both include and exclude is undefined behavior, and we do not even allow it in wizard, so I'd say handling this case is unnecessary.

{{- end }}
{{- if not .Values.network_topology.config.log_level }}
log_level: info
Expand Down
Loading