Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

TT-13680 - feat: add option to get one OpenTelemetry header from a K8s secret #364

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

TT-13680 - feat: add option to get one OpenTelemetry header from a K8s secret #364

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions components/tyk-gateway/templates/deployment-gw-repset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -338,9 +338,18 @@ spec:
value: "{{ .Values.gateway.opentelemetry.exporter }}"
- name: TYK_GW_OPENTELEMETRY_ENDPOINT
value: "{{ .Values.gateway.opentelemetry.endpoint}}"
{{- if and .Values.gateway.opentelemetry.headers .Values.gateway.opentelemetry.headerSecret.name }}
{{- fail "You can't use '.Values.gateway.opentelemetry.headers' and '.Values.gateway.opentelemetry.headerSecret' at the same time!" }}
{{- end }}
{{- if .Values.gateway.opentelemetry.headers }}
- name: TYK_GW_OPENTELEMETRY_HEADERS
value: "{{ include "otel-headers" . }}"
{{- else if and .Values.gateway.opentelemetry.headerSecret.name .Values.gateway.opentelemetry.headerSecret.key }}
- name: TYK_GW_OPENTELEMETRY_HEADERS
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TYK_GW_OPENTELEMETRY_HEADERS environment variable needs to be declared as a comma-separated list of key-value pairs, where each pair is separated by a colon. For instance:

TYK_GW_OPENTELEMETRY_HEADERS: "header_key1:header_value1,header_key2:header_value2"

So, we need to construct the value of the environment variable in this key-value pair format.

valueFrom:
secretKeyRef:
name: {{ .Values.gateway.opentelemetry.headerSecret.name | quote }}
key: {{ .Values.gateway.opentelemetry.headerSecret.key | quote }}
{{- end }}
- name: TYK_GW_OPENTELEMETRY_CONNECTIONTIMEOUT
value: "{{ .Values.gateway.opentelemetry.connectionTimeout }}"
Expand Down
16 changes: 16 additions & 0 deletions components/tyk-gateway/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -514,6 +514,22 @@ gateway:
# A map of headers that will be sent with HTTP requests to the collector.
# It should be set to map of string to string
headers: {}
# A secret that supplies *one* header which is sent with HTTP requests to the collector. Useful for Authorization
# headers, which should not be exposed in the Helm values file.
# The key of the secret will be used as the header name, and the value will be used as the header value.
# Example:
#
# headerSecret:
# name: otel-auth-secret
# key: Authorization
#
# This example will be converted to the following header:
# Authorization: <value of the secret>
#
# Note that the headerSecret setting can't be used at the same time as the headers setting.
headerSecret:
name: otel-auth-secret
key: Authorization
Comment on lines +530 to +532
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's set headerSecret to a null object by default

Suggested change
headerSecret:
name: otel-auth-secret
key: Authorization
headerSecret: {}

This prevents any failures during chart upgrades. If headers is being in use, upgrading to the new chart where headerSecret is set by default, can trigger the fail call defined in the values.yaml file.

Additionally, the default value assumes that users already have a Kubernetes secret named otel-auth-secret containing an Authorization key, which may not be the case for everyone.

Please apply this change to all values.yaml files (in tyk-stack, tyk-oss etc)

# Timeout for establishing a connection to the collector
connectionTimeout: 1
# Name of the resource that will be used to identify the resource.
Expand Down
16 changes: 16 additions & 0 deletions tyk-control-plane/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -510,6 +510,22 @@ tyk-gateway:
# A map of headers that will be sent with HTTP requests to the collector.
# It should be set to map of string to string
headers: {}
# A secret that supplies *one* header which is sent with HTTP requests to the collector. Useful for Authorization
# headers, which should not be exposed in the Helm values file.
# The key of the secret will be used as the header name, and the value will be used as the header value.
# Example:
#
# headerSecret:
# name: otel-auth-secret
# key: Authorization
#
# This example will be converted to the following header:
# Authorization: <value of the secret>
#
# Note that the headerSecret setting can't be used at the same time as the headers setting.
headerSecret:
name: otel-auth-secret
key: Authorization
# Timeout for establishing a connection to the collector
connectionTimeout: 1
# Name of the resource that will be used to identify the resource.
Expand Down
16 changes: 16 additions & 0 deletions tyk-data-plane/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -488,6 +488,22 @@ tyk-gateway:
# A map of headers that will be sent with HTTP requests to the collector.
# It should be set to map of string to string
headers: {}
# A secret that supplies *one* header which is sent with HTTP requests to the collector. Useful for Authorization
# headers, which should not be exposed in the Helm values file.
# The key of the secret will be used as the header name, and the value will be used as the header value.
# Example:
#
# headerSecret:
# name: otel-auth-secret
# key: Authorization
#
# This example will be converted to the following header:
# Authorization: <value of the secret>
#
# Note that the headerSecret setting can't be used at the same time as the headers setting.
headerSecret:
name: otel-auth-secret
key: Authorization
# Timeout for establishing a connection to the collector
connectionTimeout: 1
# Name of the resource that will be used to identify the resource.
Expand Down
16 changes: 16 additions & 0 deletions tyk-oss/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -444,6 +444,22 @@ tyk-gateway:
# A map of headers that will be sent with HTTP requests to the collector.
# It should be set to map of string to string
headers: {}
# A secret that supplies *one* header which is sent with HTTP requests to the collector. Useful for Authorization
# headers, which should not be exposed in the Helm values file.
# The key of the secret will be used as the header name, and the value will be used as the header value.
# Example:
#
# headerSecret:
# name: otel-auth-secret
# key: Authorization
#
# This example will be converted to the following header:
# Authorization: <value of the secret>
#
# Note that the headerSecret setting can't be used at the same time as the headers setting.
headerSecret:
name: otel-auth-secret
key: Authorization
# Timeout for establishing a connection to the collector
connectionTimeout: 1
# Name of the resource that will be used to identify the resource.
Expand Down
16 changes: 16 additions & 0 deletions tyk-stack/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -537,6 +537,22 @@ tyk-gateway:
# A map of headers that will be sent with HTTP requests to the collector.
# It should be set to map of string to string
headers: {}
# A secret that supplies *one* header which is sent with HTTP requests to the collector. Useful for Authorization
# headers, which should not be exposed in the Helm values file.
# The key of the secret will be used as the header name, and the value will be used as the header value.
# Example:
#
# headerSecret:
# name: otel-auth-secret
# key: Authorization
#
# This example will be converted to the following header:
# Authorization: <value of the secret>
#
# Note that the headerSecret setting can't be used at the same time as the headers setting.
headerSecret:
name: otel-auth-secret
key: Authorization
# Timeout for establishing a connection to the collector
connectionTimeout: 1
# Name of the resource that will be used to identify the resource.
Expand Down