TRACING-5814 | RHOSDT 3.9 Document google managed prometheus #104286

pavolloffay · 2025-12-23T15:13:48Z

Version(s):

RHOSDT 3.9
OCP 4.12-4.21 (all supported OCP versions at the merge time)

Issue:

https://issues.redhat.com/browse/TRACING-5814

Link to docs preview:

QE review:

QE has approved this change.

Additional information:

OTELcol 0.142.0

https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/CHANGELOG.md#-breaking-changes-

receiver/prometheus: Promote the receiver.prometheusreceiver.RemoveStartTimeAdjustment feature gate to stable and remove in-receiver metric start time adjustment in favor of the metricstarttime processor, including disabling the created-metric feature gate. (#44180) Previously, users could disable the RemoveStartTimeAdjustment feature gate to temporarily keep the legacy start time adjustment behavior in the Prometheus receiver. With this promotion to stable and bounded registration, that gate can no longer be disabled; the receiver will no longer set StartTime on metrics based on process_start_time_seconds, and users should migrate to the metricstarttime processor for equivalent functionality. This change also disables the receiver.prometheusreceiver.UseCreatedMetric feature gate, which previously used the <metric>_created series to derive start timestamps for counters, summaries, and histograms when scraping non OpenMetrics protocols. However, this does not mean that the _created series is always ignored: when using the OpenMetrics 1.0 protocol, Prometheus itself continues to interpret the _created series as the start timestamp, so only the receiver-side handling for other scrape protocols has been removed.

Signed-off-by: Pavol Loffay <p.loffay@gmail.com>

openshift-ci · 2025-12-23T15:13:52Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

pavolloffay · 2025-12-23T15:13:58Z

/test all

ocpdocs-previewbot · 2025-12-23T15:21:30Z

🤖 Thu Jan 08 12:25:44 - Prow CI generated the docs preview:

https://104286--ocpdocs-pr.netlify.app/openshift-enterprise/latest/observability/otel/otel-collector/otel-collector-extensions.html
https://104286--ocpdocs-pr.netlify.app/openshift-enterprise/latest/observability/otel/otel-forwarding-telemetry-data.html

Signed-off-by: Pavol Loffay <p.loffay@gmail.com>

IshwarKanse · 2026-01-06T09:37:47Z

@pavolloffay Should we also document the authentication bits using GCP SA and WIF ?
https://github.com/openshift/distributed-tracing-qe/blob/main/tests/e2e-otel/googlemanagedprometheus/gcp-wif/otel-wif-collector.yaml
https://github.com/openshift/distributed-tracing-qe/blob/main/tests/e2e-otel/googlemanagedprometheus/gcp-sa/otel-sa-collector.yaml

pavolloffay · 2026-01-07T15:06:29Z

/test all

ocpdocs-vale-bot · 2026-01-07T15:14:57Z

modules/otel-forwarding-data-to-google-managed-prometheus.adoc

+          exporters: [otlphttp]
+# ...
+----
+<1> The `subtract_initial_point` strategy is stateful, requiring the Collector to run as a sidecar to maintain per-pod state. Alternative strategies available; choose the one that best fits your use case.


🤖 [error] AsciiDocDITA.CalloutList: Callouts are not supported in DITA.

ocpdocs-vale-bot · 2026-01-07T15:15:00Z

observability/otel/otel-forwarding-telemetry-data.adoc

🤖 [error] AsciiDocDITA.ShortDescription: Assign [role="_abstract"] to a paragraph to use it as in DITA.

pavolloffay · 2026-01-07T15:28:15Z

modules/otel-forwarding-data-to-google-managed-prometheus.adoc

+  mode: sidecar
+  config:
+    extensions:
+      googleclientauth: {}


@IshwarKanse the enxtension has a project parameter

project - The Google Cloud Project telemetry is sent to if the gcp.project.id resource attribute is not set. If unspecified, this is determined using application default credentials.

https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/extension/googleclientauthextension

If unspecified, this is determined using application default credentials.

what do they mean by this? In OCP context, can it be only specified in GOOGLE_APPLICATION_CREDENTIALS?

The Application Default Credentials (ADC) is Google's credential discovery mechanism that searches for credentials in this order:

GOOGLE_APPLICATION_CREDENTIALS environment variable (pointing to a credential JSON file)

Local ADC file at ~/.config/gcloud/application_default_credentials.json (created by gcloud auth application-default login)

GCP metadata server (for workloads running on Google Cloud infrastructure)

In the OpenShift/Kubernetes context, GOOGLE_APPLICATION_CREDENTIALS is the standard approach, even when running on Google Cloud, because:

It provides explicit control over which credentials the collector uses

It's portable across different environments (on-prem, AWS, Azure, GCP, etc.)

The local ADC file option (Added client tools install topics #2) is meant for local development, not production containers

While the metadata server (Initial build system #3) would work for OpenShift clusters running on GCP, explicitly mounting credentials is the Kubernetes best practice

The GOOGLE_APPLICATION_CREDENTIALS env var should point to one of these credential types:

Service Account Key JSON:
env:
- name: GOOGLE_APPLICATION_CREDENTIALS
value: "/etc/google-cloud-sa/sa-key.json"

Workload Identity Federation config JSON:
env:
- name: GOOGLE_APPLICATION_CREDENTIALS
value: "/etc/workload-identity/credential-configuration.json"

About the project parameter

When we set project in the extension config, it's actually optional because:

ADC will automatically extract the project ID from the credential file

It only serves as a fallback when the gcp.project.id resource attribute isn't set

In my referenced config in the previous comment, we are already setting gcp.project_id via the resource processor, so the extension's project parameter is somewhat redundant

For the documentation, I'd suggest making the project parameter optional and explaining that users can omit it if they're already setting the resource attribute or if they want ADC to auto-detect it from the credentials.

Signed-off-by: Pavol Loffay <p.loffay@gmail.com>

pavolloffay · 2026-01-07T16:04:19Z

/test all

ocpdocs-vale-bot · 2026-01-07T16:15:21Z

modules/otel-extensions-googleauth-extension.adoc

+# ...
+----
+
+<1> The Google Cloud Project telemetry is sent to if the `gcp.project.id` resource attribute is not set. If unspecified, this is determined using application default credentials.


🤖 [error] AsciiDocDITA.CalloutList: Callouts are not supported in DITA.

Signed-off-by: Pavol Loffay <p.loffay@gmail.com>

pavolloffay · 2026-01-08T12:18:19Z

/test all

ocpdocs-vale-bot · 2026-01-08T12:27:23Z

modules/otel-forwarding-data-to-google-managed-prometheus.adoc

+          exporters: [otlphttp]
+# ...
+----
+<1> The environment variable `GOOGLE_APPLICATION_CREDENTIALS` can be configured to use the traditional secret or use the workload identity federation (WIF). This specific example uses WIF.


🤖 [error] AsciiDocDITA.CalloutList: Callouts are not supported in DITA.

openshift-ci · 2026-01-08T12:27:33Z

@pavolloffay: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

TRACING-5814 | RHOSDT 3.9 Document google managed prometheus

35a1024

Signed-off-by: Pavol Loffay <p.loffay@gmail.com>

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 23, 2025

openshift-ci bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Dec 23, 2025

pavolloffay added 2 commits December 23, 2025 16:38

TRACING-5814 | RHOSDT 3.9 Document google managed prometheus

4f37f23

Signed-off-by: Pavol Loffay <p.loffay@gmail.com>

Google link

a08a279

Signed-off-by: Pavol Loffay <p.loffay@gmail.com>

ocpdocs-vale-bot reviewed Jan 7, 2026

View reviewed changes

pavolloffay commented Jan 7, 2026

View reviewed changes

Add google auth extension

da06f79

Signed-off-by: Pavol Loffay <p.loffay@gmail.com>

openshift-ci bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jan 7, 2026

ocpdocs-vale-bot reviewed Jan 7, 2026

View reviewed changes

pavolloffay added 3 commits January 8, 2026 13:08

Use WIF

c20634e

Signed-off-by: Pavol Loffay <p.loffay@gmail.com>

Use WIF

5c73d11

Signed-off-by: Pavol Loffay <p.loffay@gmail.com>

Use WIF

725d3af

Signed-off-by: Pavol Loffay <p.loffay@gmail.com>

ocpdocs-vale-bot reviewed Jan 8, 2026

View reviewed changes

TRACING-5814 | RHOSDT 3.9 Document google managed prometheus #104286

Are you sure you want to change the base?

TRACING-5814 | RHOSDT 3.9 Document google managed prometheus #104286

Uh oh!

Conversation

pavolloffay commented Dec 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci bot commented Dec 23, 2025

Uh oh!

pavolloffay commented Dec 23, 2025

Uh oh!

ocpdocs-previewbot commented Dec 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

IshwarKanse commented Jan 6, 2026

Uh oh!

pavolloffay commented Jan 7, 2026

Uh oh!

ocpdocs-vale-bot Jan 7, 2026

Choose a reason for hiding this comment

Uh oh!

ocpdocs-vale-bot Jan 7, 2026

Choose a reason for hiding this comment

Uh oh!

pavolloffay Jan 7, 2026

Choose a reason for hiding this comment

Uh oh!

IshwarKanse Jan 8, 2026

Choose a reason for hiding this comment

Uh oh!

pavolloffay commented Jan 7, 2026

Uh oh!

ocpdocs-vale-bot Jan 7, 2026

Choose a reason for hiding this comment

Uh oh!

pavolloffay commented Jan 8, 2026

Uh oh!

ocpdocs-vale-bot Jan 8, 2026

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Jan 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

pavolloffay commented Dec 23, 2025 •

edited

Loading

ocpdocs-previewbot commented Dec 23, 2025 •

edited

Loading