K8s resource collector

Overview

The k8s resource collector is an OpenTelemetry Collector component in the SUSE Observability Agent. It watches Kubernetes Custom Resource Definitions (CRDs), selected Custom Resource (CR) instances, and optional additional Kubernetes resources, then forwards topology logs to SUSE Observability.

CRDs are always collected. CR instances are filtered by API group so you can control ingest volume and avoid forwarding large or sensitive resource payloads.

Enable

Enable OTel with the k8s resource collector:

otel:
  enabled: true
  k8sResourceCollector:
    enabled: true

Include and exclude Custom Resource API groups

Configure CR collection with otel.k8sResourceCollector.crDiscovery.apiGroups:

otel:
  k8sResourceCollector:
    crDiscovery:
      discoveryMode: api_groups
      apiGroups:
        include:
          "policies.kubewarden.io": true
          "kubevirt.io": true
        exclude:
          "internal.example.com": true

By default, the chart does not collect every CR API group. Instead, the enabled integration presets add common SUSE-related API groups, such as Kubewarden, SUSE Runtime Enforcer, and SUSE Virtualization. Add more API groups explicitly when you want their CR instances collected.

To disable an integration-provided API group in an override file, set it to false:

otel:
  k8sResourceCollector:
    crDiscovery:
      apiGroups:
        include:
          "kubevirt.io": false

Set discoveryMode: all to collect CR instances for every CRD API group. In this mode, apiGroups filters are ignored.

The Kubernetes Custom Resources StackPack shows all collected CRDs. It marks whether CR instances for that CRD API group are collected. If CR instances are not collected, add the API group to crDiscovery.apiGroups.include and upgrade the agent.

Restricted RBAC

By default the collector uses wildcard read permissions for custom resources. For restricted RBAC, set rbac.useWildcard: false. The chart uses the truthy crDiscovery.apiGroups.include entries to render API-group RBAC rules:

otel:
  k8sResourceCollector:
    crDiscovery:
      discoveryMode: api_groups
      apiGroups:
        include:
          "policies.kubewarden.io": true
          "kubevirt.io": true
    rbac:
      useWildcard: false

Kubernetes RBAC only supports exact API groups or "". Wildcard filter patterns such as ".example.com" require rbac.useWildcard: true.

Payload budgets

The collector uses total payload budgets to limit how much CR and object data is forwarded per collection cycle. CRDs themselves are always forwarded and do not count against these budgets. CRs and configured Kubernetes objects are considered smallest-first, then by stable identity. Objects that do not fit are dropped for that cycle.

otel:
  k8sResourceCollector:
    dataLimits:
      maxCrTotalDataSizeBytes: 10485760       # 10 MiB
      maxObjectTotalDataSizeBytes: 10485760   # 10 MiB

Increasing these values can increase ingest volume and may forward larger or sensitive payloads. Dropped records are counted by receiver_k8sresource_payloads_dropped_total; payload sizes are recorded in receiver_k8sresource_payload_size_bytes, labelled by source (cr or object), API group, kind, and outcome.

Additional Kubernetes resources

Use objects to watch non-CRD resources alongside CRDs and CRs:

otel:
  k8sResourceCollector:
    objects:
      pods:
        group: ""
        namespaces: ["kube-system"]
      deployments:
        group: apps
        labelSelector: "app=foo"

Entries that overlap a CRD covered by crDiscovery.apiGroups are rejected at collector startup. With rbac.useWildcard: false, the chart derives resource-scoped RBAC for each objects entry automatically.

Operational monitoring

The collector exposes OpenTelemetry Collector self-metrics on :8888 and forwards those self-metrics to SUSE Observability. The Kubernetes Custom Resources StackPack includes monitors for:

  • No CRD/CR records emitted.

  • Oversized CR payloads dropped.

  • Informer reconcile failures.

See also