Ingest cluster receiver events into index defined in annotation (#1481)

* k8s attributes procesor for cluster receiver to ingest events into index from annotation

* update to the version from main

* pre-commit

* pre-commit

* changes after review - if statement to import k8sAttributesProcessor all logs pipelines

* pre-commit + make reder

.chloggen/ingest_cluster_receiver_events_into_index_from_annotation.yaml

@@ -0,0 +1,12 @@
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: 'enhancement'
+# The name of the component, or a single word describing the area of concern, (e.g. agent, clusterReceiver, gateway, operator, chart, other)
+component: clusterReceiver
+# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: configure k8s attributes processor for cluster receiver to ingest events into index defined in namespace annotation
+# One or more tracking issues related to the change
+issues: [1481]
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:

docs/advanced-configuration.md

@@ -559,6 +559,7 @@ Manage Splunk OTel Collector Logging with these supported annotations.
 
 * Use `splunk.com/index` annotation on pod and/or namespace to tell which Splunk platform indexes to ingest to. Pod annotation will take precedence over namespace annotation when both are annotated.
   For example, the following command will make logs from `kube-system` namespace to be sent to `k8s_events` index: `kubectl annotate namespace kube-system splunk.com/index=k8s_events`
+  **Please Note:** Cluster receiver supports only namespace index annotations, pod index annotations are not supported.
 * Use `splunk.com/metricsIndex` annotation on pod and/or namespace to tell which Splunk platform metric indexes to ingest to. Pod annotation will take precedence over namespace annotation when both are annotated.
 * Filter logs using pod and/or namespace annotation
   * If `logsCollection.containers.useSplunkIncludeAnnotation` is `false` (default: false), set `splunk.com/exclude` annotation to `true` on pod and/or namespace to exclude its logs from ingested.

examples/collector-cluster-receiver-only/rendered_manifests/configmap-cluster-receiver.yaml

@@ -36,6 +36,23 @@ data:
     processors:
       batch:
         send_batch_max_size: 32768
+      k8sattributes/clusterReceiver:
+        extract:
+          metadata:
+          - k8s.namespace.name
+          - k8s.node.name
+          - k8s.pod.name
+          - k8s.pod.uid
+          - container.id
+          - container.image.name
+          - container.image.tag
+        pod_association:
+        - sources:
+          - from: resource_attribute
+            name: k8s.namespace.name
+        - sources:
+          - from: resource_attribute
+            name: k8s.node.name
       memory_limiter:
         check_interval: 2s
         limit_mib: ${SPLUNK_MEMORY_LIMIT_MIB}
@@ -130,6 +147,7 @@ data:
           - resourcedetection
           - resource
           - transform/add_sourcetype
+          - k8sattributes/clusterReceiver
           receivers:
           - k8sobjects
         metrics:

examples/collector-cluster-receiver-only/rendered_manifests/deployment-cluster-receiver.yaml

@@ -31,7 +31,7 @@ spec:
         component: otel-k8s-cluster-receiver
         release: default
       annotations:
-        checksum/config: b30b3bb56ee1f2c16bfa9aeff8933007d6f4e388850220def3c3da90815b3916
+        checksum/config: b7c6c8b6f15da89afa7eff5ec8989a631bb3004f90d82d3bf6b7f36a94c08813
     spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:

helm-charts/splunk-otel-collector/templates/config/_common.tpl

@@ -211,6 +211,36 @@ k8sattributes:
       {{- include "splunk-otel-collector.addExtraLabels" . | nindent 6 }}
     {{- end }}
 {{- end }}
+{{- define "splunk-otel-collector.k8sClusterReceiverAttributesProcessor" -}}
+k8sattributes/clusterReceiver:
+  pod_association:
+    - sources:
+      - from: resource_attribute
+        name: k8s.namespace.name
+    - sources:
+      - from: resource_attribute
+        name: k8s.node.name
+  extract:
+    metadata:
+      - k8s.namespace.name
+      - k8s.node.name
+      - k8s.pod.name
+      - k8s.pod.uid
+      - container.id
+      - container.image.name
+      - container.image.tag
+    {{- if eq (include "splunk-otel-collector.splunkPlatformEnabled" .) "true"}}
+    annotations:
+      - key: splunk.com/sourcetype
+        from: pod
+      - key: splunk.com/index
+        tag_name: com.splunk.index
+        from: namespace
+      - key: splunk.com/index
+        tag_name: com.splunk.index
+        from: pod
+    {{- end}}
+{{- end }}
 
 {{/*
 Common config for K8s attributes processor adding k8s metadata to metrics resource attributes.

helm-charts/splunk-otel-collector/templates/config/_otel-k8s-cluster-receiver-config.tpl

@@ -117,6 +117,14 @@ processors:
           - set(resource.attributes["com.splunk.sourcetype"], Concat(["kube:object:", attributes["k8s.resource.name"]], ""))
   {{- end }}
 
+  {{- if or
+    (and $clusterReceiver.eventsEnabled (eq (include "splunk-otel-collector.logsEnabled" .) "true"))
+    (and (eq (include "splunk-otel-collector.objectsEnabled" .) "true") (eq (include "splunk-otel-collector.logsEnabled" .) "true"))
+    (eq (include "splunk-otel-collector.o11yInfraMonEventsEnabled" .) "true")
+  }}
+  {{- include "splunk-otel-collector.k8sClusterReceiverAttributesProcessor" . | nindent 2 }}
+  {{- end }}
+
   # Resource attributes specific to the collector itself.
   resource/add_collector_k8s:
     attributes:
@@ -290,6 +298,7 @@ service:
         {{- if .Values.environment }}
         - resource/add_environment
         {{- end }}
+        - k8sattributes/clusterReceiver
       exporters:
         {{- if (eq (include "splunk-otel-collector.o11yLogsEnabled" .) "true") }}
         - splunk_hec/o11y
@@ -312,6 +321,7 @@ service:
         {{- if .Values.environment }}
         - resource/add_environment
         {{- end }}
+        - k8sattributes/clusterReceiver
       exporters:
         {{- if (eq (include "splunk-otel-collector.o11yLogsEnabled" .) "true") }}
         - splunk_hec/o11y
@@ -333,6 +343,7 @@ service:
         {{- if .Values.clusterName }}
         - resource/add_event_k8s
         {{- end }}
+        - k8sattributes/clusterReceiver
       exporters:
         - signalfx
     {{- end }}