feat(otel-collector): add OpenTelemetryCollector CRD, controller, and render

api/v1/fluentbit_daemonset_types.go

@@ -0,0 +1,101 @@
+// Copyright (c) 2024-2026 Tigera, Inc. All rights reserved.
+/*
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import (
+	v1 "k8s.io/api/core/v1"
+)
+
+// FluentBitDaemonSet is the configuration for the Fluent Bit DaemonSet.
+type FluentBitDaemonSet struct {
+
+	// Spec is the specification of the Fluent Bit DaemonSet.
+	// +optional
+	Spec *FluentBitDaemonSetSpec `json:"spec,omitempty"`
+}
+
+// FluentBitDaemonSetSpec defines configuration for the Fluent Bit DaemonSet.
+type FluentBitDaemonSetSpec struct {
+
+	// Template describes the Fluent Bit DaemonSet pod that will be created.
+	// +optional
+	Template *FluentBitDaemonSetPodTemplateSpec `json:"template,omitempty"`
+}
+
+// FluentBitDaemonSetPodTemplateSpec is the Fluent Bit DaemonSet's PodTemplateSpec
+type FluentBitDaemonSetPodTemplateSpec struct {
+
+	// Spec is the Fluent Bit DaemonSet's PodSpec.
+	// +optional
+	Spec *FluentBitDaemonSetPodSpec `json:"spec,omitempty"`
+}
+
+// FluentBitDaemonSetPodSpec is the Fluent Bit DaemonSet's PodSpec.
+type FluentBitDaemonSetPodSpec struct {
+	// InitContainers is a list of Fluent Bit DaemonSet init containers.
+	// If specified, this overrides the specified Fluent Bit DaemonSet init containers.
+	// If omitted, the Fluent Bit DaemonSet will use its default values for its init containers.
+	// +optional
+	InitContainers []FluentBitDaemonSetInitContainer `json:"initContainers,omitempty"`
+
+	// Containers is a list of Fluent Bit DaemonSet containers.
+	// If specified, this overrides the specified Fluent Bit DaemonSet containers.
+	// If omitted, the Fluent Bit DaemonSet will use its default values for its containers.
+	// +optional
+	Containers []FluentBitDaemonSetContainer `json:"containers,omitempty"`
+}
+
+// FluentBitDaemonSetContainer is a Fluent Bit DaemonSet container.
+type FluentBitDaemonSetContainer struct {
+	// Name is an enum which identifies the Fluent Bit DaemonSet container by name.
+	// Supported values are: calico-fluent-bit (or the deprecated alias fluentd, kept
+	// for one release so existing FluentdDaemonSet overrides continue to validate).
+	// +kubebuilder:validation:Enum=calico-fluent-bit;fluentd
+	Name string `json:"name"`
+
+	// Resources allows customization of limits and requests for compute resources such as cpu and memory.
+	// If specified, this overrides the named Fluent Bit DaemonSet container's resources.
+	// If omitted, the Fluent Bit DaemonSet will use its default value for this container's resources.
+	// +optional
+	Resources *v1.ResourceRequirements `json:"resources,omitempty"`
+
+	// ReadinessProbe allows customization of the readiness probe timing parameters.
+	// The probe handler is set by the operator and cannot be overridden.
+	// +optional
+	ReadinessProbe *ProbeOverride `json:"readinessProbe,omitempty"`
+
+	// LivenessProbe allows customization of the liveness probe timing parameters.
+	// The probe handler is set by the operator and cannot be overridden.
+	// +optional
+	LivenessProbe *ProbeOverride `json:"livenessProbe,omitempty"`
+}
+
+// FluentBitDaemonSetInitContainer is a Fluent Bit DaemonSet init container.
+type FluentBitDaemonSetInitContainer struct {
+	// Name is an enum which identifies the Fluent Bit DaemonSet init container by name.
+	// Supported values are: calico-fluent-bit-tls-key-cert-provisioner (or the deprecated
+	// alias tigera-fluentd-prometheus-tls-key-cert-provisioner, kept for one release so
+	// existing FluentdDaemonSet overrides continue to validate).
+	// +kubebuilder:validation:Enum=calico-fluent-bit-tls-key-cert-provisioner;tigera-fluentd-prometheus-tls-key-cert-provisioner
+	Name string `json:"name"`
+
+	// Resources allows customization of limits and requests for compute resources such as cpu and memory.
+	// If specified, this overrides the named Fluent Bit DaemonSet init container's resources.
+	// If omitted, the Fluent Bit DaemonSet will use its default value for this init container's resources.
+	// +optional
+	Resources *v1.ResourceRequirements `json:"resources,omitempty"`
+}

api/v1/logcollector_types.go

@@ -42,12 +42,27 @@ type LogCollectorSpec struct {
 	// +optional
 	MultiTenantManagementClusterNamespace string `json:"multiTenantManagementClusterNamespace,omitempty"`
 
-	// FluentdDaemonSet configures the Fluentd DaemonSet.
-	FluentdDaemonSet *FluentdDaemonSet `json:"fluentdDaemonSet,omitempty"`
+	// FluentdDaemonSet configures the calico-fluent-bit DaemonSet (deprecated alias).
+	//
+	// Deprecated: use CalicoFluentBitDaemonSet instead. This field is retained
+	// as an alias for one release during the Fluentd → Fluent Bit migration;
+	// when both are set, CalicoFluentBitDaemonSet takes precedence.
+	// +optional
+	FluentdDaemonSet *FluentBitDaemonSet `json:"fluentdDaemonSet,omitempty"`
+
+	// CalicoFluentBitDaemonSet configures the calico-fluent-bit DaemonSet, the
+	// Fluent Bit replacement for the Fluentd DaemonSet. Pod-template override
+	// semantics are unchanged from the deprecated FluentdDaemonSet field.
+	// +optional
+	CalicoFluentBitDaemonSet *FluentBitDaemonSet `json:"calicoFluentBitDaemonSet,omitempty"`
 
 	// EKSLogForwarderDeployment configures the EKSLogForwarderDeployment Deployment.
 	// +optional
 	EKSLogForwarderDeployment *EKSLogForwarderDeployment `json:"eksLogForwarderDeployment,omitempty"`
+
+	// OTelCollector configures the OpenTelemetry Collector for exporting logs and metrics via OTLP.
+	// +optional
+	OTelCollector *OTelCollectorSpec `json:"otelCollector,omitempty"`
 }
 
 type CollectProcessPathOption string
@@ -222,7 +237,7 @@ type LogCollectorStatus struct {
 // +kubebuilder:resource:scope=Cluster
 
 // LogCollector installs the components required for Tigera flow and DNS log collection. At most one instance
-// of this resource is supported. It must be named "tigera-secure". When created, this installs fluentd on all nodes
+// of this resource is supported. It must be named "tigera-secure". When created, this installs fluent-bit on all nodes
 // configured to collect Tigera log data and export it to Tigera's Elasticsearch cluster as well as any additionally configured destinations.
 //
 // +kubebuilder:validation:XValidation:rule="self.metadata.name == 'tigera-secure'",message="resource name must be 'tigera-secure'"
@@ -245,6 +260,25 @@ type LogCollectorList struct {
 	Items           []LogCollector `json:"items"`
 }
 
+// OTelCollectorSpec defines the desired state of the OpenTelemetry Collector.
+type OTelCollectorSpec struct {
+	// Logs configures which log types are exported via OTLP.
+	// +optional
+	Logs *OTelLogs `json:"logs,omitempty"`
+
+	// Metrics configures whether Calico component metrics are exported via OTLP.
+	// +optional
+	Metrics *OTelMetrics `json:"metrics,omitempty"`
+
+	// Exporters configures the OTLP export endpoints.
+	// +optional
+	Exporters []OTelExporter `json:"exporters,omitempty"`
+
+	// OTelCollectorStatefulSet configures the OTel Collector StatefulSet.
+	// +optional
+	OTelCollectorStatefulSet *OTelCollectorStatefulSet `json:"openTelemetryCollectorStatefulSet,omitempty"`
+}
+
 func init() {
 	SchemeBuilder.Register(&LogCollector{}, &LogCollectorList{})
 }