Repository navigation
docs: how an actor exports telemetry under the egress lockdown - #2120
Merged
Jeff Luo (JeffLuoo) merged 2 commits intoOct 2, 2026
Merged
Jeff Luo (JeffLuoo) merged 2 commits into
Jeff Luo (JeffLuoo) merged 2 commits into
Conversation
An actor's own OpenTelemetry SDK does not use the ateom relay; it dials the collector over the network, and the actor egress lockdown denies that connection unless the actor has an EgressPolicy rule for it. Verified on kind and on GKE (main 4e079e7): with no policy every export fails with "connection reset by peer" and the gateway logs "actor has no egress policy"; with an http rule naming the collector Service on 4317/4318 spans and metrics arrive. Add a section to the observability guide with the rule for the kind and GKE managed collectors, why it has to be an http rule (OTLP/gRPC is h2c), that it is per actor, the reconnect lag a running actor sees after the policy appears, and that IP-based k8sattributes enrichment attributes the actor's telemetry to the egress gateway pod. Point to it from the egress traffic doc.
haiyanmeng
reviewed
Oct 2, 2026
haiyanmeng
left a comment
haiyanmeng
left a comment
Collaborator
There was a problem hiding this comment.
LGTM. Will leave it to Bowei Du (@bowei) to approve.
|
|
||
| An actor's own OpenTelemetry SDK does not use the relay. It dials the collector over the network like any other outbound connection, and that connection is subject to the actor egress lockdown described in [Network Egress](network-egress.md): every actor TCP connection is redirected into `atunnel` and carried to the egress gateway, which refuses anything the actor's `EgressPolicy` does not allow. An actor with no policy, or a policy with no matching rule, cannot reach the collector at all. The SDK sees `Unavailable: connection reset by peer` on each export, and the gateway logs `egress denied: actor has no egress policy`. | ||
|
|
||
| To let an actor export, give it an `http` rule naming the collector's Service and the OTLP ports. It must be an `http` rule, not `https`: the OTLP/gRPC exporter speaks cleartext HTTP/2 (h2c) on `4317`, and the OTLP/HTTP exporter speaks cleartext HTTP/1.1 on `4318`, which is exactly what an `http` rule admits. On Kind the collector is `opentelemetry-collector.otel-system.svc`; on GKE with the managed collector it is `opentelemetry-collector.gke-managed-otel.svc.cluster.local`. Whatever the name, it has to match the host the actor's `OTEL_EXPORTER_OTLP_ENDPOINT` names, because the rule is matched on the request authority. |
Collaborator
There was a problem hiding this comment.
What if actor wants to use gRPC? Does current egress mode support it?
Collaborator
Author
There was a problem hiding this comment.
Yes. The OTLP/gRPC exporter on 4317 is exactly that case, gRPC over cleartext HTTP/2 (h2c), and it is what I verified on kind and GKE for this PR.
I reworded the sentence here to say the gRPC exporter goes through an http rule.
The sentence about the OTLP ports read as a note on transport. Make the point explicit: the gRPC exporter is gRPC over h2c, and that is what an http rule allows through.
Bowei Du (bowei)
approved these changes
Oct 2, 2026
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Oct 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
An actor's own OpenTelemetry SDK does not use the ateom relay; it dials the collector over the network, and the actor egress lockdown denies that connection unless the actor has an EgressPolicy rule for it. Verified on kind and on GKE (main 4e079e7): with no policy every export fails with "connection reset by peer" and the gateway logs "actor has no egress policy"; with an http rule naming the collector Service on 4317/4318 spans and metrics arrive.
Add a section to the observability guide with the rule for the kind and GKE managed collectors, why it has to be an http rule (OTLP/gRPC is h2c), that it is per actor, the reconnect lag a running actor sees after the policy appears, and that IP-based k8sattributes enrichment attributes the actor's telemetry to the egress gateway pod. Point to it from the egress traffic doc.