fix(KONFLUX-15214): upgrade otel collector to 0.158.0 in prod clusters (1/3)

[mafh314]

What

This PR updates opentelemetry-collector from 0.155.0 to 0.158.0 in the production overlays:

• stone-prd-rh01
• stone-prod-p01
• stone-prod-p02
  to remediate to remediate CVE-2026-55969 and CVE-2026-48586.

Why

Remediates CVE-2026-55969 and CVE-2026-48586 for opentelemetry-collector.

Closes:

KONFLUX-15214
KONFLUX-15246

Risk Assessment

Risk Level: Low
Description: Some KubeArchive performance metrics data can be lost during the rollout.
Rollback: Revert the image reference in stone-prd-rh01/kustomization.yaml, stone-prod-p01/kustomization.yaml, stone-prod-p02/kustomization.yaml to the previous version (sha256:1f8c9a18...) and the older otel-collector will be deployed.

Validation

Ran

kustomize build --enable-helm components/kubearchive/production/stone-prod-p01/
kustomize build --enable-helm components/kubearchive/production/stone-prod-p02/
kustomize build --enable-helm components/kubearchive/production/stone-prd-rh01/

output rendered successfully.
Deployed a local cluster using KubeArchive with the new image and verified everything works correctly.

kubectl logs -n kubearchive -l app=otel-collector -c otel-collector --tail=20
2026-06-30T13:45:01.160Z	info	otelconftelemetry/tracer.go:47	Internal trace telemetry disabled	{"resource": {..., "service.version": "0.155.0"}}
2026-06-30T13:45:01.164Z	info	service@v0.155.0/service.go:256	Starting otelcol-contrib...	{"Version": "0.155.0", "NumCPU": 22}
2026-06-30T13:45:01.165Z	info	otlpreceiver@v0.155.0/otlp.go:175	Starting HTTP server	{"endpoint": "[::]:4318"}
2026-06-30T13:45:01.165Z	info	service@v0.155.0/service.go:279	Everything is ready. Begin running and processing data.

PR merged in staging
PR merged in development

[github-actions]

Kustomize Render Diff

Comparing 0478cc979 → 408f548af

Component	Environment	Changes
components/kubearchive/production/stone-prd-rh01	production	+1 -1
components/kubearchive/production/stone-prod-p01	production	+1 -1
components/kubearchive/production/stone-prod-p02	production	+1 -1

Total: 3 components, +3 -3 lines

📋 Full diff available in the workflow summary and as a downloadable artifact.

[qodo-for-redhat-appstudio]

PR Summary by Qodo

Upgrade otel-collector to 0.158.0 in KubeArchive production overlays

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Bump opentelemetry-collector image digest to 0.158.0 across three production overlays.
• Remediate CVE-2026-55969 and CVE-2026-48586 by deploying the patched collector image.
• Add an inline version comment to make the pinned digest intent clearer.

Diagram

graph TD
  RH01["stone-prd-rh01/kustomization.yaml"] -->|"patches otel-collector image"| DEPLOY["Otel Collector Deployment"] -->|"pulls pinned digest"| QUAY{{"quay.io/kubearchive/opentelemetry-collector"}}
  P01["stone-prod-p01/kustomization.yaml"] -->|"patches otel-collector image"| DEPLOY -->|"pulls pinned digest"| QUAY
  P02["stone-prod-p02/kustomization.yaml"] -->|"patches otel-collector image"| DEPLOY -->|"pulls pinned digest"| QUAY

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use Kustomize `images:` overrides instead of inline deployment patch

• ➕ More idiomatic for image swaps; less verbose YAML
• ➕ Reduces the risk of patch drift if the Deployment structure changes
• ➖ Requires the base resources to reference the image name consistently
• ➖ May be less explicit than a targeted patch in some overlay conventions

2. Centralize the otel-collector image pin in a shared production component

• ➕ Single place to bump the digest for all production overlays
• ➕ Avoids repeating the same patch in multiple overlays
• ➖ Small refactor effort and potential overlay wiring changes
• ➖ May reduce per-cluster override flexibility if needed later

3. Automate digest/version bumps (e.g., Renovate/image policy)

• ➕ Shorter time-to-remediate for future CVEs
• ➕ Consistent update cadence across environments
• ➖ Requires additional automation setup and governance
• ➖ May increase PR volume and necessitate stricter validation gates

Recommendation: The current approach (pinning a new digest in each production overlay) is appropriate for a focused CVE remediation and preserves deterministic rollouts. If these overlays routinely need the same bump, consider a follow-up to centralize the image override (shared component or images:) to reduce repetition and make future security updates faster.

Files changed (3) +6 / -3

Other (3) +6 / -3

kustomization.yamlPin otel-collector image digest to 0.158.0 (stone-prd-rh01) +2/-1

Pin otel-collector image digest to 0.158.0 (stone-prd-rh01)

• Updates the otel-collector container image digest to the 0.158.0 build. Adds a comment to document the intended collector version near the patch.

components/kubearchive/production/stone-prd-rh01/kustomization.yaml

kustomization.yamlPin otel-collector image digest to 0.158.0 (stone-prod-p01) +2/-1

Pin otel-collector image digest to 0.158.0 (stone-prod-p01)

• Updates the otel-collector container image digest to the 0.158.0 build. Adds a nearby comment to make the version bump explicit.

components/kubearchive/production/stone-prod-p01/kustomization.yaml

kustomization.yamlPin otel-collector image digest to 0.158.0 (stone-prod-p02) +2/-1

Pin otel-collector image digest to 0.158.0 (stone-prod-p02)

• Updates the otel-collector container image digest to the 0.158.0 build. Adds an inline comment documenting the collector version for this overlay.

components/kubearchive/production/stone-prod-p02/kustomization.yaml

[qodo-for-redhat-appstudio]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Previous review results

Review updated until commit 424c846 ⚖️ Balanced

Results up to commit 149436b ⚖️ Balanced

No changes from previous review

Results up to commit 32d7c16 ⚖️ Balanced

No changes from previous review

Results up to commit 27af15a ⚖️ Balanced

No changes from previous review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 58.78%. Comparing base (0478cc9) to head (424c846).
⚠️ Report is 75 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #13505   +/-   ##
=======================================
  Coverage   58.78%   58.78%           
=======================================
  Files          24       24           
  Lines        1548     1548           
=======================================
  Hits          910      910           
  Misses        559      559           
  Partials       79       79           

Flag	Coverage Δ
go	58.78% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[eedri]

@mafh314 this PR needs at least one GitHub reviewer approval before it can be approved for production.

Please request a review from a team member using the Reviewers panel on the right, or ask someone to submit an approving review on this PR.

[eedri]

@mafh314 the staging PR for this change has been soaking for 5w — but this production PR still has no reviewer approvals.

Please request a review from a team member using the Reviewers panel on the right, or ask in your team's Slack channel.

[mafh314]

@eedri my bad. I copied the wrong links. (Now are fixed).
staging -> merged last week (August 7th).
dev -> merged 4 days ago.
I asked yesterday and today for a approval. But I think these days due to summer vacations are slow :/

[olegbet]

/approve

[olegbet]

/lgtm

[qodo-for-redhat-appstudio]

Code review by qodo was updated up to the latest commit 32d7c16

[eedri]

Production Approval Record

Field	Value
Action	APPROVED
Reviewer	@eedri
Timestamp	2026-08-16T08:42:11.824Z
Risk Level	low

low risk, no need to push on maintenance window

[qodo-for-redhat-appstudio]

Code review by qodo was updated up to the latest commit 27af15a

[olegbet]

/approve
/lgtm

[qodo-for-redhat-appstudio]

Code review by qodo was updated up to the latest commit 424c846

[olegbet]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mafh314, olegbet

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• components/kubearchive/OWNERS [mafh314,olegbet]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[eedri]

Production Approval Record

Field	Value
Action	APPROVED
Reviewer	@eedri
Timestamp	2026-08-20T10:09:05.962Z
Risk Level	low

[eedri]

This should get auto merged by now, please check with infra