Skip to content

[nr-ebpf-agent] Restore customOtlpEndpoint support to allow routing through an in-cluster OTel gateway #2372

Description

@petabook

Description

The nr-ebpf-agent chart declares and documents a customOtlpEndpoint value:

# -- Custom OTLP endpoint URL. When set, this takes precedence over the region-based static endpoints.

Since chart 1.4.5, however, the value is never rendered — the agent DaemonSet hardcodes the region-based endpoint. PR #2297 replaced the conditional that honored it:

           - name: OTLP_ENDPOINT
-        {{- if .Values.customOtlpEndpoint }}
-            value: "{{ .Values.customOtlpEndpoint }}"
-        {{- else if include "newrelic.common.region.is_stg" . }}
-            value: "staging-otlp.nr-data.net:443"
-        {{- else if include "newrelic.common.region.is_eu" . }}
-            value: "otlp.eu01.nr-data.net:443"
-        {{- else }}
-            value: "otlp.nr-data.net:443"
-        {{- end }}
+            value: {{ include "newrelic.common.otlp_endpoint" . | trimPrefix "https://" }}:443

customOtlpEndpoint is still present in values.yaml, and the template still references it in fail-guards and TLS settings (customOtlpEndpointTlsEnabled, customOtlpEndpointTlsCertSecret/...Key), so setting it now silently does nothing:

$ helm template test newrelic/nr-ebpf-agent --version 1.5.0 \
    --set cluster=demo --set licenseKey=xxx \
    --set customOtlpEndpoint=otel-gateway.observability.svc.cluster.local:4317 \
    --set customOtlpEndpointTlsEnabled=false \
    | grep -A1 'name: OTLP_ENDPOINT'
            - name: OTLP_ENDPOINT
              value: otlp.nr-data.net:443   # <-- override ignored

The common-library override key (otlpEndpoint / global.otlpEndpoint) is not a workaround either, because the new template line unconditionally appends :443 and only strips an https:// prefix — an endpoint carrying its own port renders mangled:

$ helm template ... --set otlpEndpoint=otel-gateway.observability.svc.cluster.local:4317 | grep -A1 'name: OTLP_ENDPOINT'
            - name: OTLP_ENDPOINT
              value: otel-gateway.observability.svc.cluster.local:4317:443

Use case: routing all cluster telemetry through an in-cluster OpenTelemetry Collector gateway — a single New Relic egress point for firewall allowlisting, plus centralized resource-attribute stamping. nr-k8s-otel-collector supports this cleanly via the common-library otlpEndpoint override; since 1.4.5 nr-ebpf-agent is the only component that cannot be pointed at such a gateway.

Acceptance Criteria

  • Setting customOtlpEndpoint (host:port form) again takes precedence over the region-based endpoint for the agent's OTLP_ENDPOINT env var, as documented in values.yaml.
  • No forced :443 suffix when the custom endpoint already includes a port.
  • customOtlpEndpointTlsEnabled: false keeps working, so a plaintext in-cluster gateway endpoint is usable.
  • Alternatively, if dropping the feature was intentional: remove the now-dead customOtlpEndpoint* values and fail-guards, and note the removal in the README/UPGRADING notes so users aren't silently misconfigured.

Describe Alternatives

  • Pinning chart 1.4.4 (last release honoring the value) — works, but forgoes subsequent fixes.
  • The common-library otlpEndpoint override — currently produces a mangled host:port:443 value as shown above.

Dependencies

Chart templates only (charts/nr-ebpf-agent/templates/nr-ebpf-agent-daemonset.yaml); possibly README regeneration.

Additional context

Regression introduced by #2297; last working release: chart 1.4.4. Still present on master.

Estimates

S

Metadata

Metadata

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions