aws-otel-collector

aws-otel-collector

Chainguard's redistribution of Snowplow's aws-otel-collector Helm chart, pre-configured with hardened Chainguard Images. The chart deploys the AWS Distro for OpenTelemetry Collector as a DaemonSet for Kubernetes Container Insights.

Prerequisites

Authentication is required to access this chart and its images. First, authenticate with Chainguard and configure your environment:

chainctl auth login
chainctl auth configure-docker --pull-token --save
helm registry login cgr.dev

Create an image pull secret in the namespace where the chart will be installed:

kubectl create namespace aws-otel-collector
kubectl create secret docker-registry cgr-pull-secret \
  --docker-server=cgr.dev \
  --docker-username="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Username')" \
  --docker-password="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Secret')" \
  --namespace aws-otel-collector

Installation

The upstream chart does not expose an imagePullSecrets value directly, so the pull secret is attached to the ServiceAccount that the DaemonSet uses:

helm install aws-otel-collector oci://cgr.dev/ORGANIZATION/charts/aws-otel-collector \
  --namespace aws-otel-collector \
  --set clusterName=<your-eks-cluster-name> \
  --set 'serviceAccount.annotations.eks\.amazonaws\.com/role-arn=<iam-role-arn>'

If your cluster does not automatically wire the pull secret via a namespace-level imagePullSecrets default, patch the ServiceAccount to reference the secret:

kubectl patch serviceaccount default \
  --namespace aws-otel-collector \
  -p '{"imagePullSecrets":[{"name":"cgr-pull-secret"}]}'

About This Chart

This is a redistribution of the upstream aws-otel-collector Helm chart. All upstream configuration options and documentation apply.

For full documentation, see: https://github.com/snowplow-devops/helm-charts/tree/main/charts/aws-otel-collector