15b4a1de6a
- Added detailed task completion records for KMS interface implementation and CLI support for file-based keys. - Documented security enhancements including Argon2id password hashing, audit event contracts, and rate limiting configurations. - Included scoped service support and integration updates for the Plugin platform, ensuring proper DI handling and testing coverage.
Telemetry Collector Assets
These assets provision the default OpenTelemetry Collector instance required by
DEVOPS-OBS-50-001. The collector acts as the secured ingest point for traces,
metrics, and logs emitted by Stella Ops services.
Contents
| File | Purpose |
|---|---|
otel-collector-config.yaml |
Baseline collector configuration (mutual TLS, OTLP receivers, Prometheus exporter). |
storage/prometheus.yaml |
Prometheus scrape configuration tuned for the collector and service tenants. |
storage/tempo.yaml |
Tempo configuration with multitenancy, WAL, and compaction settings. |
storage/loki.yaml |
Loki configuration enabling multitenant log ingestion with retention policies. |
storage/tenants/*.yaml |
Per-tenant overrides for Tempo and Loki rate/retention controls. |
Development workflow
- Generate development certificates (collector + client) using
ops/devops/telemetry/generate_dev_tls.sh. - Launch the collector via
docker compose -f docker-compose.telemetry.yaml up. - Launch the storage backends (Prometheus, Tempo, Loki) via
docker compose -f docker-compose.telemetry-storage.yaml up. - Run the smoke test:
python ops/devops/telemetry/smoke_otel_collector.py. - Explore the storage configuration (
storage/README.md) to tune retention/limits.
The smoke test sends OTLP traffic over TLS and asserts the collector accepted traces, metrics, and logs by scraping the Prometheus metrics endpoint.
Kubernetes
The Helm chart consumes the same configuration (see values.yaml). Provide TLS
material via a secret referenced by telemetry.collector.tls.secretName,
containing ca.crt, tls.crt, and tls.key. Client certificates are required
for ingestion and should be issued by the same CA.