Collector Helm chart and values

Runs an OpenTelemetry Collector that the Myriarch server manages over OpAMP, as a StatefulSet (a gateway with a stable identity per replica) or a DaemonSet (one collector per node). Every pod is its own OpAMP agent: remote configuration with rollback, health, effective configuration, component list and restart work as on a host.

The chart runs the unchanged upstream images. Nothing is built from them:

The pod runs as user and group 10001 by default (overridable; the OpenShift profile sets no ID), adds no capability, has a read-only root file system and runs under the Pod Security level restricted (StatefulSet). The documentation for operators is in Install the collector with Helm; the design of the optional container mode is in docs/design/container-mode.md.

Available from v0.2.0. The values are validated against a strict schema, values.schema.json: helm install, upgrade, template and lint refuse a key that the chart does not know, a value of the wrong type and a malformed value, before anything is rendered.

Minimal installation

Two things are needed: a Secret with the enrollment token and the wss:// address of the server.

kubectl create namespace observability
kubectl -n observability create secret generic myriarch-enrollment --from-literal=token='myre_...'
# from a checkout of the repository, or, from v0.2.0, from the signed OCI chart (verify it first, see the operations guide):
helm install otel-gateway deploy/helm/myriarch-collector -n observability \
  --set server.endpoint=wss://fleet.example.com/v1/opamp --set site.id=k8s-de-prod --set site.name="Regional gateway DE"
helm install otel-gateway oci://ghcr.io/myriarch/charts/myriarch-collector --version 0.2.1 -n observability \
  --set server.endpoint=wss://fleet.example.com/v1/opamp

A node agent:

helm install otel-agent deploy/helm/myriarch-collector -n observability --set mode=daemonset \
  --set server.endpoint=wss://fleet.example.com/v1/opamp --set-json 'tolerations=[{"operator":"Exists"}]'

The chart renders without the namespace; it uses the namespace of the release.

Modes

The configuration of the collector is not part of the chart: it comes from the Myriarch server (a fleet that matches site.type). The chart ships one local file (healthCheck.enabled, default on) with the health_check extension on 0.0.0.0:13133, the port of the readiness probe. The supervisor merges it in every state except the startup fallback (whose file carries the same endpoint), before the configuration from the server, so the pod is Ready without an assignment. With an assignment the server wins on conflicts: maps are merged with the server’s values last, and service.extensions is concatenated, so a fleet cannot remove health_check, but it can move it. A fleet configuration that sets extensions.health_check.endpoint to localhost or another port makes the pod not Ready; keep it on the pod IP (0.0.0.0:13133). The fallback configuration is separate and applies only while the server is unreachable at startup. A fleet configuration must not put a second health_check instance (health_check/<name>) or another extension on port 13133: the collector then fails to start, otelcol validate does not catch it, and automatic_config_rollback reverts the configuration. With healthCheck.enabled: false the pod is Ready only if the fleet configuration has health_check on the pod IP, or while the startup fallback runs.

Pod Security

• User and group 10001, as overridable defaults. The supervisor image runs under a named user, so the kubelet cannot check runAsNonRoot: true without a numeric ID. The standard profile therefore sets runAsUser, runAsGroup and fsGroup to 10001 on the pod, so that the init containers and the main container share one identity that can read and write /shared and the storage volume. Override a value, or set it to null to leave the field out. The OpenShift profile renders none of the three; the SCC assigns them from the range of the project.
• Every container: allowPrivilegeEscalation: false, capabilities.drop: [ALL], readOnlyRootFilesystem: true, runAsNonRoot: true; the pod has seccompProfile: RuntimeDefault. No Kubernetes API token is mounted (serviceAccount.automountToken: false).
• Writable paths: the storage volume, an emptyDir for /tmp and, in container mode, the binaries volume. The shared volume is writable for the init containers and read-only for the main container.
• The only hostPath volumes exist in the DaemonSet and only when you ask for them: nodeLogs.enabled (read-only, for a filelog receiver) and persistence.hostPath.enabled (the identity of a node agent). The Pod Security levels baseline and restricted refuse a hostPath volume: label the namespace privileged, or use an exception of your admission policy. The chart has no root init container: prepare the directory of persistence.hostPath on the nodes, writable for the pod user (10001 by default); the pod log files must be readable for that user. containerd creates them as 0640 root:root and CRI-O as 0600, so neither “others” nor the user’s group can read them: with containerd set podSecurityContext.supplementalGroups: [0] (a group ID, not a user ID; the OpenShift profile removes supplementalGroups, so grant the group through the SCC there); with CRI-O that is not enough.
• NetworkPolicy (networkPolicy.enabled): the ports of the receivers are reachable from the release namespace and from the namespaces that carry the label myriarch.dev/otlp-client=true (and the sources in networkPolicy.ingress.from); the health ports only from the release namespace. Egress stays open, because the server, the backends and DNS differ per environment.
• RBAC: the chart creates no Role. A collector that needs the Kubernetes API (the k8sattributes processor) needs a ServiceAccount with a read-only Role that you create; set serviceAccount.create=false, serviceAccount.name and serviceAccount.automountToken=true.

OpenShift

openshift.enabled=true (or auto) selects the OpenShift profile: no runAsUser, runAsGroup or fsGroup, so the SCC restricted-v2 assigns them from the range of the project. The StatefulSet runs under restricted-v2 without further grants. The DaemonSet with hostPath volumes needs an SCC that allows them for its ServiceAccount (and the files of the node logs must be readable under the SELinux context of the pod); the chart does not create a binding.

Container mode

containerMode.enabled=true makes myriarch-updater PID 1 of the main container. It starts the supervisor as a child, swaps the collector binary on a second volume (volumeClaimTemplate binaries) when the server asks for a new version, and rolls back on a failed health check. The image then no longer says which collector runs. Probes use the updater on port 13135 (/healthz, /readyz), and terminationGracePeriodSeconds is at least 360 seconds. The verification of the downloaded collector needs the Sigstore trusted root in a ConfigMap (containerMode.trustedRoot.existingConfigMap, created from myriarch-updater fetch-trusted-root); switching the verification off is an explicit containerMode.update.requireSignature=false.

Values

The values are validated against values.schema.json. The table is generated by make docs-gen from the schema and values.yaml; edit values.schema.source.yaml, never the schema or the table. Defaults and long explanations are in values.yaml.

Checks of the chart

ci/lint-helm.sh lints the chart (default values, both modes, container mode, the OpenShift profile) and packages it; ci/helm-conform.sh renders it for several Kubernetes versions, validates every manifest with kubeconform and asserts the contract above, including the guards that make rendering fail (ws:// without server.endpoint opt-in, container mode on a DaemonSet, a missing trusted root).