[receiver/k8sobjects] Kubernetes events are missing namespace resource attribute

[tetianakravchenko]

Component(s)

receiver/k8sobjects

What happened?

Description

Kubernetes events, collected using the watch mode:

k8sobjects:
          objects:
            - name: events
              mode: "watch"
              group: "events.k8s.io"
              exclude_watch_type:
                - "DELETED"

are missing the namespace resource.attribute.
Looking to the code - https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/v0.112.0/receiver/k8sobjectsreceiver/unstructured_to_logdata.go#L58-L60 it seems that it is expected that this attribute is added.

watchObjects have a different structure comparing to the pullObjects as a result e.GetNamespace() call return an empty string.

another option would be to add namespace to the attributes https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/v0.112.0/receiver/k8sobjectsreceiver/unstructured_to_logdata.go#L36-L40, would it be a preferable way?

Steps to Reproduce

enable k8sobjects:

k8sobjects:
          objects:
            - name: events
              mode: "watch"
              group: "events.k8s.io"
              exclude_watch_type:
                - "DELETED"

Expected Result

I expect to see Resource Attribute k8s.namespace.name added

Actual Result

ObservedTimestamp: 2024-11-13 15:27:52.068912453 +0000 UTC
Timestamp: 1970-01-01 00:00:00 +0000 UTC
SeverityText:
SeverityNumber: Unspecified(0)
Body: Map(...)
Attributes:
     -> k8s.resource.name: Str(events)
     -> event.domain: Str(k8s)
     -> event.name: Str(coredns-7db6d8ff4d-9hzj5.180790b119d77167)

Collector version

0.112.0

Environment information

Environment

OS: (e.g., "Ubuntu 20.04")
Compiler(if manually compiled): (e.g., "go 14.2")

OpenTelemetry Collector configuration

No response

Log output

No response

Additional context

No response

[github-actions]

Pinging code owners:

• receiver/k8sobjects: @dmitryax @hvaghani221 @TylerHelmuth

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[bacherfl]

Hi @tetianakravchenko, I just looked at this and could reproduce this behaviour as well. From my understanding of the readme, the watch and pull mode should only differ in how the related k8s objects are received, but not in the data structure of the log entries that are exported. Therefore i think it would make sense to ensure that the unstructured objects generated from the watch.Event passed to the unstructuredLogData() function has the same structure as the ones from the pulled objects.
As you correctly pointed out, the structure differs between those two cases, since the objects created from the watch.Events consist of an additional top layer which includes the event type (e.g. ADDED, DELETED, etc.), whereas the pulled objects directly contain the object, see the following examples:

• event received by watcher:

type: ADDED
object:
  kind: Event
  metadata:
    name: my-event
    namespace: my-namespace

• event received by pull mode:

kind: Event
metadata:
  name: my-event
  namespace: my-namespace

Thus, the GetNamespace() returns an empty value for the first object, as this function internally checks for metadata.namespace, whereas for the object derived from the watch event is located in object.metadata.namespace.

The other suggestion regarding the addition of the missing attribute in https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/v0.112.0/receiver/k8sobjectsreceiver/unstructured_to_logdata.go#L36-L40 also seems reasonable to me, but I would like to get the opinion of the code owners of this component. I'd be happy to work on a fix once we have decided on which approach to take here

[bacherfl]

I have created a PR now to make sure the generated log records have the same structure, regardless of the underlying mode (pull or watch): #36432