feat: OTel collector bootstrap as operator startup Runnable

charts/kagenti-operator/templates/manager/manager.yaml

@@ -34,6 +34,9 @@ spec:
             {{- if .Values.mlflow.enable }}
             - "--enable-mlflow=true"
             {{- end }}
+            {{- if .Values.otelBootstrap.enable }}
+            - "--enable-otel-bootstrap=true"
+            {{- end }}
             {{- if .Values.verifiedFetch.enabled }}
             - "--enable-verified-fetch=true"
             - "--verified-fetch-spiffe-socket={{ .Values.verifiedFetch.spiffeEndpointSocket }}"

charts/kagenti-operator/templates/rbac/role.yaml

@@ -19,6 +19,7 @@ rules:
 - apiGroups:
   - ""
   resources:
+  - endpoints
   - namespaces
   - services
   verbs:

charts/kagenti-operator/values.yaml

@@ -96,6 +96,14 @@ enforceNetworkPolicies: false
 mlflow:
   enable: false
 
+# [OTEL BOOTSTRAP]: OTel collector bootstrap at operator startup.
+# When enabled, the operator assembles the OTel collector ConfigMap from
+# detected components (Phoenix, MLflow) and projects the OpenShift ingress
+# CA into the operator namespace (OCP only). Replaces the Helm-based
+# otel-ingress-ca-job and kagenti.otel.collectorConfig helper.
+otelBootstrap:
+  enable: false
+
 # [VERIFIED FETCH]: mTLS-authenticated fetch of agent cards via SPIFFE identity (Phase 1)
 # When enabled, the operator uses go-spiffe mTLS to fetch agent cards and records
 # the agent's attested SPIFFE ID in CRD status.

kagenti-operator/cmd/main.go

@@ -46,6 +46,7 @@ import (
 
 	agentv1alpha1 "github.com/kagenti/operator/api/v1alpha1"
 	"github.com/kagenti/operator/internal/agentcard"
+	"github.com/kagenti/operator/internal/bootstrap"
 	"github.com/kagenti/operator/internal/controller"
 	"github.com/kagenti/operator/internal/keycloak"
 	"github.com/kagenti/operator/internal/mlflow"
@@ -100,6 +101,7 @@ func main() {
 	var signatureAuditMode bool
 	var enforceNetworkPolicies bool
 	var enableMLflow bool
+	var enableOtelBootstrap bool
 
 	var enableVerifiedFetch bool
 	var verifiedFetchSpiffeSocket string
@@ -141,6 +143,8 @@ func main() {
 		"Create NetworkPolicies to restrict traffic for agents with unverified signatures")
 	flag.BoolVar(&enableMLflow, "enable-mlflow", false,
 		"Enable MLflow experiment tracking integration")
+	flag.BoolVar(&enableOtelBootstrap, "enable-otel-bootstrap", false,
+		"Enable OTel collector bootstrap (ingress CA trust and ConfigMap assembly) at startup")
 
 	flag.BoolVar(&enableVerifiedFetch, "enable-verified-fetch", false,
 		"Enable mTLS-authenticated fetch of agent cards via SPIFFE identity")
@@ -502,6 +506,21 @@ func main() {
 	}
 	// +kubebuilder:scaffold:builder
 
+	if enableOtelBootstrap {
+		otelBootstrap := &bootstrap.OtelBootstrapRunnable{
+			Client:    mgr.GetClient(),
+			APIReader: mgr.GetAPIReader(),
+			Config:    mgr.GetConfig(),
+			Namespace: getOperatorNamespace(),
+			Log:       ctrl.Log.WithName("bootstrap"),
+		}
+		if err := mgr.Add(otelBootstrap); err != nil {
+			setupLog.Error(err, "unable to add OTel bootstrap runnable")
+			os.Exit(1)
+		}
+		setupLog.Info("OTel collector bootstrap enabled")
+	}
+
 	if metricsCertWatcher != nil {
 		setupLog.Info("Adding metrics certificate watcher to manager")
 		if err := mgr.Add(metricsCertWatcher); err != nil {