Guides

Each guide solves one specific problem with a complete configuration you can copy, explains the settings that matter, and shows how to prove it works. Every config was checked before publishing: otelcol validate and a smoke test for collector configs, kyverno test for policies, and kubeconform -strict for Kubernetes manifests. The tool versions are listed at the top of each guide.

OpenTelemetry Collector

• Tail sampling: a working config: keep every error and slow trace plus a small baseline, and why scaling out needs a trace-ID load-balancing tier.
• Redact PII with OTTL: mask emails and card numbers and delete Authorization and cookie attributes in traces and logs.
• Send logs to Grafana Loki over OTLP: file_log receiver to Loki 3’s native OTLP endpoint, plus labels vs structured metadata.
• Production-ready collector agent: memory_limiter, batch, retries, a persistent sending queue and health checks that survive outages.
• Reduce telemetry cost: drop health-check spans, DEBUG logs and unused metrics, and cut cardinality safely.
• Span metrics and service graph: RED metrics and a dependency map from traces with the span_metrics and service_graph connectors.

Kubernetes & Kyverno

• Kyverno: disallow the :latest tag: a ValidatingPolicy that handles registry ports, digests and init containers, with a kyverno test suite.
• Kyverno: require requests and limits: CPU/memory requests and a memory limit on every container, with messages that name the container.
• Kyverno: Audit to Enforce, safely: a phased rollout with PolicyReports, Warn mode and a tested, narrowly scoped PolicyException.
• Default-deny NetworkPolicy that allows DNS: block all traffic without breaking name resolution, and how to test that it is enforced.
• Pod Security Admission restricted migration: move a live namespace to restricted with dry runs, warn and audit modes, and a pinned enforce version.