fix(otlp): correct dedotting of attributes (LOG-10285)

[jcantrill]

Description

This PR:

• corrects label attribute dedotting when forwarding to OTLP

Links

• https://redhat.atlassian.net/browse/LOG-10285

cc @vparfonov

Summary by CodeRabbit

• Bug Fixes
  • Kubernetes pod labels containing dots or slashes are now preserved when added as resource attributes for container logs.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/cluster-logging-operator/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 23739e02-bf0a-4f4a-8775-d83273a761b2

📥 Commits

Reviewing files that changed from the base of the PR and between 7d55f55 and 6328523.

📒 Files selected for processing (2)

• internal/generator/vector/output/lokistack/lokistack_otel.toml
• internal/generator/vector/output/lokistack/lokistack_otel_tuning.toml

Included review availability: Your plan provides up to 12 included reviews per hour; 10 remain after this review.

---

📝 Walkthrough

Walkthrough

OTLP and LokiStack container transforms now read pod labels from ._internal.kubernetes.labels when creating k8s.pod.label.* resource attributes.

Changes

Pod-label extraction

Layer / File(s)	Summary
Use the internal Kubernetes label map internal/generator/vector/output/otlp/transform.go, internal/generator/vector/output/otlp/otlp_*.toml, internal/generator/vector/output/lokistack/lokistack_otel*.toml	The transforms read labels from ._internal.kubernetes.labels instead of .kubernetes.labels. Some comments identify the source as original, non-dedotted labels that preserve keys containing dots and slashes. The transforms continue to create k8s.pod.label.* resource attributes.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Suggested reviewers: vparfonov

Merge Risk: ⚪ Minimal · up to 63285

The changes preserve pod-label forwarding while retaining original label keys. No material merge risk is evident.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description states the purpose of the change and links the related JIRA issue. It does not include the mandatory /cc reviewer assignment or /assign approver assignment required by the template.	Add a /cc command with at least one reviewer from the top-level OWNERS file and an /assign command with at least one approver from the top-level OWNERS file.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the fix for incorrect attribute dedotting in OTLP forwarding and includes the related issue ID.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[jcantrill]

/cherrypick release-6.6

[openshift-cherrypick-robot]

@jcantrill: once the present PR merges, I will cherry-pick it on top of release-6.6 in a new PR and assign it to you.

Details

In response to this:

/cherrypick release-6.6

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jcantrill

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jcantrill]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jcantrill]

/label tide/merge-method-squash

[jcantrill]

/test e2e-using-bundle

[vparfonov]

Verification Report

Summary

✅ VERIFIED - The fix correctly preserves pod label keys containing dots (.) and slashes (/) in OTLP resource attributes.

Test Environment

• Cluster: AWS EKS (us-east-1)
• Operator Version: Red Hat OpenShift Logging 6.7.0
• JIRA: LOG-10285
• PR: fix(otlp): correct dedotting of attributes (LOG-10285) #3485

Test Configuration

Test Pod Labels (containing dots and slashes):

labels:
  app.kubernetes.io/name: verify-otlp-fix
  app.kubernetes.io/instance: test-instance
  app.kubernetes.io/component: backend
  test/label: with-slash

ClusterLogForwarder:

• Input: Application logs from otlp-verify-test namespace
• Output: OTLP endpoint at http://otel-collector.openshift-logging.svc:4318/v1/logs
• Pipeline: Direct forwarding from test namespace to OTLP

Test Steps

1. Deployed OTEL collector as the receiving endpoint
2. Created test namespace with a pod carrying labels containing . and /
3. Configured ClusterLogForwarder with OTLP output
4. Verified log collection and forwarding pipeline
5. Inspected OTLP resource attributes at the receiver

Results

Pod Label Key	Expected OTLP Attribute Key	Actual OTLP Attribute Key	Status
app.kubernetes.io/name	k8s.pod.label.app.kubernetes.io/name	k8s.pod.label.app.kubernetes.io/name	✅ PASS
app.kubernetes.io/instance	k8s.pod.label.app.kubernetes.io/instance	k8s.pod.label.app.kubernetes.io/instance	✅ PASS
app.kubernetes.io/component	k8s.pod.label.app.kubernetes.io/component	k8s.pod.label.app.kubernetes.io/component	✅ PASS
test/label	k8s.pod.label.test/label	k8s.pod.label.test/label	✅ PASS

All pod label keys with dots (.) and slashes (/) are preserved in their original form.

Evidence

OTLP Resource Attributes Received (from OTEL collector debug exporter):

Resource attributes:
     -> openshift.cluster.uid: Str(b4b38aec-8d3e-4b41-83a9-0817d2ecd616)
     -> openshift.log.source: Str(container)
     -> openshift.log.type: Str(application)
     -> k8s.node.name: Str(ip-10-0-140-96.ec2.internal)
     -> k8s.pod.name: Str(test-app)
     -> k8s.pod.uid: Str(4e56a2be-f18b-4e22-8bd1-0ef2b974d486)
     -> k8s.container.name: Str(busybox)
     -> k8s.namespace.name: Str(otlp-verify-test)
     -> k8s.pod.label.app.kubernetes.io/component: Str(backend)
     -> k8s.pod.label.app.kubernetes.io/instance: Str(test-instance)
     -> k8s.pod.label.app.kubernetes.io/name: Str(verify-otlp-fix)
     -> k8s.pod.label.test/label: Str(with-slash)
     -> k8s.pod.label.topology.kubernetes.io/region: Str(us-east-1)
     -> k8s.pod.label.topology.kubernetes.io/zone: Str(us-east-1a)

Note: Format is <attribute-key>: <type>(<value>) where the attribute key is what matters for this fix.

Conclusion

The fix successfully resolves the issue described in LOG-10285. Pod labels containing dots and slashes are now correctly exported with their original keys in k8s.pod.label.* resource attributes, compliant with OpenTelemetry semantic conventions.

Before this fix: k8s.pod.label.app_kubernetes_io_name (dedotted - underscores replace dots/slashes)
After this fix: k8s.pod.label.app.kubernetes.io/name (original - dots and slashes preserved) ✅

The change from reading .kubernetes.labels (dedotted) to ._internal.kubernetes.labels (original) in the VRL transform correctly preserves the label keys as they appear in Kubernetes.

---

Verified by: @vparfonov
Date: 2026-09-30

[vparfonov]

/lgtm

[vparfonov]

/label verified

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD 5a03552 and 2 for PR HEAD 6328523 in total

[vparfonov]

/retest-required

[vparfonov]

/retest-required

[openshift-ci]

@jcantrill: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-cherrypick-robot]

@jcantrill: new pull request created: #3517

Details

In response to this:

/cherrypick release-6.6

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.