Run a cluster gateway for Kubernetes
Cluster-level gateway that receives OTLP from apps and node agents, tails pod logs, stamps deployment.environment, deletes a PII attribute, and ships everything to your OTLP/HTTP backend with a debug tap on logs.
The cluster's central collector: applications and node agents send OTLP here, and the gateway also tails pod logs directly for anything that only writes to stdout. Every record gets deployment.environment: production stamped on the resource, and the attributes processor deletes user.ssn before anything leaves the cluster. Extend that list with whatever your compliance reviews turn up.
Export goes to your OTLP/HTTP backend via OTLP_GATEWAY_ENDPOINT (a Grafana Cloud OTLP gateway URL works verbatim). The debug exporter on the logs pipeline prints basic output for on-cluster troubleshooting; drop it from the pipeline once the setup is proven.
Use this flow
Open the config in Telflo and it becomes a working pipeline on the canvas: adapt what's specific to you, test it against recorded traffic, and push it to your fleet over OpAMP. Free account, no card.
Components
What's in it, and why
Receives traces, metrics, and logs from applications and from the node agents, over gRPC and HTTP.
Tails pod logs on the gateway host for workloads that only write to stdout, starting at the end of each file.
First processor in every pipeline, so backpressure reaches the receivers before the gateway runs out of memory.
Stamps deployment.environment: production on every record passing through the gateway.
Batches at 1024 records or 10 seconds, whichever comes first, before export.
Deletes the user.ssn attribute before anything leaves the cluster; the list is meant to grow with your compliance reviews.
Ships everything to the OTLP/HTTP backend named by OTLP_GATEWAY_ENDPOINT.
Prints basic log output on the cluster for troubleshooting; remove it from the pipeline once the setup is proven.
Exposes the liveness endpoint on 13133 for Kubernetes probes.
Notes
Gotchas
- 1
The debug exporter stays on the logs pipeline in this template. It writes to the collector's own stdout, which the node agents then collect, so leaving it enabled in production feeds logs back into your pipeline.
- 2
attributesdeletes exactly one key (user.ssn). It is a starting point, not a redaction policy; the PII redaction gateway flow covers pattern-based masking. - 3
fileloghere starts at the end of each file, so logs written while the gateway was down are not backfilled. - 4
The gateway tails
/var/log/podsdirectly, which needs a hostPath mount and the matching read permissions on the pod.
More flows
Related flows
Collect per-node telemetry with a DaemonSet
Per-node DaemonSet that scrapes kubelet and host metrics, tails pod logs with the container parser and file_storage checkpoints, enriches everything with k8sattributes, and forwards to the in-cluster gateway.
Replace vendor agents on your VM fleet
Scrapes CPU, memory, load, disk, filesystem, and network metrics plus system and application logs on every VM.
Redact PII before telemetry leaves the network
Masks emails, card numbers, SSNs, bearer tokens, AWS keys, and IPs in log bodies and span attributes at a central gateway, before telemetry leaves your network.
Test it before your fleet runs it
Free account, no card. Open this flow in the editor, adapt it, and see what it does to real data before anything ships.