default-values-reference.fragment.yaml

# Default-values reference fragment. This is not an OBI configuration document.
# Never pass this fragment to `obi config validate`; use
# default-configuration.yaml for a runnable standalone example.
#
# A migrated v1 file may emit different signal enablement for behavioral parity.

# Standard OTel declarative log level for OBI daemon logging.
log_level: info

# The target adapter applies string host.name, host.id, service.name, and
# service.namespace attributes. Other attributes, resource detection, and
# resource schema URLs are rejected.
resource: {}
# Keep empty. A non-empty propagator is rejected by the target adapter.
propagator: {}

# Trace pipeline definition (OTel-native). OBI-specific tracing controls live under extensions.obi.*.
tracer_provider:
  # Sampling policy is configured in top-level OTel tracer_provider.sampler.
  # OBI selection decides which workloads are instrumented; it does not override sampler behavior.
  # The current adapter supports always-on, always-off, trace-ID-ratio, and
  # corresponding parent-based sampler shapes. Vendor and per-workload samplers
  # are not supported.
  #
  # Example (global built-in sampler):
  # sampler:
  #   parent_based:
  #     root:
  #       trace_id_ratio_based:
  #         ratio: 0.10
  # Trace processors applied before export.
  processors:
    - batch:
        # Max in-memory queue before flush.
        max_queue_size: 16384
        # Max spans exported per batch.
        max_export_batch_size: 4096
        # Delay interval between batch exports in milliseconds.
        schedule_delay: 15000
        # Trace exporter.
        exporter:
          otlp_grpc:
            endpoint: ""
            tls:
              insecure: false

# Metrics pipeline definition (OTel-native). OBI-specific metric behavior lives under extensions.obi.*.
meter_provider:
  # Metric readers/exporters.
  readers:
    - periodic:
        # Metrics export interval in milliseconds.
        interval: 60000
        exporter:
          otlp_grpc:
            endpoint: ""
            default_histogram_aggregation: explicit_bucket_histogram
            tls:
              insecure: false
    - pull:
        exporter:
          prometheus/development:
            port: 0

extensions:
  obi:
    # OBI extension schema version (parsed after root declarative parse succeeds).
    version: "2.0"

    # capture defines what OBI instruments and how it captures telemetry.
    # Its children are the only OBI extension fields valid in Collector
    # receiver deployments.
    # A receiver component flattens every child of this block beside version;
    # it does not retain the capture wrapper.
    capture:
      # policy controls global rule evaluation behavior.
      policy:
        # Include by default unless matched by an exclude rule.
        default_action: include
        # first_match_wins requires excludes before includes. The first
        # matching YAML include supplies overlapping refinements.
        match_order: first_match_wins
        # Process re-scan interval (0s uses the process watcher's 5s default).
        poll_interval: 0s
        # Ignore very new processes until they are old enough to evaluate.
        min_process_age: 5s
      # rules is an ordered list of workload inclusion/exclusion rules.
      # Writing [] explicitly removes these built-in workload exclusion rules.
      rules:
        - action: exclude
          name: exclude-obi-and-collectors
          description: Exclude OBI and collector binaries to avoid self-instrumentation and collector recursion.
          match:
            process:
              exe_path_glob:
                - "*/obi"
                - "obi"
                - "*otelcol"
                - "*otelcol-contrib"
                - "*otelcol-contrib[!/]*"
        - action: exclude
          name: exclude-system-namespaces
          description: Exclude common platform/system Kubernetes namespaces from instrumentation by default.
          match:
            kubernetes:
              namespace_glob:
                - kube-system
                - kube-node-lease
                - local-path-storage
                - cert-manager
                - monitoring
                - gke-connect
                - gke-gmp-system
                - gke-managed-cim
                - gke-managed-filestorecsi
                - gke-managed-metrics-server
                - gke-managed-system
                - gke-system
                - gke-managed-volumepopulator
                - gatekeeper-system
        - action: exclude
          name: exclude-otlp-exporters
          description: Exclude services that already export OTLP to prevent duplicate telemetry pipelines.
          match:
            process:
              exports_otlp:
                port: 4317
                protocol: protobuf
        # Example (commented): effective glob selector exported from discovery.instrument
        # and top-level auto-target fields.
        #
        # - action: include
        #   name: checkout-glob
        #   match:
        #     process:
        #       open_ports: "8080,9090-9091"
        #       target_pids: [1234, 5678]
        #       language_glob: [go, java]
        #       cmd_args_glob: ["*--serve*"]
        #       exe_path_glob: ["/usr/bin/checkout"]
        #       containers_only: true
        #     kubernetes:
        #       namespace_glob: ["shop-*"]
        #       metadata_glob:
        #         k8s_deployment_name: ["checkout-*"]
        #         k8s_container_name: ["checkout"]
        #       pod_labels:
        #         app: ["checkout"]
        #       pod_annotations:
        #         team: ["payments"]
        #
        # Example (commented): legacy regex selector exported from discovery.services
        # or top-level executable_path/open_port fallback.
        #
        # - action: include
        #   name: checkout-regex
        #   match:
        #     process:
        #       open_ports: "8080"
        #       language_regex: "go|java"
        #       cmd_args_regex: "--serve"
        #       exe_path_regex: "^/srv/checkout$"
        #     kubernetes:
        #       namespace_regex: "^shop$"
        #       metadata_regex:
        #         k8s_deployment_name: "^checkout-.+$"
        #       pod_labels_regex:
        #         app: "^checkout$"
        #       pod_annotations_regex:
        #         team: "^payments$"

        # Example (commented): per-workload refinement on include rules.
        # The `refine` block overrides global defaults for workloads matched by this rule.
        # Use this to disable signals or add per-service HTTP routes without
        # duplicating the whole config. Per-rule filters are not currently applied.
        #
        # - action: include
        #   name: shopping-cart
        #   description: Include shopping cart services with trace-only export and custom HTTP routes.
        #   match:
        #     kubernetes:
        #       namespace_glob:
        #         - shopping-*
        #   refine:
        #     # Disable metrics for this workload; emit traces only.
        #     exports:
        #       traces: true
        #       metrics: false
        #     http:
        #       # Per-workload HTTP route policy for requests handled by or made by this workload.
        #       # Omitted fields inherit the corresponding global direction below.
        #       routes:
        #         incoming:
        #           patterns:
        #             - /cart/{id}
        #             - /cart/{id}/items
        #           ignored_patterns:
        #             - /health
        #           unmatched: path
        #         outgoing:
        #           patterns:
        #             - /checkout/{id}
        #           unmatched: wildcard

      instrumentation:
        # HTTP protocol instrumentation and HTTP-specific enrichment/parsing.
        http:
          enabled:
            traces: true
            metrics: true
          # The target adapter imports one shared application filter. Every
          # application protocol's trace and metric maps must equal this trace
          # map.
          # Example (commented): keep prod namespaces and drop health endpoints.
          # filters:
          #   traces:
          #     k8s.namespace.name:
          #       match: "prod-*"
          #     url.path:
          #       not_match: "/health*"
          #   metrics:
          #     k8s.namespace.name:
          #       match: "prod-*"
          #     url.path:
          #       not_match: "/health*"
          filters:
            traces: {}
            metrics: {}
          # Capture configured incoming/outgoing request headers when enabled.
          track_request_headers: false
          # HTTP request timeout guard for capture/processing.
          request_timeout: 0s
          # Internal parser/capture buffer size (0 uses default behavior).
          buffer_size: 0
          # HTTP route normalization and low-cardinality route naming controls.
          routes:
            # Policy for requests handled by an instrumented workload.
            incoming:
              # Fallback policy when no explicit route match is found.
              unmatched: heuristic
              # Optional user-supplied route patterns.
              patterns: []
              # Optional route patterns to ignore.
              ignored_patterns: []
              # Ignore applies to traces, metrics, or all.
              ignore_mode: all
              # Route wildcard replacement character.
              wildcard_char: "*"
              # Caps per-segment route cardinality in low-cardinality mode.
              max_path_segment_cardinality: 10
            # Policy for requests made by an instrumented workload.
            outgoing:
              unmatched: heuristic
              patterns: []
              ignored_patterns: []
              ignore_mode: all
              wildcard_char: "*"
              max_path_segment_cardinality: 10
            # Route template discovery from runtime/language frameworks.
            discovery:
              # Global timeout for route template discovery runs.
              timeout: 10s
              # Languages to skip for route template discovery.
              disabled_languages: []
              java:
                # Delay before Java route template discovery to allow runtime readiness.
                delay: 5s
          # HTTP payload-level extraction features.
          payload_extraction:
            # List-based enablement, consistent with other instrumentation selectors.
            # Supported values today: graphql, elasticsearch, aws, sqlpp,
            # openai, anthropic, gemini, qwen, bedrock, mcp, embedding,
            # rerank, retrieval, ollama, openai_compatible, jsonrpc, enrichment.
            enabled: []
            sqlpp:
              endpoint_patterns:
                - /query/service
            openai_compatible:
              gateways: []
            enrichment:
              policy:
                default_action:
                  headers: exclude
                  body: exclude
                obfuscation_string: "***"
              rules: []
        # gRPC protocol instrumentation toggle.
        grpc:
          enabled:
            traces: true
            metrics: true
          filters:
            traces: {}
            metrics: {}
        # SQL protocol instrumentation and driver-specific tuning.
        sql:
          enabled:
            traces: true
            metrics: true
          filters:
            traces: {}
            metrics: {}
          heuristic_detect: false
          mysql:
            buffer_size: 0
            prepared_statements_cache_size: 1024
          postgres:
            buffer_size: 0
            prepared_statements_cache_size: 1024
          mssql:
            buffer_size: 0
            prepared_statements_cache_size: 1024
        # Redis instrumentation and DB cache behavior.
        redis:
          enabled:
            traces: true
            metrics: true
          filters:
            traces: {}
            metrics: {}
          db_cache:
            enabled: false
            max_size: 1000
        # Kafka instrumentation tuning.
        kafka:
          enabled:
            traces: true
            metrics: true
          filters:
            traces: {}
            metrics: {}
          buffer_size: 0
          topic_uuid_cache_size: 1024
        # Mongo instrumentation tuning.
        mongo:
          enabled:
            traces: true
            metrics: true
          filters:
            traces: {}
            metrics: {}
          requests_cache_size: 1024
        # Couchbase instrumentation tuning.
        couchbase:
          enabled:
            traces: true
            metrics: true
          filters:
            traces: {}
            metrics: {}
          db_cache_size: 1024
        # DNS event instrumentation.
        dns:
          enabled:
            traces: false
            metrics: false
          filters:
            traces: {}
            metrics: {}
          request_timeout: 5s
        # GPU instrumentation mode.
        gpu:
          enabled:
            traces: false
            metrics: true
          filters:
            traces: {}
            metrics: {}
          enabled_mode: auto

      # runtimes controls injection of language-specific runtime instrumentation mechanisms.
      # These are independent from protocol instrumentation (HTTP, gRPC, etc.) and are used
      # to inject Go probes, Node.js SIGUSR1 signal handlers, or Java agents into workloads
      # that match the selection rules. The `enabled` flag controls whether to attempt
      # injection. Non-empty runtime filters are not supported by the current adapter;
      # use capture rules for workload selection.
      runtimes:
        # Go runtime instrumentation allows Go packages to be instrumented with probes.
        # When enabled, Go services can use Go-specific probes. When disabled, they fall back
        # to generic network-only instrumentation.
        go:
          enabled: true
          # Reserved; keep empty.
          filter: {}
        # Node.js runtime instrumentation allows Node.js services to be instrumented via
        # SIGUSR1 signal injection. The enabled flag controls whether to attempt injection.
        nodejs:
          enabled: true
          # Reserved; keep empty.
          filter: {}
        # Java runtime instrumentation allows Java services to be instrumented via agent
        # attachment. The enabled flag controls whether to attempt agent injection.
        java:
          enabled: true
          # Reserved; keep empty.
          filter: {}
          # Java-specific debug controls.
          debug:
            enabled: false
            bytecode_instrumentation: false
          # Timeout for Java agent attachment.
          attach_timeout: 10s

      # network controls how network flow telemetry is captured and interpreted
      # for in-scope workloads (interfaces/protocols/cidrs, dedupe, enrichment, diagnostics).
      network:
        capture:
          # Master switch for network flow observability.
          enabled: false
          # Capture backend: socket_filter (default) or tc.
          source: socket_filter
          # Identity of this OBI agent in flow metadata.
          endpoint_identity:
            agent_ip: ""
            agent_ip_interface: external
            agent_ip_family: any
          # Scope/filtering for captured network traffic.
          selection:
            interfaces:
              include: []
              exclude:
                - lo
            protocols:
              include: []
              exclude: []
            # Optional CIDR definitions for src/dst network grouping attributes.
            cidrs: []
            direction: both
          # The target adapter imports one shared network filter and requires
          # the trace and metric maps to be identical.
          # Example (commented): keep pod traffic and drop kube-system.
          # filters:
          #   traces:
          #     dst.k8s.namespace.name:
          #       match: "*"
          #     src.k8s.namespace.name:
          #       not_match: "kube-system"
          #   metrics:
          #     dst.k8s.namespace.name:
          #       match: "*"
          #     src.k8s.namespace.name:
          #       not_match: "kube-system"
          filters:
            traces: {}
            metrics: {}
          # Flow cache and reduction behavior.
          flow_lifecycle:
            max_tracked_flows: 5000
            active_timeout: 5s
            deduplication:
              # Dedup strategy for multi-interface duplicate flows.
              strategy: first_come
              first_come_ttl: 0s
            # Packet sampling rate (0 means disabled/default behavior).
            sampling: 0
            # How to assign client/server ports when connection initiator is unknown.
            guess_ports: disable
          # How interface changes are detected.
          interface_discovery:
            # watch (event-based) or poll.
            mode: watch
            poll_interval: 10s
          # Optional network-level data enrichment.
          enrichment:
            geo_ip:
              ipinfo:
                path: ""
              maxmind:
                country_path: ""
                asn_path: ""
              cache:
                size: 512
                ttl: 1h0m0s
            reverse_dns:
              mode: none
              cache:
                size: 256
                ttl: 1h0m0s
          # Debug/diagnostics output controls.
          diagnostics:
            print_flows: false
        stats:
          # Master switch for TCP stats observability.
          enabled: false
          # Supported values: tcp_rtt, tcp_failed_connections, tcp_retransmits, tcp_io.
          features: []
          endpoint_identity:
            agent_ip: ""
            agent_ip_interface: external
            agent_ip_family: any
          selection:
            # Optional CIDR definitions for src/dst stats grouping attributes.
            cidrs: []
          # The target adapter imports one shared stats filter and requires
          # the trace and metric maps to be identical.
          filters:
            traces: {}
            metrics: {}
          enrichment:
            geo_ip:
              ipinfo:
                path: ""
              maxmind:
                country_path: ""
                asn_path: ""
              cache:
                size: 512
                ttl: 1h0m0s
            reverse_dns:
              mode: none
              cache:
                size: 256
                ttl: 1h0m0s
          diagnostics:
            print_stats: false

      # limits constrains cardinality and memory growth during capture.
      limits:
        network_packets: 5000
        metric_span_names: 100

      # engine controls eBPF engine internals.
      engine:
        debug:
          bpf: false
          protocol_print: false
        pid_filter:
          disabled: false
        batching:
          wakeup_len: 500
          batch_length: 100
          batch_timeout: 1s
        propagation:
          context_propagation: disabled
          override_bpfloop_enabled: false
          disable_black_box_cp: false
        traffic:
          control_backend: auto
          high_request_volume: false
          force_map_reader: auto
        transactions:
          max_duration: 5m0s
        maps:
          global_scale_factor: 0
        bpf_filesystem:
          path: /sys/fs/bpf/

      # safety enforces host/runtime capability checks.
      safety:
        enforce_system_capabilities: false

      # channels controls internal backpressure behavior.
      channels:
        buffer_len: 50
        send_timeout: 1m0s
        panic_on_send_timeout: false

      # telemetry tunes reporter caches and metric TTLs for OBI capture internals.
      telemetry:
        traces:
          reporters_cache_len: 256
        metrics:
          ttl: 5m0s
          reporters_cache_len: 256

    # enrich defines metadata enrichment behavior for telemetry.
    # Standalone-mode only: not valid in Collector receiver deployments.
    # In receiver mode, use k8sattributesprocessor and similar Collector processors instead.
    enrich:
      # Runtime configuration for metadata enrichers.
      enrichers:
        kubernetes:
          # autodetect: enable if a Kubernetes environment is detected (default).
          # enabled:    always enable.
          # disabled:   disable in standalone mode.
          # Receiver configurations must omit enrich entirely and use Collector processors.
          mode: autodetect
          cluster_name: ""
          auth:
            kubeconfig_path: ""
          # Informer cache/sync controls.
          informers:
            initial_sync_timeout: 30s
            resync_period: 30m0s
            disabled: []
          drop_external: false
          # Optional remote/local metadata cache controls.
          metadata_cache:
            address: ""
            restrict_local_node: false
            source_labels:
              service_name: ""
              service_namespace: ""
      # Service identity enrichment policy from configured enrichers.
      service_name:
        # Ordered backends used for peer and host name resolution.
        sources:
          - k8s
        # Shared cache for peer/host service-name lookups.
        cache:
          size: 1024
          ttl: 5m0s
        # Fallback names when peer/host resolution fails.
        unresolved_hosts:
          names:
            default: unresolved
            outgoing: outgoing
            incoming: incoming
      # Attribute enrichment/selection controls.
      attributes:
        # Per-signal attribute selection. Empty uses runtime defaults.
        select: {}
        # Additional attributes to include in named attribute groups.
        extra_group_attributes: {}
        # Metadata lookup retry policy.
        metadata_retry:
          timeout: 30s
          start_interval: 500ms
          max_interval: 5s

    # correlation propagates OBI trace context into external streams.
    # Standalone-mode only: not valid in Collector receiver deployments.
    # Log trace annotation as a Collector component is planned as a separate deliverable.
    correlation:
      log_trace_annotation:
        enabled: false
        # Reserved; keep empty.
        filter: {}
        field_names:
          trace_id: trace_id
          span_id: span_id
        plain_text:
          enabled: true
          placement: suffix
          multiline: first_line
        cache:
          ttl: 30m0s
          size: 128
        async_writer:
          workers: 8
          channel_len: 500

    # daemon controls the OBI process itself: log formatting, profiling, shutdown, and internal metrics.
    # Standalone-mode only: not valid in Collector receiver deployments.
    # In receiver mode the Collector manages these concerns.
    daemon:
      # Logging output behavior. Use top-level log_level for verbosity.
      logging:
        format: text
        config_format: ""
        debug_trace_output: disabled
      # Optional profiling endpoint.
      profiling:
        port: 0
      # Graceful shutdown controls.
      shutdown:
        timeout: 10s
      # OBI daemon's own metrics export configuration.
      internal_metrics:
        exporter: disabled
        prometheus:
          port: 0
          path: /internal/metrics
        bpf:
          scrape_interval: 15s
      # Prometheus-exporter-specific metric shaping for OBI standalone output.
      telemetry:
        metrics:
          prometheus:
            allow_service_graph_self_references: false
            span_metrics_service_cache_size: 10000
            extra_resource_attributes: []
            extra_span_resource_attributes: []