@intentius/chant-lexicon-k8s 0.100.0 → 0.101.0

package/src/composites/__snapshots__/gke-otel-collector.snapshot.test.ts.snap

@@ -80,8 +80,8 @@ rules:
       - ''
     resources:
       - pods
+      - namespaces
       - nodes
-      - endpoints
     verbs:
       - get
       - list
@@ -94,39 +94,6 @@ rules:
       - get
       - list
       - watch
-  - apiGroups:
-      - batch
-    resources:
-      - jobs
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ''
-    resources:
-      - nodes/proxy
-    verbs:
-      - get
-  - apiGroups:
-      - ''
-    resources:
-      - nodes/stats
-      - configmaps
-      - events
-    verbs:
-      - create
-      - get
-  - apiGroups:
-      - ''
-    resources:
-      - configmaps
-    verbs:
-      - get
-      - update
-      - create
-    resourceNames:
-      - otel-container-insight-clusterleader
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -281,8 +248,8 @@ rules:
       - ''
     resources:
       - pods
+      - namespaces
       - nodes
-      - endpoints
     verbs:
       - get
       - list
@@ -295,39 +262,6 @@ rules:
       - get
       - list
       - watch
-  - apiGroups:
-      - batch
-    resources:
-      - jobs
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ''
-    resources:
-      - nodes/proxy
-    verbs:
-      - get
-  - apiGroups:
-      - ''
-    resources:
-      - nodes/stats
-      - configmaps
-      - events
-    verbs:
-      - create
-      - get
-  - apiGroups:
-      - ''
-    resources:
-      - configmaps
-    verbs:
-      - get
-      - update
-      - create
-    resourceNames:
-      - otel-container-insight-clusterleader
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1

package/src/composites/catalog.ts

@@ -2149,11 +2149,15 @@ export const compositeCatalog: CompositeEntry[] = [
     "lexicon": "k8s",
     "description": "Create a GkeOtelCollector composite — returns prop objects for a DaemonSet, ServiceAccount, ClusterRole, ClusterRoleBinding, and ConfigMap.",
     "bundles": [
+      "BatchProcessor",
       "ClusterRole",
       "ClusterRoleBinding",
       "ConfigMap",
       "DaemonSet",
+      "GoogleCloudExporter",
+      "OtlpReceiver",
       "Pipeline",
+      "ResourceDetectionProcessor",
       "ServiceAccount"
     ],
     "params": [
@@ -2991,6 +2995,8 @@ export const compositeCatalog: CompositeEntry[] = [
       "ConfigMap",
       "Deployment",
       "PodDisruptionBudget",
+      "Role",
+      "RoleBinding",
       "Service",
       "ServiceAccount"
     ],

package/src/composites/gke-otel-collector.snapshot.test.ts

@@ -4,7 +4,9 @@
  * `OtelCollector`, `OtelCollectorGateway` and `GkeOtelCollector` share the
  * collector resources in `otel-collector-agent.ts`. The snapshot was recorded
  * before the gateway work touched that file, so any change to the GKE output
- * made through the shared code fails here.
+ * made through the shared code fails here. #2923 changed it on purpose: the
+ * shared ClusterRole was narrowed to what k8sattributes and the config's
+ * receivers need (see `agentClusterRules`).
  */
 import { describe, expect, test } from "vitest";
 import { expandComposite } from "@intentius/chant";

package/src/composites/gke-otel-collector.ts

@@ -16,9 +16,11 @@ import {
   ResourceDetectionProcessor,
   GoogleCloudExporter,
   Pipeline,
+  buildCollectorConfig,
   collectorYaml,
 } from "@intentius/chant-lexicon-otel";
 import { collectorAgentResources, type CollectorAgentResources } from "./otel-collector-agent";
+import { agentClusterRules } from "./otel-collector-rbac";
 
 export interface GkeOtelCollectorProps {
   /** GKE cluster name. */
@@ -110,14 +112,15 @@ export const GkeOtelCollector = Composite((props: GkeOtelCollectorProps) => {
       attribute_mappings: [{ key: "service.name", replacement: "g.co/r/service/name" }],
     },
   });
-  const otelConfig = collectorYaml([
+  const entities = [
     otlp,
     batch,
     resourceDetection,
     googleCloud,
     new Pipeline({ signal: "metrics", receivers: [otlp], processors: [batch, resourceDetection], exporters: [googleCloud] }),
     new Pipeline({ signal: "traces", receivers: [otlp], processors: [batch, resourceDetection], exporters: [googleCloud] }),
-  ]);
+  ];
+  const otelConfig = collectorYaml(entities);
 
   // The DaemonSet, RBAC and ConfigMap are the ones OtelCollector builds too.
   return collectorAgentResources({
@@ -128,6 +131,9 @@ export const GkeOtelCollector = Composite((props: GkeOtelCollectorProps) => {
     extraLabels,
     configYaml: otelConfig,
     configDir: "/etc/otel",
+    // The ClusterRole OtelCollector shares: k8sattributes' rules, and none
+    // for receivers, since the config's only receiver is otlp (#2923).
+    clusterRules: agentClusterRules(buildCollectorConfig(entities).config),
     ports: [
       { containerPort: 4317, name: "otlp-grpc" },
       { containerPort: 4318, name: "otlp-http" },

package/src/composites/otel-collector-agent.ts

@@ -2,7 +2,8 @@
  * The Kubernetes resources an OpenTelemetry Collector agent needs, shared by
  * `OtelCollector` and `GkeOtelCollector`: a DaemonSet running the collector
  * with its config mounted from a ConfigMap, and a ServiceAccount bound to a
- * ClusterRole that reads pods, nodes and workloads.
+ * ClusterRole with the rules the caller works out from its config (see
+ * `agentClusterRules` in `otel-collector-rbac.ts`).
  *
  * The caller renders the collector config (with the otel lexicon's
  * `collectorYaml`) and says which ports the container exposes. Everything
@@ -15,6 +16,7 @@
 
 import { mergeDefaults } from "@intentius/chant";
 import { DaemonSet, ServiceAccount, ClusterRole, ClusterRoleBinding, ConfigMap } from "../generated";
+import type { CollectorPolicyRule } from "./otel-collector-rbac";
 
 export interface CollectorAgentOptions {
   name: string;
@@ -29,6 +31,8 @@ export interface CollectorAgentOptions {
   /** Directory the config is mounted in. The file is `<dir>/config.yaml`. */
   configDir: string;
   ports: Array<{ containerPort: number; name: string }>;
+  /** The ClusterRole's rules, from `agentClusterRules`. */
+  clusterRules: CollectorPolicyRule[];
   cpuRequest: string;
   memoryRequest: string;
   cpuLimit: string;
@@ -104,14 +108,7 @@ export function collectorAgentResources(opts: CollectorAgentOptions): CollectorA
       name: clusterRoleName,
       labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
     },
-    rules: [
-      { apiGroups: [""], resources: ["pods", "nodes", "endpoints"], verbs: ["get", "list", "watch"] },
-      { apiGroups: ["apps"], resources: ["replicasets"], verbs: ["get", "list", "watch"] },
-      { apiGroups: ["batch"], resources: ["jobs"], verbs: ["get", "list", "watch"] },
-      { apiGroups: [""], resources: ["nodes/proxy"], verbs: ["get"] },
-      { apiGroups: [""], resources: ["nodes/stats", "configmaps", "events"], verbs: ["create", "get"] },
-      { apiGroups: [""], resources: ["configmaps"], verbs: ["get", "update", "create"], resourceNames: ["otel-container-insight-clusterleader"] },
-    ],
+    rules: opts.clusterRules,
   }, defs?.clusterRole));
 
   const clusterRoleBinding = new ClusterRoleBinding(mergeDefaults({

package/src/composites/otel-collector-gateway.test.ts

@@ -4,9 +4,12 @@ import { expandComposite } from "@intentius/chant";
 import type { Declarable } from "@intentius/chant/declarable";
 import {
   DebugExporter,
+  K8sClusterReceiver,
+  K8sLeaderElectorExtension,
   LoadBalancingExporter,
   OtlpReceiver,
   Pipeline,
+  Service as CollectorService,
   TailSamplingProcessor,
   collectorTopology,
   validateCollectorConfig,
@@ -85,6 +88,48 @@ describe("OtelCollectorGateway", () => {
     expect(p(gw.clusterRoleBinding).roleRef.name).toBe("gw-role");
   });
 
+  test("an enabled k8s_leader_elector adds a Role for Leases in its lease_namespace", () => {
+    const elector = new K8sLeaderElectorExtension({ lease_name: "otel-cluster", lease_namespace: "leases" });
+    const cluster = new K8sClusterReceiver({ k8s_leader_elector: elector.componentId });
+    const debug = new DebugExporter({});
+    const pipeline = new Pipeline({ signal: "metrics", receivers: [cluster], exporters: [debug] });
+    const gw = OtelCollectorGateway({ name: "gw", namespace: "obs", config: [pipeline, new CollectorService({ extensions: [elector] })] });
+    expect(p(gw.leaseRole).metadata).toMatchObject({ name: "gw-leases", namespace: "leases" });
+    expect(p(gw.leaseRole).rules).toEqual([
+      { apiGroups: ["coordination.k8s.io"], resources: ["leases"], verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] },
+    ]);
+    expect(p(gw.leaseRoleBinding).roleRef).toEqual({ apiGroup: "rbac.authorization.k8s.io", kind: "Role", name: "gw-leases" });
+    expect(p(gw.leaseRoleBinding).subjects).toEqual([{ kind: "ServiceAccount", name: "gw-sa", namespace: "obs" }]);
+
+    // Declared but left out of service.extensions: the collector never starts it, so no Role.
+    const idle = OtelCollectorGateway({ config: [pipeline, elector, new CollectorService({ extensions: [] })] });
+    expect(config(idle).extensions).toHaveProperty(["k8s_leader_elector"]);
+    expect(idle.leaseRole).toBeUndefined();
+    expect(OtelCollectorGateway({}).leaseRole).toBeUndefined();
+  });
+
+  test("k8s_leader_elector extensions in two lease namespaces get a Role and RoleBinding in each", () => {
+    const a = new K8sLeaderElectorExtension({ name: "a", lease_name: "a", lease_namespace: "one" });
+    const b = new K8sLeaderElectorExtension({ name: "b", lease_name: "b", lease_namespace: "team-two" });
+    const debug = new DebugExporter({});
+    const otlp = new OtlpReceiver({ protocols: { grpc: { endpoint: "0.0.0.0:4317" } } });
+    const config = [new Pipeline({ signal: "traces", receivers: [otlp], exporters: [debug] }), new CollectorService({ extensions: [a, b] })];
+    const gw = OtelCollectorGateway({ name: "gw", namespace: "obs", config });
+    expect(p(gw.leaseRole).metadata).toMatchObject({ name: "gw-leases", namespace: "one" });
+    expect(p(gw.leaseRoleBinding).metadata).toMatchObject({ name: "gw-leases", namespace: "one" });
+    expect(p(gw.leaseRoleInTeamTwo).metadata).toMatchObject({ name: "gw-leases", namespace: "team-two" });
+    expect(p(gw.leaseRoleInTeamTwo).rules).toEqual(p(gw.leaseRole).rules);
+    expect(p(gw.leaseRoleBindingInTeamTwo).metadata).toMatchObject({ name: "gw-leases", namespace: "team-two" });
+    expect(p(gw.leaseRoleBindingInTeamTwo).subjects).toEqual([{ kind: "ServiceAccount", name: "gw-sa", namespace: "obs" }]);
+    const roles = manifests({ gw }).filter((d) => d.kind === "Role" || d.kind === "RoleBinding");
+    expect(roles.map((d) => `${d.kind}/${d.metadata.namespace}/${d.metadata.name}`).sort()).toEqual([
+      "Role/one/gw-leases",
+      "Role/team-two/gw-leases",
+      "RoleBinding/one/gw-leases",
+      "RoleBinding/team-two/gw-leases",
+    ]);
+  });
+
   test("the Deployment and ConfigMap say they are a gateway and name each other", () => {
     const gw = OtelCollectorGateway({ name: "gw" });
     expect(p(gw.deployment).metadata.annotations).toEqual({ [A.role]: "gateway", [A.config]: "gw-config" });
@@ -147,6 +192,36 @@ describe("gatewayExporter", () => {
     expect(() => gatewayExporter(gw)).toThrow(/no port named "otlp-grpc" \(it has: otlp-http\)/);
   });
 
+  test("with protocol http, an otlphttp exporter at the gateway's OTLP HTTP port", () => {
+    const exporter = gatewayExporter(OtelCollectorGateway({}), { protocol: "http" });
+    expect(exporter.componentId).toBe("otlphttp/gateway");
+    expect(p(exporter)).toEqual({ name: "gateway", endpoint: "http://otel-gateway.observability.svc:4318" });
+    const agent = agentOf(exporter, { name: "agent" });
+    expect(config(agent).exporters?.["otlphttp/gateway"]).toEqual({ endpoint: "http://otel-gateway.observability.svc:4318" });
+    expect(p(agent.configMap).metadata.annotations[A.gateways]).toBe("observability/otel-gateway=service");
+    expect(validateCollectorConfig(config(agent))).toEqual([]);
+  });
+
+  test("with protocol http and TLS, https and the TLS settings without insecure", () => {
+    const exporter = gatewayExporter(OtelCollectorGateway({ name: "gw", namespace: "obs" }), { protocol: "http", tls: { ca_file: "/certs/ca.pem" } });
+    expect(p(exporter)).toEqual({ name: "gateway", endpoint: "https://gw.obs.svc:4318", tls: { ca_file: "/certs/ca.pem" } });
+  });
+
+  test("with protocol grpc, the default otlp exporter", () => {
+    const gw = OtelCollectorGateway({});
+    expect(p(gatewayExporter(gw, { protocol: "grpc" }))).toEqual(p(gatewayExporter(gw)));
+  });
+
+  test("protocol http with loadBalance is refused", () => {
+    expect(() => gatewayExporter(OtelCollectorGateway({}), { protocol: "http", loadBalance: true })).toThrow(/gRPC only/);
+  });
+
+  test("a gateway without an OTLP HTTP port is refused for protocol http", () => {
+    const otlp = new OtlpReceiver({ protocols: { grpc: { endpoint: "0.0.0.0:4317" } } });
+    const gw = OtelCollectorGateway({ config: [new Pipeline({ signal: "traces", receivers: [otlp], exporters: [new DebugExporter({})] })] });
+    expect(() => gatewayExporter(gw, { protocol: "http" })).toThrow(/no port named "otlp-http" \(it has: otlp-grpc\)/);
+  });
+
   test("the otel topology reports the gateway as the exporter's endpoint", () => {
     const agent = agentOf(gatewayExporter(OtelCollectorGateway({ namespace: "obs" }), { loadBalance: true }));
     const exporters = collectorTopology(config(agent)).exporters;
@@ -182,13 +257,35 @@ describe("OtelCollector wired to a gateway", () => {
     expect(p(agent.configMap).metadata.annotations[A.gateways]).toBeUndefined();
   });
 
-  test("resolvers in two namespaces are refused", () => {
+  test("resolvers in two namespaces get a Role and RoleBinding in each", () => {
     const otlp = new OtlpReceiver({ protocols: { grpc: { endpoint: "0.0.0.0:4317" } } });
     const a = gatewayExporter(OtelCollectorGateway({ namespace: "one" }), { loadBalance: true, name: "a" });
-    const b = gatewayExporter(OtelCollectorGateway({ namespace: "two" }), { loadBalance: true, name: "b" });
-    expect(() =>
-      OtelCollector({ config: [new Pipeline({ signal: "traces", receivers: [otlp], exporters: [a, b] })] }),
-    ).toThrow(/resolve Services in one and two/);
+    const b = gatewayExporter(OtelCollectorGateway({ namespace: "team-two" }), { loadBalance: true, name: "b" });
+    const agent = OtelCollector({ name: "agent", namespace: "agents", config: [new Pipeline({ signal: "traces", receivers: [otlp], exporters: [a, b] })] });
+    expect(p(agent.endpointsRole).metadata).toMatchObject({ name: "agent-endpoints", namespace: "one" });
+    expect(p(agent.endpointsRoleInTeamTwo).metadata).toMatchObject({ name: "agent-endpoints", namespace: "team-two" });
+    expect(p(agent.endpointsRoleInTeamTwo).rules).toEqual(p(agent.endpointsRole).rules);
+    for (const binding of [agent.endpointsRoleBinding, agent.endpointsRoleBindingInTeamTwo]) {
+      expect(p(binding).roleRef).toEqual({ apiGroup: "rbac.authorization.k8s.io", kind: "Role", name: "agent-endpoints" });
+      expect(p(binding).subjects).toEqual([{ kind: "ServiceAccount", name: "agent-sa", namespace: "agents" }]);
+    }
+    expect(p(agent.endpointsRoleBindingInTeamTwo).metadata.namespace).toBe("team-two");
+    const roles = manifests({ agent }).filter((d) => d.kind === "Role" || d.kind === "RoleBinding");
+    expect(roles.map((d) => `${d.kind}/${d.metadata.namespace}/${d.metadata.name}`).sort()).toEqual([
+      "Role/one/agent-endpoints",
+      "Role/team-two/agent-endpoints",
+      "RoleBinding/one/agent-endpoints",
+      "RoleBinding/team-two/agent-endpoints",
+    ]);
+  });
+
+  test("resolvers in one namespace keep a single Role", () => {
+    const otlp = new OtlpReceiver({ protocols: { grpc: { endpoint: "0.0.0.0:4317" } } });
+    const gw = OtelCollectorGateway({ namespace: "one" });
+    const a = gatewayExporter(gw, { loadBalance: true, name: "a" });
+    const b = gatewayExporter(gw, { loadBalance: true, name: "b", routingKey: "service" });
+    const agent = OtelCollector({ config: [new Pipeline({ signal: "traces", receivers: [otlp], exporters: [a, b] })] });
+    expect(Object.keys((agent as any).members).filter((k) => k.startsWith("endpoints")).sort()).toEqual(["endpointsRole", "endpointsRoleBinding"]);
   });
 
   test("the agent's ConfigMap and DaemonSet name the gateway and how they reach it", () => {

package/src/composites/otel-collector-gateway.ts

@@ -21,28 +21,35 @@ import {
   otlpCollector,
   LoadBalancingExporter,
   OtlpExporter,
+  OtlpHttpExporter,
   COLLECTOR_IMAGE,
   type LoadBalancingRoutingKey,
   type OTelComponent,
   type Signal,
   type TLSClientSettings,
 } from "@intentius/chant-lexicon-otel";
-import { Deployment, Service, ServiceAccount, ClusterRole, ClusterRoleBinding, ConfigMap, PodDisruptionBudget } from "../generated";
+import {
+  Deployment,
+  Service,
+  ServiceAccount,
+  ClusterRole,
+  ClusterRoleBinding,
+  ConfigMap,
+  PodDisruptionBudget,
+  Role,
+  RoleBinding,
+} from "../generated";
 import { collectorConfigMap, collectorContainer } from "./otel-collector-agent";
+import { namespacedRoles, type CollectorPolicyRule } from "./otel-collector-rbac";
 import {
   collectorRuntime,
+  leaderElectorLeaseNamespaces,
   markGatewayExporter,
   OTEL_COLLECTOR_ANNOTATIONS,
   type GatewayRouting,
 } from "./otel-collector-shape";
 
-/** One RBAC rule, as a ClusterRole lists it. */
-export interface CollectorPolicyRule {
-  apiGroups: string[];
-  resources: string[];
-  verbs: string[];
-  resourceNames?: string[];
-}
+export type { CollectorPolicyRule };
 
 export interface OtelCollectorGatewayProps {
   /** Gateway name (default: "otel-gateway"). */
@@ -90,6 +97,8 @@ export interface OtelCollectorGatewayProps {
     podDisruptionBudget?: Partial<Record<string, unknown>>;
     clusterRole?: Partial<Record<string, unknown>>;
     clusterRoleBinding?: Partial<Record<string, unknown>>;
+    leaseRole?: Partial<Record<string, unknown>>;
+    leaseRoleBinding?: Partial<Record<string, unknown>>;
   };
 }
 
@@ -103,13 +112,23 @@ export type OtelCollectorGatewayResult = {
   podDisruptionBudget?: InstanceType<typeof PodDisruptionBudget>;
   clusterRole?: InstanceType<typeof ClusterRole>;
   clusterRoleBinding?: InstanceType<typeof ClusterRoleBinding>;
+  /**
+   * Access to Leases for the `k8s_leader_elector` extensions the config
+   * enables, in the first `lease_namespace`. Each further namespace gets
+   * `leaseRoleIn<Namespace>` and `leaseRoleBindingIn<Namespace>`.
+   */
+  leaseRole?: InstanceType<typeof Role>;
+  leaseRoleBinding?: InstanceType<typeof RoleBinding>;
+  [member: `leaseRoleIn${string}`]: InstanceType<typeof Role>;
+  [member: `leaseRoleBindingIn${string}`]: InstanceType<typeof RoleBinding>;
 };
 
 /**
  * Create an OtelCollectorGateway composite. Returns a Deployment, a ClusterIP
  * Service, a headless Service, a ServiceAccount and a ConfigMap, a
- * PodDisruptionBudget when there is more than one replica, and a ClusterRole
- * and binding when `clusterRules` is set.
+ * PodDisruptionBudget when there is more than one replica, a ClusterRole
+ * and binding when `clusterRules` is set, and a Role and binding for Leases
+ * when the config enables a `k8s_leader_elector` extension.
  *
  * @example
  * ```ts
@@ -239,14 +258,42 @@ export const OtelCollectorGateway = Composite((props: OtelCollectorGatewayProps)
       }
     : {};
 
-  return { deployment, service, headlessService, serviceAccount, configMap, ...pdb, ...rbac };
+  // A k8s_leader_elector extension takes a Lease in its lease_namespace, so
+  // the gateway's ServiceAccount gets the access the extension's README
+  // suggests (collector-contrib v0.130.0, extension/k8sleaderelector), with
+  // one Role and RoleBinding in each namespace the electors use.
+  const leaseRbac = namespacedRoles({
+    key: "lease",
+    name: `${name}-leases`,
+    namespaces: leaderElectorLeaseNamespaces(runtime.built),
+    rules: [
+      {
+        apiGroups: ["coordination.k8s.io"],
+        resources: ["leases"],
+        verbs: ["get", "list", "watch", "create", "update", "patch", "delete"],
+      },
+    ],
+    labels: { ...commonLabels, "app.kubernetes.io/component": "rbac" },
+    serviceAccount: { name: saName, namespace },
+    roleDefaults: defs?.leaseRole,
+    roleBindingDefaults: defs?.leaseRoleBinding,
+  });
+
+  return { deployment, service, headlessService, serviceAccount, configMap, ...pdb, ...rbac, ...leaseRbac } as OtelCollectorGatewayResult;
 }, "OtelCollectorGateway");
 
 // ── Agent side ───────────────────────────────────────────────────────
 
 export interface GatewayExporterOptions {
-  /** Exporter name, so the id is `otlp/<name>` or `loadbalancing/<name>` (default: "gateway"). */
+  /** Exporter name, so the id is `otlp/<name>`, `otlphttp/<name>` or `loadbalancing/<name>` (default: "gateway"). */
   name?: string;
+  /**
+   * OTLP over gRPC (an `otlp` exporter) or over HTTP (an `otlphttp`
+   * exporter). The `loadbalancing` exporter sends OTLP over gRPC only at the
+   * pinned collector version, so `http` cannot be combined with
+   * `loadBalance`. Default: "grpc".
+   */
+  protocol?: "grpc" | "http";
   /**
    * Send each trace to one gateway replica through the headless Service with
    * a `loadbalancing` exporter, instead of to the ClusterIP Service with an
@@ -262,9 +309,13 @@ export interface GatewayExporterOptions {
   resolver?: "k8s" | "dns";
   /** What the `loadbalancing` exporter hashes on (default: "traceID"). */
   routingKey?: LoadBalancingRoutingKey;
-  /** The gateway Service port to send to, by name (default: "otlp-grpc"). */
+  /** The gateway Service port to send to, by name (default: "otlp-grpc", or "otlp-http" with `protocol: "http"`). */
   port?: string;
-  /** TLS for the connection to the gateway (default: `{ insecure: true }`, plaintext inside the cluster). */
+  /**
+   * TLS for the connection to the gateway (default: `{ insecure: true }`,
+   * plaintext inside the cluster). Over HTTP, `insecure` picks the scheme
+   * (`http://`, or `https://` without it) and the other settings are passed on.
+   */
   tls?: TLSClientSettings;
 }
 
@@ -285,6 +336,9 @@ function serviceMeta(service: InstanceType<typeof Service>): ServiceMeta {
  * config listens on.
  *
  * By default an `otlp` exporter at `<service>.<namespace>.svc:<port>`. With
+ * `protocol: "http"`, an `otlphttp` exporter at
+ * `http://<service>.<namespace>.svc:<port>` (`https://` when `tls` is not
+ * `insecure`), sending to the gateway's OTLP HTTP port. With
  * `loadBalance`, a `loadbalancing` exporter routing by trace id to the
  * headless Service, through the `k8s` resolver (`<headless>.<namespace>`) or
  * the `dns` resolver (`<headless>.<namespace>.svc`). Put it in the agent's
@@ -294,8 +348,15 @@ function serviceMeta(service: InstanceType<typeof Service>): ServiceMeta {
 export function gatewayExporter(
   gateway: OtelCollectorGatewayResult,
   options: GatewayExporterOptions = {},
-): InstanceType<typeof OtlpExporter> | InstanceType<typeof LoadBalancingExporter> {
-  const { name = "gateway", loadBalance = false, resolver = "k8s", routingKey = "traceID", port: portName = "otlp-grpc", tls = { insecure: true } } = options;
+): InstanceType<typeof OtlpExporter> | InstanceType<typeof OtlpHttpExporter> | InstanceType<typeof LoadBalancingExporter> {
+  const { name = "gateway", protocol = "grpc", loadBalance = false, resolver = "k8s", routingKey = "traceID", tls = { insecure: true } } = options;
+  const portName = options.port ?? (protocol === "http" ? "otlp-http" : "otlp-grpc");
+  if (protocol === "http" && loadBalance) {
+    throw new Error(
+      `gatewayExporter: the loadbalancing exporter sends OTLP over gRPC only; ` +
+        `use protocol "grpc" with loadBalance, or drop loadBalance to send OTLP over HTTP to the gateway's Service`,
+    );
+  }
   const deploymentName = (gateway.deployment as unknown as { props: { metadata: { name: string } } }).props.metadata.name;
   const target = serviceMeta(loadBalance ? gateway.headlessService : gateway.service);
   const port = target.ports.find((p) => p.name === portName)?.port;
@@ -303,7 +364,7 @@ export function gatewayExporter(
     const names = target.ports.map((p) => p.name).join(", ") || "none";
     throw new Error(
       `gatewayExporter: Service ${target.namespace}/${target.name} has no port named "${portName}" (it has: ${names}); ` +
-        `give the gateway an OTLP gRPC receiver or pass the port name`,
+        `give the gateway an OTLP ${protocol === "http" ? "HTTP" : "gRPC"} receiver or pass the port name`,
     );
   }
   const routing: GatewayRouting = loadBalance ? "loadbalancing" : "service";
@@ -318,8 +379,25 @@ export function gatewayExporter(
             ? { dns: { hostname: `${target.name}.${target.namespace}.svc`, port: String(port) } }
             : { k8s: { service: `${target.name}.${target.namespace}`, ports: [port] } },
       })
-    : new OtlpExporter({ name, endpoint: `${target.name}.${target.namespace}.svc:${port}`, tls });
+    : protocol === "http"
+      ? otlpHttpExporter(name, `${target.name}.${target.namespace}.svc:${port}`, tls)
+      : new OtlpExporter({ name, endpoint: `${target.name}.${target.namespace}.svc:${port}`, tls });
 
   markGatewayExporter(exporter, { name: deploymentName, namespace: target.namespace, routing });
   return exporter;
 }
+
+/**
+ * An `otlphttp` exporter to `host:port`. Its endpoint is a URL, so TLS is the
+ * scheme: `insecure` gives `http://`, anything else `https://` with the
+ * remaining TLS settings (a CA, a client certificate) kept.
+ */
+function otlpHttpExporter(name: string, hostPort: string, tls: TLSClientSettings): InstanceType<typeof OtlpHttpExporter> {
+  const { insecure, ...rest } = tls;
+  const scheme = insecure ? "http" : "https";
+  return new OtlpHttpExporter({
+    name,
+    endpoint: `${scheme}://${hostPort}`,
+    ...(Object.keys(rest).length ? { tls: rest } : {}),
+  });
+}