OpAMP Bridge: collector.DeepCopy() causes full spec updates → DaemonSet mode fails (should patch spec.config only) #4481
Description
Component(s)
opamp
What happened?
Description
When using the Operator’s OpAMP Bridge to update an OpenTelemetryCollector that runs in spec.mode: daemonset, the bridge fails with a webhook denial even if the remote config only intends to change spec.config. Manual kubectl patch of only spec.config succeeds, but the bridge’s update fails.
I suspect the bridge sends a full-object update (based on collector.DeepCopy() in Apply()), which unintentionally “touches” fields that the webhook forbids for DaemonSet pools, causing the rejection.
Steps to Reproduce
go // cmd/operator-opamp-bridge/internal/operator/client.go updatedCollector := collector.DeepCopy() ... return c.update(ctx, instance, updatedCollector)
Kubernetes Version
1.31
Operator version
0.138.0
Collector version
0.138.0
Environment information
Environment
• OpenTelemetry Operator: v0.138.0
• OpAMP Bridge image: ghcr.io/open-telemetry/opentelemetry-operator/operator-opamp-bridge:0.138.0
• CR namespace: opentelemetry-operator-system
• Collector image: otel/opentelemetry-collector-contrib:latest
• CR labels: opentelemetry.io/opamp-managed: "true"
• CR mode: daemonset
Log output
{"level":"error","ts":"2025-11-06T05:55:19Z","logger":"agent","msg":"failed to apply remote config","error":"admission webhook \"vopentelemetrycollectorcreateupdatebeta.kb.io\" denied the request: the OpenTelemetry Collector mode is set to daemonset, which does not support modification","stacktrace":"github.com/open-telemetry/opentelemetry-operator/cmd/operator-opamp-bridge/internal/agent.(*Agent).onMessage
.../agent.go:467
github.com/open-telemetry/opamp-go/client/types.CallbacksStruct.OnMessage
.../callbacks.go:161
github.com/open-telemetry/opamp-go/client/internal.(*receivedProcessor).ProcessReceivedMessage
.../receivedprocessor.go:153
github.com/open-telemetry/opamp-go/client/internal.(*wsReceiver).ReceiverLoop
.../wsreceiver.go:92"}Additional context
From testing, the operator webhook blocks DaemonSet updates that touch:
• spec.mode
• spec.image
• spec.targetAllocator
• spec.volumes
• spec.volumeMounts
• spec.env
• spec.resources
• spec.upgradeStrategy
(and sometimes other non-config spec mutations)
Manual config-only patches work, so the failure likely comes from the bridge’s full update including zero-values or unchanged fields that still register as a spec mutation.
Tip
React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it. Learn more here.