Linkerd distributed tracing with OpenCensus

[jjangga0214]

Context

I am trying to use OpenCensus and Linkerd.
Though Linkerd has an option to automatically provision OpenCensus and jaeger in its namespace, I don't want to use them. Instead, I deployed them independently by myself under the namespace named 'ops'.

Questions

1. Whether OpenCensus collector should be injected by Linkerd.

At the end (exactly 4th line from the last) of the the official docs, it says,

Ensure the OpenCensus collector is injected with the Linkerd proxy.

What does this mean?
Should I inject linkerd sidecar into OpenCensus collector pod?
If so, why?

2. Should I suffix serviceaccount name by namespace?

For example, let's say I've configured the default namespace like this.

apiVersion: v1
kind: Namespace
metadata:
  name: default
  annotations:
    linkerd.io/inject: enabled
    config.linkerd.io/trace-collector: my-opencensus-collector.ops:12345
    config.alpha.linkerd.io/trace-collector-service-account: my-opencensus-collector-service-account

my-opencensus-collector is in ops namespace, so I put .ops at the end of its service name, resulting my-opencensus-collector.ops:12345.
And the dedicated service account for the OpenCensus collector exists in ops namespace, too. In this case, should I put the namespace name at the end of service account name as well?

Which one would be right?

config.alpha.linkerd.io/trace-collector-service-account: my-opencensus-collector-service-account

or

config.alpha.linkerd.io/trace-collector-service-account: my-opencensus-collector-service-account.ops

Thanks!

[cpretzer]

@jjangga0214 I think you should add the namespace to the annotation, so that the collector knows where to find the service account.

The Linkerd proxy does need to be injected into the OpenCensus collector pod. I believe that this is because the traces are sent using the same mTLS provided by Linkerd for all meshed workloads, and that means that the proxies need to validate each other's identities. There may be more to it, but that's my basic understanding.

[jjangga0214]

@cpretzer Thank you so much for the explantion!
Now I got why the collector should be injected :)

But what do you mean by the below?

think you should add the namespace to the annotation,

In my case, the service account is on the same namespace from the collector, and the collector already knows the service account.
The question was how I can let Linkerd find the service account.

Anyway, thank you @cpretzer again for the reply!!

[cpretzer]

@jjangga0214 What I mean to say is that I believe that this is the correct annotation, with the namespace included:

config.alpha.linkerd.io/trace-collector-service-account: my-opencensus-collector-service-account.ops

[cpretzer]

hi @jjangga0214 did this configuration help answer the question? If so, would you mind marking the discussion as answered 😄