Why do you need it?
Is your feature request related to a problem? Please describe in details
Currently, the opensandbox egress component supports exporting OpenTelemetry metrics to a configured OTLP endpoint. However, the default egress network policy strictly denies all outbound traffic from the sandbox. This forces users to manually configure and inject explicit allowlist policies for the OTLP endpoint to get their metrics exported.
Since system-level telemetry and observability should be supported out-of-the-box, users should not need to manage underlying network policies just to enable default metrics. We need the opensandbox egress component to automatically permit this telemetry traffic by default.
How could it be?
A clear and concise description of what you want to happen. You can explain more about input of the feature, and output of it.
The opensandbox egress component should detect the target OTLP endpoint by automatically parsing the standard OpenTelemetry environment variables:First, check for OTEL_EXPORTER_OTLP_METRICS_ENDPOINT/OTEL_EXPORTER_OTLP_ENDPOINT.Based on the parsed host/IP and port from these variables, the egress controller should dynamically generate and inject an internal egress network allow rule, preventing the sandbox's default deny-all policy from blocking this traffic.
Proposed Solution
1、Automated Policy Injection: Update the opensandbox egress controller to automatically parse the configured OTLP endpoint destination from the standard env vars.Built-in Allowlist:
2、Automatically inject or apply an internal egress network rule that allows outbound traffic to that specific OTLP IP/domain and port.
Why do you need it?
Is your feature request related to a problem? Please describe in details
Currently, the opensandbox egress component supports exporting OpenTelemetry metrics to a configured OTLP endpoint. However, the default egress network policy strictly denies all outbound traffic from the sandbox. This forces users to manually configure and inject explicit allowlist policies for the OTLP endpoint to get their metrics exported.
Since system-level telemetry and observability should be supported out-of-the-box, users should not need to manage underlying network policies just to enable default metrics. We need the opensandbox egress component to automatically permit this telemetry traffic by default.
How could it be?
A clear and concise description of what you want to happen. You can explain more about input of the feature, and output of it.
The opensandbox egress component should detect the target OTLP endpoint by automatically parsing the standard OpenTelemetry environment variables:First, check for OTEL_EXPORTER_OTLP_METRICS_ENDPOINT/OTEL_EXPORTER_OTLP_ENDPOINT.Based on the parsed host/IP and port from these variables, the egress controller should dynamically generate and inject an internal egress network allow rule, preventing the sandbox's default deny-all policy from blocking this traffic.
Proposed Solution
1、Automated Policy Injection: Update the opensandbox egress controller to automatically parse the configured OTLP endpoint destination from the standard env vars.Built-in Allowlist:
2、Automatically inject or apply an internal egress network rule that allows outbound traffic to that specific OTLP IP/domain and port.