OpenTelemetry Operator无法注入.Net自动插桩库问题求助

我们计划将OpenTelemetry作为所有应用的标准可观测方案，已在Kubernetes集群中安装opentelemetry-operator，OTel Collector与Instrumentation组件运行正常。但为某一.Net部署添加注解instrumentation.opentelemetry.io/inject-dotnet: opentelemetry-operator-system/my-instrumentation后，无法完成自动插桩库的注入，日志输出如下：

2023-04-04T00:57:56-04:00 cp: can't preserve ownership of '/otel-auto-instrumentation/./store/x64/net7.0/microsoft.extensions.configuration.binder/7.0.0/lib/net7.0': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve ownership of '/otel-auto-instrumentation/./store/x64/net7.0/microsoft.extensions.configuration.binder/7.0.0/lib': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve ownership of '/otel-auto-instrumentation/./store/x64/net7.0/microsoft.extensions.configuration.binder/7.0.0': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve ownership of '/otel-auto-instrumentation/./store/x64/net7.0/microsoft.extensions.configuration.binder': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve ownership of '/otel-auto-instrumentation/./store/x64/net7.0/mongodb.driver.core/2.13.3/runtimes/win/native/libzstd.dll': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve ownership of '/otel-auto-instrumentation/./store/x64/net7.0/mongodb.driver.core/2.13.3/runtimes/win/native/snappy32.dll': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve ownership of '/otel-auto-instrumentation/./store/x64/net7.0/mongodb.driver.core/2.13.3/runtimes/win/native/snappy64.dll': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve ownership of '/otel-auto-instrumentation/./store/x64/net7.0/mongodb.driver.core/2.13.3/runtimes/win/native': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve ownership of '/otel-auto-instrumentation/./store/x64/net7.0/mongodb.driver.core/2.13.3/runtimes/win': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve ownership of '/otel-auto-instrumentation/./store/x64/net7.0/mongodb.driver.core/2.13.3/runtimes': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve ownership of '/otel-auto-instrumentation/./store/x64/net7.0/mongodb.driver.core/2.13.3/lib/netstandard2.1/MongoDB.Driver.Core.dll': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve ownership of '/otel-auto-instrumentation/./store/x64/net7.0/mongodb.driver.core/2.13.3/lib/netstandard2.1': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve ownership of '/otel-auto-instrumentation/./store/x64/net7.0/mongodb.driver.core/2.13.3/lib': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve ownership of '/otel-auto-instrumentation/./store/x64/net7.0/mongodb.driver.core/2.13.3': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve ownership of '/otel-auto-instrumentation/./store/x64/net7.0/mongodb.driver.core': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve ownership of '/otel-auto-instrumentation/./store/x64/net7.0/microsoft.extensions.configuration/7.0.0/lib/net7.0/Microsoft.Extensions.Configuration.dll': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve ownership of '/otel-auto-instrumentation/./store/x64/net7.0/microsoft.extensions.configuration/7.0.0/lib/net7.0': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve ownership of '/otel-auto-instrumentation/./store/x64/net7.0/microsoft.extensions.configuration/7.0.0/lib': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve ownership of '/otel-auto-instrumentation/./store/x64/net7.0/microsoft.extensions.configuration/7.0.0': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve ownership of '/otel-auto-instrumentation/./store/x64/net7.0/microsoft.extensions.configuration': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve ownership of '/otel-auto-instrumentation/./store/x64/net7.0': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve ownership of '/otel-auto-instrumentation/./store/x64': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve ownership of '/otel-auto-instrumentation/./store': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve times of '/otel-auto-instrumentation/.': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve ownership of '/otel-auto-instrumentation/.': Operation not permitted
2023-04-04T00:57:56-04:00 cp: can't preserve permissions of '/otel-auto-instrumentation/.': Operation not permitted

所有部署与Pod均采用非root用户运行。

这些错误源于自动插桩初始化脚本复制文件时，尝试保留原文件的所有权、权限和时间戳，但非root用户无足够权限执行这些操作。以下是几种可行的解决方式：

1. 修改Instrumentation配置，跳过权限保留 #

在你的Instrumentation资源中添加环境变量，让复制脚本仅复制文件内容，不保留权限相关属性：

apiVersion: opentelemetry.io/v1alpha1
kind: Instrumentation
metadata:
  name: my-instrumentation
  namespace: opentelemetry-operator-system
spec:
  dotnet:
    image: otel/opentelemetry-dotnet-instrumentation:latest
    env:
      - name: OTEL_DOTNET_AUTO_COPY_FILES_SKIP_PERMISSIONS
        value: "true"

2. 调整Pod的SecurityContext权限 #

若上述方法无效，可给Pod添加必要的权限能力，让非root用户能修改文件所有权：

securityContext:
  capabilities:
    add: ["CHOWN", "FOWNER"]

注意此方式仅添加必要权限，避免过度开放。

3. 使用优化权限的插桩镜像 #

部分新版本的OTel .NET插桩镜像已优化/otel-auto-instrumentation目录的权限，设置为全局可读，非root用户可直接访问，无需复制文件，可尝试升级镜像版本。

验证方式 #

修改配置后重新部署应用Pod，检查初始化容器日志是否不再出现权限错误，同时确认应用是否正常加载插桩库。

内容的提问来源于stack exchange，提问作者Sajid