[processor/k8sattributes] Support name:tag@digest image name format

[zarbis]

Component(s)

processor/k8sattributes

What happened?

Description

For better integrity guarantees we've started using name:tag@digest image reference format (e.g. alpine:3.19@sha256:ae65dbf8749a7d4527648ccee1fa3deb6bfcae34cbc30fc67aa45c44dcaa90ee).

It doesn't seem to be part of OCI image spec, but many projects use it (for example Karpenter).

Steps to Reproduce

• Deploy Pod with image alpine:3.19@sha256:ae65dbf8749a7d4527648ccee1fa3deb6bfcae34cbc30fc67aa45c44dcaa90ee
• Create collector with k8sattributes processor:

processors:
  k8sattributes: 
    extract:
      metadata:
      - k8s.node.name
      - k8s.deployment.name
      - k8s.replicaset.name
      - k8s.daemonset.name
      - k8s.job.name
      - k8s.cronjob.name
      - k8s.statefulset.name
      - k8s.container.name
      - container.image.name
      - container.image.tag

• Observe telemetry metadata

Expected Result

container.image.name: alpine
container.image.tag: 3.19

Actual Result

container.image.name: alpine:3.19@sha
container.image.tag: ae65dbf8749a7d4527648ccee1fa3deb6bfcae34cbc30fc67aa45c44dcaa90ee

So basically split happens on last colon, not the first one.

Collector version

0.107.0

Environment information

Environment

K8s: 1.29

OpenTelemetry Collector configuration

No response

Log output

No response

Additional context

No response

[github-actions]

Pinging code owners:

• processor/k8sattributes: @dmitryax @fatsheep9146 @TylerHelmuth

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[TylerHelmuth]

This feels correct. The digest can instead be captured in container.image.id or container.image.repo_digests: https://github.com/open-telemetry/semantic-conventions/blob/main/docs/resource/container.md

[zarbis]

@TylerHelmuth indeed, you will get full content of ImageID from registry to digest in container.image.repo_digests, but image.name will still be incorrectly capturing @sha256 and image.tag would incorrectly be digest, regardless of capturing image.repo_digests.

Capturing image.repo_digests doesn't solve incorrect captures for name and tag.

[TylerHelmuth]

@zarbis I meant fixing the captured fields to

container.image.name: alpine
container.image.tag: 3.19
image.repo_digests: sha256:ae65dbf8749a7d4527648ccee1fa3deb6bfcae34cbc30fc67aa45c44dcaa90ee

feels the most right