Ansible OTel Collector Deployment

To automate the deployment of the OpenTelemetry (OTel) Collector using Ansible, you can use a structured playbook that handles the installation, configuration, and service management.

Below is a production-ready example for Windows (IIS environments) and Linux, integrating your requirements for GitHub, Smallstep CA, and Caddy.

1. Ansible Playbook: deploy_otel.yml

This playbook targets your infrastructure nodes and ensures the OTel Collector is installed and running with your custom configuration.

YAML

---
- name: Deploy and Configure OpenTelemetry Collector
hosts: all
become: yes
vars:
otel_version: "0.96.0"
config_path: "/etc/otelcol-contrib/config.yaml"
# Cert paths for Smallstep CA integration
cert_file: "/etc/otelcol-contrib/certs/client.crt"
key_file: "/etc/otelcol-contrib/certs/client.key"

tasks:
- name: Ensure configuration directory exists
file:
path: "/etc/otelcol-contrib/certs"
state: directory
mode: '0755'

- name: Download OTel Collector (Linux)
get_url:
url: "https://github.com/open-telemetry/opentelemetry-collector-releases/releases/download/v{{ otel_version }}/otelcol-contrib_{{ otel_version }}_linux_amd64.deb"
dest: "/tmp/otelcol.deb"
when: ansible_os_family == "Debian"

- name: Install OTel Collector (Debian)
apt:
deb: "/tmp/otelcol.deb"
when: ansible_os_family == "Debian"

- name: Deploy OTel Configuration Template
template:
src: otel-config.yaml.j2
dest: "{{ config_path }}"
notify: Restart OTel Collector

- name: Ensure OTel Service is Started
service:
name: otelcol-contrib
state: started
enabled: yes

handlers:
- name: Restart OTel Collector
service:
name: otelcol-contrib
state: restarted

2. Configuration Template: otel-config.yaml.j2

This template defines the OTel pipeline, including IIS/Windows monitoring, Node.js microservices, and secure exports via mTLS.

YAML

receivers:
# Host metrics (Physical HP ProLiant / VM)
hostmetrics:
collection_interval: 30s
scrapers:
cpu:
memory:
disk:
network:

# IIS/Windows Specific (Conditional for Windows nodes)
windowseventlog:
channel: System

# OTLP for Node.js, Astro, and Dockerized apps
otlp:
protocols:
grpc:
endpoint: 0.0.0.0:4317
http:
endpoint: 0.0.0.0:4318

processors:
batch:
resourcedetection:
detectors: [env, system]

exporters:
# Secure OTLP Export with Smallstep CA Certs
otlp/secure:
endpoint: "telemetry-backend.example.com:4317"
tls:
ca_file: "/etc/otelcol-contrib/certs/ca.crt"
cert_file: "{{ cert_file }}"
key_file: "{{ key_file }}"

service:
pipelines:
metrics:
receivers: [hostmetrics, otlp]
processors: [batch, resourcedetection]
exporters: [otlp/secure]
logs:
receivers: [windowseventlog, otlp]
processors: [batch]
exporters: [otlp/secure]

3. CI/CD Integration: .github/workflows/deploy.yml

Automate the execution of your Ansible playbook whenever you update your configuration in GitHub.

YAML

name: CI/CD OTel Deployment
on:
push:
branches: [ main ]
paths:
- 'ansible/**'

jobs:
deploy:
runs-on: ubuntu-latest
steps:
- name: Checkout Source Code
uses: actions/checkout@v3

- name: Run Ansible Playbook
uses: dawidd6/action-ansible-playbook@v2
with:
playbook: ansible/deploy_otel.yml
inventory: ansible/inventory.ini
key: ${{ secrets.SSH_PRIVATE_KEY }}
options: |
--extra-vars "otel_version=0.96.0"

How this supports your Architecture:

• Infrastructure as Code (IaC): The entire monitoring setup is versioned in GitHub.
• DevSecOps: The GitHub Actions workflow ensures that every change is automatically deployed and can be audited.
• Security: The otlp/secure exporter uses certificates issued by Smallstep CA to ensure all telemetry data (from IIS, Node.js, or Docker) is encrypted in transit.
• Hybrid Monitoring: The receivers are configured to handle legacy Windows Server logs alongside modern OTLP data from Astro and microservices.
  +2