feat: Add global OTEL extension, backend service, and release automation to Argo template

.github/workflows/release.yml

@@ -0,0 +1,42 @@
+name: Release
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-and-push-backend:
+    name: Build and push backend image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/glueops/argocd-otel-extension-api
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: ./backend
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.gitignore

@@ -0,0 +1 @@
+backend/node_modules/

README.md

@@ -17,6 +17,13 @@ wget -O argocd.yaml https://raw.githubusercontent.com/GlueOps/docs-argocd/main/a
     - Replace `placeholder_tenant_key` with your tenant/company key. Example: `antoniostacos`
     - Replace `placeholder_cluster_environment` with your cluster_environment name. Example: `nonprod`
     - The `placeholder_argocd_oidc_client_secret_from_dex` that you specify needs to be the same one you use in the `platform.yaml` for ArgoCD. If they do not match you will not be able to login.
+    - OTEL is tenant-overridable through the Terraform module inputs:
+      - `otel_enabled` enables or disables the global ArgoCD OTEL extension for the tenant. The default is `false`, so tenants must opt in explicitly.
+      - `otel_extension_version` sets the GitHub release tag used for the extension tarball.
+      - `otel_backend_tag` sets the OTEL backend API image tag.
+      - `tempo_base_url` sets the in-cluster Tempo endpoint. Leave it empty to disable traces while keeping metrics enabled.
+    - If you are installing from the downloaded `argocd.yaml` directly instead of using Terraform, replace `placeholder_otel_enabled` with `true` or `false` before running Helm. Leave the OTEL placeholder comments in place to keep OTEL disabled, or replace those placeholder comments with concrete OTEL config, RBAC, server extension, and backend object blocks if you want OTEL enabled without Terraform.
+    - The OTEL extension is defined in `argocd.yaml` and loaded by ArgoCD itself, so it is global for all Argo applications without changing app templates.
 
 - Install ArgoCD
 
@@ -38,14 +45,20 @@ kubectl get pods -n glueops-core
 
 ```hcl
 module "argocd_helm_values" {
-  source              = "git::https://github.com/GlueOps/docs-argocd.git"
-  tenant_key          = "antoniostacos"
-  cluster_environment = "nonprod"
-  client_secret       = "Zsbui/29YEqoGOzuI8snlqGcdaRYPSLocwLXDB5GhZY="
-  glueops_root_domain = "onglueops.com"
+  source                   = "git::https://github.com/GlueOps/docs-argocd.git"
+  tenant_key               = "antoniostacos"
+  cluster_environment      = "nonprod"
+  client_secret            = "Zsbui/29YEqoGOzuI8snlqGcdaRYPSLocwLXDB5GhZY="
+  glueops_root_domain      = "onglueops.com"
+  argocd_app_version       = "v2.8.6"
+  gatekeeper_tag           = "v1.0.0"
+  otel_enabled             = true
+  otel_extension_version   = "v0.1.2"
+  otel_backend_tag         = "v0.1.2"
+  tempo_base_url           = "http://tempo.glueops-core-tempo.svc.cluster.local:3200"
 }
 
 output "argocd_helm_values" {
-  value = module.argocd_yaml.argocd
+  value = module.argocd_helm_values.helm_values
 }
 ```

argocd.yaml.tpl

@@ -165,6 +165,7 @@ applicationSet:
 configs:
   params:
     server.insecure: true
+    server.enable.proxy.extension: placeholder_otel_enabled
   cm:
     # @ignored
     timeout.reconciliation: 10s
@@ -217,15 +218,18 @@ configs:
       clientID: argocd
       clientSecret: placeholder_argocd_oidc_client_secret_from_dex
       redirectURI: https://argocd.placeholder_cluster_environment.placeholder_tenant_key.placeholder_glueops_root_domain/api/dex/callback
+    # placeholder_otel_extension_config
   rbac:
     # -- A good reference for this is: https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/
     # This default policy is for GlueOps orgs/teams only. Please change it to reflect your own orgs/teams.
     # `development` is the project that all developers are expected to deploy under
     # @default -- `''` (See [values.yaml])
     policy.csv: |
       placeholder_argocd_rbac_policies
+      # placeholder_otel_rbac_policies
   # @ignored
 server:
+  # placeholder_otel_server_extensions
   # @ignored
   affinity:
     nodeAffinity:
@@ -296,6 +300,7 @@ extraObjects:
                     name: argocd-server
                     port:
                       number: 80
+# placeholder_otel_backend_objects
 
   - apiVersion: apiextensions.k8s.io/v1
     kind: CustomResourceDefinition

backend/.dockerignore

@@ -0,0 +1,3 @@
+node_modules
+npm-debug.log
+.npm

backend/Dockerfile

@@ -0,0 +1,8 @@
+FROM node:20-alpine
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci --omit=dev
+COPY src/ ./src/
+EXPOSE 8000
+USER node
+CMD ["node", "src/server.js"]

backend/README.md

@@ -0,0 +1,46 @@
+# argocd-otel-extension-api
+
+Backend service for the ArgoCD OTEL UI extension. It proxies Prometheus and Tempo endpoints so the extension frontend can query metrics and traces without direct cluster network access.
+
+## Endpoints
+
+| Path | Proxied to |
+|------|------------|
+| `GET /healthz` | Local health check — returns `{"status":"ok"}` |
+| `ANY /prometheus/*` | `PROMETHEUS_BASE_URL/*` (path prefix stripped) |
+| `ANY /tempo/*` | `TEMPO_BASE_URL/*` (path prefix stripped) |
+
+### Prometheus example
+```
+GET /prometheus/api/v1/query?query=up
+```
+Proxied to `$PROMETHEUS_BASE_URL/api/v1/query?query=up`.
+
+### Tempo example
+```
+GET /tempo/api/search?tags=service.name%3Dmyapp
+```
+Proxied to `$TEMPO_BASE_URL/api/search?tags=service.name%3Dmyapp`.
+
+## Environment variables
+
+| Variable | Required | Default | Description |
+|----------|----------|---------|-------------|
+| `PORT` | No | `8000` | Port the server listens on |
+| `PROMETHEUS_BASE_URL` | Yes (for metrics) | `""` | In-cluster Prometheus base URL, e.g. `http://kps-prometheus.glueops-core-kube-prometheus-stack.svc.cluster.local:9090` |
+| `TEMPO_BASE_URL` | No | `""` | In-cluster Tempo base URL, e.g. `http://tempo.glueops-core-tempo.svc.cluster.local:3200`. Leave empty to disable trace proxying. |
+| `LOG_LEVEL` | No | `INFO` | Log verbosity: `DEBUG`, `INFO`, `WARN`, or `ERROR` |
+
+## Running locally
+
+```bash
+npm install
+PROMETHEUS_BASE_URL=http://localhost:9090 node src/server.js
+```
+
+## Container image
+
+The image is published to GHCR on every release:
+```
+ghcr.io/glueops/argocd-otel-extension-api:<tag>
+```