RHSA-2026:65542 - Security Advisory

Topic

Red Hat build of OpenTelemetry 3.11.0 has been released

Description

This release of the Red Hat build of OpenTelemetry provides new features, security improvements, and bug fixes.

Breaking changes:

• With this update, the `add_metric_suffixes` field of the Prometheus Exporter configuration in the `OpenTelemetryCollector` custom resource is removed. To manage metric name suffixes, use the `translation_strategy` field instead.

Deprecations:

• Google Cloud Exporter is deprecated: The Google Cloud Exporter, which sends telemetry data to Google Cloud Operations Suite, is deprecated and will be removed in a future major release. You can export data to Google Cloud Operations Suite by using the OTLP HTTP Exporter with the Google Client Authorization Extension instead. For more information, see https://redhat.atlassian.net/browse/TRACING-6139.

Technology Preview features:

• OBI (Open Telemetry eBPF) Receiver: This update adds the OBI (Open Telemetry eBPF) Receiver to the Red Hat build of OpenTelemetry as a Technology Preview feature. The OBI Receiver uses eBPF to automatically inspect application executables and the OS networking layer, and capture trace spans, Rate Errors Duration (RED) metrics.
• Redaction Processor: This update adds the Redaction Processor to the Red Hat build of OpenTelemetry as a Technology Preview feature. The Redaction Processor removes sensitive data from telemetry data before it is exported. For more information, see https://redhat.atlassian.net/browse/TRACING-6502.
• Headers Setter Extension: This update adds the Headers Setter Extension to the Red Hat build of OpenTelemetry as a Technology Preview feature. The Headers Setter Extension sets headers on outgoing HTTP requests made by exporters. For more information, see https://redhat.atlassian.net/browse/TRACING-6504.
• Kubernetes Leader Elector Extension: This update adds the Kubernetes Leader Elector Extension to the Red Hat build of OpenTelemetry as a Technology Preview feature. The Kubernetes Leader Elector Extension enables OpenTelemetry components to run in HA mode across a Kubernetes cluster. The component that owns the lease becomes the leader and becomes the active instance. For more information, see https://redhat.atlassian.net/browse/TRACING-6478.

Enhancements:

• High availability for the Operator webhooks: This update introduces high availability support for the Red Hat build of OpenTelemetry Operator webhooks. The webhooks run in a separate deployment from the main Operator deployment. For more information, see https://redhat.atlassian.net/browse/TRACING-6157.

Bug fixes:

• Instrumentation CR status fields are updated automatically: Before this update, when creating or updating an Instrumentation custom resource (CR), the .status.observedGeneration and .status.conditions fields were not updated because the Red Hat build of OpenTelemetry Operator lacked a reconciliation controller for Instrumentation CRs. In this release, the Operator continuously reconciles Instrumentation CRs and populates these status fields upon creation or update without requiring an Operator restart. For more information, see https://issues.redhat.com/browse/TRACING-6412.
• Automatic RBAC of the Operator includes PersistentVolume and PersistentVolumeClaim resources: Before this update, the automatic Role-Based Access Control (RBAC) feature of the Red Hat build of OpenTelemetry Operator did not include the required permissions for PersistentVolume and PersistentVolumeClaim resources. As a consequence, the Kubernetes Cluster Receiver failed with RBAC errors. With this update, the Operator automatically grants the required permissions for these resources. As a result, the Kubernetes Cluster Receiver works correctly with the automatic RBAC feature. For more information, see https://redhat.atlassian.net/browse/TRACING-6381.

Solution

For details on how to apply this update, refer to:

https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators

Affected Products

• Red Hat OpenShift distributed tracing

Fixes

• TRACING-6412 - [Upstream] The Instrumentation CR's `status.observedGeneration` and `status.conditions` are never set because the operator lacks a reconciliation controller for Instrumentation.
• TRACING-6381 - 3.10 bug, k8sclusterreceiver requires more RBAC

CVEs

• CVE-2026-48586
• CVE-2026-55969

References

• https://access.redhat.com/security/updates/classification/
• https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/red_hat_build_of_opentelemetry