[アップデート] OTel Container Insights for Amazon EKS を利用できるようになりました

% kubectl describe pod cloudwatch-agent-cluster-scraper-86b9bff485-wfngh -n amazon-cloudwatch
Name:                 cloudwatch-agent-cluster-scraper-86b9bff485-wfngh
Namespace:            amazon-cloudwatch
Priority:             2000001000
Priority Class Name:  system-node-critical
Service Account:      cloudwatch-agent
Node:                 i-059a422b6465310a9/10.0.100.23
Start Time:           Sat, 18 Apr 2026 14:57:59 +0900
Labels:               app.kubernetes.io/component=amazon-cloudwatch-agent
                      app.kubernetes.io/instance=amazon-cloudwatch.cloudwatch-agent-cluster-scraper
                      app.kubernetes.io/managed-by=amazon-cloudwatch-agent-operator
                      app.kubernetes.io/name=cloudwatch-agent-cluster-scraper
                      app.kubernetes.io/part-of=amazon-cloudwatch-agent
                      app.kubernetes.io/version=1.300066.0b1367
                      pod-template-hash=86b9bff485
                      topology.kubernetes.io/region=us-east-1
                      topology.kubernetes.io/zone=us-east-1a
Annotations:          amazon-cloudwatch-agent-operator-config/sha256: a08d38b4a834ea3b4a24dc066b3f8b24000c66737bb3a515d18ab8c4575f1a51
Status:               Running
IP:                   10.0.100.23
IPs:
  IP:           10.0.100.23
Controlled By:  ReplicaSet/cloudwatch-agent-cluster-scraper-86b9bff485
Containers:
  otc-container:
    Container ID:   containerd://5208d99b8946e0f94b46ac6a167e24e9da55d6febd9f97fead7d8229735b07f9
    Image:          602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/observability/cloudwatch-agent:1.300066.0b1367
    Image ID:       602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/observability/cloudwatch-agent@sha256:522d36eb276e7764b5cab0c2c5e620ac0f2bb76c9fea99d4543cf2621625f824
    Port:           <none>
    Host Port:      <none>
    State:          Running
      Started:      Sat, 18 Apr 2026 14:58:01 +0900
    Ready:          True
    Restart Count:  0
    Limits:
      cpu:     500m
      memory:  512Mi
    Requests:
      cpu:     250m
      memory:  128Mi
    Environment:
      K8S_NODE_NAME:                            (v1:spec.nodeName)
      HOST_IP:                                  (v1:status.hostIP)
      HOST_NAME:                                (v1:spec.nodeName)
      K8S_NAMESPACE:                           amazon-cloudwatch (v1:metadata.namespace)
      K8S_CLUSTER_NAME:                        test-cluster
      POD_NAME:                                cloudwatch-agent-cluster-scraper-86b9bff485-wfngh (v1:metadata.name)
      AWS_STS_REGIONAL_ENDPOINTS:              regional
      AWS_DEFAULT_REGION:                      us-east-1
      AWS_REGION:                              us-east-1
      AWS_CONTAINER_CREDENTIALS_FULL_URI:      http://169.254.170.23/v1/credentials
      AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE:  /var/run/secrets/pods.eks.amazonaws.com/serviceaccount/eks-pod-identity-token
    Mounts:
      /dev/disk from devdisk (ro)
      /etc/amazon-cloudwatch-observability-agent-cert from agenttls (ro)
      /etc/amazon-cloudwatch-observability-agent-client-cert from agentclienttls (ro)
      /etc/amazon-cloudwatch-observability-agent-server-cert from agentservertls (ro)
      /etc/amazon-cloudwatch-observability-agent-ta-client-cert from agenttaclienttls (ro)
      /etc/cwagentconfig from otc-internal (rw)
      /rootfs from rootfs (ro)
      /run/containerd/containerd.sock from containerdsock (rw)
      /sys from sys (ro)
      /var/lib/containers from criocontainer (ro)
      /var/lib/docker from varlibdocker (ro)
      /var/lib/kubelet/pod-resources from kubelet-podresources (rw)
      /var/log/pods from criologs (ro)
      /var/run/crio/crio.sock from criosock (ro)
      /var/run/docker.sock from dockersock (ro)
      /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-m6k2b (ro)
      /var/run/secrets/pods.eks.amazonaws.com/serviceaccount from eks-pod-identity-token (ro)
Conditions:
  Type                        Status
  PodReadyToStartContainers   True
  Initialized                 True
  Ready                       True
  ContainersReady             True
  PodScheduled                True
Volumes:
  eks-pod-identity-token:
    Type:                    Projected (a volume that contains injected data from multiple sources)
    TokenExpirationSeconds:  83157
  otc-internal:
    Type:      ConfigMap (a volume populated by a ConfigMap)
    Name:      cloudwatch-agent-cluster-scraper
    Optional:  false
  kubelet-podresources:
    Type:          HostPath (bare host directory volume)
    Path:          /var/lib/kubelet/pod-resources
    HostPathType:  Directory
  rootfs:
    Type:          HostPath (bare host directory volume)
    Path:          /
    HostPathType:
  dockersock:
    Type:          HostPath (bare host directory volume)
    Path:          /var/run/docker.sock
    HostPathType:
  varlibdocker:
    Type:          HostPath (bare host directory volume)
    Path:          /var/lib/docker
    HostPathType:
  containerdsock:
    Type:          HostPath (bare host directory volume)
    Path:          /run/containerd/containerd.sock
    HostPathType:
  criosock:
    Type:          HostPath (bare host directory volume)
    Path:          /var/run/crio/crio.sock
    HostPathType:
  criocontainer:
    Type:          HostPath (bare host directory volume)
    Path:          /var/lib/containers
    HostPathType:
  criologs:
    Type:          HostPath (bare host directory volume)
    Path:          /var/log/pods
    HostPathType:
  sys:
    Type:          HostPath (bare host directory volume)
    Path:          /sys
    HostPathType:
  devdisk:
    Type:          HostPath (bare host directory volume)
    Path:          /dev/disk/
    HostPathType:
  agenttls:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  amazon-cloudwatch-observability-agent-cert
    Optional:    false
  agentclienttls:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  amazon-cloudwatch-observability-agent-client-cert
    Optional:    false
  agentservertls:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  amazon-cloudwatch-observability-agent-server-cert
    Optional:    false
  agenttaclienttls:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  amazon-cloudwatch-observability-agent-ta-client-cert
    Optional:    false
  kube-api-access-m6k2b:
    Type:                    Projected (a volume that contains injected data from multiple sources)
    TokenExpirationSeconds:  3607
    ConfigMapName:           kube-root-ca.crt
    ConfigMapOptional:       <nil>
    DownwardAPI:             true
QoS Class:                   Burstable
Node-Selectors:              kubernetes.io/os=linux
Tolerations:                 op=Exists
Events:                      <none>

% kubectl describe cm cloudwatch-agent-cluster-scraper -n amazon-cloudwatch
Name:         cloudwatch-agent-cluster-scraper
Namespace:    amazon-cloudwatch
Labels:       app.kubernetes.io/component=amazon-cloudwatch-agent
              app.kubernetes.io/instance=amazon-cloudwatch.cloudwatch-agent-cluster-scraper
              app.kubernetes.io/managed-by=amazon-cloudwatch-agent-operator
              app.kubernetes.io/name=cloudwatch-agent-cluster-scraper
              app.kubernetes.io/part-of=amazon-cloudwatch-agent
              app.kubernetes.io/version=1.300066.0b1367
Annotations:  <none>

Data
====
cwagentconfig.json:
----
{"agent":{"region":"us-east-1"}}

cwagentotelconfig.yaml:
----
exporters:
  otlphttp/cw_k8s_ci_v0_cwotel:
    auth:
      authenticator: sigv4auth/cw_k8s_ci_v0_cwotel
    endpoint: https://monitoring.us-east-1.amazonaws.com:443
    tls:
      insecure: false
extensions:
  sigv4auth/cw_k8s_ci_v0_cwotel:
    region: us-east-1
    service: monitoring
processors:
  awsattributelimit/cw_k8s_ci_v0:
    max_total_attributes: 150
  batch/cw_k8s_ci_v0_cwotel:
    send_batch_max_size: 500
    send_batch_size: 500
    timeout: 10s
  filter/cw_k8s_ci_v0_apiserver_build_info:
    error_mode: ignore
    metrics:
      metric:
      - name == "kubernetes_build_info"
  filter/cw_k8s_ci_v0_scrape_metadata:
    error_mode: ignore
    metrics:
      metric:
      - IsMatch(name, "^(up|scrape_duration_seconds|scrape_samples_scraped|scrape_samples_post_metric_relabeling|scrape_series_added)$")
  groupbyattrs/cw_k8s_ci_v0_ksm:
    keys:
    - pod
    - namespace
    - uid
    - node
    - container
    - owner_name
    - owner_kind
  k8sattributes/cw_k8s_ci_v0_node:
    auth_type: serviceAccount
    extract:
      labels:
      - from: node
        key_regex: (.*)
        tag_name: k8s.node.label.$$$1
      metadata:
      - k8s.node.name
    passthrough: false
    pod_association:
    - sources:
      - from: resource_attribute
        name: k8s.node.name
  metricstarttime/cw_k8s_ci_v0: {}
  resourcedetection/cw_k8s_ci_v0:
    detectors:
    - ec2
    - eks
    ec2:
      resource_attributes:
        cloud.account.id:
          enabled: true
        cloud.availability_zone:
          enabled: true
        cloud.platform:
          enabled: true
        cloud.provider:
          enabled: true
        cloud.region:
          enabled: true
        host.id:
          enabled: false
        host.image.id:
          enabled: false
        host.name:
          enabled: false
        host.type:
          enabled: false
  transform/cw_k8s_ci_v0_apiserver_cleanup_version:
    error_mode: ignore
    metric_statements:
    - context: resource
      statements:
      - delete_key(attributes, "k8s.apiserver.version") where attributes["k8s.apiserver.version"]
        != nil
  transform/cw_k8s_ci_v0_apiserver_extract_version:
    error_mode: ignore
    metric_statements:
    - context: datapoint
      statements:
      - set(resource.attributes["k8s.apiserver.version"], attributes["git_version"])
        where attributes["git_version"] != nil and attributes["git_version"] != ""
  transform/cw_k8s_ci_v0_clear_schema_url:
    error_mode: ignore
    metric_statements:
    - context: resource
      statements:
      - set(resource.schema_url, "")
  transform/cw_k8s_ci_v0_ksm_clean_resource:
    error_mode: ignore
    metric_statements:
    - context: resource
      statements:
      - delete_key(attributes, "k8s.pod.name")
      - delete_key(attributes, "k8s.pod.uid")
      - delete_key(attributes, "k8s.namespace.name")
      - delete_key(attributes, "k8s.node.name")
      - delete_key(attributes, "k8s.container.name")
      - delete_key(attributes, "k8s.deployment.name")
      - delete_key(attributes, "k8s.replicaset.name")
      - delete_key(attributes, "k8s.workload.name")
      - delete_key(attributes, "k8s.workload.type")
      - delete_key(attributes, "host.id")
      - delete_key(attributes, "host.name")
      - delete_key(attributes, "host.type")
      - delete_key(attributes, "host.image.id")
  transform/cw_k8s_ci_v0_ksm_promote:
    error_mode: ignore
    metric_statements:
    - context: resource
      statements:
      - set(attributes["k8s.pod.name"], attributes["pod"]) where attributes["pod"]
        != nil
      - delete_key(attributes, "pod") where attributes["pod"] != nil
      - set(attributes["k8s.namespace.name"], attributes["namespace"]) where attributes["namespace"]
        != nil
      - delete_key(attributes, "namespace") where attributes["namespace"] != nil
      - set(attributes["k8s.node.name"], attributes["node"]) where attributes["node"]
        != nil
      - delete_key(attributes, "node") where attributes["node"] != nil
      - set(attributes["k8s.pod.uid"], attributes["uid"]) where attributes["uid"]
        != nil
      - delete_key(attributes, "uid") where attributes["uid"] != nil
      - set(attributes["k8s.container.name"], attributes["container"]) where attributes["container"]
        != nil
      - delete_key(attributes, "container") where attributes["container"] != nil
      - set(attributes["k8s.workload.name"], attributes["owner_name"]) where attributes["owner_name"]
        != nil
      - set(attributes["k8s.workload.type"], attributes["owner_kind"]) where attributes["owner_kind"]
        != nil
      - delete_key(attributes, "owner_name") where attributes["owner_name"] != nil
      - delete_key(attributes, "owner_kind") where attributes["owner_kind"] != nil
  transform/cw_k8s_ci_v0_promote_component:
    error_mode: ignore
    metric_statements:
    - context: datapoint
      statements:
      - set(resource.attributes["k8s.component.name"], attributes["component"])
  transform/cw_k8s_ci_v0_set_cloud_resource_id:
    error_mode: ignore
    metric_statements:
    - context: resource
      statements:
      - set(resource.attributes["cloud.resource_id"], Concat(["arn:aws:eks:", resource.attributes["cloud.region"],
        ":", resource.attributes["cloud.account.id"], ":cluster/", resource.attributes["k8s.cluster.name"]],
        "")) where resource.attributes["cloud.region"] != nil and resource.attributes["cloud.account.id"]
        != nil and resource.attributes["k8s.cluster.name"] != nil
  transform/cw_k8s_ci_v0_set_cluster_name:
    error_mode: ignore
    metric_statements:
    - context: datapoint
      statements:
      - set(resource.attributes["k8s.cluster.name"], "test-cluster")
  transform/cw_k8s_ci_v0_set_component:
    error_mode: ignore
    metric_statements:
    - context: datapoint
      statements:
      - set(attributes["component"], "apiserver")
  transform/cw_k8s_ci_v0_set_scope_apiserver:
    error_mode: ignore
    metric_statements:
    - context: scope
      statements:
      - set(scope.version, resource.attributes["k8s.apiserver.version"]) where resource.attributes["k8s.apiserver.version"]
        != nil
      - set(scope.schema_url, "")
      - set(attributes["cloudwatch.source"], "cloudwatch-agent")
      - set(attributes["cloudwatch.solution"], "k8s-otel-container-insights")
      - set(attributes["cloudwatch.pipeline"], "apiserver")
  transform/cw_k8s_ci_v0_set_scope_kube_state_metrics:
    error_mode: ignore
    metric_statements:
    - context: scope
      statements:
      - set(scope.name, "github.com/kubernetes/kube-state-metrics")
      - set(scope.version, "v2.18.0-eksbuild.1")
      - set(scope.schema_url, "")
      - set(attributes["cloudwatch.source"], "cloudwatch-agent")
      - set(attributes["cloudwatch.solution"], "k8s-otel-container-insights")
      - set(attributes["cloudwatch.pipeline"], "kube-state-metrics")
  transform/cw_k8s_ci_v0_set_unit:
    error_mode: ignore
    metric_statements:
    - context: metric
      statements:
      - set(unit, "s") where IsMatch(name, ".*_seconds(_total)?$")
      - set(unit, "ms") where IsMatch(name, ".*_milliseconds(_total)?$")
      - set(unit, "us") where IsMatch(name, ".*_microseconds(_total)?$")
      - set(unit, "ns") where IsMatch(name, ".*_nanoseconds(_total)?$")
      - set(unit, "By") where IsMatch(name, ".*_bytes(_total)?$")
      - set(unit, "KBy") where IsMatch(name, ".*_kilobytes(_total)?$")
      - set(unit, "MBy") where IsMatch(name, ".*_megabytes(_total)?$")
      - set(unit, "GBy") where IsMatch(name, ".*_gigabytes(_total)?$")
      - set(unit, "KiBy") where IsMatch(name, ".*_kibibytes(_total)?$")
      - set(unit, "MiBy") where IsMatch(name, ".*_mebibytes(_total)?$")
      - set(unit, "GiBy") where IsMatch(name, ".*_gibibytes(_total)?$")
      - set(unit, "Cel") where IsMatch(name, ".*_celsius$")
      - set(unit, "Hz") where IsMatch(name, ".*_hertz$")
      - set(unit, "1") where IsMatch(name, ".*_ratio$")
      - set(unit, "%") where IsMatch(name, ".*_percent$")
      - set(unit, "V") where IsMatch(name, ".*_volts$")
      - set(unit, "W") where IsMatch(name, ".*_watts$")
      - set(unit, "J") where IsMatch(name, ".*_joules$")
      - set(unit, "A") where IsMatch(name, ".*_amperes$")
      - set(unit, "m") where IsMatch(name, ".*_meters(_total)?$")
      - set(unit, "1") where unit == "" and IsMatch(name, ".*_total$")
receivers:
  prometheus/cw_k8s_ci_v0_apiserver:
    config:
      scrape_configs:
      - bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
        job_name: kubernetes-apiserver
        kubernetes_sd_configs:
        - namespaces:
            names:
            - default
          role: endpoints
        relabel_configs:
        - action: keep
          regex: kubernetes
          source_labels:
          - __meta_kubernetes_service_name
        - action: keep
          regex: https
          source_labels:
          - __meta_kubernetes_endpoint_port_name
        - replacement: /metrics
          target_label: __metrics_path__
        scheme: https
        scrape_interval: 30s
        scrape_timeout: 10s
        tls_config:
          ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
          insecure_skip_verify: false
  prometheus/cw_k8s_ci_v0_kube_state_metrics:
    config:
      scrape_configs:
      - job_name: kube-state-metrics
        scheme: https
        scrape_interval: 30s
        scrape_timeout: 10s
        static_configs:
        - targets:
          - kube-state-metrics.amazon-cloudwatch.svc:8443
        tls_config:
          ca_file: /etc/amazon-cloudwatch-observability-agent-cert/tls-ca.crt
service:
  extensions:
  - sigv4auth/cw_k8s_ci_v0_cwotel
  pipelines:
    metrics/cw_k8s_ci_v0_apiserver:
      exporters:
      - otlphttp/cw_k8s_ci_v0_cwotel
      processors:
      - filter/cw_k8s_ci_v0_scrape_metadata
      - transform/cw_k8s_ci_v0_set_unit
      - metricstarttime/cw_k8s_ci_v0
      - transform/cw_k8s_ci_v0_apiserver_extract_version
      - filter/cw_k8s_ci_v0_apiserver_build_info
      - transform/cw_k8s_ci_v0_set_scope_apiserver
      - transform/cw_k8s_ci_v0_apiserver_cleanup_version
      - transform/cw_k8s_ci_v0_set_cluster_name
      - transform/cw_k8s_ci_v0_set_component
      - transform/cw_k8s_ci_v0_promote_component
      - resourcedetection/cw_k8s_ci_v0
      - transform/cw_k8s_ci_v0_clear_schema_url
      - transform/cw_k8s_ci_v0_set_cloud_resource_id
      - awsattributelimit/cw_k8s_ci_v0
      - batch/cw_k8s_ci_v0_cwotel
      receivers:
      - prometheus/cw_k8s_ci_v0_apiserver
    metrics/cw_k8s_ci_v0_kube_state_metrics:
      exporters:
      - otlphttp/cw_k8s_ci_v0_cwotel
      processors:
      - filter/cw_k8s_ci_v0_scrape_metadata
      - transform/cw_k8s_ci_v0_set_unit
      - metricstarttime/cw_k8s_ci_v0
      - transform/cw_k8s_ci_v0_set_scope_kube_state_metrics
      - transform/cw_k8s_ci_v0_set_cluster_name
      - transform/cw_k8s_ci_v0_ksm_clean_resource
      - groupbyattrs/cw_k8s_ci_v0_ksm
      - transform/cw_k8s_ci_v0_ksm_promote
      - k8sattributes/cw_k8s_ci_v0_node
      - resourcedetection/cw_k8s_ci_v0
      - transform/cw_k8s_ci_v0_clear_schema_url
      - transform/cw_k8s_ci_v0_set_cloud_resource_id
      - awsattributelimit/cw_k8s_ci_v0
      - batch/cw_k8s_ci_v0_cwotel
      receivers:
      - prometheus/cw_k8s_ci_v0_kube_state_metrics

BinaryData
====

Events:  <none>

apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: default
  name: nginx
  labels:
    app.kubernetes.io/name: nginx
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: nginx
  replicas: 1
  template:
    metadata:
      labels:
        app.kubernetes.io/name: nginx
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "9113"
        prometheus.io/path: "/metrics"
    spec:
      containers:
        - image: nginx
          imagePullPolicy: Always
          name: nginx
          ports:
            - containerPort: 80
          volumeMounts:
            - name: nginx-config
              mountPath: /etc/nginx/conf.d
        - name: nginx-exporter
          image: nginx/nginx-prometheus-exporter:0.11.0
          args:
            - -nginx.scrape-uri=http://127.0.0.1/nginx_status
          ports:
            - containerPort: 9113
              name: metrics
      volumes:
        - name: nginx-config
          configMap:
            name: nginx-config
---
apiVersion: v1
kind: ConfigMap
metadata:
  namespace: default
  name: nginx-config
data:
  default.conf: |
    server {
        listen 80;
        server_name localhost;

        location / {
            root /usr/share/nginx/html;
            index index.html index.htm;
        }

        # nginx status endpoint for prometheus exporter
        location /nginx_status {
            stub_status on;
            access_log off;
            allow 127.0.0.1;
            deny all;
        }
    }
---
apiVersion: v1
kind: Service
metadata:
  namespace: default
  name: nginx-service
  labels:
    app.kubernetes.io/name: nginx
  annotations:
    prometheus.io/scrape: "true"
    prometheus.io/port: "9113"
    prometheus.io/path: "/metrics"
spec:
  selector:
    app.kubernetes.io/name: nginx
  ports:
    - name: http
      port: 80
      targetPort: 80
    - name: metrics
      port: 9113
      targetPort: 9113
  type: ClusterIP