[processor/k8sattributes] Support `name:tag@digest` image name format

[zarbis]

Component(s)

processor/k8sattributes

What happened?

Description

For better integrity guarantees we've started using name:tag@digest image reference format (e.g. alpine:3.19@sha256:ae65dbf8749a7d4527648ccee1fa3deb6bfcae34cbc30fc67aa45c44dcaa90ee).

It doesn't seem to be part of OCI image spec, but many projects use it (for example Karpenter).

Steps to Reproduce

• Deploy Pod with image alpine:3.19@sha256:ae65dbf8749a7d4527648ccee1fa3deb6bfcae34cbc30fc67aa45c44dcaa90ee
• Create collector with k8sattributes processor:

  processors:
  k8sattributes: 
  extract:
    metadata:
    - k8s.node.name
    - k8s.deployment.name
    - k8s.replicaset.name
    - k8s.daemonset.name
    - k8s.job.name
    - k8s.cronjob.name
    - k8s.statefulset.name
    - k8s.container.name
    - container.image.name
    - container.image.tag

• Observe telemetry metadata

Expected Result

container.image.name: alpine
container.image.tag: 3.19

Actual Result

container.image.name: alpine:3.19@sha
container.image.tag: ae65dbf8749a7d4527648ccee1fa3deb6bfcae34cbc30fc67aa45c44dcaa90ee

So basically split happens on last colon, not the first one.

Collector version

0.107.0

Environment information

Environment

K8s: 1.29

OpenTelemetry Collector configuration

No response

Log output

No response

Additional context

No response

[github-actions[bot]]

Pinging code owners:

• processor/k8sattributes: @dmitryax @fatsheep9146 @TylerHelmuth

  See Adding Labels via Comments if you do not have permissions to add labels yourself.

[TylerHelmuth]

This feels correct. The digest can instead be captured in container.image.id or container.image.repo_digests: https://github.com/open-telemetry/semantic-conventions/blob/main/docs/resource/container.md

[zarbis]

@TylerHelmuth indeed, you will get full content of ImageID from registry to digest in container.image.repo_digests, but image.name will still be incorrectly capturing @sha256 and image.tag would incorrectly be digest, regardless of capturing image.repo_digests.

Capturing image.repo_digests doesn't solve incorrect captures for name and tag.

[TylerHelmuth]

@zarbis I meant fixing the captured fields to

container.image.name: alpine
container.image.tag: 3.19
image.repo_digests: sha256:ae65dbf8749a7d4527648ccee1fa3deb6bfcae34cbc30fc67aa45c44dcaa90ee

feels the most right