chore(chart-deps): update otel-operator to version 0.119.0

[svcAPLBot]

This PR updates the dependency opentelemetry-operator to version 0.119.0.

[Copilot]

Pull request overview

Updates the vendored opentelemetry-operator Helm chart to align with upstream chart version 0.119.0, bringing along CRD/schema/RBAC/test changes and bumping referenced collector image tag to 0.154.0.

Changes:

• Bump chart dependency/version references to 0.119.0 and update related metadata.
• Update chart values/schema and CRDs to match the new upstream chart.
• Adjust Helm test pods/scripts and expand ClusterRole permissions.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
charts/otel-operator/values.yaml	Bumps default collector image tag to 0.154.0.
charts/otel-operator/values.schema.json	Adds new feature gate schema key (operator.collector.usedefaulttelemetryshape).
charts/otel-operator/templates/tests/test-service-connection.yaml	Renames test pods and rewrites service/webhook connectivity test loops.
charts/otel-operator/templates/tests/test-certmanager-connection.yaml	Updates cert-manager webhook address and rewrites retry logic.
charts/otel-operator/templates/clusterrole.yaml	Adds OLM ClusterServiceVersion permissions.
charts/otel-operator/crds/crd-opentelemetrycollector.yaml	Updates collector CRD status schema (conditions/observedGeneration).
charts/otel-operator/crds/crd-opentelemetry.io_opampbridges.yaml	Extends OpAMPBridge CRD schema with tls options.
charts/otel-operator/Chart.yaml	Updates chart version and appVersion.
chart/chart-index/Chart.yaml	Bumps dependency version for otel-operator to 0.119.0.
apps.yaml	Updates listed otel appVersion value.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (3)

charts/otel-operator/templates/tests/test-service-connection.yaml:32

• The test uses wget -q and a URL without a scheme (e.g. service:port). With BusyBox wget (testFramework.image is busybox:latest), -q suppresses the HTTP error text and missing http:// can be treated as an invalid URL, so this loop may never detect the expected 400 and the Helm test can fail even when the service is up. Use an explicit http:// URL and avoid -q so the 400 status/error text can be matched reliably.

            wget_output=$(wget -q "$MANAGER_METRICS_SERVICE_CLUSTERIP:$MANAGER_METRICS_SERVICE_PORT" 2>&1 || true)
            if [ "$wget_output" = "wget: server returned error: HTTP/1.0 400 Bad Request" ]; then
              exit 0
            fi

charts/otel-operator/templates/tests/test-service-connection.yaml:91

• Same issue as the metrics test: wget -q + missing http:// makes the check brittle with BusyBox wget and can cause Helm tests to fail even if the webhook service is reachable. Use an explicit http:// URL and avoid quiet mode so the 400 can be detected.

            wget_output=$(wget -q "$WEBHOOK_SERVICE_CLUSTERIP:$WEBHOOK_SERVICE_PORT" 2>&1 || true)
            if [ "$wget_output" = "wget: server returned error: HTTP/1.0 400 Bad Request" ]; then
              exit 0
            fi

charts/otel-operator/templates/tests/test-certmanager-connection.yaml:32

• This cert-manager hook test has the same BusyBox wget problem as the other tests: wget -q suppresses the HTTP 400 error text and the URL lacks http://, so the loop may never succeed. Use an explicit http:// URL and avoid quiet mode so the 400 can be matched.

            wget_output=$(wget -q "$CERT_MANAGER_CLUSTERIP:$CERT_MANAGER_PORT" 2>&1 || true)
            if [ "$wget_output" = "wget: server returned error: HTTP/1.0 400 Bad Request" ]; then
              exit 0
            fi

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (4)

charts/otel-operator/templates/tests/test-service-connection.yaml:32

• The test logic relies on matching wget's exact error string while using -q and no URL scheme, which is brittle with BusyBox wget (quiet mode can suppress the error text, and host:port without http:// is not consistently treated as a URL). Use an explicit scheme and match more robustly (e.g., check for a 400 substring) so the test reliably detects the service being up.

            wget_output=$(wget -q "$MANAGER_METRICS_SERVICE_CLUSTERIP:$MANAGER_METRICS_SERVICE_PORT" 2>&1 || true)
            if [ "$wget_output" = "wget: server returned error: HTTP/1.0 400 Bad Request" ]; then
              exit 0
            fi

charts/otel-operator/templates/tests/test-service-connection.yaml:91

• This test hits the admission webhook service on port 443, but the current wget invocation omits an https:// scheme and depends on an exact error string. With BusyBox wget this can fail (HTTP vs HTTPS mismatch and output differences). Use https:// (and skip cert verification for the self-signed cert) and match on a 400 substring instead of an exact message.

            wget_output=$(wget -q "$WEBHOOK_SERVICE_CLUSTERIP:$WEBHOOK_SERVICE_PORT" 2>&1 || true)
            if [ "$wget_output" = "wget: server returned error: HTTP/1.0 400 Bad Request" ]; then
              exit 0
            fi

charts/otel-operator/templates/tests/test-certmanager-connection.yaml:32

• The cert-manager webhook runs on 443 (TLS), but this test currently calls wget without an https:// scheme and depends on an exact error string. That can fail even when the service is healthy (e.g., TLS handshake/cert validation differences). Use https:// with --no-check-certificate and match on a 400 substring so the test reliably signals readiness.

            wget_output=$(wget -q "$CERT_MANAGER_CLUSTERIP:$CERT_MANAGER_PORT" 2>&1 || true)
            if [ "$wget_output" = "wget: server returned error: HTTP/1.0 400 Bad Request" ]; then
              exit 0
            fi

charts/otel-operator/templates/clusterrole.yaml:218

• This change grants the operator ClusterRole patch/update on operators.coreos.com/clusterserviceversions, which is a significant permission increase (writes to OLM resources). If the operator only needs to read CSVs, consider dropping the write verbs; if write access is required, consider gating this rule behind a value/flag and documenting why it’s needed to keep least-privilege defaults.

      - get
      - list
      - patch
      - update
      - watch

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.

Suppressed comments (3)

charts/otel-operator/templates/tests/test-service-connection.yaml:31

• The Helm test treats only one exact wget error string as success. In practice the response can vary (HTTP/1.1 vs HTTP/1.0, or any other HTTP status), which will make this test flaky. Also, without an explicit scheme wget implementations may not interpret "$HOST:$PORT" as an HTTP URL. Consider using an explicit http:// URL and treating any HTTP response as success (exit code 0 or an HTTP error message).

          i=0
          while [ "$i" -lt 30 ]; do
            wget_output=$(wget -q "$MANAGER_METRICS_SERVICE_CLUSTERIP:$MANAGER_METRICS_SERVICE_PORT" 2>&1 || true)
            if [ "$wget_output" = "wget: server returned error: HTTP/1.0 400 Bad Request" ]; then
              exit 0

charts/otel-operator/templates/tests/test-certmanager-connection.yaml:31

• The cert-manager connectivity test hits the cert-manager webhook on port 443 but uses an HTTP URL and expects one exact wget error string. Since the cert-manager webhook is TLS, this can fail with a TLS/connection error rather than an HTTP 400, making the test unreliable. Use an explicit https:// URL with --no-check-certificate and a tolerant success condition (any HTTP response).

          i=0
          while [ "$i" -lt 30 ]; do
            wget_output=$(wget -q "$CERT_MANAGER_CLUSTERIP:$CERT_MANAGER_PORT" 2>&1 || true)
            if [ "$wget_output" = "wget: server returned error: HTTP/1.0 400 Bad Request" ]; then
              exit 0

charts/otel-operator/templates/tests/test-service-connection.yaml:90

• This Helm test targets the admission webhook Service on port 443, but it uses an HTTP URL and compares for a single exact error string. Since the webhook server is TLS-enabled (it mounts serving certs), this can fail with a TLS/connection error instead of an HTTP 400. Use an explicit https:// URL (and disable cert verification for self-signed/cert-manager certs) and make the success condition tolerant of HTTP version/status differences.

          i=0
          while [ "$i" -lt 30 ]; do
            wget_output=$(wget -q "$WEBHOOK_SERVICE_CLUSTERIP:$WEBHOOK_SERVICE_PORT" 2>&1 || true)
            if [ "$wget_output" = "wget: server returned error: HTTP/1.0 400 Bad Request" ]; then
              exit 0

[merll]

#3446