Jaeger v2 With Badger On Loopback, A Span Written And Read Back

jaeger

Jaeger v2, the tracing backend built on the OpenTelemetry Collector, from the upstream release (sha256-verified), as a hardened system service on loopback with badger storage under its data directory and the query API and UI on loopback for a proxy that authenticates. Original role for EL 10, live-tested with podman on Rocky Linux 10.

No package, so the checksum is the whole story. EL 10 carries no jaeger; Jaeger ships a release with a checksum file beside it. The role downloads both and has Ansible's get_url refuse the asset unless its SHA-256 is the one in the vendor's file, then installs the binaries as root's in /usr/local/bin, pinned by jaeger_version.

A service account, a hardened unit, a loopback listener. jaeger is a system user with no shell that owns the data directory and nothing else; the unit runs with NoNewPrivileges, PrivateTmp, ProtectHome and ProtectSystem=strict. The listener is 127.0.0.1:4318 by default, for a proxy that authenticates or a client on the same host; the live test reads the listening sockets and expects loopback only.

The right checksum file. The release publishes two: the per-platform .sha256sum.txt lists the files INSIDE the tarball, the top-level jaeger-<version>.sha256sum.txt lists the tarballs; the role checks the download against the latter, whose names carry a leading * that Ansible's get_url matches. jaeger validate checks the configuration before it lands.

Proven by a span. The live test pushes one span over OTLP/HTTP and reads the trace back by id from the query API with its operation name and service; that is the receiver, the storage exporter, badger and the query extension all at work. Badger keeps spans for jaeger_span_ttl (a week) in two directories under the data directory. This catalogue's tempo and otel-collector roles listen on the same OTLP ports; one host runs one of them on 4317/4318.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.