What is the difference between a Collector and a Subscription in Kubernetes telemetry routing?

Why This Matters for Security Teams

A Collector and a Subscription divide responsibility in Kubernetes telemetry routing, so the security question is really about who controls collection scope versus who controls forwarding destinations. That separation matters because telemetry often carries operational details, security signals, and sometimes sensitive context from multiple teams or tenants. If those boundaries are loose, teams can over-collect, over-share, or unintentionally route data beyond its intended audience. The practical security value of the split is control granularity. A Collector can enforce broad intake rules at the cluster or tenant boundary, while a Subscription limits what leaves that already filtered set. That lets platform teams define the allowed telemetry surface once, then let application or tenant owners choose how much of that sanctioned stream is forwarded and to where. In effect, the Collector reduces exposure at the source, and the Subscription reduces accidental redistribution downstream. This is especially important in multi-tenant environments where routing mistakes can become cross-team visibility problems rather than simple configuration errors. A clean collector-to-subscription model helps prevent “everything goes everywhere” telemetry pipelines, which are hard to audit and easy to misconfigure. In practice, many security teams discover telemetry overexposure only after a routing rule sends more data than intended, rather than through intentional design reviews.

How It Works in Practice

A Collector is the upstream control point. It decides which telemetry enters the routing system at all, usually by applying cluster-level or tenant-selection logic before any forwarding happens. That makes it the right place for coarse-grained policy: namespace boundaries, tenant ownership, default inclusion or exclusion rules, and broad data-minimisation decisions. A Subscription is downstream. It consumes the filtered stream that the Collector already made available and then defines one or more destinations for forwarding. In practice, that means the two objects solve different problems:

• The Collector answers, “Should this tenant or cluster be in scope?”
• The Subscription answers, “Where should this already-approved telemetry go?”
• The Collector constrains intake, while the Subscription constrains distribution.
• The Collector is typically cluster-wide or platform-owned, while the Subscription is often team-owned or workload-owned.

This separation is useful because it creates layered control. If the Collector is too permissive, a Subscription still cannot magically access telemetry that was never selected for it. If the Subscription is too broad, it still only acts on the data the Collector has already admitted. That layered model is similar in spirit to least-privilege routing, where scope and destination are controlled independently. For operational teams, the main implementation concern is consistency. The Collector policy should be stable enough that teams can rely on a predictable tenant boundary, while Subscriptions should be explicit enough that forwarding paths are reviewable and auditable. These controls tend to break down when teams encode tenant ownership inconsistently across clusters, because the routing boundary no longer matches the actual operational boundary.

Common Variations and Edge Cases

Tighter routing control often increases operational overhead, requiring organisations to balance clear boundaries against configuration complexity. The exact Collector and Subscription model can vary by platform, but the governance pattern stays the same: scope first, forwarding second. Some teams use a very restrictive Collector and relatively flexible Subscriptions, while others keep the Collector broad and rely on more precise Subscriptions for downstream fan-out. The trade-off is between central control and local autonomy. A stricter Collector reduces the chance of cross-tenant leakage, but it can also make onboarding new telemetry sources slower. A more permissive Collector speeds adoption, but it pushes more responsibility onto Subscription authors to avoid over-sharing. Edge cases usually appear when one telemetry source legitimately serves multiple consumers. In that situation, the Subscription layer should make the duplication explicit rather than relying on ad hoc re-use of routes. Another common issue is assuming the Subscription can correct an overly broad Collector. It cannot. Once telemetry is excluded or scoped away upstream, downstream routing cannot recover it. For this reason, guidance is evolving toward treating the Collector as the enforcement boundary and the Subscription as the distribution boundary. That distinction becomes most valuable when teams need to prove who can see what, and why, across shared clusters or regulated environments.

Risk and Threat Considerations

Telemetry routing creates exposure when collection scope and forwarding scope are not separately controlled. The main risks are accidental data disclosure, cross-tenant visibility, and overly broad access to operational signals that can include sensitive topology, workload names, error traces, or incident clues. Failure mechanism: Misconfigured Collectors can admit telemetry from more tenants than intended, and overly broad Subscriptions can forward that data to destinations that were never meant to receive it. The risk grows when routing rules are reused across teams, copied between clusters, or changed without a clear ownership model. Impact: The result can be unintended data sharing, audit gaps, and a weaker trust boundary between platform operators and application teams. In regulated or multi-tenant environments, that can turn a routing mistake into a confidentiality and governance problem rather than a simple observability issue.

Practitioner Guidance

What to prioritise: Treat the Collector as the policy boundary and review it for tenant scope, default inclusion, and exclusion logic before tuning any Subscription. If the upstream boundary is wrong, downstream routing will only distribute the mistake more efficiently.

What to verify: Confirm that every Subscription can only forward telemetry from the tenant scope the Collector already approved, and that destination lists are explicit. The control is working when a team cannot expand its own visibility beyond the data admitted upstream.

Common mistake: Teams often focus on destination control and ignore upstream selection. That works until a broad Collector feeds multiple Subscriptions, at which point the routing model becomes difficult to audit and easy to misread.

Practitioner takeaway: The safest operating model is to make scope decisions once at collection time, then let Subscriptions handle only controlled distribution, not boundary setting.

Related resources from NHI Mgmt Group

• What is the difference between routing traffic and authorizing access in Kubernetes?
• What is the difference between a telemetry processor and a connector in the OpenTelemetry Collector?
• What is the difference between a Role and a ClusterRole in Kubernetes?
• What is the difference between RBAC and Zero Trust in Kubernetes?