|
| 1 | +# Google Secrets Provider |
| 2 | +<!-- status autogenerated section --> |
| 3 | +| Status | | |
| 4 | +| ------------- |-----------| |
| 5 | +| Stability | [development] | |
| 6 | +| Distributions | [] | |
| 7 | +| Issues | [](https://github.com/open-telemetry/opentelemetry-collector-contrib/issues?q=is%3Aopen+is%3Aissue+label%3Aprovider%2Fgooglesecretmanagerprovider) [](https://github.com/open-telemetry/opentelemetry-collector-contrib/issues?q=is%3Aclosed+is%3Aissue+label%3Aprovider%2Fgooglesecretmanagerprovider) | |
| 8 | +| Code coverage | [](https://app.codecov.io/gh/open-telemetry/opentelemetry-collector-contrib/tree/main/?components%5B0%5D=provider_googlesecretmanagerprovider&displayType=list) | |
| 9 | +| [Code Owners](https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/CONTRIBUTING.md#becoming-a-code-owner) | [@aabmass](https://www.github.com/aabmass), [@dashpole](https://www.github.com/dashpole), [@jsuereth](https://www.github.com/jsuereth), [@psx95](https://www.github.com/psx95), [@braydonk](https://www.github.com/braydonk), [@ridwanmsharif](https://www.github.com/ridwanmsharif) | |
| 10 | + |
| 11 | +[development]: https://github.com/open-telemetry/opentelemetry-collector/blob/main/docs/component-stability.md#development |
| 12 | +<!-- end autogenerated section --> |
| 13 | + |
| 14 | +## Summary |
| 15 | + |
| 16 | +This Provider component offers a secure way to reference secrets or sensitive information in collector configurations using [Google Secret Manager](https://cloud.google.com/security/products/secret-manager). Use a placeholder in the format `${googlesecretmanagerprovider:projects/<project Id>/secrets/<secret Id>/versions/<version Id>}` within your configuration. The actual secrets will then be fetched dynamically from [Google Secret Manager](https://cloud.google.com/security/products/secret-manager) during collector initialization. |
| 17 | +## Usage |
| 18 | + |
| 19 | +- Simply replace plaintext secrets within your collector configuration with the placeholder: `${googlesecretmanagerprovider:projects/<project Id>/secrets/<secret Id>/versions/<version Id>}` |
| 20 | + |
| 21 | +An example collector configuration: |
| 22 | + |
| 23 | +``` |
| 24 | +receivers: |
| 25 | + otlp: |
| 26 | + protocols: |
| 27 | + grpc: |
| 28 | + http: |
| 29 | +processors: |
| 30 | + batch: |
| 31 | +
|
| 32 | +exporters: |
| 33 | + logging: |
| 34 | + loglevel: debug |
| 35 | + http: |
| 36 | + endpoint: "https://example.com/api/metrics" |
| 37 | + headers: |
| 38 | + X-API-Key: ${googlesecretmanagerprovider:projects/12345/secrets/my-secret/versions/1} |
| 39 | +service: |
| 40 | + pipelines: |
| 41 | + traces: |
| 42 | + receivers: [otlp] |
| 43 | + processors: [batch] |
| 44 | + exporters: [logging, http] |
| 45 | + metrics: |
| 46 | + receivers: [otlp] |
| 47 | + processors: [batch] |
| 48 | + exporters: [logging, http] |
| 49 | + logs: |
| 50 | + receivers: [otlp] |
| 51 | + processors: [batch] |
| 52 | + exporters: [logging, http] |
| 53 | +
|
| 54 | +``` |
| 55 | + |
| 56 | +### Prerequisites |
| 57 | +1. Make sure to enable access to the [Secret Manager API](https://cloud.google.com/secret-manager/docs/accessing-the-api). |
| 58 | +2. Make sure to [add the secret entries to Google Secret Manager](https://cloud.google.com/secret-manager/docs/create-secret-quickstart) before referencing them in the collector configurations. |
| 59 | +3. This Provider interacts with Google Secret Manager using the Secret Manager client library. This library uses [Application Default Credentials (ADC)](https://cloud.google.com/docs/authentication/application-default-credentials) to locate authentication credentials for Secret Manager. Therefore, if you run your collector in a local environment, execute the [`gcloud auth application-default login`](https://cloud.google.com/secret-manager/docs/authentication#client-libs) command to generate the necessary credential file to provide to ADC. |
| 60 | +4. However, if your collector runs on Google Compute Engine (GCE) or Google Kubernetes Engine (GKE), running `gcloud auth application-default login` is optional. This is because ADC can retrieve credentials via [the metadata server](https://cloud.google.com/docs/authentication/application-default-credentials#order). However, ensure that your GKE or GCE instance [has enabled the cloud-platform OAuth scope](https://cloud.google.com/secret-manager/docs/accessing-the-api#oauth-scopes). Additionally, verify that the Service Account attached to the GCE or GKE instance has been granted at least the [roles/secretmanager.secretAccessor](https://cloud.google.com/secret-manager/docs/access-control#secret-manager-roles) IAM role to access secret entries in Google Secret Manager. |
| 61 | + |
0 commit comments