Mengelola secret dalam konfigurasi OpenTelemetry Collector Buatan Google
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Mengonfigurasi beberapa komponen, seperti penerima atau eksportir, mungkin mengharuskan Anda memberikan rahasia, seperti sandi. Anda dapat menyertakan secret ini sebagai
teks biasa dalam file konfigurasi Pengumpul. Namun, secret ini disertakan dalam log sistem yang ditulis oleh Pengumpul dan dikirim ke Cloud Logging, sehingga mengekspos secret di luar node atau virtual machine (VM) tempat Pengumpul berjalan.
Mulai dari versi Pengumpul yang dibuat Google 0.126.0, Anda dapat menggunakan penyedia OpenTelemetry yang terintegrasi dengan Secret Manager untuk menghilangkan secret teks biasa dalam file konfigurasi Anda.
Penyedia adalah komponen konfigurasi OpenTelemetry,
yang serupa dengan komponen penerima dan pemroses. Setiap penyedia memiliki
jenis, dan setiap jenis penyedia memetakan ID tertentu dalam
konfigurasi ke suatu nilai.
Penyedia googlesecretmanager memetakan ID Secret Manager ke secret, seperti sandi, token, dan kunci API, yang telah Anda simpan di Secret Manager. Menggunakan penyedia
googlesecretmanager memberikan manfaat berikut:
Keamanan yang ditingkatkan: File konfigurasi Anda tidak berisi
informasi sensitif seperti sandi. Secret sebenarnya disimpan
di Secret Manager, layanan yang dirancang khusus untuk
menyimpan, mengakses, dan mengelola data sensitif secara aman.
Mengurangi risiko eksposur: Secret Manager mengambil
secret selama inisialisasi Pengumpul OpenTelemetry Buatan Google, yang mencegah
secret teks biasa direkam secara tidak sengaja dalam log.
Sebelum memulai
Untuk menggunakan penyedia googlesecretmanager, Anda harus mengaktifkan
Secret Manager API dan mengizinkan akses ke API,
seperti yang dijelaskan dalam langkah-langkah berikut:
Menginstal Google Cloud CLI.
Setelah penginstalan,
lakukan inisialisasi Google Cloud CLI dengan menjalankan perintah berikut:
Sebelum menjalankan perintah sebelumnya, ganti variabel PROJECT_ID
dengan ID project Google Cloud Anda.
Enable the Secret Manager API:
gcloudservicesenablesecretmanager.googleapis.com
Perbarui cakupan akses OAuth untuk instance Anda agar menyertakan cakupan
yang diperlukan untuk Secret Manager, https://www.googleapis.com/auth/cloud-platform:
Beri pengguna yang mengelola konfigurasi OpenTelemetry Collector Buatan Google
izin yang diperlukan untuk membuat dan mengelola rahasia. Peran Identity and Access Management
roles/secretManager.secretAdmin mencakup izin
yang diperlukan:
Sebelum menjalankan perintah sebelumnya, ganti variabel berikut:
PROJECT_ID: ID
Google Cloud project Anda.
USER_EMAIL: alamat pengguna yang diberi
peran.
Beri akun layanan yang terkait dengan VM izin yang diperlukan untuk mengakses secret. Peran Identity and Access Management
roles/secretManager.secretAccessor mencakup izin
yang diperlukan:
Sebelum menjalankan perintah sebelumnya, ganti variabel berikut:
PROJECT_ID: ID Google Cloud project Anda.
SERVICE_ACCT_EMAIL: alamat
akun layanan yang terkait dengan VM.
Mengganti secret teks biasa dengan secret terkelola
Untuk menghilangkan penggunaan secret teks biasa dalam file konfigurasi dengan menggunakan Secret Manager dan penyedia googlesecretmanager, lakukan langkah berikut:
Buat secret di Secret Manager untuk setiap secret teks biasa
dalam file konfigurasi Anda.
Ganti setiap secret teks biasa dalam file konfigurasi Anda dengan referensi
ke secret yang sesuai di Secret Manager.
Misalnya, jika Anda menggunakan eksportir http,
file konfigurasi Anda dapat menyertakan entri seperti berikut:
Dalam contoh ini, Anda ingin menempatkan string plaintext-secret
ke Secret Manager, lalu mengganti
secret teks biasa dengan referensi ke secret terkelola.
Membuat secret Secret Manager
untuk secret teks biasa
Untuk membuat secret Secret Manager yang berisi secret teks biasa plaintext-secret, jalankan perintah berikut:
Untuk mengetahui informasi selengkapnya tentang cara menyimpan, membuat versi, dan mengakses secret di
Secret Manager, lihat
Membuat secret.
Mengganti secret teks biasa
Untuk memperbarui file konfigurasi, ganti setiap secret teks biasa dengan referensi ke penyedia googlesecretmanager dan nama resource secret terkelola, seperti yang ditunjukkan dalam contoh berikut:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-12 UTC."],[],[],null,["# Manage secrets in Google-Built OpenTelemetry Collector configuration\n\nConfiguring some components, like receivers or exporters, might require\nyou to provide secrets, such as passwords. You can includes these secrets as\nplaintext in the Collector's configuration files. However, these secrets are\nincluded in system logs written by the Collector and transmitted to\nCloud Logging, exposing the secrets beyond the node or virtual machine (VM)\nwhere the Collector is running.\n\nStarting with the Google-built Collector version\n0.126.0,\nyou can use an OpenTelemetry provider integrated with [Secret Manager](/secret-manager/docs/overview) to\neliminate plaintext secrets in your configuration files.\n\nA *provider* is an OpenTelemetry configuration component,\nanalogous to the receiver and processor components. Each provider has a\ntype, and each type of provider maps a specific identifier in the\nconfiguration to a value.\n\nThe `googlesecretmanager` provider maps Secret Manager\nidentifiers to the secrets, like passwords, tokens, and API keys, that you've\nstored in Secret Manager. Using the\n`googlesecretmanager` provider offers the following benefits:\n\n- **Enhanced security** : Your configuration files don't contain sensitive information like passwords. The actual secrets are stored in [Secret Manager](/secret-manager/docs/overview), a service designed specifically for securely storing, accessing, and managing sensitive data.\n- **Reduced risk of exposure**: Secret Manager fetches secrets during initialization of the Google-Built OpenTelemetry Collector, which prevents plaintext secrets from accidentally being recorded in logs.\n\nBefore you begin\n----------------\n\nTo use the `googlesecretmanager` provider, you must enable the\nSecret Manager API and permit access to the API,\nas described in the following steps:\n\n1.\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n After installation,\n [initialize](/sdk/docs/initializing) the Google Cloud CLI by running the following command:\n\n ```bash\n gcloud init\n ```\n\n\n If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n2. Set the default project for Google Cloud CLI:\n\n ```\n gcloud config set project PROJECT_ID\n ```\n\n Before you run the previous command, replace the \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n variable with the identifier of your Google Cloud project.\n3.\n\n\n Enable the Secret Manager API:\n\n\n ```bash\n gcloud services enable secretmanager.googleapis.com\n ```\n4. Update the OAuth access scopes for your instance to include the required scope for Secret Manager, `https://www.googleapis.com/auth/cloud-platform`: \n\n ```\n gcloud compute instances set-service-account \"INSTANCE_ID\" \\\n --service-account \"SERVICE_ACCT_EMAIL\" \\\n --scopes \"https://www.googleapis.com/auth/cloud-platform\"\n ```\n\n Before you run the previous command, replace the following variables:\n - \u003cvar translate=\"no\"\u003eINSTANCE_ID\u003c/var\u003e: the identifier of your VM.\n - \u003cvar translate=\"no\"\u003eSERVICE_ACCT_EMAIL\u003c/var\u003e: the address of the service account associated with the VM.\n\n For more information, see\n [Access the Secret Manager API](/stackdriver/docs/instrumentation/secret-manager/docs/accessing-the-api).\n5. Grant the user who manages the Google-Built OpenTelemetry Collector configurations the permissions needed to create and manage secrets. The Identity and Access Management role `roles/secretManager.secretAdmin` includes the necessary permissions: \n\n ```\n gcloud projects add-iam-policy-binding PROJECT_ID \\\n --member=\"user:USER_EMAIL\" \\\n --role=roles/secretManager.secretAdmin\n ```\n\n Before you run the previous command, replace the following variables:\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the identifier of your Google Cloud project.\n - \u003cvar translate=\"no\"\u003eUSER_EMAIL\u003c/var\u003e: the address of the user being granted the role.\n6. Grant the service account associated with the VM the permissions it needs to access the secrets. The Identity and Access Management role `roles/secretManager.secretAccessor` includes the necessary permissions: \n\n ```\n gcloud projects add-iam-policy-binding PROJECT_ID \\\n --member=\"serviceAccount:SERVICE_ACCT_EMAIL\" \\\n --role=roles/secretManager.secretAccessor\n ```\n\n Before you run the previous command, replace the following variables:\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the identifier of your Google Cloud project.\n - \u003cvar translate=\"no\"\u003eSERVICE_ACCT_EMAIL\u003c/var\u003e: the address of the service account associated with the VM.\n\nReplace plaintext secrets with managed secrets\n----------------------------------------------\n\nTo eliminate the use of plaintext secrets in your configuration files by\nusing Secret Manager and the `googlesecretmanager`\nprovider, do the following:\n\n1. Create a secret in Secret Manager for each plaintext secret in your configuration files.\n2. Replace each plaintext secret in your configuration files with a reference to the corresponding secret in Secret Manager.\n\nFor example, if you are using an `http` exporter,\nyour configuration file might include an entry like the following: \n\n```\nexporters:\n logging:\n loglevel: debug\n http:\n endpoint: \"https://example.com/api/metrics\"\n headers:\n X-API-Key: plaintext-secret\n```\n\nIn this example, you want to place the \u003cvar translate=\"no\"\u003eplaintext-secret\u003c/var\u003e\nstring into Secret Manager and then replace\nthe plaintext secret with a reference to the managed secret.\n\n### Create Secret Manager secrets\nfor plaintext secrets\n\nTo create a Secret Manager secret containing the plaintext secret `plaintext-secret`, run the following command: \n\n```\necho -n \"plaintext-secret\" | gcloud secrets create SECRET_NAME \\\n --replication-policy=\"automatic\" \\\n --data-file=-\n```\n\nBefore you run the previous command, replace the following variables:\n\n- \u003cvar translate=\"no\"\u003eplaintext-secret\u003c/var\u003e: Replace with your plaintext secret.\n- \u003cvar translate=\"no\"\u003eSECRET_NAME\u003c/var\u003e: Replace with a meaningful name for your secret.\n\nThe fully qualified resource name of your new secret has the following\nformat, with a \u003cvar translate=\"no\"\u003eVERSION\u003c/var\u003e of `1`: \n\n```\nprojects/PROJECT_ID/secrets/SECRET_NAME/versions/VERSION\n```\n\nFor more information about storing, versioning, and accessing secrets in\nSecret Manager, see\n[Create a secret](/secret-manager/docs/creating-and-accessing-secrets).\n\n### Replace plaintext secrets\n\nTo update your configuration files, replace each plaintext secret\nwith a reference to the `googlesecretmanager` provider and the resource\nname of the managed secret, as shown in the following example: \n\n```\nexporters:\n logging:\n loglevel: debug\n http:\n endpoint: \"https://example.com/api/metrics\"\n headers:\n X-API-Key: ${googlesecretmanager:projects/PROJECT_ID/secrets/SECRET_NAME/versions/VERSION}\n```\n\n### Learn more\n\nFor more information about using the `googlesecretmanager` provider, visit the [`opentelemetry-collector-contrib` repository](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/confmap/provider/googlesecretmanagerprovider)."]]
