Secret Management

Best practices for managing the secrets used to connect to your sources, destinations, and the Bindplane Control Plane.

The Bindplane Collector relies on the following configuration files:

• manager.yaml - Used to configure connectivity to the Bindplane server over OpAMP

  • When the collector runs for the first time, the Manager.yaml will be bootstrapped. When the OPAMP_SECRET_KEY and OPAMP_ENDPOINT environment variables are present, the collector will write the manager.yaml file to disk, automatically injecting the ${env:..} mapping for you.
• config.yaml - Used to define what sources, processors, destinations, and other OTel components are used by the Bindplane Distro for OpenTelemetry Collector (BDOT) at runtime.

Choose an Approach

The following approaches allow for secure secret management of collector secret values.

Approach	Mechanism	Use When
ENV Provider	${env:VAR} in manager.yaml / config.yaml, resolved at startup	You inject secrets at runtime
AES Provider (recommended)	${aes:CIPHER_TEXT} + OTEL_AES_CREDENTIAL_PROVIDER	You must persist or commit manager.yaml, or environment-variable leakage is a high risk.

Configure the collector environment

Set the collector's environment variables on each platform. The collector reads OPAMP_SECRET_KEY, OTEL_AES_CREDENTIAL_PROVIDER, and any ${env:...} pipeline variables from its service environment at startup.

Windows

This can be done via PowerShell:

Run Powershell as Administrator:

# set-collector-env.ps1
# Usage: .\set-collector-env.ps1 "OPAMP_SECRET_KEY=<secret>" "OTEL_AES_CREDENTIAL_PROVIDER=<key>"

param(
    [Parameter(Mandatory, ValueFromRemainingArguments)]
    [string[]]$Variables
)

$service = "observiq-otel-collector"
$regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$service"

Set-ItemProperty -Path $regPath -Name Environment -Value $Variables -Type MultiString
Restart-Service $service

Write-Host "Set $($Variables.Count) variable(s) and restarted $service."

Or using the Registry Editor:

Open the service's registry key.

1. Press Win + R, type regedit, and press Enter.
2. Approve the User Account Control prompt.
3. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\observiq-otel-collector.

Create or open the Environment value.

1. Right-click the observiq-otel-collector key and choose New > Multi-String Value.
2. Name it Environment. If the value already exists, skip to editing it.
3. Double-click Environment to open the editor.

Add your variables.

1. Enter each variable on its own line as NAME=value — for example, OPAMP_SECRET_KEY=<secret>.
2. Add additional variables (such as OTEL_AES_CREDENTIAL_PROVIDER=<key>) on separate lines.
3. Click OK.

Restart the service.

1. Press Win + R, type services.msc, and press Enter.
2. Right-click Bindplane OTel Collector and choose Restart.
3. Confirm the variables took effect by checking the collector logs.

Systemd

Open a drop-in override for the service.

1. Run sudo systemctl edit observiq-otel-collector.
2. This creates an override at /etc/systemd/system/observiq-otel-collector.service.d/override.conf without touching the packaged unit.

Add your variables

For static values, add them directly under [Service]:

[Service]
Environment=OPAMP_SECRET_KEY=<secret>
Environment=OTEL_AES_CREDENTIAL_PROVIDER=<key>

To inject secrets from a manager at startup:

[Service]
ExecStartPre=/usr/local/bin/fetch-secrets.sh
EnvironmentFile=/run/secrets/collector.env

Apply the changes.

1. Reload the unit files: sudo systemctl daemon-reload.
2. Restart the collector: sudo systemctl restart observiq-otel-collector.
3. Confirm the variables took effect by checking the collector logs.

macOS

Open the collector's launchd service file.

1. Open /Library/LaunchDaemons/com.observiq.collector.plist in a text editor with sudo.
2. Locate the EnvironmentVariables dict, or add one if it isn't present.

Add your variables.

Add each variable as a key/string pair inside the dict:

<key>EnvironmentVariables</key>
<dict>
    <key>OPAMP_SECRET_KEY</key>
    <string>secret</string>
    <key>OTEL_AES_CREDENTIAL_PROVIDER</key>
    <string>Encryption key</string>
</dict>

Reload the service.

1. Unload it: sudo launchctl unload /Library/LaunchDaemons/com.observiq.collector.plist.
2. Load it again: sudo launchctl load /Library/LaunchDaemons/com.observiq.collector.plist.
3. Confirm the variables took effect by checking the collector logs.

Resulting file contents

The recommended patterns resolve secrets at startup instead of storing them in plaintext on disk. Here's what each file looks like before and after.

manager.yaml

Before - the secret key is written in plaintext:

endpoint: wss://bindplane.example.com/v1/opamp
secret_key: 3d83f0cb-2567-42c7-ada6-960842924d11
labels: "configuration=linux-hosts"

After - the value resolves from the environment at startup:

ENV provider:

endpoint: wss://bindplane.example.com/v1/opamp
secret_key: ${env:OPAMP_SECRET_KEY}
labels: "configuration=linux-hosts"

AES Provider:

endpoint: wss://bindplane.example.com/v1/opamp
secret_key: ${aes:YTgzZjBjYjI1Njc0MmM3YWRhNjk2MDg0MjkyNGQxMQ}
labels: "configuration=linux-hosts"

config.yaml

Before - a destination credential is written in plaintext:

exporters:
  otlphttp/backend:
    endpoint: https://ingest.example.com
    headers:
      authorization: "Bearer sk_live_abcd1234..."

After - the credential resolves from the environment at startup:

ENV provider:

exporters:
  otlphttp/backend:
    endpoint: https://ingest.example.com
    headers:
      authorization: "Bearer ${env:BACKEND_API_TOKEN}"

AES Provider:

exporters:
  otlphttp/backend:
    endpoint: https://ingest.example.com
    headers:
      authorization: ${aes:YTgzZjBjYjI1Njc0MmM3YWRhNjk2MDg0MjkyNGQxMQ}