> For the complete documentation index, see [llms.txt](https://docs.bindplane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bindplane.com/production-checklist/bindplane-otel-collector/secret-management.md). # Secret Management The Bindplane Collector relies on the following configuration files: * **manager.yaml** - Used to configure connectivity to the Bindplane server over OpAMP * When the collector runs for the first time, the `Manager.yaml` will be bootstrapped. When the `OPAMP_SECRET_KEY` and `OPAMP_ENDPOINT` environment variables are present, the collector will write the `manager.yaml` file to disk, automatically injecting the `${env:..}` mapping for you. * **config.yaml -** Used to define what sources, processors, destinations, and other OTel components are used by the Bindplane Distro for OpenTelemetry Collector (BDOT) at runtime. #### Choose an Approach The following approaches allow for secure secret management of collector secret values. | Approach | Mechanism | Use When | | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ | | [**ENV Provider**](https://docs.bindplane.com/production-checklist/bindplane/secrets-management/using-environment-variables#step-2-environment-configuration) | `${env:VAR}` in `manager.yaml` / `config.yaml`, resolved at startup | You inject secrets at runtime | | [**AES Provider** ](https://docs.bindplane.com/configuration/bindplane-otel-collector/configuration-encryption)(recommended) | `${aes:CIPHER_TEXT}` + `OTEL_AES_CREDENTIAL_PROVIDER` | You must persist or commit `manager.yaml`, or environment-variable leakage is a high risk. | #### Configure the collector environment Set the collector's environment variables on each platform. The collector reads `OPAMP_SECRET_KEY`, `OTEL_AES_CREDENTIAL_PROVIDER`, and any `${env:...}` pipeline variables from its service environment at startup. {% tabs %} {% tab title="Windows" %} This can be done via PowerShell: **Run Powershell as Administrator:** {% code overflow="wrap" lineNumbers="true" %} ```powershell # set-collector-env.ps1 # Usage: .\set-collector-env.ps1 "OPAMP_SECRET_KEY=" "OTEL_AES_CREDENTIAL_PROVIDER=" param( [Parameter(Mandatory, ValueFromRemainingArguments)] [string[]]$Variables ) $service = "observiq-otel-collector" $regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$service" Set-ItemProperty -Path $regPath -Name Environment -Value $Variables -Type MultiString Restart-Service $service Write-Host "Set $($Variables.Count) variable(s) and restarted $service." ``` {% endcode %} Or using the Registry Editor: **Open the service's registry key.** 1. Press `Win + R`, type `regedit`, and press Enter. 2. Approve the User Account Control prompt. 3. Navigate to `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\observiq-otel-collector`. **Create or open the Environment value.** 1. Right-click the `observiq-otel-collector` key and choose New > Multi-String Value. 2. Name it `Environment`. If the value already exists, skip to editing it. 3. Double-click `Environment` to open the editor. **Add your variables.** 1. Enter each variable on its own line as `NAME=value` — for example, `OPAMP_SECRET_KEY=`. 2. Add additional variables (such as `OTEL_AES_CREDENTIAL_PROVIDER=`) on separate lines. 3. Click OK. **Restart the service.** 1. Press `Win + R`, type `services.msc`, and press Enter. 2. Right-click Bindplane OTel Collector and choose Restart. 3. Confirm the variables took effect by checking the collector logs. {% endtab %} {% tab title="Systemd" %} **Open a drop-in override for the service.** 1. Run `sudo systemctl edit observiq-otel-collector`. 2. This creates an override at `/etc/systemd/system/observiq-otel-collector.service.d/override.conf` without touching the packaged unit. #### Add your variables For static values, add them directly under `[Service]`: ```ini [Service] Environment=OPAMP_SECRET_KEY= Environment=OTEL_AES_CREDENTIAL_PROVIDER= ``` To inject secrets from a manager at startup: ```ini [Service] ExecStartPre=/usr/local/bin/fetch-secrets.sh EnvironmentFile=/run/secrets/collector.env ``` **Apply the changes.** 1. Reload the unit files: `sudo systemctl daemon-reload`. 2. Restart the collector: `sudo systemctl restart observiq-otel-collector`. 3. Confirm the variables took effect by checking the collector logs. {% endtab %} {% tab title="macOS" %} **Open the collector's launchd service file.** 1. Open `/Library/LaunchDaemons/com.observiq.collector.plist` in a text editor with `sudo`. 2. Locate the `EnvironmentVariables` dict, or add one if it isn't present. **Add your variables.** Add each variable as a `key`/`string` pair inside the dict: ```xml EnvironmentVariables OPAMP_SECRET_KEY secret OTEL_AES_CREDENTIAL_PROVIDER Encryption key ``` **Reload the service.** 1. Unload it: `sudo launchctl unload /Library/LaunchDaemons/com.observiq.collector.plist`. 2. Load it again: `sudo launchctl load /Library/LaunchDaemons/com.observiq.collector.plist`. 3. Confirm the variables took effect by checking the collector logs. {% endtab %} {% endtabs %} ### Resulting file contents The recommended patterns resolve secrets at startup instead of storing them in plaintext on disk. Here's what each file looks like before and after. #### **manager.yaml** Before - the secret key is written in plaintext: ```yaml endpoint: wss://bindplane.example.com/v1/opamp secret_key: 3d83f0cb-2567-42c7-ada6-960842924d11 labels: "configuration=linux-hosts" ``` After - the value resolves from the environment at startup: ***ENV provider:*** ```yaml endpoint: wss://bindplane.example.com/v1/opamp secret_key: ${env:OPAMP_SECRET_KEY} labels: "configuration=linux-hosts" ``` ***AES Provider:*** ```yaml endpoint: wss://bindplane.example.com/v1/opamp secret_key: ${aes:YTgzZjBjYjI1Njc0MmM3YWRhNjk2MDg0MjkyNGQxMQ} labels: "configuration=linux-hosts" ``` **config.yaml** Before - a destination credential is written in plaintext: ```yaml exporters: otlphttp/backend: endpoint: https://ingest.example.com headers: authorization: "Bearer sk_live_abcd1234..." ``` After - the credential resolves from the environment at startup: ***ENV provider:*** ```yaml exporters: otlphttp/backend: endpoint: https://ingest.example.com headers: authorization: "Bearer ${env:BACKEND_API_TOKEN}" ``` ***AES Provider:*** ```yaml exporters: otlphttp/backend: endpoint: https://ingest.example.com headers: authorization: ${aes:YTgzZjBjYjI1Njc0MmM3YWRhNjk2MDg0MjkyNGQxMQ} ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.bindplane.com/production-checklist/bindplane-otel-collector/secret-management.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.