Secrets Management

Manage Secrets with Bindplane

Managing sensitive information securely is critical when deploying monitoring solutions. Bindplane provides several approaches to help you protect credentials and other secrets used in your OpenTelemetry configurations. This guide outlines the available options and best practices for securing your sensitive data.

IMPORTANT

Bindplane SaaS automatically encrypts all Library Resources, Configurations, Snapshot Recordings, and Agent State information using Envelope Encryption, regardless of whether they contain sensitive data.

For self-hosted Bindplane deployments, encryption is not enabled by default. To enable encryption of sensitive data, you must configure your instance to integrate with Google KMS. Directions for this can be found here. Customers must be using Postgres to enable this option. Encryption is not supported when using Boltstore, which is being deprecated.

Available Methods

Bindplane offers multiple approaches to secure your secrets, with more options being developed:

Method	Status	Description	Bindplane Access
Environment Variables	Available	Reference environment variables in Configurations	No Access
Envelope Encryption	Available	Use a managed KEK (Key Encryption Key) and an encrypted DEK (Data Encryption Key) to protect secrets	Limited Access *

NOTE

• When using Envelope Encryption, the Bindplane Platform will need to decrypt the secret before transmitting the configuration to the selected Agents. AES encryption can be used to symmetrically encrypt the secret before transmission using the AES provider.

NOTE

When using Environment Variables, the Bindplane Platform does not access any secrets in the configuration. Only the Agent will have access.

Choosing the Right Approach

The right secrets management approach depends on your security requirements, operational constraints, and existing infrastructure:

Environment Variables

Best for: Organizations with established environment management practices or simpler deployments. Kubernetes based deployments with integrated KMS in a Kubernetes cluster.

Benefits

• Secrets never leave customer premises

• Secrets are not in the collector pipeline YAML

• Works Out of the Box in SaaS or in a self-hosted deployment

Drawbacks

• More complex to manage at scale

Envelope Encryption

Best for: Organizations requiring enhanced security while maintaining operational simplicity.

Benefits

• Works out of the box in Bindplane SaaS

• Securely stores secrets in all Library Resources, Configurations, and Snapshot Recordings.

• Supports end-to-end encryption through integration with the AES Provider for enhanced security during configuration transmission

Drawbacks

• Requires configuration to work in a self-hosted scenario.

• Pipeline YAML in Collector will still contain secret values if AES Provider is not used.

Getting Started

Explore our detailed guides for each method:

• Using Environment Variables

• Envelope Encryption