수신자나 내보내기 도구와 같은 일부 구성요소를 구성하려면 비밀번호와 같은 보안 비밀을 제공해야 할 수 있습니다. 이러한 보안 비밀을 Collector 구성 파일에 일반 텍스트로 포함할 수 있습니다. 그러나 이러한 보안 비밀은 Collector에서 작성한 시스템 로그에 포함되어 Cloud Logging으로 전송되므로 Collector가 실행되는 노드 또는 가상 머신(VM) 외부에 보안 비밀이 노출됩니다.
Google에서 빌드한 Collector 버전 0.126.0부터 Secret Manager와 통합된 OpenTelemetry 제공자를 사용하여 구성 파일에서 일반 텍스트 보안 비밀을 삭제할 수 있습니다.
제공자는 수신자 및 프로세서 구성요소와 유사한 OpenTelemetry 구성 구성요소입니다. 각 제공자에는 유형이 있으며 각 유형의 제공자는 구성의 특정 식별자를 값에 매핑합니다.
googlesecretmanager 제공자는 Secret Manager 식별자를 Secret Manager에 저장한 비밀번호, 토큰, API 키와 같은 보안 비밀에 매핑합니다. googlesecretmanager 제공자를 사용하면 다음과 같은 이점이 있습니다.
보안 강화: 구성 파일에 비밀번호와 같은 민감한 정보가 포함되지 않습니다. 실제 보안 비밀은 민감한 정보를 안전하게 저장, 액세스, 관리하기 위해 특별히 설계된 서비스인 Secret Manager에 저장됩니다.
노출 위험 감소: Secret Manager는 Google에서 빌드한 OpenTelemetry Collector의 초기화 중에 보안 비밀을 가져오므로 일반 텍스트 보안 비밀이 실수로 로그에 기록되는 것을 방지합니다.
시작하기 전에
googlesecretmanager 제공자를 사용하려면 다음 단계에 설명된 대로 Secret Manager API를 사용 설정하고 API에 대한 액세스를 허용해야 합니다.
After installing the Google Cloud CLI,
initialize it by running the following command:
Google에서 빌드한 OpenTelemetry Collector 구성을 관리하는 사용자에게 보안 비밀을 만들고 관리하는 데 필요한 권한을 부여합니다. Identity and Access Management 역할 roles/secretManager.secretAdmin에는 다음과 같은 필수 권한이 포함되어 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-07-21(UTC)"],[],[],null,["# Manage secrets in Google-Built OpenTelemetry Collector configuration\n\nConfiguring some components, like receivers or exporters, might require\nyou to provide secrets, such as passwords. You can includes these secrets as\nplaintext in the Collector's configuration files. However, these secrets are\nincluded in system logs written by the Collector and transmitted to\nCloud Logging, exposing the secrets beyond the node or virtual machine (VM)\nwhere the Collector is running.\n\nStarting with the Google-built Collector version\n0.126.0,\nyou can use an OpenTelemetry provider integrated with [Secret Manager](/secret-manager/docs/overview) to\neliminate plaintext secrets in your configuration files.\n\nA *provider* is an OpenTelemetry configuration component,\nanalogous to the receiver and processor components. Each provider has a\ntype, and each type of provider maps a specific identifier in the\nconfiguration to a value.\n\nThe `googlesecretmanager` provider maps Secret Manager\nidentifiers to the secrets, like passwords, tokens, and API keys, that you've\nstored in Secret Manager. Using the\n`googlesecretmanager` provider offers the following benefits:\n\n- **Enhanced security** : Your configuration files don't contain sensitive information like passwords. The actual secrets are stored in [Secret Manager](/secret-manager/docs/overview), a service designed specifically for securely storing, accessing, and managing sensitive data.\n- **Reduced risk of exposure**: Secret Manager fetches secrets during initialization of the Google-Built OpenTelemetry Collector, which prevents plaintext secrets from accidentally being recorded in logs.\n\nBefore you begin\n----------------\n\nTo use the `googlesecretmanager` provider, you must enable the\nSecret Manager API and permit access to the API,\nas described in the following steps:\n\n1.\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n After installation,\n [initialize](/sdk/docs/initializing) the Google Cloud CLI by running the following command:\n\n ```bash\n gcloud init\n ```\n\n\n If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n2. Set the default project for Google Cloud CLI:\n\n ```\n gcloud config set project PROJECT_ID\n ```\n\n Before you run the previous command, replace the \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n variable with the identifier of your Google Cloud project.\n3.\n\n\n Enable the Secret Manager API:\n\n\n ```bash\n gcloud services enable secretmanager.googleapis.com\n ```\n4. Update the OAuth access scopes for your instance to include the required scope for Secret Manager, `https://www.googleapis.com/auth/cloud-platform`: \n\n ```\n gcloud compute instances set-service-account \"INSTANCE_ID\" \\\n --service-account \"SERVICE_ACCT_EMAIL\" \\\n --scopes \"https://www.googleapis.com/auth/cloud-platform\"\n ```\n\n Before you run the previous command, replace the following variables:\n - \u003cvar translate=\"no\"\u003eINSTANCE_ID\u003c/var\u003e: the identifier of your VM.\n - \u003cvar translate=\"no\"\u003eSERVICE_ACCT_EMAIL\u003c/var\u003e: the address of the service account associated with the VM.\n\n For more information, see\n [Access the Secret Manager API](/stackdriver/docs/instrumentation/secret-manager/docs/accessing-the-api).\n5. Grant the user who manages the Google-Built OpenTelemetry Collector configurations the permissions needed to create and manage secrets. The Identity and Access Management role `roles/secretManager.secretAdmin` includes the necessary permissions: \n\n ```\n gcloud projects add-iam-policy-binding PROJECT_ID \\\n --member=\"user:USER_EMAIL\" \\\n --role=roles/secretManager.secretAdmin\n ```\n\n Before you run the previous command, replace the following variables:\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the identifier of your Google Cloud project.\n - \u003cvar translate=\"no\"\u003eUSER_EMAIL\u003c/var\u003e: the address of the user being granted the role.\n6. Grant the service account associated with the VM the permissions it needs to access the secrets. The Identity and Access Management role `roles/secretManager.secretAccessor` includes the necessary permissions: \n\n ```\n gcloud projects add-iam-policy-binding PROJECT_ID \\\n --member=\"serviceAccount:SERVICE_ACCT_EMAIL\" \\\n --role=roles/secretManager.secretAccessor\n ```\n\n Before you run the previous command, replace the following variables:\n - \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the identifier of your Google Cloud project.\n - \u003cvar translate=\"no\"\u003eSERVICE_ACCT_EMAIL\u003c/var\u003e: the address of the service account associated with the VM.\n\nReplace plaintext secrets with managed secrets\n----------------------------------------------\n\nTo eliminate the use of plaintext secrets in your configuration files by\nusing Secret Manager and the `googlesecretmanager`\nprovider, do the following:\n\n1. Create a secret in Secret Manager for each plaintext secret in your configuration files.\n2. Replace each plaintext secret in your configuration files with a reference to the corresponding secret in Secret Manager.\n\nFor example, if you are using an `http` exporter,\nyour configuration file might include an entry like the following: \n\n```\nexporters:\n logging:\n loglevel: debug\n http:\n endpoint: \"https://example.com/api/metrics\"\n headers:\n X-API-Key: plaintext-secret\n```\n\nIn this example, you want to place the \u003cvar translate=\"no\"\u003eplaintext-secret\u003c/var\u003e\nstring into Secret Manager and then replace\nthe plaintext secret with a reference to the managed secret.\n\n### Create Secret Manager secrets\nfor plaintext secrets\n\nTo create a Secret Manager secret containing the plaintext secret `plaintext-secret`, run the following command: \n\n```\necho -n \"plaintext-secret\" | gcloud secrets create SECRET_NAME \\\n --replication-policy=\"automatic\" \\\n --data-file=-\n```\n\nBefore you run the previous command, replace the following variables:\n\n- \u003cvar translate=\"no\"\u003eplaintext-secret\u003c/var\u003e: Replace with your plaintext secret.\n- \u003cvar translate=\"no\"\u003eSECRET_NAME\u003c/var\u003e: Replace with a meaningful name for your secret.\n\nThe fully qualified resource name of your new secret has the following\nformat, with a \u003cvar translate=\"no\"\u003eVERSION\u003c/var\u003e of `1`: \n\n```\nprojects/PROJECT_ID/secrets/SECRET_NAME/versions/VERSION\n```\n\nFor more information about storing, versioning, and accessing secrets in\nSecret Manager, see\n[Create a secret](/secret-manager/docs/creating-and-accessing-secrets).\n\n### Replace plaintext secrets\n\nTo update your configuration files, replace each plaintext secret\nwith a reference to the `googlesecretmanager` provider and the resource\nname of the managed secret, as shown in the following example: \n\n```\nexporters:\n logging:\n loglevel: debug\n http:\n endpoint: \"https://example.com/api/metrics\"\n headers:\n X-API-Key: ${googlesecretmanager:projects/PROJECT_ID/secrets/SECRET_NAME/versions/VERSION}\n```\n\n### Learn more\n\nFor more information about using the `googlesecretmanager` provider, visit the [`opentelemetry-collector-contrib` repository](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/confmap/provider/googlesecretmanagerprovider)."]]
