signalfx / splunk-otel-collector

Apache License 2.0
187 stars 154 forks source link

Request to review and add basic http auth module to the Splunk distribution of otelcol #1475

Closed kdessai19 closed 1 year ago

kdessai19 commented 2 years ago

Requesting to add basic auth features to securing clear text passwords stored inside the agent_config.yaml files from a security perspective. here is a sample of how the config would like

`extensions:
  basicauth:
    htpasswd: 
      file: C:\ProgramData\Splunk\OpenTelemetry Collector\.htpasswd
  health_check:
    endpoint: 0.0.0.0:13133
  http_forwarder:
    ingress:
      endpoint: 0.0.0.0:6060
    egress:
      endpoint: "${SPLUNK_API_URL}"
      # Use instead when sending to gateway
      #endpoint: "${SPLUNK_GATEWAY_URL}"
  smartagent:
    bundleDir: "${SPLUNK_BUNDLE_DIR}"
    collectd:
      configDir: "${SPLUNK_COLLECTD_DIR}"
  zpages:
    #endpoint: 0.0.0.0:55679
  memory_ballast:
    # In general, the ballast should be set to 1/3 of the collector's memory, the limit
    # should be 90% of the collector's memory.
    # The simplest way to specify the ballast size is set the value of SPLUNK_BALLAST_SIZE_MIB env variable.
    size_mib: ${SPLUNK_BALLAST_SIZE_MIB}

receivers:
  smartagent/AmazonSSMAgent:
    type: telegraf/procstat
    WinService: AmazonSSMAgent
  smartagent/sqlserver:
    type: telegraf/sqlserver
    host: MYSQLSERVER
    port: 1433
    protocols:
      http:
        auth:
          authenticator: basicauth
    appName: signalfxagent`

And the content of the .htpasswd file would be signalfxagent:{SHA}sW5M4Ncbiu3o0/eHokVOZvqfScI=

kdessai19 commented 2 years ago

for reference https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/extension/basicauthextension

atoulme commented 1 year ago

This request would best be placed upstream with the opentelemetry project. Please consider following up with an issue to https://github.com/open-telemetry/opentelemetry-collector-contrib targeting the basicauthextension, and more likely to the collector core project targeting the auth config module. Closing as this is out of scope of this project.