[extension/basicauthextension] Add AWS Secrets Manager support for basicauth extension #49025
Open
meebok wants to merge 18 commits into
Open
[extension/basicauthextension] Add AWS Secrets Manager support for basicauth extension #49025meebok wants to merge 18 commits into
meebok wants to merge 18 commits into
Conversation
Contributor
|
Welcome, contributor! Thank you for your contribution to opentelemetry-collector-contrib. Important reminders:
|
github-actions
Bot
added
first-time contributor
Add support for fetching credentials from AWS Secrets Manager as an alternative credential source for both client and server authentication modes. The resolver logic lives in a shared internal package at extension/internal/awssecretsmanager/ and supports periodic background refresh with atomic value updates for seamless secret rotation.
- Remove unused defaultRefreshInterval constant from config.go - Remove requireKeys parameter from AWSSecretClientConfig.validate() - Move logger field to end of basicAuthServer struct - Restructure server Start() so AWS and file/inline paths are exclusive
- Pass *zap.Logger into newServerAuthExtension and newClientAuthExtension instead of assigning ext.logger after construction - Simplify factory.go by removing intermediate variables - Restore original inline-precedence comment from main
…esolver Move the awssecretsmanager package from extension/internal/ to basicauthextension/internal/ since no other extension needs it. Add ClientResolver for client mode that fetches the secret once and extracts both username and password in a single API call, replacing the previous approach of two separate resolvers hitting the same secret ARN independently.
Replace two nearly-identical types (Resolver + ClientResolver) with a single Resolver that takes an onFetch(string) error callback. The caller provides all parsing and storage logic in the callback, eliminating ~330 lines of duplicated lifecycle code. Server mode callback rebuilds the htpasswd matcher atomically. Client mode callback parses JSON and stores username+password via CompareAndSwap.
meebok
force-pushed
the
aws-secret-manager-support
branch
from
a37ac8b to
ac65fc4
Compare
…r credential lookup
meebok
force-pushed
the
aws-secret-manager-support
branch
from
f15362d to
cd5fd67
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
htpasswdcontent from a Secrets Manager secret and refreshes it on a configurable intervalaws-sdk-go-v2/config.LoadDefaultConfig: workloads must have an IAM identity (instance profile, EKS pod identity/IRSA, ECS task role) withsecretsmanager:GetSecretValuepermissioninternal/awssecretsmanager.Resolver: a callback-based fetcher with periodic refresh loopLink to tracking issue
Fixes #48277
Testing
Sample Configs
Server mode (validates inbound requests):
Client mode (attaches credentials to outbound requests):
Collector Logs
Server collector startup + request handling:
Client collector startup:
Graceful shutdown (both):
Prometheus Metrics
Secret Rotation : Live Refresh Logs
The collector's background goroutine refreshes credentials every refresh_interval (10s here). When the secret is updated in AWS Secrets Manager, the new value is picked up atomically on the next tick . No restart required.
Client collector log (credentials rotated mid-flight):
Observations:
Documentation
Authorship