Security

MetricsHub provides a set of security mechanisms to secure:

  • The MetricsHub Agent's passwords stored in the config/metricshub.yaml file
  • The communications instantiated between the MetricsHub Agent and the OpenTelemetry Collector.

Encryption

Use the metricshub-encrypt command to encrypt the passwords specified in the config/metricshub.yaml file. See Passwords Encryption[1] for more details.

OpenTelemetry Collector Security

Receiver security

To prevent malicious attacks, the gRPC listener is by default only opened on localhost:

  otlp:
    protocols:
      grpc:
        endpoint: localhost:4317

Transport security

MetricsHub secures the communications instantiated from the MetricsHub Agent's internal OTLP Exporter to the OpenTelemetry Collector's internal OTLP gRPC Receiver through TLS.

The OTLP gRPC Receiver is configured as follows in the otel/otel-config.yaml file:

  otlp:
    protocols:
      grpc:
        endpoint: localhost:4317
        tls:
          cert_file: ../security/otel.crt
          key_file: ../security/otel.key

To customize the default TLS settings, see Customizing TLS Certificates[2].

Requests authentication

Once TLS is established, the OTLP gRPC Receiver uses the basicauth authenticator to authenticate any incoming request:

  otlp:
    protocols:
      grpc:
        endpoint: localhost:4317
        tls:
          cert_file: ../security/otel.crt
          key_file: ../security/otel.key
        auth:
          authenticator: basicauth

To customize the default authentication secret, see Customizing OTLP Authentication Password[3].

No results.