OTel Certificate Placement And Automation

To automate the placement of certificate files for a secure OpenTelemetry (OTel) pipeline, you should follow a standardized directory structure that aligns with your DevSecOps and Ansible automation workflows.

For a production environment using Smallstep CA and Caddy, certificates are typically placed in a dedicated, restricted directory on the host to ensure only the OTel service can access them.

1. Recommended Directory Structure

Whether on Windows or Linux, keep your certificates separate from the application binaries to simplify permission management and rotation.

For Linux (Ubuntu/RHEL):

• Path: /etc/otelcol-contrib/certs/
• Files:
  • ca.crt: The Smallstep root/intermediate certificate.
  • client.crt: The certificate issued to the specific server or collector.
  • client.key: The private key (must have restricted permissions).

For Windows (IIS Environments):

• Path: C:\Program Files\OpenTelemetry Collector\certs\
• Files: Same as above. Note that for IIS applications, you may also import these into the Windows Certificate Store, but the OTel Collector typically reads from the file system.

2. Automating Placement with Ansible

In your Ansible playbook, use the file and copy (or template) modules to ensure the files are placed correctly with the right security context.

YAML

- name: Setup OTel Certificate Directory
hosts: otel_nodes
tasks:
- name: Create secure certs directory
file:
path: /etc/otelcol-contrib/certs
state: directory
owner: otelcol # Restrict to the OTel service user
group: otelcol
mode: '0700' # Read/Write/Execute for owner only

- name: Deploy CA Certificate
copy:
src: files/ca.crt
dest: /etc/otelcol-contrib/certs/ca.crt
mode: '0644'

- name: Deploy Client Private Key
copy:
content: "{{ vault_otel_client_key }}" # Use Ansible Vault for sensitive keys
dest: /etc/otelcol-contrib/certs/client.key
mode: '0600'

3. Referencing Paths in the OTel Config

Once the files are placed by Ansible, you must reference these exact paths in your config.yaml to enable mTLS for your exporters (sending data to VictoriaMetrics or ELK) or receivers.

YAML

exporters:
otlp/secure:
endpoint: "your-backend-dns:4317"
tls:
ca_file: "/etc/otelcol-contrib/certs/ca.crt"
cert_file: "/etc/otelcol-contrib/certs/client.crt"
key_file: "/etc/otelcol-contrib/certs/client.key"

4. Security Best Practices for Cert Placement

• Permissions: Always set the private key (.key) to 0600 on Linux so only the owner can read it.
• Source Control: Never store actual .key files in GitHub. Store them in GitHub Secrets and inject them via GitHub Actions or use Ansible Vault to encrypt them within your repository.
• Automation: Use Caddy's automation capabilities to handle certificate renewal for your web apps/Astro sites, and have Ansible reload the OTel service if certificates change.