Signing Processor

Maintainers: @hilmarf, @jmacd Source: opentelemetry-collector-contrib

Supported Telemetry

Overview

The signing processor adds cryptographic integrity attributes to log records. For each log record it computes a canonical JSON hash (RFC 8785 / JCS) over the full record and signs it with an RSA private key. The resulting signature is stored as audit.integrity.value attribute on the record, and the JWA algorithm identifier plus a certificate reference are stored as audit.integrity.algorithm and audit.integrity.certificate on the enclosing Resource. The processor is designed for use with the OpenTelemetry Audit Logging signal and satisfies the Tier-2 Collector integrity-verification requirements defined there.

Configuration

For complete examples of all supported configurations see testdata/config.yaml. For invalid configuration examples used in tests see testdata/config_invalid.yaml.

processors:
  signing:
    # JWA signing algorithm. Default: RS256.
    # Valid values: RS256, RS512, ES256, EdDSA, HMAC-SHA256
    algorithm: RS256

    # How to encode the signing certificate in the audit.integrity.certificate
    # resource attribute. Default: fingerprint.
    # - fingerprint: "sha256:<hex>" of the DER-encoded certificate
    # - full:        standard-base64 of the DER-encoded certificate
    certificate_ref: fingerprint

    # Key material source (required). Exactly one sub-block must be provided.
    key_source:
      # type selects the provider: file | env | k8s_secret | bao
      type: file

      # --- file provider ---
      file:
        cert_file: /etc/otelcol/signing-cert.pem
        key_file:  /etc/otelcol/signing-key.pem

      # --- env provider — asymmetric ---
      # env:
      #   cert_env_var: SIGNING_CERT_PEM   # PEM or base64-encoded PEM
      #   key_env_var:  SIGNING_KEY_PEM

      # --- env provider — HMAC-SHA256 ---
      # env:
      #   hmac_key_env_var: SIGNING_HMAC_KEY

      # --- Kubernetes Secret provider — asymmetric ---
      # k8s_secret:
      #   name:      signing-secret
      #   namespace: default              # optional, defaults to "default"
      #   cert_key:  tls.crt
      #   key_key:   tls.key

      # --- Kubernetes Secret provider — HMAC-SHA256 ---
      # k8s_secret:
      #   name:      signing-secret
      #   namespace: default
      #   hmac_key:  hmac.key

      # --- OpenBao / Vault provider — asymmetric ---
      # bao:
      #   address:     https://bao.example.com   # optional, falls back to BAO_ADDR
      #   token:       s.xxxx                    # optional, falls back to BAO_TOKEN
      #   secret_path: secret/data/signing
      #   cert_field:  certificate
      #   key_field:   private_key

      # --- OpenBao / Vault provider — HMAC-SHA256 ---
      # bao:
      #   secret_path:   secret/data/signing
      #   hmac_key_field: hmac_key

Key source providers

Provider	Description
`file`	Reads PEM-encoded certificate and private key (RSA, ECDSA, or Ed25519) from local files, or a raw HMAC secret. Supports plain PEM and base64-encoded PEM.
`env`	Reads asymmetric key material (cert + private key) or an HMAC secret from environment variables. Useful for container deployments where secrets are injected via env.
`k8s_secret`	Reads a Kubernetes Secret by name/namespace via the in-cluster or kubeconfig client.
`bao`	Reads key material from an OpenBao (Vault-compatible) secret engine.

Output attributes

Per log record

Attribute	Type	Description
`audit.integrity.value`	string	Base64-encoded signature (or MAC for HMAC-SHA256) of the JCS-canonical payload, using the configured algorithm.

Per Resource (set once per ResourceLogs block)

Attribute	Type	Description
`audit.integrity.algorithm`	string	JWA/IANA algorithm identifier matching the configured `algorithm` field (e.g. `RS256`, `ES256`, `EdDSA`, `HMAC-SHA256`).
`audit.integrity.certificate`	string	Certificate reference: `sha256:<hex>` fingerprint or full base64 DER, depending on `certificate_ref`. Not set for HMAC-SHA256.

Signed payload

The processor serialises the following log-record fields into a JSON object, canonicalises it with RFC 8785 (JCS), and hashes the result. All audit.integrity.* attributes are excluded so the signature can be verified before those attributes are removed.

event_name, body, timestamp, observed_timestamp, severity_number, severity_text,
trace_id, span_id, attributes (all except audit.integrity.*)

Example pipeline

receivers:
  otlp:
    protocols:
      grpc:

processors:
  signing:
    algorithm: RS256
    certificate_ref: fingerprint
    key_source:
      type: file
      file:
        cert_file: /etc/otelcol/cert.pem
        key_file:  /etc/otelcol/key.pem

exporters:
  otlp:
    endpoint: audit-sink:4317

service:
  pipelines:
    logs:
      receivers:  [otlp]
      processors: [signing]
      exporters:  [otlp]

Configuration

Example Configuration

# Signing processor — file-based key material (minimal config).
# algorithm and certificate_ref use their defaults (RS256, fingerprint).
signing:
  key_source:
    type: file
    file:
      cert_file: /etc/otelcol/signing-cert.pem
      key_file:  /etc/otelcol/signing-key.pem

# RS512 variant with full certificate reference.
signing/sha512_full:
  algorithm: RS512
  certificate_ref: full
  key_source:
    type: file
    file:
      cert_file: /etc/otelcol/signing-cert.pem
      key_file:  /etc/otelcol/signing-key.pem

# Environment-variable key material.
signing/env:
  key_source:
    type: env
    env:
      cert_env_var: SIGNING_CERT_PEM
      key_env_var:  SIGNING_KEY_PEM

# Kubernetes Secret key material.
signing/k8s:
  key_source:
    type: k8s_secret
    k8s_secret:
      name:      signing-secret
      namespace: default
      cert_key:  tls.crt
      key_key:   tls.key

# OpenBao / Vault key material.
signing/bao:
  key_source:
    type: bao
    bao:
      address:     https://bao.example.com
      secret_path: secret/data/signing
      cert_field:  certificate
      key_field:   private_key

# HMAC-SHA256 with key from environment variable.
signing/hmac:
  algorithm: HMAC-SHA256
  key_source:
    type: env
    env:
      hmac_key_env_var: SIGNING_HMAC_KEY

Last generated: 2026-08-31

​Signing Processor

​Supported Telemetry

​Overview

​Configuration

​Key source providers

​Output attributes

​Per log record

​Per Resource (set once per ResourceLogs block)

​Signed payload

​Example pipeline

​Configuration

​Example Configuration

Signing Processor

Supported Telemetry

Overview

Configuration

Key source providers

Output attributes

Per log record

Per Resource (set once per ResourceLogs block)

Signed payload

Example pipeline

Configuration

Example Configuration