> ## Documentation Index > Fetch the complete documentation index at: https://otel.fyi/llms.txt > Use this file to discover all available pages before exploring further. # Signing > OpenTelemetry processor for Signing # Signing Processor ![Status](https://img.shields.io/badge/status-development-orange) **Maintainers:** [@hilmarf](https://github.com/hilmarf), [@jmacd](https://github.com/jmacd) **Source:** [opentelemetry-collector-contrib](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/processor/signingprocessor) ## Supported Telemetry ![Logs](https://img.shields.io/badge/logs-development-blue) ## Overview The signing processor adds cryptographic integrity attributes to log records. For each log record it computes a canonical JSON hash (RFC 8785 / JCS) over the full record and signs it with an RSA private key. The resulting signature is stored as `audit.integrity.value` attribute on the record, and the JWA algorithm identifier plus a certificate reference are stored as `audit.integrity.algorithm` and `audit.integrity.certificate` on the enclosing Resource. The processor is designed for use with the [OpenTelemetry Audit Logging signal](https://github.com/apeirora/opentelemetry-specification/tree/auditing/specification/audit) and satisfies the Tier-2 Collector integrity-verification requirements defined there. ## Configuration For complete examples of all supported configurations see [testdata/config.yaml](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/processor/signingprocessor/testdata/config.yaml). For invalid configuration examples used in tests see [testdata/config\_invalid.yaml](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/processor/signingprocessor/testdata/config_invalid.yaml). ```yaml theme={null} processors: signing: # JWA signing algorithm. Default: RS256. # Valid values: RS256, RS512, ES256, EdDSA, HMAC-SHA256 algorithm: RS256 # How to encode the signing certificate in the audit.integrity.certificate # resource attribute. Default: fingerprint. # - fingerprint: "sha256:" of the DER-encoded certificate # - full: standard-base64 of the DER-encoded certificate certificate_ref: fingerprint # Key material source (required). Exactly one sub-block must be provided. key_source: # type selects the provider: file | env | k8s_secret | bao type: file # --- file provider --- file: cert_file: /etc/otelcol/signing-cert.pem key_file: /etc/otelcol/signing-key.pem # --- env provider — asymmetric --- # env: # cert_env_var: SIGNING_CERT_PEM # PEM or base64-encoded PEM # key_env_var: SIGNING_KEY_PEM # --- env provider — HMAC-SHA256 --- # env: # hmac_key_env_var: SIGNING_HMAC_KEY # --- Kubernetes Secret provider — asymmetric --- # k8s_secret: # name: signing-secret # namespace: default # optional, defaults to "default" # cert_key: tls.crt # key_key: tls.key # --- Kubernetes Secret provider — HMAC-SHA256 --- # k8s_secret: # name: signing-secret # namespace: default # hmac_key: hmac.key # --- OpenBao / Vault provider — asymmetric --- # bao: # address: https://bao.example.com # optional, falls back to BAO_ADDR # token: s.xxxx # optional, falls back to BAO_TOKEN # secret_path: secret/data/signing # cert_field: certificate # key_field: private_key # --- OpenBao / Vault provider — HMAC-SHA256 --- # bao: # secret_path: secret/data/signing # hmac_key_field: hmac_key ``` ## Key source providers | Provider | Description | | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `file` | Reads PEM-encoded certificate and private key (RSA, ECDSA, or Ed25519) from local files, or a raw HMAC secret. Supports plain PEM and base64-encoded PEM. | | `env` | Reads asymmetric key material (cert + private key) or an HMAC secret from environment variables. Useful for container deployments where secrets are injected via env. | | `k8s_secret` | Reads a Kubernetes Secret by name/namespace via the in-cluster or kubeconfig client. | | `bao` | Reads key material from an [OpenBao](https://openbao.org/) (Vault-compatible) secret engine. | ## Output attributes ### Per log record | Attribute | Type | Description | | ----------------------- | ------ | --------------------------------------------------------------------------------------------------------------- | | `audit.integrity.value` | string | Base64-encoded signature (or MAC for HMAC-SHA256) of the JCS-canonical payload, using the configured algorithm. | ### Per Resource (set once per ResourceLogs block) | Attribute | Type | Description | | ----------------------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------ | | `audit.integrity.algorithm` | string | JWA/IANA algorithm identifier matching the configured `algorithm` field (e.g. `RS256`, `ES256`, `EdDSA`, `HMAC-SHA256`). | | `audit.integrity.certificate` | string | Certificate reference: `sha256:` fingerprint or full base64 DER, depending on `certificate_ref`. Not set for HMAC-SHA256. | ## Signed payload The processor serialises the following log-record fields into a JSON object, canonicalises it with RFC 8785 (JCS), and hashes the result. All `audit.integrity.*` attributes are excluded so the signature can be verified before those attributes are removed. ``` event_name, body, timestamp, observed_timestamp, severity_number, severity_text, trace_id, span_id, attributes (all except audit.integrity.*) ``` ## Example pipeline ```yaml theme={null} receivers: otlp: protocols: grpc: processors: signing: algorithm: RS256 certificate_ref: fingerprint key_source: type: file file: cert_file: /etc/otelcol/cert.pem key_file: /etc/otelcol/key.pem exporters: otlp: endpoint: audit-sink:4317 service: pipelines: logs: receivers: [otlp] processors: [signing] exporters: [otlp] ``` ## Configuration ### Example Configuration ```yaml theme={null} # Signing processor — file-based key material (minimal config). # algorithm and certificate_ref use their defaults (RS256, fingerprint). signing: key_source: type: file file: cert_file: /etc/otelcol/signing-cert.pem key_file: /etc/otelcol/signing-key.pem # RS512 variant with full certificate reference. signing/sha512_full: algorithm: RS512 certificate_ref: full key_source: type: file file: cert_file: /etc/otelcol/signing-cert.pem key_file: /etc/otelcol/signing-key.pem # Environment-variable key material. signing/env: key_source: type: env env: cert_env_var: SIGNING_CERT_PEM key_env_var: SIGNING_KEY_PEM # Kubernetes Secret key material. signing/k8s: key_source: type: k8s_secret k8s_secret: name: signing-secret namespace: default cert_key: tls.crt key_key: tls.key # OpenBao / Vault key material. signing/bao: key_source: type: bao bao: address: https://bao.example.com secret_path: secret/data/signing cert_field: certificate key_field: private_key # HMAC-SHA256 with key from environment variable. signing/hmac: algorithm: HMAC-SHA256 key_source: type: env env: hmac_key_env_var: SIGNING_HMAC_KEY ``` *** *Last generated: 2026-08-31*