stankiewicz opened a new pull request, #40579:
URL: https://github.com/apache/beam/pull/40579
### Summary
Allows referencing secrets managed by Beam's `Secret` framework (e.g.,
`GcpSecret` / `GoogleCloudSecretManager`) inline inside
`--openTelemetryProperties` values so sensitive tokens (such as OTLP exporter
authentication headers) do not need to be passed in plaintext in
`PipelineOptions`.
### Details
- Updates `SdkHarnessOptions.configureOpenTelemetry(PipelineOptions)` to
resolve inline `${type:<secret_type>;<secret_param>:<value>}` placeholders via
`Secret.parseSecretOption(String)` when populating JVM system properties on the
worker.
- Example usage:
```
--openTelemetryProperties={"otel.exporter.otlp.metrics.headers":"api-key=${type:GcpSecret;version_name:projects/my-project/secrets/my-secret/versions/latest}"}
```
- Trims surrounding whitespace/newlines from fetched secret payloads and
quotes regex replacement metacharacters (`$` and `\`).
- Leaves non-secret placeholders (such as `${ENV_VAR}`) unchanged and
preserves the unresolved placeholder in `PipelineOptions`.
- Adds unit tests in `SdkHarnessOptionsTest` covering plain strings,
non-secret placeholders, single and multiple `${type:...}` placeholders,
whitespace/newline trimming, `$` and `\` escaping, invalid secret types, and
`configureOpenTelemetry` system property initialization.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
