Telegraf Secret Store Plugins
Telegraf secret store plugins provide secrets such as credentials to plugins. Secret store plugins provide secrets like usernames, passwords, or tokens to other plugins including other secret stores (for example, when retrieving secrets requires a token). Different secret store plugins retrieve secrets from different stores, including the operating system, Docker Secrets, and HashiCorp Vault.
Docker
This plugin allows to access Docker
secrets mounted by the
engine during container runtime. The secrets are accessible as files
under /run/secrets from within the container.
GoogleCloud Credentials
This plugin allows to retrieve token-based Google Cloud Credentials.
HTTP Secret store
This plugin allows to query secrets from an HTTP endpoint, transmitting the secrets either plain-text or in an encrypted fashion.
Javascript Object Signing and Encryption
This plugin allows to read local secrets from files protected by the Javascript Object Signing and Encryption algorithm.
OAuth2
This plugin allows to retrieve and maintain secrets from various OAuth2 services such as Auth0, AzureAD or others (see Configuration section. Expired tokens will be renewed automatically for allowing plugins referencing those tokens to perform their API calls without hassle.
This plugin only supports the 2-legged client credentials flow.
OS
This plugin allows to read and manage secrets using the native Operating System keyring. For Windows this plugin uses the credential manager, on Linux the kernel keyring is used and on MacOS we use the Keychain implementation.
Systemd
This plugin allows utilizing credentials and secrets provided to the Telegraf service by systemd. Systemd ensures that only the intended service can access the credentials for the lifetime of this service. The credentials appear as plaintext files to the consuming service but are stored encrypted on the host system. This encryption can also use TPM2 protection if available (see this article for details).
This plugin does not support setting the credentials. See the credentials management section below for how to setup systemd credentials and how to add credentials
This plugin requires systemd version 250+.
HashiCorp Vault
This plugin allows to access secrets provided by a HashiCorp
Vault server via the Vault
API. It supports authentication via a pre-obtained token or via the
AppRole method.
Was this page helpful?
Thank you for your feedback!
Support and feedback
Thank you for being part of our community! We welcome and encourage your feedback and bug reports for Telegraf and this documentation. To find support, use the following resources:
Customers with an annual or support contract can contact InfluxData Support.