<p>I have a Kubernetes cluster with a pod running an instance of Open Telemetry Collector.</p>
<p>My .Net app  inside Kubernetes exports traces to the Collector instance which in turn exports them to Elastic APM server. This work correctly if I use this config (<a href="https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/exporter/elasticexporter#sample-configuration-using-an-elastic-apm-secret-token" rel="nofollow noreferrer">described here</a>) for my Collector instance:</p>
<pre><code>exporters:
  otlp/elastic:
      endpoint: &quot;xxx.elastic-cloud.com:443&quot;
      headers:
          Authorization: &quot;Bearer your-apm-secret-token&quot;
</code></pre>
<p>To work in Kubernetes, I set this config in a ConfigMap. <strong>This work correctly but the issue is that this requires me to add a secret in the ConfigMap which I would like to avoid.</strong></p>
<p>To avoid this, I saw that you could add an <a href="https://www.elastic.co/guide/en/apm/get-started/current/open-telemetry-elastic.html#instrument-apps-apm-server" rel="nofollow noreferrer">OTEL_EXPORTER_OTLP_HEADERS environment variable</a> which will be used by the exporter. You could then pass the secrets through an environment variable in the container  (not a perfect solution, but ok for me). This functionality seems to be implemented by the different OpenTelemetry SDKs (.Net, Java, <a href="https://opentelemetry-python.readthedocs.io/en/latest/exporter/otlp/otlp.html" rel="nofollow noreferrer">Python</a>, ...) but it doesn't seem to work with the Collector if I try to use the environment variable trick.</p>
<p>Any idea how I could do this with the Collector? Or any other trick to avoid passing the secret to the ConfigMap?</p>

Absolom
<p>An <a href="https://github.com/open-telemetry/opentelemetry-collector/issues/2469" rel="nofollow noreferrer">issue</a> was entered for OpenTelemetry Collector that would solve my main concerns of using secrets in environment variables.</p>
<p>Until then, the author of the issue suggest environment variable expansion mechanism as a workaround.</p>
<p>So if you put your token in an environment variable ELASTIC_APM_TOKEN, then you could reference it in your ConfigMap like so:</p>
<pre><code>exporters:
  otlp/elastic:
      endpoint: &quot;xxx.elastic-cloud.com:443&quot;
      headers:
          Authorization: &quot;Bearer $ELASTIC_APM_TOKEN&quot;
</code></pre>
<p>The Collector will then replace $ELASTIC_APM_TOKEN with the value in your environment variable before applying the config.</p>
