Monedula
monedula-metrics-reporter docs menu

Secure the collector connection

Send metrics over TLS or mutual TLS, trust a private CA, and authenticate to the collector with static OTLP headers.

How-to guides 5 of 6

2 min read

Updated 5 October 2026

Markdown

On this page

The reporter opens the connection to the collector itself, so it handles TLS and authentication for that one connection. Everything beyond it, such as credential rotation, proxies, retries and fan-out to other backends, belongs in the OpenTelemetry Collector.

Before you start

  • A collector whose OTLP receiver serves TLS.
  • For a private certificate authority: its CA bundle as a PEM file.
  • For mutual TLS: a client certificate and its private key as PEM files.
  • For header authentication: the header name and value the collector expects, such as a bearer token.
  • The files must be readable by the user that runs Kafka on every broker.

Use an https endpoint

Point the endpoint at the collector with the https:// scheme. If the collector’s certificate is signed by a CA in the JVM’s default trust store, nothing else is needed for TLS:

otlp.metric.reporter.endpoint=https://otel-collector:4317

Trust a private CA

When the collector’s certificate comes from your own CA, give the reporter that CA’s bundle:

otlp.metric.reporter.trusted.certificates.path=/etc/kafka/otlp/ca.pem

Add a client certificate for mutual TLS

When the collector requires mutual TLS, set both the client certificate and its private key. One without the other is a configuration error:

otlp.metric.reporter.client.certificate.path=/etc/kafka/otlp/client.pem
otlp.metric.reporter.client.key.path=/etc/kafka/otlp/client-key.pem

Send an authentication header

otlp.metric.reporter.headers adds static headers to every export request, as Header-Name=value,Other=value:

otlp.metric.reporter.headers=Authorization=Bearer <token>

A header value may contain =, but a comma always separates two headers, so a value cannot contain one. An entry with an empty name or value is a configuration error.

Restart the brokers

The endpoint, headers and TLS paths are read once, when the reporter starts, and never change at runtime. Restart each broker to apply them, and again whenever you rotate a certificate or a token.

Check it worked

  • The broker log has a line that starts with OtlpMetricReporter started and shows the https:// endpoint.
  • In Prometheus, monedula_reporter_export_success_total grows and monedula_reporter_export_failure_total stays flat.

If a certificate or key file is missing or unreadable, a header entry is malformed, or only one of the two client TLS paths is set, the log shows OtlpMetricReporter failed to initialize, running as no-op with the reason; fix the setting and restart.

If the reporter starts but the collector rejects the handshake or the credentials, each failed export logs OTLP metric export failed or timed out and increments monedula_reporter_export_failure_total.