Best Way to Handle Frontend Traces with OTEL Collector and Keep It Private?
Asked by
CuriousCoder42
Hey there! I'm currently working with an OTEL Collector and Tempo setup, where the app consists of a frontend using Nginx and React, and a backend built in Node.js. My backend is successfully sending traces to the OTEL Collector over the VPC. However, I'm facing a dilemma with the frontend. Since the traces originate from the public IP of the user accessing the app, I'm wondering if I need to expose the Collector to the public. Is there a way to keep the Collector completely private while still allowing my frontend to send traces effectively? Here's a little about my setup:
- Utilizing Google Cloud Platform (GCP)
- Both the frontend and backend are deployed as Cloud Run services
- Traces are sent to the OTEL Collector that's hosted on a Compute Engine instance
- The connection utilizes a Serverless VPC Access connector
Any best practices or insights would be greatly appreciated!
Answers
Another great option is to set up a reverse proxy in front of your Collector. This way, you can handle things like SSL offloading more securely. If your frontend needs to send telemetry from public users, just keep in mind that you’ll have to manage authentication. Google Analytics does something similar—they use application keys for identification. Here's a link to some documentation that might help: [OpenTelemetry Docs](https://opentelemetry.io/docs/languages/js/exporters/#securely-expose-your-collector). Just choose what fits your needs best!
Reply to this answer
You can definitely keep the OTEL Collector private! Instead of exposing it directly, you could send the traces from the frontend to your backend first and then have the backend relay that information to the Collector. Just ensure you set the right CORS policies to allow for that communication without opening things up completely.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions