Fleet-managed policies with OTel configuration can include secrets, these secrets are not being processed.

Looking to code it looks like Fleet Server only processes secrets when they appear under some specific keys (outputs, inputs, agent, fleet...), but they don't include the ones that are relevant for OTel (receivers, processors, exporters...).

See

More info in these conversations:

• [postgresql_input_otel] PostgreSQL Input Package integrations#17186 (comment)
• Add Prometheus OpenTelemetry Input Package integrations#17117 (comment)

For confirmed bugs, please report:

• Version: All versions since 9.2, where support for OTel packages was introduced.
• Operating System: N/A
• Steps to Reproduce:
  • Create a policy for an OTel package that includes secrets, for example the one in Add Prometheus OpenTelemetry Input Package integrations#17117.
  • Configure one of the secret variables.
  • Check that collection is failing, and the generated configuration didn't resolve the secrets.

As temporary workaround, it is possible to set secret: false in variables, and Fleet Server will be able to migrate them when the issue is fixed.