Secrets Management: Remove Credentials From Configs

Mon, 20 Apr 2026 00:00:00 +0000

If you’re running Netdata collectors that connect to databases, APIs, or other authenticated services, there’s a good chance you have passwords sitting in plain-text configuration files right now. It works, but it’s the kind of thing that makes security teams nervous and makes credential rotation painful. Every password change means editing config files and restarting collectors.

Netdata now supports secrets management natively. Instead of putting credentials directly in your collector configurations, you reference them using a resolver syntax, and Netdata resolves the actual values at runtime from whatever source you choose: environment variables, files on disk, the output of a command, or a centralized secret store like HashiCorp Vault or AWS Secrets Manager.

Google Secret Manager on Netdata

Secrets Management: Remove Credentials From Configs