Custom OpenTelemetry collectors: are your build controls keeping up?

TL;DR: Custom OpenTelemetry collector builds reduce binary size and unnecessary dependencies, but Bindplane’s tutorial shows they also shift governance into manifest design, GitHub Actions, and runtime management, according to Bindplane. The security issue is not convenience alone, but whether build-time component selection and remote configuration stay aligned with least-privilege operational control.

NHIMG editorial — based on content published by Bindplane: a tutorial on building a custom OpenTelemetry collector with ODB, GitHub Actions, and OpAMP

Questions worth separating out

Q: How should teams govern custom OpenTelemetry collector builds in production?

A: Treat the manifest, build workflow, and release artifact as one control chain.

Q: Why do custom collectors change the risk profile of observability pipelines?

A: Because the collector is no longer a generic distribution with known behaviour.

Q: What do security teams get wrong about trimming collector components?

A: They often focus on performance and binary size while underestimating governance impact.

Practitioner guidance

• Lock down the collector manifest as a controlled asset Require review and approval for every change to manifest.yaml, including receiver, exporter, processor, and extension additions or removals.
• Separate build permissions from runtime administration Ensure the identity that can trigger GitHub Actions builds cannot also push remote configuration changes through OpAMP or the management UI.
• Restrict remote configuration to approved capabilities Expose only the collector functions included in the build, and verify that unsupported components remain unavailable in the UI and API.

What's in the full article

Bindplane's full tutorial covers the operational detail this post intentionally leaves for the source:

• Step-by-step manifest.yaml examples for building a custom OpenTelemetry Collector distribution
• GitHub Actions workflow details for producing multi-platform packages and release artifacts
• Installation and service management output for running the collector as a systemd service
• Bindplane UI configuration steps showing how supported collector capabilities are discovered and applied

👉 Read Bindplane's tutorial on building a custom OpenTelemetry collector with GitHub Actions →

Custom OpenTelemetry collectors: are your build controls keeping up?

Explore further

View Full Forum →  |  NHI Foundation Course →