1.3. 监控堆栈中的 TLS 安全性和轮转


了解 TLS 配置集和证书轮转如何在 OpenShift Container Platform 监控堆栈中工作,以保持通信安全。

监控组件的 TLS 安全配置集
监控堆栈的所有组件都使用集群管理员集中配置的 TLS 安全配置集设置。监控堆栈组件使用全局 OpenShift Container Platform apiservers.config.openshift.io/cluster 资源中的 tlsSecurityProfile 字段中已存在的 TLS 安全配置集设置。
TLS 证书轮转和自动重启

Cluster Monitoring Operator 管理监控组件的内部 TLS 证书生命周期。这些证书保护监控组件之间的内部通信。

在证书轮转过程中,CMO 会更新 secret 和配置映射,这会触发受影响 pod 的自动重启。这是一个预期的行为,pod 会自动恢复。

以下示例显示了证书轮转过程中发生的事件:

$ oc get events -n openshift-monitoring

LAST SEEN   TYPE      REASON              OBJECT                                   MESSAGE
2h39m       Normal    SecretUpdated       deployment/cluster-monitoring-operator   Updated Secret/grpc-tls -n openshift-monitoring because it changed
2h39m       Normal    SecretCreated       deployment/cluster-monitoring-operator   Created Secret/prometheus-user-workload-grpc-tls -n openshift-user-workload-monitoring because it was missing
2h39m       Normal    SecretCreated       deployment/cluster-monitoring-operator   Created Secret/thanos-querier-grpc-tls -n openshift-monitoring because it was missing
2h39m       Normal    SecretCreated       deployment/cluster-monitoring-operator   Created Secret/thanos-ruler-grpc-tls -n openshift-user-workload-monitoring because it was missing
2h39m       Normal    SecretCreated       deployment/cluster-monitoring-operator   Created Secret/prometheus-k8s-grpc-tls -n openshift-monitoring because it was missing
2h38m       Warning   FailedMount         pod/prometheus-k8s-0                     MountVolume.SetUp failed for volume "secret-grpc-tls" : secret "prometheus-k8s-grpc-tls" not found
2h39m       Normal    Created             pod/prometheus-k8s-0                     Created container kube-rbac-proxy-thanos
2h39m       Normal    Started             pod/prometheus-k8s-0                     Started container kube-rbac-proxy-thanos
2h39m       Normal    SuccessfulDelete    statefulset/prometheus-k8s               delete Pod prometheus-k8s-0 in StatefulSet prometheus-k8s successful
2h39m       Normal    SuccessfulCreate    statefulset/prometheus-k8s               create Pod prometheus-k8s-0 in StatefulSet prometheus-k8s successful
Copy to Clipboard Toggle word wrap
返回顶部
Red Hat logoGithubredditYoutubeTwitter

学习

尝试、购买和销售

社区

关于红帽文档

通过我们的产品和服务,以及可以信赖的内容,帮助红帽用户创新并实现他们的目标。 了解我们当前的更新.

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情,请参阅红帽博客.

關於紅帽

我们提供强化的解决方案,使企业能够更轻松地跨平台和环境(从核心数据中心到网络边缘)工作。

Theme

© 2025 Red Hat