红帽全球峰会此内容没有您所选择的语言版本。
Chapter 5. Connecting external clients to templates-based broker deployments
5.1. Configuring SSL
For a minimal SSL configuration to allow connections outside of OpenShift Container Platform, AMQ Broker requires a broker keystore, a client keystore, and a client truststore that includes the broker keystore. The broker keystore is also used to create a secret for the AMQ Broker on OpenShift Container Platform image, which is added to the service account.
The following example commands use Java KeyTool, a package included with the Java Development Kit, to generate the necessary certificates and stores.
For a more complete example of deploying a broker instance that supports SSL, see Deploying a basic broker with SSL.
Procedure
Generate a self-signed certificate for the broker keystore:
keytool -genkey -alias broker -keyalg RSA -keystore broker.ks
$ keytool -genkey -alias broker -keyalg RSA -keystore broker.ksCopy to Clipboard Copied! Toggle word wrap Toggle overflow Export the certificate so that it can be shared with clients:
keytool -export -alias broker -keystore broker.ks -file broker_cert
$ keytool -export -alias broker -keystore broker.ks -file broker_certCopy to Clipboard Copied! Toggle word wrap Toggle overflow Generate a self-signed certificate for the client keystore:
keytool -genkey -alias client -keyalg RSA -keystore client.ks
$ keytool -genkey -alias client -keyalg RSA -keystore client.ksCopy to Clipboard Copied! Toggle word wrap Toggle overflow Create a client truststore that imports the broker certificate:
keytool -import -alias broker -keystore client.ts -file broker_cert
$ keytool -import -alias broker -keystore client.ts -file broker_certCopy to Clipboard Copied! Toggle word wrap Toggle overflow Export the client’s certificate from the keystore:
keytool -export -alias client -keystore client.ks -file client_cert
$ keytool -export -alias client -keystore client.ks -file client_certCopy to Clipboard Copied! Toggle word wrap Toggle overflow Import the client’s exported certificate into a broker SERVER truststore:
keytool -import -alias client -keystore broker.ts -file client_cert
$ keytool -import -alias client -keystore broker.ts -file client_certCopy to Clipboard Copied! Toggle word wrap Toggle overflow
5.2. Generating the AMQ Broker secret
The broker keystore can be used to generate a secret for the namespace, which is also added to the service account so that the applications can be authorized.
Procedure
At the command line, run the following commands:
oc create secret generic <secret-name> --from-file=<broker-keystore> --from-file=<broker-truststore> oc secrets add sa/<service-account-name> secret/<secret-name>
$ oc create secret generic <secret-name> --from-file=<broker-keystore> --from-file=<broker-truststore> $ oc secrets add sa/<service-account-name> secret/<secret-name>Copy to Clipboard Copied! Toggle word wrap Toggle overflow
5.3. Creating an SSL Route
After the AMQ Broker on OpenShift Container Platform image has been deployed, you need to create an SSL Route for the AMQ Broker transport protocol port to allow connections to AMQ Broker outside of OpenShift. You can only expose SSL Routes because the OpenShift router requires SNI to send traffic to the correct Service.
Selecting Passthrough for TLS Termination relays all communication to AMQ Broker without the OpenShift router decrypting and resending it.
Regular HTTP traffic does not require a TLS passthrough Route because the OpenShift router uses HAProxy, which is a HTTP proxy.
External clients for AMQ Broker on OpenShift Container Platform must specify the OpenShift router port (443, by default) when setting the broker URL for SSL connections. Otherwise, AMQ Broker attempts to use the default SSL port (61617).
By default, the OpenShift router uses port 443. However, the router might be configured to use a different port number, based on the value specified for the ROUTER_SERVICE_HTTPS_PORT environment variable. For more information, see OpenShift Container Platform 4.1 Routes.
Also, including the failover protocol in the URL preserves the client connection in case the pod is restarted or upgraded, or a disruption occurs on the router. Both of these settings are shown below.
...
factory.setBrokerURL("failover://ssl://<route-to-broker-pod>:443");
...
...
factory.setBrokerURL("failover://ssl://<route-to-broker-pod>:443");
...External clients do not support HA.
The default ports for the various AMQ Broker transport protocols are shown in the table.
| AMQ Broker transport protocol | Default port |
|---|---|
| All protocols (OpenWire, AMQP, STOMP, MQTT, and HornetQ) | 61616 |
| All protocols -SSL (OpenWire AMQP, STOMP, MQTT, and HornetQ) | 61617 |
| AMQP | 5672 |
| AMQP -SSL | 5671 |
| MQTT | 1883 |
| MQTT -SSL | 8883 |
| STOMP | 61613 |
| STOMP -SSL | 61612 |
Additional resources
- For more information on cluster networking, see Secured Routes.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}