Red Hat Summit 红帽全球峰会支持控制台（Console）开发人员开始试用联系人

此内容没有您所选择的语言版本。

Chapter 8. Securing Data Grid Connections

Encrypt connections between clients and Data Grid nodes with Red Hat OpenShift service certificates or custom TLS certificates.

8.1. Using Red Hat OpenShift Service Certificates
复制链接

Data Grid Operator automatically generates TLS certificates signed by the Red Hat OpenShift service CA. You can use these certificates to encrypt remote client connections.

Procedure

  • Set the following spec.security.endpointEncryption configuration in your Infinispan CR and then apply the changes. 

    spec:
  ...
  security:
    endpointEncryption:
      type: service
      certServiceName: service.beta.openshift.io
    1 
    
      certSecretName: example-rhdatagrid-cert-secret
    2
    Copy to Clipboard Toggle word wrap
1
Specifies the Red Hat OpenShift Service.
2
Specifies the name of the secret where Data Grid Operator stores service certificates and keys.

Data Grid Operator stores in a secret named -cert-secret that is prefixed with the Data Grid cluster name, for example: 

metadata:
  name: example-rhdatagrid
Copy to Clipboard Toggle word wrap

The preceding cluster name results in a secret named example-rhdatagrid-cert-secret.

8.1.1. Red Hat OpenShift Service Certificates
复制链接

If the Red Hat OpenShift service CA is available, Data Grid Operator automatically generates a certificate, tls.crt, and key, tls.key, in PEM format.

Note

Service certificates use the internal DNS name of the Data Grid cluster as the common name (CN), for example:

Subject: CN = example-infinispan.mynamespace.svc

For this reason, service certificates can be fully trusted only inside OpenShift. If you want to encrypt connections with clients running outside OpenShift, you should use custom TLS certificates.

Certificates are valid for one year and are automatically replaced before they expire.

8.1.2. Retrieving TLS Certificates
复制链接

Get TLS certificates from encryption secrets to create client trust stores.

  • Retrieve tls.crt from encryption secrets as follows: 
$ oc get secret example-rhdatagrid-cert-secret \
-o jsonpath='{.data.tls\.crt}' | base64 -d > tls.crt
Copy to Clipboard Toggle word wrap

8.2. Using Custom TLS Certificates
复制链接

Use custom PKCS12 keystore or TLS certificate/key pairs to encrypt connections between clients and Data Grid clusters.

Prerequisites

Create either a keystore or certificate secret. See:

Procedure

  1. Add the encryption secret to your OpenShift namespace, for example: 

    $ oc apply -f tls_secret.yaml
    Copy to Clipboard Toggle word wrap

  2. Specify the encryption secret with spec.security.endpointEncryption in your Infinispan CR and then apply the changes. 

    spec:
  ...
  security:
    endpointEncryption:
    1 
    
            type: secret
    2 
    
            certSecretName: tls-secret
    3
    Copy to Clipboard Toggle word wrap
    1
    encrypts traffic to and from Data Grid endpoints.
    2
    configures Data Grid to use secrets that contain encryption certificates.
    3
    names the encryption secret.

8.2.1. Certificate Secrets
复制链接

apiVersion: v1
kind: Secret
metadata:
  name: tls-secret
type: Opaque
data:
    tls.key:  "LS0tLS1CRUdJTiBQUk ..."
1 

    tls.crt: "LS0tLS1CRUdJTiBDRVl ..."
2
Copy to Clipboard Toggle word wrap
1
Adds a base64 encoded TLS key.
2
Adds a base64 encoded TLS certificate.

8.2.2. Keystore Secrets
复制链接

apiVersion: v1
kind: Secret
metadata:
  name: tls-secret
type: Opaque
stringData:
    alias: server
1 

    password: password
2 

data:
    keystore.p12:  "MIIKDgIBAzCCCdQGCSqGSIb3DQEHA..."
3
Copy to Clipboard Toggle word wrap
1
Specifies an alias for the keystore.
2
Specifies a password for the keystore.
3
Adds a base64 encoded keystore.
Red Hat logoGithubredditYoutubeTwitter

学习

尝试、购买和销售

社区

关于红帽文档

通过我们的产品和服务，以及可以信赖的内容，帮助红帽用户创新并实现他们的目标。 了解我们当前的更新.

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情，请参阅红帽博客.

關於紅帽

我们提供强化的解决方案，使企业能够更轻松地跨平台和环境（从核心数据中心到网络边缘）工作。

Theme

© 2026 Red Hat返回顶部