带有 Prometheus Pushgateway 的千分尺 - 添加 TLS 支持

Question

I have a Spring boot application with Prometheus Pushgateway using Micrometer, mainly based on this tutorial: https://luramarchanjo.tech/2020/01/05/spring-boot-2.2-and-prometheus-pushgateway-with-micrometer.html

pom.xml有以下相关依赖：

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-actuator</artifactId>
</dependency>
<dependency>
    <groupId>io.micrometer</groupId>
    <artifactId>micrometer-core</artifactId>
</dependency>
<dependency>
    <groupId>io.micrometer</groupId>
    <artifactId>micrometer-registry-prometheus</artifactId>
</dependency>
<dependency>
    <groupId>io.prometheus</groupId>
    <artifactId>simpleclient_pushgateway</artifactId>
    <version>0.16.0</version>
</dependency>

application.properties文件有：

management.metrics.export.prometheus.pushgateway.enabled=true
management.metrics.export.prometheus.pushgateway.shutdown-operation=PUSH
management.metrics.export.prometheus.pushgateway.baseUrl=localhost:9091

它在开发环境中本地运行良好，同时在没有任何 TLS 的情况下连接到 Pushgateway。 在我们的 CI 环境中，Prometheus Pushgateway 启用了 TLS。 如何在此 Spring 启动应用程序中配置 TLS 支持和配置证书？

Answer 1

由于使用 TLS，您将需要自定义一些 Spring 类：

• HttpConnectionFactory -> PushGateway -> PrometheusPushGatewayManager

Prometheus 的PushGateway使用HttpConnectionFactory来创建安全连接，然后创建使用先前 pushgateway 的PrometheusPushGatewayManager 。

您将需要实现普罗米修斯的接口HttpConnectionFactory ，我假设您能够创建一个有效的javax.net.ssl.SSLContext object （如果没有，最后有更多详细信息¹）。

HttpConnectionFactory示例：

public class MyTlsConnectionFactory implements io.prometheus.client.exporter.HttpConnectionFactory {
    @Override
    public HttpURLConnection create(String hostUrl) {
        // considering you can get javax.net.ssl.SSLContext or javax.net.ssl.SSLSocketFactory
        URL url = new URL(hostUrl);
        HttpsURLConnection connection = (HttpsURLConnection) url.openConnection();
        connection.setSSLSocketFactory(sslContext.getSocketFactory());
        return connection;
    }
}

PushGateway和PrometheusPushGatewayManager ：

@Bean 
public HttpConnectionFactory tlsConnectionFactory() {
    return new MyTlsConnectionFactory();
}

@Bean 
public PushGateway pushGateway(HttpConnectionFactory connectionFactory) throws MalformedURLException {
    String url = "https://localhost:9091"; // replace by your props
    PushGateway pushGateway = new PushGateway(new URL(url));
    pushGateway.setConnectionFactory(connectionFactory); 
    return pushGateway;
}

@Bean 
public PrometheusPushGatewayManager tlsPrometheusPushGatewayManager(PushGateway pushGateway,
                                                                    CollectorRegistry registry) {
    // fill the others params accordingly (the important is pushGateway!)
    return new PrometheusPushGatewayManager(
            pushGateway,
            registry,
            Duration.of(15, ChronoUnit.SECONDS),
            "some-job-id",
            null,
            PrometheusPushGatewayManager.ShutdownOperation.PUSH
    );
}

---

¹If you face difficulty retrieving the SSLContext from java code, I recommend studying the library https://github.com/Hakky54/sslcontext-kickstart and https://github.com/Hakky54/mutual-tls-ssl (which shows how to将其应用于不同的客户端库）。

然后，将有可能以干净的方式在 java 代码中生成 SSLContext，例如：

String keyStorePath = "client.jks";
char[] keyStorePassword = "password".toCharArray();
SSLFactory sslFactory = SSLFactory.builder()
        .withIdentityMaterial(keyStorePath, keyStorePassword)
        .build();
javax.net.ssl.SSLContext sslContext = sslFactory.getSslContext();

最后，如果您需要设置本地 Prometheus + TLS 环境进行测试，我建议您关注以下帖子： https://smallstep.com/hello-mtls/doc/client/prometheus