보안을 위해 모든 측정항목 데이터는 전송 중에 암호화해야 합니다. Google Distributed Cloud (GDC) 오프라인 어플라이언스의 모니터링 구성요소는 상호 전송 계층 보안 (mTLS)을 통해 전송 중 암호화 및 인증을 제공합니다. mTLS 메서드는 네트워크 연결에서 양쪽 당사자의 신원을 확인하여 요청한 대상이 맞음을 보장합니다.
이 페이지에서는 측정항목 서버에 mTLS를 설정하는 방법을 설명합니다.
시작하기 전에
MonitoringTarget 커스텀 리소스를 관리하는 데 필요한 권한을 얻으려면 조직 IAM 관리자 또는 프로젝트 IAM 관리자에게 연결된 MonitoringTarget 역할 중 하나를 부여해 달라고 요청하세요.
필요한 액세스 수준과 권한에 따라 조직 또는 프로젝트에서 이 리소스에 대한 생성자, 편집자 또는 뷰어 역할을 획득할 수 있습니다. 자세한 내용은 IAM 권한 준비를 참고하세요.
워크로드는 MonitoringTarget 커스텀 리소스에서 mTLS를 사용 설정할 때 자동으로 생성되는 인증서를 사용해야 합니다. 다음 템플릿을 사용하여 이 인증서의 볼륨과 볼륨 마운트를 추가합니다.
apiVersion:apps/v1kind:Deployment# or StatefulSetmetadata:name:"SERVICE_NAME"spec:template:spec:containers:-name:"CONTAINER_NAME"volumeMounts:-mountPath:"/etc/ssl/MONITORING_TARGET_NAME-cert"name:"MONITORING_TARGET_NAME-cert"readOnly:truevolumes:-name:"MONITORING_TARGET_NAME-cert"secret:secretName:"MONITORING_TARGET_NAME-cert"[...]
다음을 바꿉니다.
SERVICE_NAME: Deployment 또는 StatefulSet 객체의 이름입니다.
CONTAINER_NAME: 볼륨 마운트를 추가할 컨테이너의 이름입니다.
MONITORING_TARGET_NAME: MonitoringTarget 커스텀 리소스의 이름입니다. 보안 비밀 이름은 이 이름을 기반으로 합니다. 예를 들어 my-mon-target 리소스는 my-mon-target-cert 보안 비밀 이름을 만듭니다.
측정항목 제공
측정항목 서버는 mTLS 지원 HTTP 서버에서 측정항목을 제공해야 합니다. 다음 두 가지 시나리오 중 하나에서 측정항목을 암호화할 수 있습니다.
소유한 애플리케이션의 경우: mTLS를 지원하도록 소스 코드를 수정하고 mTLS 인증서로 측정항목 서버를 구성합니다.
내가 소유하지 않은 애플리케이션: 애플리케이션 문서를 참고하여 HTTPS 측정항목 엔드포인트를 사용 설정합니다. 명령줄 인수 구성 또는 config 파일 배포와 같은 필요한 구성을 적용합니다.
mTLS 측정항목 수집 사용 설정
암호화된 측정항목의 수집을 사용 설정하려면 MonitoringTarget 커스텀 리소스의 metadata 섹션에 다음 라벨을 추가합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["# Encrypt metrics from your applications\n\nAll metrics data must be encrypted in transit to ensure security. The monitoring\ncomponent of Google Distributed Cloud (GDC) air-gapped appliance provides in-transit encryption and\nauthentication through mutual Transport Layer Security (mTLS). The mTLS method\nverifies the identity of both parties in a network connection, confirming they\nare who they claim to be.\n\nThis page explains how to set up mTLS for your metrics server.\n\nBefore you begin\n----------------\n\nTo get the permissions that you need to manage `MonitoringTarget` custom\nresources, ask your Organization IAM Admin or Project IAM Admin to grant you one\nof the associated `MonitoringTarget` roles.\n\nDepending on the level of access and permissions you need, you might obtain\ncreator, editor, or viewer roles for this resource in an organization or a\nproject. For more information, see [Prepare IAM permissions](/distributed-cloud/hosted/docs/latest/appliance/platform/pa-user/obs-iam-permissions).\n\nAfter obtaining the necessary permissions, complete these steps before enabling\nmetrics encryption:\n\n1. Deploy your metrics server.\n2. [Collect metrics from your workloads](/distributed-cloud/hosted/docs/latest/appliance/application/ao-user/collect-metrics).\n3. Ensure your `MonitoringTarget` custom resource shows a `Ready` status, like\n in the following example:\n\n apiVersion: monitoring.gdc.goog/v1\n kind: MonitoringTarget\n [...]\n status:\n conditions:\n - lastTransitionTime: \"2023-10-27T15:27:51Z\"\n message: \"\"\n observedGeneration: 1\n reason: Ready\n status: True\n type: Ready\n\n4. [Query and view metrics on dashboards](/distributed-cloud/hosted/docs/latest/appliance/application/ao-user/query-and-view-metrics#query-and-view-metrics-on-dashboards)\n to confirm that your metrics server is sending the expected data.\n\n | **Note:** If metrics are not showing up, resolve any issues with your `MonitoringTarget` configuration before enabling mTLS. Review the [Collect metrics](/distributed-cloud/hosted/docs/latest/appliance/application/ao-user/collect-metrics) documentation to ensure your configuration is correct.\n\nMount the certificate\n---------------------\n\nYour workload needs to use a certificate that is automatically generated when\nyou enable mTLS on the `MonitoringTarget` custom resource. Add a volume and\nvolume mount for this certificate using the following template: \n\n apiVersion: apps/v1\n kind: Deployment # or StatefulSet\n metadata:\n name: \"\u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e\"\n spec:\n template:\n spec:\n containers:\n - name: \"\u003cvar translate=\"no\"\u003eCONTAINER_NAME\u003c/var\u003e\"\n volumeMounts:\n - mountPath: \"/etc/ssl/\u003cvar translate=\"no\"\u003eMONITORING_TARGET_NAME\u003c/var\u003e-cert\"\n name: \"\u003cvar translate=\"no\"\u003eMONITORING_TARGET_NAME\u003c/var\u003e-cert\"\n readOnly: true\n volumes:\n - name: \"\u003cvar translate=\"no\"\u003eMONITORING_TARGET_NAME\u003c/var\u003e-cert\"\n secret:\n secretName: \"\u003cvar translate=\"no\"\u003eMONITORING_TARGET_NAME\u003c/var\u003e-cert\"\n [...]\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e: the name of your `Deployment` or `StatefulSet` object.\n- \u003cvar translate=\"no\"\u003eCONTAINER_NAME\u003c/var\u003e: the name of the container where you are adding the volume mount.\n- \u003cvar translate=\"no\"\u003eMONITORING_TARGET_NAME\u003c/var\u003e: the name of your `MonitoringTarget` custom resource. The secret name is based on this name. For example, a `my-mon-target` resource creates a `my-mon-target-cert` secret name.\n\nServe metrics\n-------------\n\nYour metrics server must serve metrics from an mTLS-enabled HTTP server. You\nmight want to encrypt metrics in one of the following two scenarios:\n\n- **For applications you own**: Modify the source code to support mTLS and configure the metrics server with the mTLS certificate.\n- **For applications you don't own** : Consult the application's documentation to enable an HTTPS metrics endpoint. Apply the necessary configuration, like configuring command-line arguments or deploying a `config` file.\n\nEnable mTLS metrics collection\n------------------------------\n\nAdd the following label to the `metadata` section of your `MonitoringTarget`\ncustom resource to enable the collection of encrypted metrics: \n\n monitoring.gdc.goog/enable-mtls: \"true\"\n\nThe custom resource must look like the following example: \n\n apiVersion: monitoring.gdc.goog/v1\n kind: MonitoringTarget\n metadata:\n namespace: my-project-namespace\n name: \"\u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e\"\n labels:\n monitoring.gdc.goog/enable-mtls: \"true\" # Enable mTLS metrics collection\n spec:\n [...]\n\nTo verify that you enabled mTLS authentication, check that your\n`MonitoringTarget` custom resource shows a `Ready` status for the certificate\nand the certificate secret, like in the following example: \n\n apiVersion: monitoring.gdc.goog/v1\n kind: MonitoringTarget\n [...]\n status:\n conditions:\n - lastTransitionTime: \"2023-11-09T11:15:10Z\"\n message: \"admin,user-vm-1,user-vm-2,org-1-system\"\n observedGeneration: 2\n reason: Ready\n status: \"True\"\n type: Ready\n - lastTransitionTime: \"2023-11-09T11:14:43Z\"\n message: \"Certificate is ready\"\n observedGeneration: 2\n reason: Ready\n status: \"True\"\n type: CertificateReady\n - lastTransitionTime: \"2023-11-09T11:15:10Z\"\n message: \"Successfully created secret\"\n observedGeneration: 2\n reason: Ready\n status: \"True\"\n type: CertificateSecretReady\n\n| **Note:** Certificates reside in the org infrastructure cluster. Only certificate *secrets* exist in Kubernetes clusters."]]
