Skip to content

Commit 7464a63

Browse files
bburt-rhbburt-rh
authored
Merge pull request #56427 from bburt-rh/RHDEVDOCS-4842-how-to-configure-secrets-in-alertmanager
RHDEVDOCS-4842-how-to-configure-secrets-in-alertmanager
2 parents 45ff966 + e7bdc9e commit 7464a63

4 files changed

+119
-1
lines changed

‎modules/monitoring-adding-a-secret-to-the-alertmanager-configuration.adoc

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * monitoring/configuring-the-monitoring-stack.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="monitoring-adding-a-secret-to-the-alertmanager-configuration_{context}"]
7+
= Adding a secret to the Alertmanager configuration
8+
9+
You can add secrets to the Alertmanager configuration for core platform monitoring components by editing the `cluster-monitoring-config` config map in the `openshift-monitoring` project.
10+
You can add secrets to the Alertmanager configuration for user-defined projects by editing the `user-workload-monitoring-config` config map in the `openshift-user-workload-monitoring` project.
11+
12+
After you add a secret to the config map, the secret is mounted as a volume at `/etc/alertmanager/secrets/<secret_name>` within the `alertmanager` container for the Alertmanager pods.
13+
14+
.Prerequisites
15+
16+
* You have installed the OpenShift CLI (`oc`).
17+
* *If you are configuring core {product-title} monitoring components in the `openshift-monitoring` project*:
18+
** You have access to the cluster as a user with the `cluster-admin` role.
19+
** You have created the `cluster-monitoring-config` config map.
20+
** You have created the secret to be configured in Alertmanager in the `openshift-monitoring` project.
21+
* *If you are configuring components that monitor user-defined projects*:
22+
** A cluster administrator has enabled monitoring for user-defined projects.
23+
** You have access to the cluster as a user with the `cluster-admin` role, or as a user with the `user-workload-monitoring-config-edit` role in the `openshift-user-workload-monitoring` project.
24+
** You have created the secret to be configured in Alertmanager in the `openshift-user-workload-monitoring` project.
25+
26+
.Procedure
27+
28+
. To add a secret configuration to Alertmanager for core platform monitoring, edit the `cluster-monitoring-config` config map in the `openshift-monitoring` project:
29+
+
30+
[source,terminal]
31+
----
32+
$ oc -n openshift-monitoring edit configmap cluster-monitoring-config
33+
----
34+
35+
. Add a `secrets:` section under `data/config.yaml/alertmanagerMain`.
36+
37+
. Add the configuration details for the secret in this section:
38+
+
39+
[source,yaml]
40+
----
41+
apiVersion: v1
42+
kind: ConfigMap
43+
metadata:
44+
name: cluster-monitoring-config
45+
namespace: openshift-monitoring
46+
data:
47+
config.yaml: |
48+
alertmanagerMain:
49+
secrets: <1>
50+
- <secret_name_1> <2>
51+
- <secret_name_2>
52+
----
53+
<1> This section contains the secrets to be mounted into Alertmanager.
54+
The secrets must be located within the same namespace as the Alertmanager object.
55+
<2> The name of the `Secret` object that contains authentication credentials for the receiver.
56+
If you add multiple secrets, place each one on a new line.
57+
+
58+
The following sample config map settings configure Alertmanager to use two `Secret` objects named `test-secret-basic-auth` and `test-secret-api-token`:
59+
+
60+
[source,yaml]
61+
----
62+
apiVersion: v1
63+
kind: ConfigMap
64+
metadata:
65+
name: cluster-monitoring-config
66+
namespace: openshift-monitoring
67+
data:
68+
config.yaml: |
69+
alertmanagerMain:
70+
secrets:
71+
- test-secret-basic-auth
72+
- test-secret-api-token
73+
----
74+
75+
. Optional: To add the secrets for use by Alertmanager in user-defined projects, add the secret names under `data/config.yaml/alertmanager/secrets` in the `user-workload-monitoring-config` config map in the `openshift-user-workload-monitoring` project:
76+
+
77+
[source,yaml]
78+
----
79+
apiVersion: v1
80+
kind: ConfigMap
81+
metadata:
82+
name: user-workload-monitoring-config
83+
namespace: openshift-user-workload-monitoring
84+
data:
85+
config.yaml: |
86+
alertmanager:
87+
enabled: true
88+
secrets:
89+
- test-secret
90+
- test-api-receiver-token
91+
----
92+
+
93+
[NOTE]
94+
====
95+
Configurations applied to the `user-workload-monitoring-config` `ConfigMap` object are not activated unless a cluster administrator has enabled monitoring for user-defined projects.
96+
====
97+
98+
. Save the file to apply the changes to the `ConfigMap` object.
99+
The new configuration is applied automatically.
100+

‎modules/monitoring-configuring-external-alertmanagers.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
:_content-type: PROCEDURE
66
[id="monitoring-configuring-external-alertmanagers_{context}"]
7-
= Configuring external alertmanager instances
7+
= Configuring external Alertmanager instances
88

99
The {product-title} monitoring stack includes a local Alertmanager instance that routes alerts from Prometheus.
1010
You can add external Alertmanager instances by configuring the `cluster-monitoring-config` config map in either the `openshift-monitoring` project or the `user-workload-monitoring-config` project.

‎modules/monitoring-configuring-secrets-for-alertmanager.adoc

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * monitoring/configuring-the-monitoring-stack.adoc
4+
5+
:_content-type: CONCEPT
6+
[id="monitoring-configuring-secrets-for-alertmanager_{context}"]
7+
= Configuring secrets for Alertmanager
8+
9+
The {product-title} monitoring stack includes Alertmanager, which routes alerts from Prometheus to endpoint receivers.
10+
If you need to authenticate with a receiver so that Alertmanager can send alerts to it, you can configure Alertmanager to use a secret that contains authentication credentials for the receiver.
11+
12+
For example, you can configure Alertmanager to use a secret to authenticate with an endpoint receiver that requires a certificate issued by a private Certificate Authority (CA).
13+
You can also configure Alertmanager to use a secret to authenticate with a receiver that requires a password file for Basic HTTP authentication.
14+
In either case, authentication details are contained in the `Secret` object rather than in the `ConfigMap` object.

‎monitoring/configuring-the-monitoring-stack.adoc

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,10 @@ include::modules/monitoring-creating-scrape-sample-alerts.adoc[leveloffset=+2]
131131
//Configuring external alertmanagers
132132
include::modules/monitoring-configuring-external-alertmanagers.adoc[leveloffset=1]
133133

134+
//Configuring secrets for Alertmanager
135+
include::modules/monitoring-configuring-secrets-for-alertmanager.adoc[leveloffset=1]
136+
include::modules/monitoring-adding-a-secret-to-the-alertmanager-configuration.adoc[leveloffset=2]
137+
134138
//Attaching additional labels to your time series and alerts
135139
include::modules/monitoring-attaching-additional-labels-to-your-time-series-and-alerts.adoc[leveloffset=+1]
136140

0 commit comments

Comments
 (0)