github/deprecated-helm-charts
1
0
Fork 0
mirror of https://github.com/helm/charts.git synced 2026-08-23 22:37:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add LDAP support to RabbitMQ (#18488)

Browse Source 
Signed-off-by: Alejandro Moreno <amoreno@bitnami.com>
This commit is contained in:
Alejandro Moreno
2019-10-31 09:33:48 -07:00
committed by Kubernetes Prow Robot
parent 63df606da2
commit 12faba581c
9 changed files with 164 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stable/rabbitmq/Chart.yaml
+1 -1
View File
@@ -1,6 +1,6 @@
apiVersion: v1
name: rabbitmq
version: 6.10.1
version: 6.11.0
appVersion: 3.8.0
description: Open source message broker software that implements the Advanced Message Queuing Protocol (AMQP)
keywords:
stable/rabbitmq/README.md
+35
View File
@@ -86,6 +86,15 @@ The following table lists the configurable parameters of the RabbitMQ chart and
| `rabbitmq.tls.serverCertificate` | Server certificate | Server certificate content |
| `rabbitmq.tls.serverKey` | Server Key | Server private key content |
| `rabbitmq.tls.existingSecret` | Existing secret with certificate content to rabbitmq credentials | `nil` |
| `ldap.enabled` | Enable LDAP support | `false` |
| `ldap.server` | LDAP server | `""` |
| `ldap.port` | LDAP port | `389` |
| `ldap.user_dn_pattern` | DN used to bind to LDAP | `cn=${username},dc=example,dc=org` |
| `ldap.tls.enabled` | Enable TLS for LDAP connections | `false` |
| `ldap.tls.caCertificate` | CA certificate for LDAP connections | `nil` |
| `ldap.tls.serverCertificate` | Server certificate for LDAP connections | `nil` |
| `ldap.tls.serverKey` | Server key for LDAP connections | `nil` |
| `ldap.tls.existingSecret` | Existing secret with certificate content to LDAP credentials | `nil` |
| `service.type` | Kubernetes Service type | `ClusterIP` |
| `service.port` | Amqp port | `5672` |
| `service.tlsPort` | Amqp TLS port | `5671` |
@@ -332,6 +341,32 @@ Disabling [failIfNoPeerCert](https://www.rabbitmq.com/ssl.html#peer-verification
[sslOptionsVerify](https://www.rabbitmq.com/ssl.html#peer-verification-configuration): When the sslOptionsVerify option is set to verify_peer, the client does send us a certificate, the node must perform peer verification. When set to verify_none, peer verification will be disabled and certificate exchange won't be performed.
### LDAP
LDAP support can be enabled in the chart by specifying the `ldap.` parameters while creating a release. The following parameters should be configured to properly enable the LDAP support in the chart.
- `ldap.enabled`: Enable LDAP support. Defaults to `false`.
- `ldap.server`: LDAP server host. No defaults.
- `ldap.port`: LDAP server port. `389`.
- `ldap.user_dn_pattern`: DN used to bind to LDAP. `cn=${username},dc=example,dc=org`.
It's also possible to connect to LDAP servers using TLS. The following parameters allow this configuration:
- `ldap.tls.enabled`: Enable TLS for LDAP connections. Defaults to `false`.
- `ldap.tls.caCertificate`: CA certificate for LDAP connections. No defaults.
- `ldap.tls.serverCertificate`: Server certificate for LDAP connections. No defaults.
- `ldap.tls.serverKey`: Server key for LDAP connections. No defaults.
- `ldap.tls.existingSecret`: Existing secret with certificate content to LDAP credentials. No defaults.
For example:
```console
ldap.enabled="true"
ldap.server="my-ldap-server"
ldap.port="389"
ldap.user_dn_pattern="cn=${username},dc=example,dc=org"
```
## Persistence
The [Bitnami RabbitMQ](https://github.com/bitnami/bitnami-docker-rabbitmq) image stores the RabbitMQ data and configurations at the `/opt/bitnami/rabbitmq/var/lib/rabbitmq/` path of the container.
stable/rabbitmq/templates/NOTES.txt
+2
View File
@@ -69,6 +69,8 @@ Then, open the URL obtained in a browser.
{{- end }}
{{- include "rabbitmq.validateValues" . -}}
{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }}
WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment.
stable/rabbitmq/templates/_helpers.tpl
+33
View File
@@ -210,3 +210,36 @@ but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else
{{- end -}}
{{- end -}}
{{- end -}}
{{/*
Compile all warnings into a single message, and call fail.
*/}}
{{- define "rabbitmq.validateValues" -}}
{{- $messages := list -}}
{{- $messages := append $messages (include "rabbitmq.validateValues.ldap" .) -}}
{{- $messages := without $messages "" -}}
{{- $message := join "\n" $messages -}}
{{- if $message -}}
{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}}
{{- end -}}
{{- end -}}
{{/*
Validate values of rabbitmq - LDAP support
*/}}
{{- define "rabbitmq.validateValues.ldap" -}}
{{- if .Values.ldap.enabled }}
{{- if not (and .Values.ldap.server .Values.ldap.port .Values.ldap.user_dn_pattern) }}
rabbitmq: LDAP
Invalid LDAP configuration. When enabling LDAP support, the parameters "ldap.server",
"ldap.port", and "ldap. user_dn_pattern" are mandatory. Please provide them:
$ helm install --name {{ .Release.Name }} stable/rabbitmq \
--set ldap.enabled=true \
--set ldap.server="lmy-ldap-server" \
--set ldap.port="389" \
--set user_dn_pattern="cn=${username},dc=example,dc=org"
{{- end -}}
{{- end -}}
{{- end -}}
stable/rabbitmq/templates/configuration.yaml
+13
View File
@@ -24,6 +24,19 @@ data:
ssl_options.certfile = /opt/bitnami/rabbitmq/certs/server_certificate.pem
ssl_options.keyfile = /opt/bitnami/rabbitmq/certs/server_key.pem
{{- end }}
{{- if .Values.ldap.enabled }}
auth_backends.1 = rabbit_auth_backend_ldap
auth_ldap.servers.1 = {{ .Values.ldap.server }}
auth_ldap.port = {{ .Values.ldap.port }}
auth_ldap.user_dn_pattern = {{ .Values.ldap.user_dn_pattern }}
{{- if .Values.ldap.tls.enabled }}
auth_ldap.use_ssl = true
auth_ldap.ssl_options.cacertfile = /opt/bitnami/rabbitmq/certs-ldap/ca_certificate.pem
auth_ldap.ssl_options.certfile = /opt/bitnami/rabbitmq/certs-ldap/server_certificate.pem
auth_ldap.ssl_options.keyfile = /opt/bitnami/rabbitmq/certs-ldap/server_key.pem
{{- end }}
{{- end }}
{{ if .Values.rabbitmq.advancedConfiguration}}
advanced.config: |-
{{ .Values.rabbitmq.advancedConfiguration | indent 4 }}
stable/rabbitmq/templates/ldap-certs.yaml
+19
View File
@@ -0,0 +1,19 @@
{{- if and (not .Values.ldap.tls.existingSecret) .Values.ldap.enabled .Values.ldap.tls.enabled }}
apiVersion: v1
kind: Secret
metadata:
name: {{ template "rabbitmq.fullname" . }}-ldap-certs
labels:
app: {{ template "rabbitmq.name" . }}
chart: {{ template "rabbitmq.chart" . }}
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
type: Opaque
data:
ca_certificate.pem:
{{ required "A valid .Values.ldap.tls.caCertificate entry required!" .Values.ldap.tls.caCertificate | b64enc | quote }}
server_certificate.pem:
{{ required "A valid .Values.ldap.tls.serverCertificate entry required!" .Values.ldap.tls.serverCertificate| b64enc | quote }}
server_key.pem:
{{ required "A valid .Values.ldap.tls.serverKey entry required!" .Values.ldap.tls.serverKey | b64enc | quote }}
{{- end }}
stable/rabbitmq/templates/statefulset.yaml
+29 -1
View File
@@ -116,6 +116,10 @@ spec:
- name: {{ template "rabbitmq.fullname" . }}-certs
mountPath: /opt/bitnami/rabbitmq/certs
{{- end }}
{{- if .Values.ldap.tls.enabled }}
- name: {{ template "rabbitmq.fullname" . }}-ldap-certs
mountPath: /opt/bitnami/rabbitmq/certs-ldap
{{- end }}
- name: data
mountPath: "{{ .Values.persistence.path }}"
{{- if .Values.rabbitmq.loadDefinition.enabled }}
@@ -197,6 +201,18 @@ spec:
value: "rabbit@$(MY_POD_NAME)"
{{- end }}
{{- end }}
{{- if .Values.ldap.enabled }}
- name: RABBITMQ_LDAP_ENABLE
value: "yes"
- name: RABBITMQ_LDAP_TLS
value: {{ ternary "yes" "no" .Values.ldap.tls.enabled | quote }}
- name: RABBITMQ_LDAP_SERVER
value: {{ .Values.ldap.server }}
- name: RABBITMQ_LDAP_SERVER_PORT
value: {{ .Values.ldap.port | quote }}
- name: RABBITMQ_LDAP_USER_DN_PATTERN
value: {{ .Values.ldap.user_dn_pattern }}
{{- end }}
- name: RABBITMQ_LOGS
value: {{ .Values.rabbitmq.logs | quote }}
- name: RABBITMQ_ULIMIT_NOFILES
@@ -291,7 +307,19 @@ spec:
path: server_certificate.pem
- key: server_key.pem
path: server_key.pem
{{- end }}
{{- end }}
{{- if and .Values.ldap.enabled .Values.ldap.tls.enabled }}
- name: {{ template "rabbitmq.fullname" . }}-ldap-certs
secret:
secretName: {{ if .Values.ldap.tls.existingSecret }}{{ .Values.ldap.tls.existingSecret }}{{- else }}{{ template "rabbitmq.fullname" . }}-ldap-certs{{- end }}
items:
- key: ca_certificate.pem
path: ca_certificate.pem
- key: server_certificate.pem
path: server_certificate.pem
- key: server_key.pem
path: server_key.pem
{{- end }}
- name: config-volume
configMap:
name: {{ template "rabbitmq.fullname" . }}-config
stable/rabbitmq/values-production.yaml
+16 -2
View File
@@ -14,7 +14,7 @@
image:
registry: docker.io
repository: bitnami/rabbitmq
tag: 3.8.0-debian-9-r0
tag: 3.8.0-debian-9-r17
## set to true if you would like to see extra information on logs
## it turns BASH and NAMI debugging in minideb
@@ -108,7 +108,7 @@ rabbitmq:
## Extra plugins to enable
## Use this instead of `plugins` to add new plugins
# extraPlugins: ""
extraPlugins: "rabbitmq_auth_backend_ldap"
## Clustering settings
clustering:
@@ -159,6 +159,20 @@ rabbitmq:
serverKey: |-
# existingSecret: name-of-existing-secret-to-rabbitmq
## LDAP configuration
##
ldap:
enabled: false
server: ""
port: "389"
user_dn_pattern: cn=${username},dc=example,dc=org
tls:
enabled: false
caCertificate: |-
serverCertificate: |-
serverKey: |-
# existingSecret: name-of-existing-secret-to-rabbitmq
## Kubernetes service type
service:
type: ClusterIP
stable/rabbitmq/values.yaml
+16 -2
View File
@@ -14,7 +14,7 @@
image:
registry: docker.io
repository: bitnami/rabbitmq
tag: 3.8.0-debian-9-r0
tag: 3.8.0-debian-9-r17
## set to true if you would like to see extra information on logs
## it turns BASH and NAMI debugging in minideb
@@ -108,7 +108,7 @@ rabbitmq:
## Extra plugins to enable
## Use this instead of `plugins` to add new plugins
# extraPlugins: ""
extraPlugins: "rabbitmq_auth_backend_ldap"
## Clustering settings
clustering:
@@ -159,6 +159,20 @@ rabbitmq:
serverKey: |-
# existingSecret: name-of-existing-secret-to-rabbitmq
## LDAP configuration
##
ldap:
enabled: false
server: ""
port: "389"
user_dn_pattern: cn=${username},dc=example,dc=org
tls:
enabled: false
caCertificate: |-
serverCertificate: |-
serverKey: |-
# existingSecret: name-of-existing-secret-to-rabbitmq
## Kubernetes service type
service:
type: ClusterIP