From 12faba581c1c734fab2d5426f3f27ca282f64765 Mon Sep 17 00:00:00 2001 From: Alejandro Moreno <47833905+alemorcuq@users.noreply.github.com> Date: Thu, 31 Oct 2019 17:33:48 +0100 Subject: [PATCH] Add LDAP support to RabbitMQ (#18488) Signed-off-by: Alejandro Moreno --- stable/rabbitmq/Chart.yaml | 2 +- stable/rabbitmq/README.md | 35 ++++++++++++++++++++ stable/rabbitmq/templates/NOTES.txt | 2 ++ stable/rabbitmq/templates/_helpers.tpl | 33 ++++++++++++++++++ stable/rabbitmq/templates/configuration.yaml | 13 ++++++++ stable/rabbitmq/templates/ldap-certs.yaml | 19 +++++++++++ stable/rabbitmq/templates/statefulset.yaml | 30 ++++++++++++++++- stable/rabbitmq/values-production.yaml | 18 ++++++++-- stable/rabbitmq/values.yaml | 18 ++++++++-- 9 files changed, 164 insertions(+), 6 deletions(-) create mode 100644 stable/rabbitmq/templates/ldap-certs.yaml diff --git a/stable/rabbitmq/Chart.yaml b/stable/rabbitmq/Chart.yaml index 2ab8e3e572..e00ff1defd 100644 --- a/stable/rabbitmq/Chart.yaml +++ b/stable/rabbitmq/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: rabbitmq -version: 6.10.1 +version: 6.11.0 appVersion: 3.8.0 description: Open source message broker software that implements the Advanced Message Queuing Protocol (AMQP) keywords: diff --git a/stable/rabbitmq/README.md b/stable/rabbitmq/README.md index fd97297c2d..559b7d1394 100644 --- a/stable/rabbitmq/README.md +++ b/stable/rabbitmq/README.md @@ -86,6 +86,15 @@ The following table lists the configurable parameters of the RabbitMQ chart and | `rabbitmq.tls.serverCertificate` | Server certificate | Server certificate content | | `rabbitmq.tls.serverKey` | Server Key | Server private key content | | `rabbitmq.tls.existingSecret` | Existing secret with certificate content to rabbitmq credentials | `nil` | +| `ldap.enabled` | Enable LDAP support | `false` | +| `ldap.server` | LDAP server | `""` | +| `ldap.port` | LDAP port | `389` | +| `ldap.user_dn_pattern` | DN used to bind to LDAP | `cn=${username},dc=example,dc=org` | +| `ldap.tls.enabled` | Enable TLS for LDAP connections | `false` | +| `ldap.tls.caCertificate` | CA certificate for LDAP connections | `nil` | +| `ldap.tls.serverCertificate` | Server certificate for LDAP connections | `nil` | +| `ldap.tls.serverKey` | Server key for LDAP connections | `nil` | +| `ldap.tls.existingSecret` | Existing secret with certificate content to LDAP credentials | `nil` | | `service.type` | Kubernetes Service type | `ClusterIP` | | `service.port` | Amqp port | `5672` | | `service.tlsPort` | Amqp TLS port | `5671` | @@ -332,6 +341,32 @@ Disabling [failIfNoPeerCert](https://www.rabbitmq.com/ssl.html#peer-verification [sslOptionsVerify](https://www.rabbitmq.com/ssl.html#peer-verification-configuration): When the sslOptionsVerify option is set to verify_peer, the client does send us a certificate, the node must perform peer verification. When set to verify_none, peer verification will be disabled and certificate exchange won't be performed. +### LDAP + +LDAP support can be enabled in the chart by specifying the `ldap.` parameters while creating a release. The following parameters should be configured to properly enable the LDAP support in the chart. + +- `ldap.enabled`: Enable LDAP support. Defaults to `false`. +- `ldap.server`: LDAP server host. No defaults. +- `ldap.port`: LDAP server port. `389`. +- `ldap.user_dn_pattern`: DN used to bind to LDAP. `cn=${username},dc=example,dc=org`. + +It's also possible to connect to LDAP servers using TLS. The following parameters allow this configuration: + +- `ldap.tls.enabled`: Enable TLS for LDAP connections. Defaults to `false`. +- `ldap.tls.caCertificate`: CA certificate for LDAP connections. No defaults. +- `ldap.tls.serverCertificate`: Server certificate for LDAP connections. No defaults. +- `ldap.tls.serverKey`: Server key for LDAP connections. No defaults. +- `ldap.tls.existingSecret`: Existing secret with certificate content to LDAP credentials. No defaults. + +For example: + +```console +ldap.enabled="true" +ldap.server="my-ldap-server" +ldap.port="389" +ldap.user_dn_pattern="cn=${username},dc=example,dc=org" +``` + ## Persistence The [Bitnami RabbitMQ](https://github.com/bitnami/bitnami-docker-rabbitmq) image stores the RabbitMQ data and configurations at the `/opt/bitnami/rabbitmq/var/lib/rabbitmq/` path of the container. diff --git a/stable/rabbitmq/templates/NOTES.txt b/stable/rabbitmq/templates/NOTES.txt index c0981042c6..2084e1ef58 100644 --- a/stable/rabbitmq/templates/NOTES.txt +++ b/stable/rabbitmq/templates/NOTES.txt @@ -69,6 +69,8 @@ Then, open the URL obtained in a browser. {{- end }} +{{- include "rabbitmq.validateValues" . -}} + {{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. diff --git a/stable/rabbitmq/templates/_helpers.tpl b/stable/rabbitmq/templates/_helpers.tpl index b5577a5ab3..267a33a3bb 100644 --- a/stable/rabbitmq/templates/_helpers.tpl +++ b/stable/rabbitmq/templates/_helpers.tpl @@ -210,3 +210,36 @@ but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else {{- end -}} {{- end -}} {{- end -}} + +{{/* +Compile all warnings into a single message, and call fail. +*/}} +{{- define "rabbitmq.validateValues" -}} +{{- $messages := list -}} +{{- $messages := append $messages (include "rabbitmq.validateValues.ldap" .) -}} +{{- $messages := without $messages "" -}} +{{- $message := join "\n" $messages -}} + +{{- if $message -}} +{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}} +{{- end -}} +{{- end -}} + +{{/* +Validate values of rabbitmq - LDAP support +*/}} +{{- define "rabbitmq.validateValues.ldap" -}} +{{- if .Values.ldap.enabled }} +{{- if not (and .Values.ldap.server .Values.ldap.port .Values.ldap.user_dn_pattern) }} +rabbitmq: LDAP + Invalid LDAP configuration. When enabling LDAP support, the parameters "ldap.server", + "ldap.port", and "ldap. user_dn_pattern" are mandatory. Please provide them: + + $ helm install --name {{ .Release.Name }} stable/rabbitmq \ + --set ldap.enabled=true \ + --set ldap.server="lmy-ldap-server" \ + --set ldap.port="389" \ + --set user_dn_pattern="cn=${username},dc=example,dc=org" +{{- end -}} +{{- end -}} +{{- end -}} diff --git a/stable/rabbitmq/templates/configuration.yaml b/stable/rabbitmq/templates/configuration.yaml index aa46b23e84..f983632869 100644 --- a/stable/rabbitmq/templates/configuration.yaml +++ b/stable/rabbitmq/templates/configuration.yaml @@ -24,6 +24,19 @@ data: ssl_options.certfile = /opt/bitnami/rabbitmq/certs/server_certificate.pem ssl_options.keyfile = /opt/bitnami/rabbitmq/certs/server_key.pem {{- end }} +{{- if .Values.ldap.enabled }} + auth_backends.1 = rabbit_auth_backend_ldap + auth_ldap.servers.1 = {{ .Values.ldap.server }} + auth_ldap.port = {{ .Values.ldap.port }} + auth_ldap.user_dn_pattern = {{ .Values.ldap.user_dn_pattern }} +{{- if .Values.ldap.tls.enabled }} + auth_ldap.use_ssl = true + auth_ldap.ssl_options.cacertfile = /opt/bitnami/rabbitmq/certs-ldap/ca_certificate.pem + auth_ldap.ssl_options.certfile = /opt/bitnami/rabbitmq/certs-ldap/server_certificate.pem + auth_ldap.ssl_options.keyfile = /opt/bitnami/rabbitmq/certs-ldap/server_key.pem +{{- end }} +{{- end }} + {{ if .Values.rabbitmq.advancedConfiguration}} advanced.config: |- {{ .Values.rabbitmq.advancedConfiguration | indent 4 }} diff --git a/stable/rabbitmq/templates/ldap-certs.yaml b/stable/rabbitmq/templates/ldap-certs.yaml new file mode 100644 index 0000000000..caed3e0605 --- /dev/null +++ b/stable/rabbitmq/templates/ldap-certs.yaml @@ -0,0 +1,19 @@ +{{- if and (not .Values.ldap.tls.existingSecret) .Values.ldap.enabled .Values.ldap.tls.enabled }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "rabbitmq.fullname" . }}-ldap-certs + labels: + app: {{ template "rabbitmq.name" . }} + chart: {{ template "rabbitmq.chart" . }} + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +type: Opaque +data: + ca_certificate.pem: + {{ required "A valid .Values.ldap.tls.caCertificate entry required!" .Values.ldap.tls.caCertificate | b64enc | quote }} + server_certificate.pem: + {{ required "A valid .Values.ldap.tls.serverCertificate entry required!" .Values.ldap.tls.serverCertificate| b64enc | quote }} + server_key.pem: + {{ required "A valid .Values.ldap.tls.serverKey entry required!" .Values.ldap.tls.serverKey | b64enc | quote }} +{{- end }} diff --git a/stable/rabbitmq/templates/statefulset.yaml b/stable/rabbitmq/templates/statefulset.yaml index f05e2c1617..a42788436b 100644 --- a/stable/rabbitmq/templates/statefulset.yaml +++ b/stable/rabbitmq/templates/statefulset.yaml @@ -116,6 +116,10 @@ spec: - name: {{ template "rabbitmq.fullname" . }}-certs mountPath: /opt/bitnami/rabbitmq/certs {{- end }} + {{- if .Values.ldap.tls.enabled }} + - name: {{ template "rabbitmq.fullname" . }}-ldap-certs + mountPath: /opt/bitnami/rabbitmq/certs-ldap + {{- end }} - name: data mountPath: "{{ .Values.persistence.path }}" {{- if .Values.rabbitmq.loadDefinition.enabled }} @@ -197,6 +201,18 @@ spec: value: "rabbit@$(MY_POD_NAME)" {{- end }} {{- end }} + {{- if .Values.ldap.enabled }} + - name: RABBITMQ_LDAP_ENABLE + value: "yes" + - name: RABBITMQ_LDAP_TLS + value: {{ ternary "yes" "no" .Values.ldap.tls.enabled | quote }} + - name: RABBITMQ_LDAP_SERVER + value: {{ .Values.ldap.server }} + - name: RABBITMQ_LDAP_SERVER_PORT + value: {{ .Values.ldap.port | quote }} + - name: RABBITMQ_LDAP_USER_DN_PATTERN + value: {{ .Values.ldap.user_dn_pattern }} + {{- end }} - name: RABBITMQ_LOGS value: {{ .Values.rabbitmq.logs | quote }} - name: RABBITMQ_ULIMIT_NOFILES @@ -291,7 +307,19 @@ spec: path: server_certificate.pem - key: server_key.pem path: server_key.pem - {{- end }} + {{- end }} + {{- if and .Values.ldap.enabled .Values.ldap.tls.enabled }} + - name: {{ template "rabbitmq.fullname" . }}-ldap-certs + secret: + secretName: {{ if .Values.ldap.tls.existingSecret }}{{ .Values.ldap.tls.existingSecret }}{{- else }}{{ template "rabbitmq.fullname" . }}-ldap-certs{{- end }} + items: + - key: ca_certificate.pem + path: ca_certificate.pem + - key: server_certificate.pem + path: server_certificate.pem + - key: server_key.pem + path: server_key.pem + {{- end }} - name: config-volume configMap: name: {{ template "rabbitmq.fullname" . }}-config diff --git a/stable/rabbitmq/values-production.yaml b/stable/rabbitmq/values-production.yaml index 5eeca4952b..3534679ad7 100644 --- a/stable/rabbitmq/values-production.yaml +++ b/stable/rabbitmq/values-production.yaml @@ -14,7 +14,7 @@ image: registry: docker.io repository: bitnami/rabbitmq - tag: 3.8.0-debian-9-r0 + tag: 3.8.0-debian-9-r17 ## set to true if you would like to see extra information on logs ## it turns BASH and NAMI debugging in minideb @@ -108,7 +108,7 @@ rabbitmq: ## Extra plugins to enable ## Use this instead of `plugins` to add new plugins - # extraPlugins: "" + extraPlugins: "rabbitmq_auth_backend_ldap" ## Clustering settings clustering: @@ -159,6 +159,20 @@ rabbitmq: serverKey: |- # existingSecret: name-of-existing-secret-to-rabbitmq +## LDAP configuration +## +ldap: + enabled: false + server: "" + port: "389" + user_dn_pattern: cn=${username},dc=example,dc=org + tls: + enabled: false + caCertificate: |- + serverCertificate: |- + serverKey: |- + # existingSecret: name-of-existing-secret-to-rabbitmq + ## Kubernetes service type service: type: ClusterIP diff --git a/stable/rabbitmq/values.yaml b/stable/rabbitmq/values.yaml index 6881eaf51a..48d4047715 100644 --- a/stable/rabbitmq/values.yaml +++ b/stable/rabbitmq/values.yaml @@ -14,7 +14,7 @@ image: registry: docker.io repository: bitnami/rabbitmq - tag: 3.8.0-debian-9-r0 + tag: 3.8.0-debian-9-r17 ## set to true if you would like to see extra information on logs ## it turns BASH and NAMI debugging in minideb @@ -108,7 +108,7 @@ rabbitmq: ## Extra plugins to enable ## Use this instead of `plugins` to add new plugins - # extraPlugins: "" + extraPlugins: "rabbitmq_auth_backend_ldap" ## Clustering settings clustering: @@ -159,6 +159,20 @@ rabbitmq: serverKey: |- # existingSecret: name-of-existing-secret-to-rabbitmq +## LDAP configuration +## +ldap: + enabled: false + server: "" + port: "389" + user_dn_pattern: cn=${username},dc=example,dc=org + tls: + enabled: false + caCertificate: |- + serverCertificate: |- + serverKey: |- + # existingSecret: name-of-existing-secret-to-rabbitmq + ## Kubernetes service type service: type: ClusterIP