github/deprecated-helm-charts
1
0
Fork 0
mirror of https://github.com/helm/charts.git synced 2026-08-23 22:37:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Tls support added to rabbitmq (#17202)

Browse Source 
Signed-off-by: Juan Manuel Vizcaino  <juanmanuel.vizcaino@iomed.health>
Signed-off-by: Juan Manuel <juanmanuel.vizcaino@iomed.es>
This commit is contained in:
jmvizcainoio
2019-09-18 01:15:31 -07:00
committed by Kubernetes Prow Robot
parent 1e9412ee3f
commit 1e0ceb73bb
9 changed files with 141 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stable/rabbitmq/Chart.yaml
+1 -1
View File
@@ -1,6 +1,6 @@
apiVersion: v1
name: rabbitmq
version: 6.6.0
version: 6.7.0
appVersion: 3.7.17
description: Open source message broker software that implements the Advanced Message Queuing Protocol (AMQP)
keywords:
stable/rabbitmq/README.md
+39 -1
View File
@@ -78,10 +78,19 @@ The following table lists the configurable parameters of the RabbitMQ chart and
| `rabbitmq.configuration` | Required cluster configuration | See values.yaml |
| `rabbitmq.extraConfiguration` | Extra configuration to add to rabbitmq.conf | See values.yaml |
| `rabbitmq.advancedConfiguration` | Extra configuration (in classic format) to add to advanced.config | See values.yaml |
| `rabbitmq.tls.enabled` | Enable TLS support to rabbitmq | | `false` |
| `rabbitmq.tls.failIfNoPeerCert` | When set to true, TLS connection will be rejected if client fails to provide a certificate | `true` |
| `rabbitmq.tls.sslOptionsVerify` | `verify_peer` | Should [peer verification](https://www.rabbitmq.com/ssl.html#peer-verification) be enabled? |
| `rabbitmq.tls.caCertificate` | Ca certificate | Certificate Authority (CA) bundle content |
| `rabbitmq.tls.serverCertificate` | Server certificate | Server certificate content |
| `rabbitmq.tls.serverKey` | Server Key | Server private key content |
| `rabbitmq.tls.existingSecret` | Existing secret with certificate content to rabbitmq credentials | `nil` |
| `service.type` | Kubernetes Service type | `ClusterIP` |
| `service.port` | Amqp port | `5672` |
| `service.tlsPort` | Amqp TLS port | `5671` |
| `service.distPort` | Erlang distribution server port | `25672` |
| `service.nodePort` | Node port override, if serviceType NodePort | _random available between 30000-32767_ |
| `service.nodeTlsPort` | Node port override, if serviceType NodePort | _random available between 30000-32767_ |
| `service.managerPort` | RabbitMQ Manager port | `15672` |
| `persistence.enabled` | Use a PVC to persist data | `true` |
| `service.annotations` | service annotations as an array | [] |
@@ -94,7 +103,6 @@ The following table lists the configurable parameters of the RabbitMQ chart and
| `securityContext.enabled` | Enable security context | `true` |
| `securityContext.fsGroup` | Group ID for the container | `1001` |
| `securityContext.runAsUser` | User ID for the container | `1001` |
| `securityContext.extra` | Extra securityContext configuration | {} |
| `resources` | resource needs and limits to apply to the pod | {} |
| `replicas` | Replica count | `1` |
| `priorityClassName` | Pod priority class name | `` |
@@ -282,6 +290,36 @@ The chart mounts a [Persistent Volume](http://kubernetes.io/docs/user-guide/pers
$ helm install --set persistence.existingClaim=PVC_NAME rabbitmq
```
## Enabling TLS support
To enable TLS support you must generate the certificates using RabbitMQ [documentation](https://www.rabbitmq.com/ssl.html#automated-certificate-generation).
You must include in your values.yaml the caCertificate, serverCertificate and serverKey files.
```yaml
caCertificate: |-
-----BEGIN CERTIFICATE-----
MIIDRTCCAi2gAwIBAgIJAJPh+paO6a3cMA0GCSqGSIb3DQEBCwUAMDExIDAeBgNV
...
-----END CERTIFICATE-----
serverCertificate: |-
-----BEGIN CERTIFICATE-----
MIIDqjCCApKgAwIBAgIBATANBgkqhkiG9w0BAQsFADAxMSAwHgYDVQQDDBdUTFNH
...
-----END CERTIFICATE-----
serverKey: |-
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA2iX3M4d3LHrRAoVUbeFZN3EaGzKhyBsz7GWwTgETiNj+AL7p
....
-----END RSA PRIVATE KEY-----
```
This will be generate a secret with the certs, but is possible specify an existing secret using `existingSecret: name-of-existing-secret-to-rabbitmq`
Disabling [failIfNoPeerCert](https://www.rabbitmq.com/ssl.html#peer-verification-configuration) allows a TLS connection if client fails to provide a certificate
[sslOptionsVerify](https://www.rabbitmq.com/ssl.html#peer-verification-configuration): When the sslOptionsVerify option is set to verify_peer, the client does send us a certificate, the node must perform peer verification. When set to verify_none, peer verification will be disabled and certificate exchange won't be performed.
## Upgrading
### To 6.0.0
stable/rabbitmq/templates/certs.yaml
+19
View File
@@ -0,0 +1,19 @@
{{- if and (not .Values.rabbitmq.tls.existingSecret) ( .Values.rabbitmq.tls.enabled) }}
apiVersion: v1
kind: Secret
metadata:
name: {{ template "rabbitmq.fullname" . }}-certs
labels:
app: {{ template "rabbitmq.name" . }}
chart: {{ template "rabbitmq.chart" . }}
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
type: Opaque
data:
ca_certificate.pem:
{{ required "A valid .Values.rabbitmq.tls.caCertificate entry required!" .Values.rabbitmq.tls.caCertificate | b64enc | quote }}
server_certificate.pem:
{{ required "A valid .Values.rabbitmq.tls.serverCertificate entry required!" .Values.rabbitmq.tls.serverCertificate| b64enc | quote }}
server_key.pem:
{{ required "A valid .Values.rabbitmq.tls.serverKey entry required!" .Values.rabbitmq.tls.serverKey | b64enc | quote }}
{{- end }}
stable/rabbitmq/templates/configuration.yaml
+9 -1
View File
@@ -16,7 +16,15 @@ data:
default_pass=CHANGEME
{{ .Values.rabbitmq.configuration | indent 4 }}
{{ .Values.rabbitmq.extraConfiguration | indent 4 }}
{{- if .Values.rabbitmq.tls.enabled }}
ssl_options.verify={{ .Values.rabbitmq.tls.sslOptionsVerify }}
listeners.ssl.default={{ .Values.service.tlsPort }}
ssl_options.fail_if_no_peer_cert={{ .Values.rabbitmq.tls.failIfNoPeerCert }}
ssl_options.cacertfile = /opt/bitnami/rabbitmq/certs/ca_certificate.pem
ssl_options.certfile = /opt/bitnami/rabbitmq/certs/server_certificate.pem
ssl_options.keyfile = /opt/bitnami/rabbitmq/certs/server_key.pem
{{- end }}
{{ if .Values.rabbitmq.advancedConfiguration}}
advanced.config: |-
{{ .Values.rabbitmq.advancedConfiguration | indent 4 }}
{{ end }}
{{- end }}
stable/rabbitmq/templates/statefulset.yaml
+20 -1
View File
@@ -134,6 +134,10 @@ spec:
volumeMounts:
- name: config-volume
mountPath: /opt/bitnami/rabbitmq/conf
{{- if .Values.rabbitmq.tls.enabled }}
- name: {{ template "rabbitmq.fullname" . }}-certs
mountPath: /opt/bitnami/rabbitmq/certs
{{- end }}
- name: data
mountPath: "{{ .Values.persistence.path }}"
{{- if .Values.rabbitmq.loadDefinition.enabled }}
@@ -146,6 +150,10 @@ spec:
containerPort: 4369
- name: amqp
containerPort: {{ .Values.service.port }}
{{- if .Values.rabbitmq.tls.enabled }}
- name: amqp-ssl
containerPort: {{ .Values.service.tlsPort }}
{{- end }}
- name: dist
containerPort: {{ .Values.service.distPort }}
- name: stats
@@ -272,7 +280,6 @@ spec:
resources:
{{ toYaml .Values.metrics.resources | indent 10 }}
{{- end }}
{{- if .Values.securityContext.enabled }}
securityContext:
fsGroup: {{ .Values.securityContext.fsGroup }}
@@ -282,6 +289,18 @@ spec:
{{- end }}
{{- end }}
volumes:
{{- if .Values.rabbitmq.tls.enabled }}
- name: {{ template "rabbitmq.fullname" . }}-certs
secret:
secretName: {{ if .Values.rabbitmq.tls.existingSecret }}{{ .Values.rabbitmq.tls.existingSecret }}{{- else }}{{ template "rabbitmq.fullname" . }}-certs{{- end }}
items:
- key: ca_certificate.pem
path: ca_certificate.pem
- key: server_certificate.pem
path: server_certificate.pem
- key: server_key.pem
path: server_key.pem
{{- end }}
- name: config-volume
configMap:
name: {{ template "rabbitmq.fullname" . }}-config
stable/rabbitmq/templates/svc-headless.yaml
+5
View File
@@ -16,6 +16,11 @@ spec:
- name: amqp
port: {{ .Values.service.port }}
targetPort: amqp
{{- if .Values.rabbitmq.tls.enabled }}
- name: amqp-tls
port: {{ .Values.service.tlsPort }}
targetPort: amqp-tls
{{- end }}
- name: dist
port: {{ .Values.service.distPort }}
targetPort: dist
stable/rabbitmq/templates/svc.yaml
+8
View File
@@ -34,6 +34,14 @@ spec:
{{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.service.nodePort))) }}
nodePort: {{ .Values.service.nodePort }}
{{- end }}
{{- if .Values.rabbitmq.tls.enabled }}
- name: amqp-ssl
port: {{ .Values.service.tlsPort }}
targetPort: amqp-ssl
{{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.service.nodeTlsPort))) }}
nodePort: {{ .Values.service.nodeTlsPort }}
{{- end }}
{{- end }}
- name: dist
port: {{ .Values.service.distPort }}
targetPort: dist
stable/rabbitmq/values-production.yaml
+20
View File
@@ -147,6 +147,18 @@ rabbitmq:
## Use this as additional configuraton in classic config format (Erlang term configuration format)
advancedConfiguration: |-
## Enable encryption to rabbitmq
## ref: https://www.rabbitmq.com/ssl.html
##
tls:
enabled: false
failIfNoPeerCert: true
sslOptionsVerify: verify_peer
caCertificate: |-
serverCertificate: |-
serverKey: |-
# existingSecret: name-of-existing-secret-to-rabbitmq
## Kubernetes service type
service:
type: ClusterIP
@@ -155,11 +167,19 @@ service:
##
# nodePort: 30672
## Node port Tls
##
# nodeTlsPort: 30671
## Amqp port
## ref: https://github.com/bitnami/bitnami-docker-rabbitmq#environment-variables
##
port: 5672
## Amqp Tls port
##
tlsPort: 5671
## Dist port
## ref: https://github.com/bitnami/bitnami-docker-rabbitmq#environment-variables
##
stable/rabbitmq/values.yaml
+20
View File
@@ -147,6 +147,18 @@ rabbitmq:
## Use this as additional configuraton in classic config format (Erlang term configuration format)
advancedConfiguration: |-
## Enable encryption to rabbitmq
## ref: https://www.rabbitmq.com/ssl.html
##
tls:
enabled: false
failIfNoPeerCert: true
sslOptionsVerify: verify_peer
caCertificate: |-
serverCertificate: |-
serverKey: |-
# existingSecret: name-of-existing-secret-to-rabbitmq
## Kubernetes service type
service:
type: ClusterIP
@@ -155,11 +167,19 @@ service:
##
# nodePort: 30672
## Node port Tls
##
# nodeTlsPort: 30671
## Amqp port
## ref: https://github.com/bitnami/bitnami-docker-rabbitmq#environment-variables
##
port: 5672
## Amqp Tls port
##
tlsPort: 5671
## Dist port
## ref: https://github.com/bitnami/bitnami-docker-rabbitmq#environment-variables
##