diff --git a/stable/rabbitmq/Chart.yaml b/stable/rabbitmq/Chart.yaml index f0abd5e0d9..7354c33e56 100644 --- a/stable/rabbitmq/Chart.yaml +++ b/stable/rabbitmq/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: rabbitmq -version: 6.6.0 +version: 6.7.0 appVersion: 3.7.17 description: Open source message broker software that implements the Advanced Message Queuing Protocol (AMQP) keywords: diff --git a/stable/rabbitmq/README.md b/stable/rabbitmq/README.md index 4454f0d4ec..6846265ff0 100644 --- a/stable/rabbitmq/README.md +++ b/stable/rabbitmq/README.md @@ -78,10 +78,19 @@ The following table lists the configurable parameters of the RabbitMQ chart and | `rabbitmq.configuration` | Required cluster configuration | See values.yaml | | `rabbitmq.extraConfiguration` | Extra configuration to add to rabbitmq.conf | See values.yaml | | `rabbitmq.advancedConfiguration` | Extra configuration (in classic format) to add to advanced.config | See values.yaml | +| `rabbitmq.tls.enabled` | Enable TLS support to rabbitmq | | `false` | +| `rabbitmq.tls.failIfNoPeerCert` | When set to true, TLS connection will be rejected if client fails to provide a certificate | `true` | +| `rabbitmq.tls.sslOptionsVerify` | `verify_peer` | Should [peer verification](https://www.rabbitmq.com/ssl.html#peer-verification) be enabled? | +| `rabbitmq.tls.caCertificate` | Ca certificate | Certificate Authority (CA) bundle content | +| `rabbitmq.tls.serverCertificate` | Server certificate | Server certificate content | +| `rabbitmq.tls.serverKey` | Server Key | Server private key content | +| `rabbitmq.tls.existingSecret` | Existing secret with certificate content to rabbitmq credentials | `nil` | | `service.type` | Kubernetes Service type | `ClusterIP` | | `service.port` | Amqp port | `5672` | +| `service.tlsPort` | Amqp TLS port | `5671` | | `service.distPort` | Erlang distribution server port | `25672` | | `service.nodePort` | Node port override, if serviceType NodePort | _random available between 30000-32767_ | +| `service.nodeTlsPort` | Node port override, if serviceType NodePort | _random available between 30000-32767_ | | `service.managerPort` | RabbitMQ Manager port | `15672` | | `persistence.enabled` | Use a PVC to persist data | `true` | | `service.annotations` | service annotations as an array | [] | @@ -94,7 +103,6 @@ The following table lists the configurable parameters of the RabbitMQ chart and | `securityContext.enabled` | Enable security context | `true` | | `securityContext.fsGroup` | Group ID for the container | `1001` | | `securityContext.runAsUser` | User ID for the container | `1001` | -| `securityContext.extra` | Extra securityContext configuration | {} | | `resources` | resource needs and limits to apply to the pod | {} | | `replicas` | Replica count | `1` | | `priorityClassName` | Pod priority class name | `` | @@ -282,6 +290,36 @@ The chart mounts a [Persistent Volume](http://kubernetes.io/docs/user-guide/pers $ helm install --set persistence.existingClaim=PVC_NAME rabbitmq ``` +## Enabling TLS support + +To enable TLS support you must generate the certificates using RabbitMQ [documentation](https://www.rabbitmq.com/ssl.html#automated-certificate-generation). + +You must include in your values.yaml the caCertificate, serverCertificate and serverKey files. + +```yaml + caCertificate: |- + -----BEGIN CERTIFICATE----- + MIIDRTCCAi2gAwIBAgIJAJPh+paO6a3cMA0GCSqGSIb3DQEBCwUAMDExIDAeBgNV + ... + -----END CERTIFICATE----- + serverCertificate: |- + -----BEGIN CERTIFICATE----- + MIIDqjCCApKgAwIBAgIBATANBgkqhkiG9w0BAQsFADAxMSAwHgYDVQQDDBdUTFNH + ... + -----END CERTIFICATE----- + serverKey: |- + -----BEGIN RSA PRIVATE KEY----- + MIIEpAIBAAKCAQEA2iX3M4d3LHrRAoVUbeFZN3EaGzKhyBsz7GWwTgETiNj+AL7p + .... + -----END RSA PRIVATE KEY----- +``` + +This will be generate a secret with the certs, but is possible specify an existing secret using `existingSecret: name-of-existing-secret-to-rabbitmq` + +Disabling [failIfNoPeerCert](https://www.rabbitmq.com/ssl.html#peer-verification-configuration) allows a TLS connection if client fails to provide a certificate + +[sslOptionsVerify](https://www.rabbitmq.com/ssl.html#peer-verification-configuration): When the sslOptionsVerify option is set to verify_peer, the client does send us a certificate, the node must perform peer verification. When set to verify_none, peer verification will be disabled and certificate exchange won't be performed. + ## Upgrading ### To 6.0.0 diff --git a/stable/rabbitmq/templates/certs.yaml b/stable/rabbitmq/templates/certs.yaml new file mode 100644 index 0000000000..33821522b0 --- /dev/null +++ b/stable/rabbitmq/templates/certs.yaml @@ -0,0 +1,19 @@ +{{- if and (not .Values.rabbitmq.tls.existingSecret) ( .Values.rabbitmq.tls.enabled) }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "rabbitmq.fullname" . }}-certs + labels: + app: {{ template "rabbitmq.name" . }} + chart: {{ template "rabbitmq.chart" . }} + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +type: Opaque +data: + ca_certificate.pem: + {{ required "A valid .Values.rabbitmq.tls.caCertificate entry required!" .Values.rabbitmq.tls.caCertificate | b64enc | quote }} + server_certificate.pem: + {{ required "A valid .Values.rabbitmq.tls.serverCertificate entry required!" .Values.rabbitmq.tls.serverCertificate| b64enc | quote }} + server_key.pem: + {{ required "A valid .Values.rabbitmq.tls.serverKey entry required!" .Values.rabbitmq.tls.serverKey | b64enc | quote }} +{{- end }} diff --git a/stable/rabbitmq/templates/configuration.yaml b/stable/rabbitmq/templates/configuration.yaml index 44448ee491..aa46b23e84 100644 --- a/stable/rabbitmq/templates/configuration.yaml +++ b/stable/rabbitmq/templates/configuration.yaml @@ -16,7 +16,15 @@ data: default_pass=CHANGEME {{ .Values.rabbitmq.configuration | indent 4 }} {{ .Values.rabbitmq.extraConfiguration | indent 4 }} +{{- if .Values.rabbitmq.tls.enabled }} + ssl_options.verify={{ .Values.rabbitmq.tls.sslOptionsVerify }} + listeners.ssl.default={{ .Values.service.tlsPort }} + ssl_options.fail_if_no_peer_cert={{ .Values.rabbitmq.tls.failIfNoPeerCert }} + ssl_options.cacertfile = /opt/bitnami/rabbitmq/certs/ca_certificate.pem + ssl_options.certfile = /opt/bitnami/rabbitmq/certs/server_certificate.pem + ssl_options.keyfile = /opt/bitnami/rabbitmq/certs/server_key.pem +{{- end }} {{ if .Values.rabbitmq.advancedConfiguration}} advanced.config: |- {{ .Values.rabbitmq.advancedConfiguration | indent 4 }} -{{ end }} +{{- end }} diff --git a/stable/rabbitmq/templates/statefulset.yaml b/stable/rabbitmq/templates/statefulset.yaml index 68aa2ed1f7..8c43db6266 100644 --- a/stable/rabbitmq/templates/statefulset.yaml +++ b/stable/rabbitmq/templates/statefulset.yaml @@ -134,6 +134,10 @@ spec: volumeMounts: - name: config-volume mountPath: /opt/bitnami/rabbitmq/conf + {{- if .Values.rabbitmq.tls.enabled }} + - name: {{ template "rabbitmq.fullname" . }}-certs + mountPath: /opt/bitnami/rabbitmq/certs + {{- end }} - name: data mountPath: "{{ .Values.persistence.path }}" {{- if .Values.rabbitmq.loadDefinition.enabled }} @@ -146,6 +150,10 @@ spec: containerPort: 4369 - name: amqp containerPort: {{ .Values.service.port }} + {{- if .Values.rabbitmq.tls.enabled }} + - name: amqp-ssl + containerPort: {{ .Values.service.tlsPort }} + {{- end }} - name: dist containerPort: {{ .Values.service.distPort }} - name: stats @@ -272,7 +280,6 @@ spec: resources: {{ toYaml .Values.metrics.resources | indent 10 }} {{- end }} - {{- if .Values.securityContext.enabled }} securityContext: fsGroup: {{ .Values.securityContext.fsGroup }} @@ -282,6 +289,18 @@ spec: {{- end }} {{- end }} volumes: + {{- if .Values.rabbitmq.tls.enabled }} + - name: {{ template "rabbitmq.fullname" . }}-certs + secret: + secretName: {{ if .Values.rabbitmq.tls.existingSecret }}{{ .Values.rabbitmq.tls.existingSecret }}{{- else }}{{ template "rabbitmq.fullname" . }}-certs{{- end }} + items: + - key: ca_certificate.pem + path: ca_certificate.pem + - key: server_certificate.pem + path: server_certificate.pem + - key: server_key.pem + path: server_key.pem + {{- end }} - name: config-volume configMap: name: {{ template "rabbitmq.fullname" . }}-config diff --git a/stable/rabbitmq/templates/svc-headless.yaml b/stable/rabbitmq/templates/svc-headless.yaml index 38bc3c31ac..14ad08e8ec 100644 --- a/stable/rabbitmq/templates/svc-headless.yaml +++ b/stable/rabbitmq/templates/svc-headless.yaml @@ -16,6 +16,11 @@ spec: - name: amqp port: {{ .Values.service.port }} targetPort: amqp +{{- if .Values.rabbitmq.tls.enabled }} + - name: amqp-tls + port: {{ .Values.service.tlsPort }} + targetPort: amqp-tls +{{- end }} - name: dist port: {{ .Values.service.distPort }} targetPort: dist diff --git a/stable/rabbitmq/templates/svc.yaml b/stable/rabbitmq/templates/svc.yaml index d2505f4c1e..236f604afd 100644 --- a/stable/rabbitmq/templates/svc.yaml +++ b/stable/rabbitmq/templates/svc.yaml @@ -34,6 +34,14 @@ spec: {{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.service.nodePort))) }} nodePort: {{ .Values.service.nodePort }} {{- end }} + {{- if .Values.rabbitmq.tls.enabled }} + - name: amqp-ssl + port: {{ .Values.service.tlsPort }} + targetPort: amqp-ssl + {{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.service.nodeTlsPort))) }} + nodePort: {{ .Values.service.nodeTlsPort }} + {{- end }} + {{- end }} - name: dist port: {{ .Values.service.distPort }} targetPort: dist diff --git a/stable/rabbitmq/values-production.yaml b/stable/rabbitmq/values-production.yaml index 2726a8d53d..43ef53ad26 100644 --- a/stable/rabbitmq/values-production.yaml +++ b/stable/rabbitmq/values-production.yaml @@ -147,6 +147,18 @@ rabbitmq: ## Use this as additional configuraton in classic config format (Erlang term configuration format) advancedConfiguration: |- + ## Enable encryption to rabbitmq + ## ref: https://www.rabbitmq.com/ssl.html + ## + tls: + enabled: false + failIfNoPeerCert: true + sslOptionsVerify: verify_peer + caCertificate: |- + serverCertificate: |- + serverKey: |- + # existingSecret: name-of-existing-secret-to-rabbitmq + ## Kubernetes service type service: type: ClusterIP @@ -155,11 +167,19 @@ service: ## # nodePort: 30672 + ## Node port Tls + ## + # nodeTlsPort: 30671 + ## Amqp port ## ref: https://github.com/bitnami/bitnami-docker-rabbitmq#environment-variables ## port: 5672 + ## Amqp Tls port + ## + tlsPort: 5671 + ## Dist port ## ref: https://github.com/bitnami/bitnami-docker-rabbitmq#environment-variables ## diff --git a/stable/rabbitmq/values.yaml b/stable/rabbitmq/values.yaml index ca6163c6e5..5b6c2b11cc 100644 --- a/stable/rabbitmq/values.yaml +++ b/stable/rabbitmq/values.yaml @@ -147,6 +147,18 @@ rabbitmq: ## Use this as additional configuraton in classic config format (Erlang term configuration format) advancedConfiguration: |- + ## Enable encryption to rabbitmq + ## ref: https://www.rabbitmq.com/ssl.html + ## + tls: + enabled: false + failIfNoPeerCert: true + sslOptionsVerify: verify_peer + caCertificate: |- + serverCertificate: |- + serverKey: |- + # existingSecret: name-of-existing-secret-to-rabbitmq + ## Kubernetes service type service: type: ClusterIP @@ -155,11 +167,19 @@ service: ## # nodePort: 30672 + ## Node port Tls + ## + # nodeTlsPort: 30671 + ## Amqp port ## ref: https://github.com/bitnami/bitnami-docker-rabbitmq#environment-variables ## port: 5672 + ## Amqp Tls port + ## + tlsPort: 5671 + ## Dist port ## ref: https://github.com/bitnami/bitnami-docker-rabbitmq#environment-variables ##