From 81575c002d633e5d4f4ba3bdfa0fbcc5ca66b6a9 Mon Sep 17 00:00:00 2001 From: Louise Champ Date: Mon, 11 Feb 2019 08:59:08 +0000 Subject: [PATCH] [stable/rabbitmq] Existing secret values switches for password / erlang cookie (#10699) * [stable/rabbitmq] Existing password / erlang cookie secret Allows usage of rabbitmq application password and erlang cookie values from an externally-managed Kube secret Signed-off-by: Louise Champ * add new values to values-production Signed-off-by: Louise Champ * suggested changed Signed-off-by: Louise Champ * Revert "suggested changed" This reverts commit 47afc08a4e571aeb79eda593ab3b5a18daf635a2. Signed-off-by: Louise Champ * suggested changes Signed-off-by: Louise Champ * use secret name helper function in metrics container env Signed-off-by: Louise Champ * use newer appVersion in chart 4.2.0 Signed-off-by: Louise Champ --- stable/rabbitmq/Chart.yaml | 2 +- stable/rabbitmq/README.md | 2 ++ stable/rabbitmq/templates/_helpers.tpl | 22 ++++++++++++++++++++++ stable/rabbitmq/templates/secrets.yaml | 10 ++++++---- stable/rabbitmq/templates/statefulset.yaml | 6 +++--- stable/rabbitmq/values-production.yaml | 2 ++ stable/rabbitmq/values.yaml | 2 ++ 7 files changed, 38 insertions(+), 8 deletions(-) diff --git a/stable/rabbitmq/Chart.yaml b/stable/rabbitmq/Chart.yaml index bb4b61a68f..a1acc2a948 100644 --- a/stable/rabbitmq/Chart.yaml +++ b/stable/rabbitmq/Chart.yaml @@ -1,5 +1,5 @@ name: rabbitmq -version: 4.1.1 +version: 4.2.0 appVersion: 3.7.11 description: Open source message broker software that implements the Advanced Message Queuing Protocol (AMQP) keywords: diff --git a/stable/rabbitmq/README.md b/stable/rabbitmq/README.md index 9b0732c9cd..4994376773 100644 --- a/stable/rabbitmq/README.md +++ b/stable/rabbitmq/README.md @@ -57,7 +57,9 @@ The following table lists the configurable parameters of the RabbitMQ chart and | `rbacEnabled` | Specify if rbac is enabled in your cluster | `true` | | `rabbitmq.username` | RabbitMQ application username | `user` | | `rabbitmq.password` | RabbitMQ application password | _random 10 character long alphanumeric string_ | +| `rabbitmq.existingPasswordSecret` | Existing secret with RabbitMQ credentials | nil | | `rabbitmq.erlangCookie` | Erlang cookie | _random 32 character long alphanumeric string_ | +| `rabbitmq.existingErlSecret` | Existing secret with RabbitMQ Erlang cookie | nil | | `rabbitmq.plugins` | configuration file for plugins to enable | `[rabbitmq_management,rabbitmq_peer_discovery_k8s].` | | `rabbitmq.clustering.address_type` | Switch clustering mode | `ip` or `hostname` | | `rabbitmq.clustering.k8s_domain` | Customize internal k8s cluster domain | `cluster.local` | diff --git a/stable/rabbitmq/templates/_helpers.tpl b/stable/rabbitmq/templates/_helpers.tpl index b6e5b889d7..b9fa48f30d 100644 --- a/stable/rabbitmq/templates/_helpers.tpl +++ b/stable/rabbitmq/templates/_helpers.tpl @@ -63,3 +63,25 @@ Return the proper metrics image name {{- $tag := .Values.metrics.image.tag | toString -}} {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} {{- end -}} + +{{/* +Get the password secret. +*/}} +{{- define "rabbitmq.secretPasswordName" -}} + {{- if .Values.rabbitmq.existingPasswordSecret -}} + {{- printf "%s" .Values.rabbitmq.existingPasswordSecret -}} + {{- else -}} + {{- printf "%s" (include "rabbitmq.fullname" .) -}} + {{- end -}} +{{- end -}} + +{{/* +Get the erlang secret. +*/}} +{{- define "rabbitmq.secretErlangName" -}} + {{- if .Values.rabbitmq.existingErlangSecret -}} + {{- printf "%s" .Values.rabbitmq.existingErlangSecret -}} + {{- else -}} + {{- printf "%s" (include "rabbitmq.fullname" .) -}} + {{- end -}} +{{- end -}} diff --git a/stable/rabbitmq/templates/secrets.yaml b/stable/rabbitmq/templates/secrets.yaml index b5362f142f..19c0296cd3 100644 --- a/stable/rabbitmq/templates/secrets.yaml +++ b/stable/rabbitmq/templates/secrets.yaml @@ -1,3 +1,4 @@ +{{ if or (not .Values.rabbitmq.existingErlangSecret) (not .Values.rabbitmq.existingPasswordSecret) }} apiVersion: v1 kind: Secret metadata: @@ -9,13 +10,14 @@ metadata: heritage: "{{ .Release.Service }}" type: Opaque data: - {{ if .Values.rabbitmq.password }} + {{ if not .Values.rabbitmq.existingPasswordSecret }}{{ if .Values.rabbitmq.password }} rabbitmq-password: {{ .Values.rabbitmq.password | b64enc | quote }} {{ else }} rabbitmq-password: {{ randAlphaNum 10 | b64enc | quote }} - {{ end }} - {{ if .Values.rabbitmq.erlangCookie }} + {{ end }}{{ end }} + {{ if not .Values.rabbitmq.existingErlangSecret }}{{ if .Values.rabbitmq.erlangCookie }} rabbitmq-erlang-cookie: {{ .Values.rabbitmq.erlangCookie | b64enc | quote }} {{ else }} rabbitmq-erlang-cookie: {{ randAlphaNum 32 | b64enc | quote }} - {{ end }} + {{ end }}{{ end }} +{{ end }} diff --git a/stable/rabbitmq/templates/statefulset.yaml b/stable/rabbitmq/templates/statefulset.yaml index 2e304a1117..185f28bd38 100644 --- a/stable/rabbitmq/templates/statefulset.yaml +++ b/stable/rabbitmq/templates/statefulset.yaml @@ -152,12 +152,12 @@ spec: - name: RABBITMQ_ERL_COOKIE valueFrom: secretKeyRef: - name: {{ template "rabbitmq.fullname" . }} + name: {{ template "rabbitmq.secretErlangName" . }} key: rabbitmq-erlang-cookie - name: RABBITMQ_PASSWORD valueFrom: secretKeyRef: - name: {{ template "rabbitmq.fullname" . }} + name: {{ template "rabbitmq.secretPasswordName" . }} key: rabbitmq-password {{- if .Values.metrics.enabled }} - name: metrics @@ -167,7 +167,7 @@ spec: - name: RABBIT_PASSWORD valueFrom: secretKeyRef: - name: {{ template "rabbitmq.fullname" . }} + name: {{ template "rabbitmq.secretPasswordName" . }} key: rabbitmq-password - name: RABBIT_URL value: "http://localhost:{{ .Values.service.managerPort }}" diff --git a/stable/rabbitmq/values-production.yaml b/stable/rabbitmq/values-production.yaml index 6fbf2ce3c9..f0f9e05afb 100644 --- a/stable/rabbitmq/values-production.yaml +++ b/stable/rabbitmq/values-production.yaml @@ -43,11 +43,13 @@ rabbitmq: ## ref: https://github.com/bitnami/bitnami-docker-rabbitmq#environment-variables ## # password: + # existingPasswordSecret: name-of-existing-secret ## Erlang cookie to determine whether different nodes are allowed to communicate with each other ## ref: https://github.com/bitnami/bitnami-docker-rabbitmq#environment-variables ## # erlangCookie: + # existingErlangSecret: name-of-existing-secret ## Node name to cluster with. e.g.: `clusternode@hostname` ## ref: https://github.com/bitnami/bitnami-docker-rabbitmq#environment-variables diff --git a/stable/rabbitmq/values.yaml b/stable/rabbitmq/values.yaml index ade7a4b38b..c38e4d9921 100644 --- a/stable/rabbitmq/values.yaml +++ b/stable/rabbitmq/values.yaml @@ -43,11 +43,13 @@ rabbitmq: ## ref: https://github.com/bitnami/bitnami-docker-rabbitmq#environment-variables ## # password: + # existingPasswordSecret: name-of-existing-secret ## Erlang cookie to determine whether different nodes are allowed to communicate with each other ## ref: https://github.com/bitnami/bitnami-docker-rabbitmq#environment-variables ## # erlangCookie: + # existingErlangSecret: name-of-existing-secret ## Node name to cluster with. e.g.: `clusternode@hostname` ## ref: https://github.com/bitnami/bitnami-docker-rabbitmq#environment-variables