mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
[stable/rabbitmq-ha] Handle management credentials as secret (#13678)
* [stable/rabbitmq-ha] Handle management credentials as secret Set management user and password in secret object. Expose credentials to rabbitmq container due to probes. Main disadvantage is that authorization header is computed in each probe instead of only once during helm template evaluation. Signed-off-by: hasul <matej.hasul@gooddata.com> * Remove existingSecret condition from NOTES.txt Signed-off-by: hasul <matej.hasul@gooddata.com> * Bump chart version to prevent conflict Signed-off-by: hasul <matej.hasul@gooddata.com>
This commit is contained in:
matejhasul
committed by
Kubernetes Prow Robot
Kubernetes Prow Robot
parent
9bb750ccd2
commit
cdc09f7dc2
@@ -1,7 +1,7 @@
|
||||
name: rabbitmq-ha
|
||||
apiVersion: v1
|
||||
appVersion: 3.7.12
|
||||
version: 1.26.0
|
||||
version: 1.27.0
|
||||
description: Highly available RabbitMQ cluster, the open source message broker
|
||||
software that implements the Advanced Message Queuing Protocol (AMQP).
|
||||
keywords:
|
||||
|
||||
@@ -66,7 +66,7 @@ and their default values.
|
||||
| Parameter | Description | Default |
|
||||
|------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------|
|
||||
| `existingConfigMap` | Use an existing ConfigMap | `false` |
|
||||
| `existingSecret` | Use an existing secret for password & erlang cookie | `""` |
|
||||
| `existingSecret` | Use an existing secret for password, managementPassword & erlang cookie | `""` |
|
||||
| `extraPlugins` | Additional plugins to add to the default configmap | `rabbitmq_shovel, rabbitmq_shovel_management, rabbitmq_federation, rabbitmq_federation_management,` |
|
||||
| `extraConfig` | Additional configuration to add to default configmap | `{}` |
|
||||
| `advancedConfig` | Additional configuration in classic config format | `""` |
|
||||
@@ -83,7 +83,7 @@ and their default values.
|
||||
| `image.repository` | RabbitMQ container image repository | `rabbitmq` |
|
||||
| `image.tag` | RabbitMQ container image tag | `3.7.12-alpine` |
|
||||
| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` |
|
||||
| `managementPassword` | Management user password. Should be changed from default | `E9R3fjZm4ejFkVFE` |
|
||||
| `managementPassword` | Management user password. | _random 24 character long alphanumeric string_ |
|
||||
| `managementUsername` | Management user with minimal permissions used for health checks | `management` |
|
||||
| `nodeSelector` | Node labels for pod assignment | `{}` |
|
||||
| `persistentVolume.accessMode` | Persistent volume access modes | `[ReadWriteOnce]` |
|
||||
@@ -128,7 +128,7 @@ and their default values.
|
||||
| `rabbitmqMemoryHighWatermark` | Memory high watermark | `256MB` |
|
||||
| `rabbitmqMemoryHighWatermarkType` | Memory high watermark type. Either absolute or relative | `absolute` |
|
||||
| `rabbitmqNodePort` | Node port | `5672` |
|
||||
| `rabbitmqPassword` | RabbitMQ application password | _random 10 character long alphanumeric string_ |
|
||||
| `rabbitmqPassword` | RabbitMQ application password | _random 24 character long alphanumeric string_ |
|
||||
| `rabbitmqSTOMPPlugin.config` | STOMP configuration | `` |
|
||||
| `rabbitmqSTOMPPlugin.enabled` | Enable STOMP plugin | `false` |
|
||||
| `rabbitmqUsername` | RabbitMQ application username | `guest` |
|
||||
@@ -174,12 +174,13 @@ Specify each parameter using the `--set key=value[,key=value]` argument to `helm
|
||||
|
||||
```bash
|
||||
$ helm install --name my-release \
|
||||
--set rabbitmqUsername=admin,rabbitmqPassword=secretpassword,rabbitmqErlangCookie=secretcookie \
|
||||
--set rabbitmqUsername=admin,rabbitmqPassword=secretpassword,managementPassword=anothersecretpassword,rabbitmqErlangCookie=secretcookie \
|
||||
stable/rabbitmq-ha
|
||||
```
|
||||
|
||||
The above command sets the RabbitMQ admin username and password to `admin` and
|
||||
`secretpassword` respectively. Additionally the secure erlang cookie is set to
|
||||
`secretpassword` respectively. Additionally the management user password is set
|
||||
to `anothersecretpassword` and the secure erlang cookie is set to
|
||||
`secretcookie`.
|
||||
|
||||
Alternatively, a YAML file that specifies the values for the parameters can be
|
||||
@@ -243,6 +244,8 @@ the following keys:
|
||||
|
||||
* `rabbitmq-user`
|
||||
* `rabbitmq-password`
|
||||
* `rabbitmq-management-user`
|
||||
* `rabbitmq-management-password`
|
||||
* `rabbitmq-erlang-cookie`
|
||||
* `definitions.json` (the name can be altered by setting the `definitionsSource`)
|
||||
|
||||
|
||||
@@ -2,14 +2,11 @@
|
||||
|
||||
Credentials:
|
||||
|
||||
Username : {{ .Values.rabbitmqUsername -}}
|
||||
{{ if .Values.existingSecret }}
|
||||
Password : $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "rabbitmq-ha.secretName" . }} -o jsonpath="{.data.rabbitmq-password}" | base64 --decode)
|
||||
ErLang Cookie : $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "rabbitmq-ha.secretName" . }} -o jsonpath="{.data.rabbitmq-erlang-cookie}" | base64 --decode)
|
||||
{{ else }}
|
||||
Password : $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "rabbitmq-ha.fullname" . }} -o jsonpath="{.data.rabbitmq-password}" | base64 --decode)
|
||||
ErLang Cookie : $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "rabbitmq-ha.fullname" . }} -o jsonpath="{.data.rabbitmq-erlang-cookie}" | base64 --decode)
|
||||
{{ end }}
|
||||
Username : {{ .Values.rabbitmqUsername }}
|
||||
Password : $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "rabbitmq-ha.secretName" . }} -o jsonpath="{.data.rabbitmq-password}" | base64 --decode)
|
||||
Management username : {{ .Values.managementUsername }}
|
||||
Management password : $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "rabbitmq-ha.secretName" . }} -o jsonpath="{.data.rabbitmq-management-password}" | base64 --decode)
|
||||
ErLang Cookie : $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "rabbitmq-ha.secretName" . }} -o jsonpath="{.data.rabbitmq-erlang-cookie}" | base64 --decode)
|
||||
|
||||
RabbitMQ can be accessed within the cluster on port {{ .Values.rabbitmqNodePort }} at {{ template "rabbitmq-ha.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}
|
||||
|
||||
|
||||
@@ -15,8 +15,12 @@ type: Opaque
|
||||
data:
|
||||
{{- $password := .Values.rabbitmqPassword | default (randAlphaNum 24 | nospace) -}}
|
||||
{{- $_ := set .Values "rabbitmqPassword" $password }}
|
||||
{{- $managementPassword := .Values.managementPassword | default (randAlphaNum 24 | nospace) -}}
|
||||
{{- $_ := set .Values "managementPassword" $managementPassword }}
|
||||
rabbitmq-username: {{ .Values.rabbitmqUsername | b64enc | quote }}
|
||||
rabbitmq-password: {{ .Values.rabbitmqPassword | b64enc | quote }}
|
||||
rabbitmq-management-username: {{ .Values.managementUsername | b64enc | quote }}
|
||||
rabbitmq-management-password: {{ .Values.managementPassword | b64enc | quote }}
|
||||
rabbitmq-erlang-cookie: {{ .Values.rabbitmqErlangCookie | default (randAlphaNum 32) | b64enc | quote }}
|
||||
{{ .Values.definitionsSource }}: {{ include "rabbitmq-ha.definitions" . | b64enc | quote }}
|
||||
{{ end }}
|
||||
|
||||
@@ -101,14 +101,12 @@ spec:
|
||||
protocol: TCP
|
||||
containerPort: 5671
|
||||
{{- end }}
|
||||
{{- $managementCredentials := printf "%s:%s" .Values.managementUsername .Values.managementPassword | b64enc }}
|
||||
{{- $managementHeader := printf "Authorization: Basic %s" $managementCredentials }}
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- 'wget -O - -q --header "{{ $managementHeader }}" http://localhost:15672/api/healthchecks/node | grep -qF "{\"status\":\"ok\"}"'
|
||||
- 'wget -O - -q --header "Authorization: Basic `echo -n \"$RABBIT_MANAGEMENT_USER:$RABBIT_MANAGEMENT_PASSWORD\" | base64`" http://localhost:15672/api/healthchecks/node | grep -qF "{\"status\":\"ok\"}"'
|
||||
initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
|
||||
@@ -118,7 +116,7 @@ spec:
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- 'wget -O - -q --header "{{ $managementHeader }}" http://localhost:15672/api/healthchecks/node | grep -qF "{\"status\":\"ok\"}"'
|
||||
- 'wget -O - -q --header "Authorization: Basic `echo -n \"$RABBIT_MANAGEMENT_USER:$RABBIT_MANAGEMENT_PASSWORD\" | base64`" http://localhost:15672/api/healthchecks/node | grep -qF "{\"status\":\"ok\"}"'
|
||||
initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
|
||||
timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
|
||||
periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
|
||||
@@ -142,6 +140,16 @@ spec:
|
||||
secretKeyRef:
|
||||
name: {{ template "rabbitmq-ha.secretName" . }}
|
||||
key: rabbitmq-erlang-cookie
|
||||
- name: RABBIT_MANAGEMENT_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "rabbitmq-ha.secretName" . }}
|
||||
key: rabbitmq-management-username
|
||||
- name: RABBIT_MANAGEMENT_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "rabbitmq-ha.secretName" . }}
|
||||
key: rabbitmq-management-password
|
||||
{{- if .Values.rabbitmqHipeCompile }}
|
||||
- name: RABBITMQ_HIPE_COMPILE
|
||||
value: {{ .Values.rabbitmqHipeCompile | quote }}
|
||||
|
||||
@@ -6,7 +6,7 @@ rabbitmqUsername: guest
|
||||
|
||||
## RabbitMQ Management user used for health checks
|
||||
managementUsername: management
|
||||
managementPassword: E9R3fjZm4ejFkVFE
|
||||
# managementPassword:
|
||||
|
||||
## Place any additional key/value configuration to add to rabbitmq.conf
|
||||
## Ref: https://www.rabbitmq.com/configure.html#config-items
|
||||
@@ -436,7 +436,7 @@ readinessProbe:
|
||||
timeoutSeconds: 3
|
||||
periodSeconds: 5
|
||||
|
||||
# Specifies an existing secret to be used for RMQ password and Erlang Cookie
|
||||
# Specifies an existing secret to be used for RMQ password, management user password and Erlang Cookie
|
||||
existingSecret: ""
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user