diff --git a/stable/rabbitmq-ha/Chart.yaml b/stable/rabbitmq-ha/Chart.yaml index bc9747a6c8..5011ed11aa 100644 --- a/stable/rabbitmq-ha/Chart.yaml +++ b/stable/rabbitmq-ha/Chart.yaml @@ -1,7 +1,7 @@ name: rabbitmq-ha apiVersion: v1 appVersion: 3.7.12 -version: 1.26.0 +version: 1.27.0 description: Highly available RabbitMQ cluster, the open source message broker software that implements the Advanced Message Queuing Protocol (AMQP). keywords: diff --git a/stable/rabbitmq-ha/README.md b/stable/rabbitmq-ha/README.md index 5a8ea1b20d..e73b62557f 100644 --- a/stable/rabbitmq-ha/README.md +++ b/stable/rabbitmq-ha/README.md @@ -66,7 +66,7 @@ and their default values. | Parameter | Description | Default | |------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------| | `existingConfigMap` | Use an existing ConfigMap | `false` | -| `existingSecret` | Use an existing secret for password & erlang cookie | `""`                               | +| `existingSecret` | Use an existing secret for password, managementPassword & erlang cookie | `""`                               | | `extraPlugins` | Additional plugins to add to the default configmap | `rabbitmq_shovel, rabbitmq_shovel_management, rabbitmq_federation, rabbitmq_federation_management,` | | `extraConfig` | Additional configuration to add to default configmap | `{}` | | `advancedConfig` | Additional configuration in classic config format | `""` | @@ -83,7 +83,7 @@ and their default values. | `image.repository` | RabbitMQ container image repository | `rabbitmq` | | `image.tag` | RabbitMQ container image tag | `3.7.12-alpine` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `managementPassword` | Management user password. Should be changed from default | `E9R3fjZm4ejFkVFE` | +| `managementPassword` | Management user password. | _random 24 character long alphanumeric string_ | | `managementUsername` | Management user with minimal permissions used for health checks | `management` | | `nodeSelector` | Node labels for pod assignment | `{}` | | `persistentVolume.accessMode` | Persistent volume access modes | `[ReadWriteOnce]` | @@ -128,7 +128,7 @@ and their default values. | `rabbitmqMemoryHighWatermark` | Memory high watermark | `256MB` | | `rabbitmqMemoryHighWatermarkType` | Memory high watermark type. Either absolute or relative | `absolute` | | `rabbitmqNodePort` | Node port | `5672` | -| `rabbitmqPassword` | RabbitMQ application password | _random 10 character long alphanumeric string_ | +| `rabbitmqPassword` | RabbitMQ application password | _random 24 character long alphanumeric string_ | | `rabbitmqSTOMPPlugin.config` | STOMP configuration | `` | | `rabbitmqSTOMPPlugin.enabled` | Enable STOMP plugin | `false` | | `rabbitmqUsername` | RabbitMQ application username | `guest` | @@ -174,12 +174,13 @@ Specify each parameter using the `--set key=value[,key=value]` argument to `helm ```bash $ helm install --name my-release \ - --set rabbitmqUsername=admin,rabbitmqPassword=secretpassword,rabbitmqErlangCookie=secretcookie \ + --set rabbitmqUsername=admin,rabbitmqPassword=secretpassword,managementPassword=anothersecretpassword,rabbitmqErlangCookie=secretcookie \ stable/rabbitmq-ha ``` The above command sets the RabbitMQ admin username and password to `admin` and -`secretpassword` respectively. Additionally the secure erlang cookie is set to +`secretpassword` respectively. Additionally the management user password is set +to `anothersecretpassword` and the secure erlang cookie is set to `secretcookie`. Alternatively, a YAML file that specifies the values for the parameters can be @@ -243,6 +244,8 @@ the following keys: * `rabbitmq-user` * `rabbitmq-password` +* `rabbitmq-management-user` +* `rabbitmq-management-password` * `rabbitmq-erlang-cookie` * `definitions.json` (the name can be altered by setting the `definitionsSource`) diff --git a/stable/rabbitmq-ha/templates/NOTES.txt b/stable/rabbitmq-ha/templates/NOTES.txt index 777c187684..d5c97ab3e0 100644 --- a/stable/rabbitmq-ha/templates/NOTES.txt +++ b/stable/rabbitmq-ha/templates/NOTES.txt @@ -2,14 +2,11 @@ Credentials: - Username : {{ .Values.rabbitmqUsername -}} - {{ if .Values.existingSecret }} - Password : $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "rabbitmq-ha.secretName" . }} -o jsonpath="{.data.rabbitmq-password}" | base64 --decode) - ErLang Cookie : $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "rabbitmq-ha.secretName" . }} -o jsonpath="{.data.rabbitmq-erlang-cookie}" | base64 --decode) - {{ else }} - Password : $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "rabbitmq-ha.fullname" . }} -o jsonpath="{.data.rabbitmq-password}" | base64 --decode) - ErLang Cookie : $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "rabbitmq-ha.fullname" . }} -o jsonpath="{.data.rabbitmq-erlang-cookie}" | base64 --decode) - {{ end }} + Username : {{ .Values.rabbitmqUsername }} + Password : $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "rabbitmq-ha.secretName" . }} -o jsonpath="{.data.rabbitmq-password}" | base64 --decode) + Management username : {{ .Values.managementUsername }} + Management password : $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "rabbitmq-ha.secretName" . }} -o jsonpath="{.data.rabbitmq-management-password}" | base64 --decode) + ErLang Cookie : $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "rabbitmq-ha.secretName" . }} -o jsonpath="{.data.rabbitmq-erlang-cookie}" | base64 --decode) RabbitMQ can be accessed within the cluster on port {{ .Values.rabbitmqNodePort }} at {{ template "rabbitmq-ha.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} diff --git a/stable/rabbitmq-ha/templates/secret.yaml b/stable/rabbitmq-ha/templates/secret.yaml index e02cb150ed..b3ad273ef9 100644 --- a/stable/rabbitmq-ha/templates/secret.yaml +++ b/stable/rabbitmq-ha/templates/secret.yaml @@ -15,8 +15,12 @@ type: Opaque data: {{- $password := .Values.rabbitmqPassword | default (randAlphaNum 24 | nospace) -}} {{- $_ := set .Values "rabbitmqPassword" $password }} + {{- $managementPassword := .Values.managementPassword | default (randAlphaNum 24 | nospace) -}} + {{- $_ := set .Values "managementPassword" $managementPassword }} rabbitmq-username: {{ .Values.rabbitmqUsername | b64enc | quote }} rabbitmq-password: {{ .Values.rabbitmqPassword | b64enc | quote }} + rabbitmq-management-username: {{ .Values.managementUsername | b64enc | quote }} + rabbitmq-management-password: {{ .Values.managementPassword | b64enc | quote }} rabbitmq-erlang-cookie: {{ .Values.rabbitmqErlangCookie | default (randAlphaNum 32) | b64enc | quote }} {{ .Values.definitionsSource }}: {{ include "rabbitmq-ha.definitions" . | b64enc | quote }} {{ end }} diff --git a/stable/rabbitmq-ha/templates/statefulset.yaml b/stable/rabbitmq-ha/templates/statefulset.yaml index fa1a1146a1..b1106b40b6 100644 --- a/stable/rabbitmq-ha/templates/statefulset.yaml +++ b/stable/rabbitmq-ha/templates/statefulset.yaml @@ -101,14 +101,12 @@ spec: protocol: TCP containerPort: 5671 {{- end }} - {{- $managementCredentials := printf "%s:%s" .Values.managementUsername .Values.managementPassword | b64enc }} - {{- $managementHeader := printf "Authorization: Basic %s" $managementCredentials }} livenessProbe: exec: command: - /bin/sh - -c - - 'wget -O - -q --header "{{ $managementHeader }}" http://localhost:15672/api/healthchecks/node | grep -qF "{\"status\":\"ok\"}"' + - 'wget -O - -q --header "Authorization: Basic `echo -n \"$RABBIT_MANAGEMENT_USER:$RABBIT_MANAGEMENT_PASSWORD\" | base64`" http://localhost:15672/api/healthchecks/node | grep -qF "{\"status\":\"ok\"}"' initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }} periodSeconds: {{ .Values.livenessProbe.periodSeconds }} timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }} @@ -118,7 +116,7 @@ spec: command: - /bin/sh - -c - - 'wget -O - -q --header "{{ $managementHeader }}" http://localhost:15672/api/healthchecks/node | grep -qF "{\"status\":\"ok\"}"' + - 'wget -O - -q --header "Authorization: Basic `echo -n \"$RABBIT_MANAGEMENT_USER:$RABBIT_MANAGEMENT_PASSWORD\" | base64`" http://localhost:15672/api/healthchecks/node | grep -qF "{\"status\":\"ok\"}"' initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} periodSeconds: {{ .Values.readinessProbe.periodSeconds }} @@ -142,6 +140,16 @@ spec: secretKeyRef: name: {{ template "rabbitmq-ha.secretName" . }} key: rabbitmq-erlang-cookie + - name: RABBIT_MANAGEMENT_USER + valueFrom: + secretKeyRef: + name: {{ template "rabbitmq-ha.secretName" . }} + key: rabbitmq-management-username + - name: RABBIT_MANAGEMENT_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "rabbitmq-ha.secretName" . }} + key: rabbitmq-management-password {{- if .Values.rabbitmqHipeCompile }} - name: RABBITMQ_HIPE_COMPILE value: {{ .Values.rabbitmqHipeCompile | quote }} diff --git a/stable/rabbitmq-ha/values.yaml b/stable/rabbitmq-ha/values.yaml index fa38feb844..f17e5a00b2 100644 --- a/stable/rabbitmq-ha/values.yaml +++ b/stable/rabbitmq-ha/values.yaml @@ -6,7 +6,7 @@ rabbitmqUsername: guest ## RabbitMQ Management user used for health checks managementUsername: management -managementPassword: E9R3fjZm4ejFkVFE +# managementPassword: ## Place any additional key/value configuration to add to rabbitmq.conf ## Ref: https://www.rabbitmq.com/configure.html#config-items @@ -436,7 +436,7 @@ readinessProbe: timeoutSeconds: 3 periodSeconds: 5 -# Specifies an existing secret to be used for RMQ password and Erlang Cookie +# Specifies an existing secret to be used for RMQ password, management user password and Erlang Cookie existingSecret: ""