From cdc09f7dc20b938f6b2712c46ccb45f97b93203c Mon Sep 17 00:00:00 2001 From: matejhasul Date: Tue, 14 May 2019 16:41:15 +0200 Subject: [PATCH] [stable/rabbitmq-ha] Handle management credentials as secret (#13678) * [stable/rabbitmq-ha] Handle management credentials as secret Set management user and password in secret object. Expose credentials to rabbitmq container due to probes. Main disadvantage is that authorization header is computed in each probe instead of only once during helm template evaluation. Signed-off-by: hasul * Remove existingSecret condition from NOTES.txt Signed-off-by: hasul * Bump chart version to prevent conflict Signed-off-by: hasul --- stable/rabbitmq-ha/Chart.yaml | 2 +- stable/rabbitmq-ha/README.md | 13 ++++++++----- stable/rabbitmq-ha/templates/NOTES.txt | 13 +++++-------- stable/rabbitmq-ha/templates/secret.yaml | 4 ++++ stable/rabbitmq-ha/templates/statefulset.yaml | 16 ++++++++++++---- stable/rabbitmq-ha/values.yaml | 4 ++-- 6 files changed, 32 insertions(+), 20 deletions(-) diff --git a/stable/rabbitmq-ha/Chart.yaml b/stable/rabbitmq-ha/Chart.yaml index bc9747a6c8..5011ed11aa 100644 --- a/stable/rabbitmq-ha/Chart.yaml +++ b/stable/rabbitmq-ha/Chart.yaml @@ -1,7 +1,7 @@ name: rabbitmq-ha apiVersion: v1 appVersion: 3.7.12 -version: 1.26.0 +version: 1.27.0 description: Highly available RabbitMQ cluster, the open source message broker software that implements the Advanced Message Queuing Protocol (AMQP). keywords: diff --git a/stable/rabbitmq-ha/README.md b/stable/rabbitmq-ha/README.md index 5a8ea1b20d..e73b62557f 100644 --- a/stable/rabbitmq-ha/README.md +++ b/stable/rabbitmq-ha/README.md @@ -66,7 +66,7 @@ and their default values. | Parameter | Description | Default | |------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------| | `existingConfigMap` | Use an existing ConfigMap | `false` | -| `existingSecret` | Use an existing secret for password & erlang cookie | `""`                               | +| `existingSecret` | Use an existing secret for password, managementPassword & erlang cookie | `""`                               | | `extraPlugins` | Additional plugins to add to the default configmap | `rabbitmq_shovel, rabbitmq_shovel_management, rabbitmq_federation, rabbitmq_federation_management,` | | `extraConfig` | Additional configuration to add to default configmap | `{}` | | `advancedConfig` | Additional configuration in classic config format | `""` | @@ -83,7 +83,7 @@ and their default values. | `image.repository` | RabbitMQ container image repository | `rabbitmq` | | `image.tag` | RabbitMQ container image tag | `3.7.12-alpine` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `managementPassword` | Management user password. Should be changed from default | `E9R3fjZm4ejFkVFE` | +| `managementPassword` | Management user password. | _random 24 character long alphanumeric string_ | | `managementUsername` | Management user with minimal permissions used for health checks | `management` | | `nodeSelector` | Node labels for pod assignment | `{}` | | `persistentVolume.accessMode` | Persistent volume access modes | `[ReadWriteOnce]` | @@ -128,7 +128,7 @@ and their default values. | `rabbitmqMemoryHighWatermark` | Memory high watermark | `256MB` | | `rabbitmqMemoryHighWatermarkType` | Memory high watermark type. Either absolute or relative | `absolute` | | `rabbitmqNodePort` | Node port | `5672` | -| `rabbitmqPassword` | RabbitMQ application password | _random 10 character long alphanumeric string_ | +| `rabbitmqPassword` | RabbitMQ application password | _random 24 character long alphanumeric string_ | | `rabbitmqSTOMPPlugin.config` | STOMP configuration | `` | | `rabbitmqSTOMPPlugin.enabled` | Enable STOMP plugin | `false` | | `rabbitmqUsername` | RabbitMQ application username | `guest` | @@ -174,12 +174,13 @@ Specify each parameter using the `--set key=value[,key=value]` argument to `helm ```bash $ helm install --name my-release \ - --set rabbitmqUsername=admin,rabbitmqPassword=secretpassword,rabbitmqErlangCookie=secretcookie \ + --set rabbitmqUsername=admin,rabbitmqPassword=secretpassword,managementPassword=anothersecretpassword,rabbitmqErlangCookie=secretcookie \ stable/rabbitmq-ha ``` The above command sets the RabbitMQ admin username and password to `admin` and -`secretpassword` respectively. Additionally the secure erlang cookie is set to +`secretpassword` respectively. Additionally the management user password is set +to `anothersecretpassword` and the secure erlang cookie is set to `secretcookie`. Alternatively, a YAML file that specifies the values for the parameters can be @@ -243,6 +244,8 @@ the following keys: * `rabbitmq-user` * `rabbitmq-password` +* `rabbitmq-management-user` +* `rabbitmq-management-password` * `rabbitmq-erlang-cookie` * `definitions.json` (the name can be altered by setting the `definitionsSource`) diff --git a/stable/rabbitmq-ha/templates/NOTES.txt b/stable/rabbitmq-ha/templates/NOTES.txt index 777c187684..d5c97ab3e0 100644 --- a/stable/rabbitmq-ha/templates/NOTES.txt +++ b/stable/rabbitmq-ha/templates/NOTES.txt @@ -2,14 +2,11 @@ Credentials: - Username : {{ .Values.rabbitmqUsername -}} - {{ if .Values.existingSecret }} - Password : $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "rabbitmq-ha.secretName" . }} -o jsonpath="{.data.rabbitmq-password}" | base64 --decode) - ErLang Cookie : $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "rabbitmq-ha.secretName" . }} -o jsonpath="{.data.rabbitmq-erlang-cookie}" | base64 --decode) - {{ else }} - Password : $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "rabbitmq-ha.fullname" . }} -o jsonpath="{.data.rabbitmq-password}" | base64 --decode) - ErLang Cookie : $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "rabbitmq-ha.fullname" . }} -o jsonpath="{.data.rabbitmq-erlang-cookie}" | base64 --decode) - {{ end }} + Username : {{ .Values.rabbitmqUsername }} + Password : $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "rabbitmq-ha.secretName" . }} -o jsonpath="{.data.rabbitmq-password}" | base64 --decode) + Management username : {{ .Values.managementUsername }} + Management password : $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "rabbitmq-ha.secretName" . }} -o jsonpath="{.data.rabbitmq-management-password}" | base64 --decode) + ErLang Cookie : $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "rabbitmq-ha.secretName" . }} -o jsonpath="{.data.rabbitmq-erlang-cookie}" | base64 --decode) RabbitMQ can be accessed within the cluster on port {{ .Values.rabbitmqNodePort }} at {{ template "rabbitmq-ha.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} diff --git a/stable/rabbitmq-ha/templates/secret.yaml b/stable/rabbitmq-ha/templates/secret.yaml index e02cb150ed..b3ad273ef9 100644 --- a/stable/rabbitmq-ha/templates/secret.yaml +++ b/stable/rabbitmq-ha/templates/secret.yaml @@ -15,8 +15,12 @@ type: Opaque data: {{- $password := .Values.rabbitmqPassword | default (randAlphaNum 24 | nospace) -}} {{- $_ := set .Values "rabbitmqPassword" $password }} + {{- $managementPassword := .Values.managementPassword | default (randAlphaNum 24 | nospace) -}} + {{- $_ := set .Values "managementPassword" $managementPassword }} rabbitmq-username: {{ .Values.rabbitmqUsername | b64enc | quote }} rabbitmq-password: {{ .Values.rabbitmqPassword | b64enc | quote }} + rabbitmq-management-username: {{ .Values.managementUsername | b64enc | quote }} + rabbitmq-management-password: {{ .Values.managementPassword | b64enc | quote }} rabbitmq-erlang-cookie: {{ .Values.rabbitmqErlangCookie | default (randAlphaNum 32) | b64enc | quote }} {{ .Values.definitionsSource }}: {{ include "rabbitmq-ha.definitions" . | b64enc | quote }} {{ end }} diff --git a/stable/rabbitmq-ha/templates/statefulset.yaml b/stable/rabbitmq-ha/templates/statefulset.yaml index fa1a1146a1..b1106b40b6 100644 --- a/stable/rabbitmq-ha/templates/statefulset.yaml +++ b/stable/rabbitmq-ha/templates/statefulset.yaml @@ -101,14 +101,12 @@ spec: protocol: TCP containerPort: 5671 {{- end }} - {{- $managementCredentials := printf "%s:%s" .Values.managementUsername .Values.managementPassword | b64enc }} - {{- $managementHeader := printf "Authorization: Basic %s" $managementCredentials }} livenessProbe: exec: command: - /bin/sh - -c - - 'wget -O - -q --header "{{ $managementHeader }}" http://localhost:15672/api/healthchecks/node | grep -qF "{\"status\":\"ok\"}"' + - 'wget -O - -q --header "Authorization: Basic `echo -n \"$RABBIT_MANAGEMENT_USER:$RABBIT_MANAGEMENT_PASSWORD\" | base64`" http://localhost:15672/api/healthchecks/node | grep -qF "{\"status\":\"ok\"}"' initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }} periodSeconds: {{ .Values.livenessProbe.periodSeconds }} timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }} @@ -118,7 +116,7 @@ spec: command: - /bin/sh - -c - - 'wget -O - -q --header "{{ $managementHeader }}" http://localhost:15672/api/healthchecks/node | grep -qF "{\"status\":\"ok\"}"' + - 'wget -O - -q --header "Authorization: Basic `echo -n \"$RABBIT_MANAGEMENT_USER:$RABBIT_MANAGEMENT_PASSWORD\" | base64`" http://localhost:15672/api/healthchecks/node | grep -qF "{\"status\":\"ok\"}"' initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} periodSeconds: {{ .Values.readinessProbe.periodSeconds }} @@ -142,6 +140,16 @@ spec: secretKeyRef: name: {{ template "rabbitmq-ha.secretName" . }} key: rabbitmq-erlang-cookie + - name: RABBIT_MANAGEMENT_USER + valueFrom: + secretKeyRef: + name: {{ template "rabbitmq-ha.secretName" . }} + key: rabbitmq-management-username + - name: RABBIT_MANAGEMENT_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "rabbitmq-ha.secretName" . }} + key: rabbitmq-management-password {{- if .Values.rabbitmqHipeCompile }} - name: RABBITMQ_HIPE_COMPILE value: {{ .Values.rabbitmqHipeCompile | quote }} diff --git a/stable/rabbitmq-ha/values.yaml b/stable/rabbitmq-ha/values.yaml index fa38feb844..f17e5a00b2 100644 --- a/stable/rabbitmq-ha/values.yaml +++ b/stable/rabbitmq-ha/values.yaml @@ -6,7 +6,7 @@ rabbitmqUsername: guest ## RabbitMQ Management user used for health checks managementUsername: management -managementPassword: E9R3fjZm4ejFkVFE +# managementPassword: ## Place any additional key/value configuration to add to rabbitmq.conf ## Ref: https://www.rabbitmq.com/configure.html#config-items @@ -436,7 +436,7 @@ readinessProbe: timeoutSeconds: 3 periodSeconds: 5 -# Specifies an existing secret to be used for RMQ password and Erlang Cookie +# Specifies an existing secret to be used for RMQ password, management user password and Erlang Cookie existingSecret: ""