github/deprecated-helm-charts
1
0
Fork 0
mirror of https://github.com/helm/charts.git synced 2026-08-21 13:28:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Removes certificates requirements for LDAP+TLS. Fixes health checks when LDAP is used. (#19529)

Browse Source 
Signed-off-by: Rafael Rios Saavedra <rafael.rios.saavedra@gmail.com>
This commit is contained in:
Rafael Ríos Saavedra
2019-12-12 09:04:32 -08:00
committed by Kubernetes Prow Robot
parent ab911e1919
commit db4139cdfd
7 changed files with 38 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stable/rabbitmq/Chart.yaml
+1 -1
View File
@@ -1,6 +1,6 @@
apiVersion: v1
name: rabbitmq
version: 6.14.2
version: 6.15.0
appVersion: 3.8.2
description: Open source message broker software that implements the Advanced Message Queuing Protocol (AMQP)
keywords:
stable/rabbitmq/README.md
+3 -12
View File
@@ -90,11 +90,7 @@ The following table lists the configurable parameters of the RabbitMQ chart and
| `ldap.server` | LDAP server | `""` |
| `ldap.port` | LDAP port | `389` |
| `ldap.user_dn_pattern` | DN used to bind to LDAP | `cn=${username},dc=example,dc=org` |
| `ldap.tls.enabled` | Enable TLS for LDAP connections | `false` |
| `ldap.tls.caCertificate` | CA certificate for LDAP connections | `nil` |
| `ldap.tls.serverCertificate` | Server certificate for LDAP connections | `nil` |
| `ldap.tls.serverKey` | Server key for LDAP connections | `nil` |
| `ldap.tls.existingSecret` | Existing secret with certificate content to LDAP credentials | `nil` |
| `ldap.tls.enabled` | Enable TLS for LDAP connections | `false` (if set to true, check advancedConfiguration parameter in values.yml) |
| `service.type` | Kubernetes Service type | `ClusterIP` |
| `service.port` | Amqp port | `5672` |
| `service.tlsPort` | Amqp TLS port | `5671` |
@@ -353,14 +349,7 @@ LDAP support can be enabled in the chart by specifying the `ldap.` parameters wh
- `ldap.server`: LDAP server host. No defaults.
- `ldap.port`: LDAP server port. `389`.
- `ldap.user_dn_pattern`: DN used to bind to LDAP. `cn=${username},dc=example,dc=org`.
It's also possible to connect to LDAP servers using TLS. The following parameters allow this configuration:
- `ldap.tls.enabled`: Enable TLS for LDAP connections. Defaults to `false`.
- `ldap.tls.caCertificate`: CA certificate for LDAP connections. No defaults.
- `ldap.tls.serverCertificate`: Server certificate for LDAP connections. No defaults.
- `ldap.tls.serverKey`: Server key for LDAP connections. No defaults.
- `ldap.tls.existingSecret`: Existing secret with certificate content to LDAP credentials. No defaults.
For example:
@@ -371,6 +360,8 @@ ldap.port="389"
ldap.user_dn_pattern="cn=${username},dc=example,dc=org"
```
If `ldap.tls.enabled` is set to true, consider using `ldap.port=636` and checking the settings in the advancedConfiguration.
## Persistence
The [Bitnami RabbitMQ](https://github.com/bitnami/bitnami-docker-rabbitmq) image stores the RabbitMQ data and configurations at the `/opt/bitnami/rabbitmq/var/lib/rabbitmq/` path of the container.
stable/rabbitmq/templates/configuration.yaml
+1 -3
View File
@@ -26,14 +26,12 @@ data:
{{- end }}
{{- if .Values.ldap.enabled }}
auth_backends.1 = rabbit_auth_backend_ldap
auth_backends.2 = internal
auth_ldap.servers.1 = {{ .Values.ldap.server }}
auth_ldap.port = {{ .Values.ldap.port }}
auth_ldap.user_dn_pattern = {{ .Values.ldap.user_dn_pattern }}
{{- if .Values.ldap.tls.enabled }}
auth_ldap.use_ssl = true
auth_ldap.ssl_options.cacertfile = /opt/bitnami/rabbitmq/certs-ldap/ca_certificate.pem
auth_ldap.ssl_options.certfile = /opt/bitnami/rabbitmq/certs-ldap/server_certificate.pem
auth_ldap.ssl_options.keyfile = /opt/bitnami/rabbitmq/certs-ldap/server_key.pem
{{- end }}
{{- end }}
stable/rabbitmq/templates/ldap-certs.yaml
-19
View File
@@ -1,19 +0,0 @@
{{- if and (not .Values.ldap.tls.existingSecret) .Values.ldap.enabled .Values.ldap.tls.enabled }}
apiVersion: v1
kind: Secret
metadata:
name: {{ template "rabbitmq.fullname" . }}-ldap-certs
labels:
app: {{ template "rabbitmq.name" . }}
chart: {{ template "rabbitmq.chart" . }}
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
type: Opaque
data:
ca_certificate.pem:
{{ required "A valid .Values.ldap.tls.caCertificate entry required!" .Values.ldap.tls.caCertificate | b64enc | quote }}
server_certificate.pem:
{{ required "A valid .Values.ldap.tls.serverCertificate entry required!" .Values.ldap.tls.serverCertificate| b64enc | quote }}
server_key.pem:
{{ required "A valid .Values.ldap.tls.serverKey entry required!" .Values.ldap.tls.serverKey | b64enc | quote }}
{{- end }}
stable/rabbitmq/templates/statefulset.yaml
-16
View File
@@ -115,10 +115,6 @@ spec:
- name: {{ template "rabbitmq.fullname" . }}-certs
mountPath: /opt/bitnami/rabbitmq/certs
{{- end }}
{{- if .Values.ldap.tls.enabled }}
- name: {{ template "rabbitmq.fullname" . }}-ldap-certs
mountPath: /opt/bitnami/rabbitmq/certs-ldap
{{- end }}
- name: data
mountPath: "{{ .Values.persistence.path }}"
{{- if .Values.rabbitmq.loadDefinition.enabled }}
@@ -309,18 +305,6 @@ spec:
- key: server_key.pem
path: server_key.pem
{{- end }}
{{- if and .Values.ldap.enabled .Values.ldap.tls.enabled }}
- name: {{ template "rabbitmq.fullname" . }}-ldap-certs
secret:
secretName: {{ if .Values.ldap.tls.existingSecret }}{{ .Values.ldap.tls.existingSecret }}{{- else }}{{ template "rabbitmq.fullname" . }}-ldap-certs{{- end }}
items:
- key: ca_certificate.pem
path: ca_certificate.pem
- key: server_certificate.pem
path: server_certificate.pem
- key: server_key.pem
path: server_key.pem
{{- end }}
- name: config-volume
configMap:
name: {{ template "rabbitmq.fullname" . }}-config
stable/rabbitmq/values-production.yaml
+16 -4
View File
@@ -145,6 +145,21 @@ rabbitmq:
## Configuration file content: advanced configuration
## Use this as additional configuraton in classic config format (Erlang term configuration format)
## If you set LDAP with TLS/SSL enabled and you are using self-signed certificates, uncomment these lines.
## advancedConfiguration: |-
## [{
## rabbitmq_auth_backend_ldap,
## [{
## ssl_options,
## [{
## verify, verify_none
## }, {
## fail_if_no_peer_cert,
## false
## }]
## ]}
## }].
##
advancedConfiguration: |-
## Enable encryption to rabbitmq
@@ -167,11 +182,8 @@ ldap:
port: "389"
user_dn_pattern: cn=${username},dc=example,dc=org
tls:
# If you enabled TLS/SSL you can set advaced options using the advancedConfiguration parameter.
enabled: false
caCertificate: |-
serverCertificate: |-
serverKey: |-
# existingSecret: name-of-existing-secret-to-rabbitmq
## Kubernetes service type
service:
stable/rabbitmq/values.yaml
+17 -4
View File
@@ -145,6 +145,22 @@ rabbitmq:
## Configuration file content: advanced configuration
## Use this as additional configuraton in classic config format (Erlang term configuration format)
##
## If you set LDAP with TLS/SSL enabled and you are using self-signed certificates, uncomment these lines.
## advancedConfiguration: |-
## [{
## rabbitmq_auth_backend_ldap,
## [{
## ssl_options,
## [{
## verify, verify_none
## }, {
## fail_if_no_peer_cert,
## false
## }]
## ]}
## }].
##
advancedConfiguration: |-
## Enable encryption to rabbitmq
@@ -167,11 +183,8 @@ ldap:
port: "389"
user_dn_pattern: cn=${username},dc=example,dc=org
tls:
# If you enabled TLS/SSL you can set advaced options using the advancedConfiguration parameter.
enabled: false
caCertificate: |-
serverCertificate: |-
serverKey: |-
# existingSecret: name-of-existing-secret-to-rabbitmq
## Kubernetes service type
service: