From db4139cdfd90bbcdebbaa89fdbb013c7f134d21c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafael=20R=C3=ADos=20Saavedra?= Date: Thu, 12 Dec 2019 18:04:32 +0100 Subject: [PATCH] Removes certificates requirements for LDAP+TLS. Fixes health checks when LDAP is used. (#19529) Signed-off-by: Rafael Rios Saavedra --- stable/rabbitmq/Chart.yaml | 2 +- stable/rabbitmq/README.md | 15 +++----------- stable/rabbitmq/templates/configuration.yaml | 4 +--- stable/rabbitmq/templates/ldap-certs.yaml | 19 ------------------ stable/rabbitmq/templates/statefulset.yaml | 16 --------------- stable/rabbitmq/values-production.yaml | 20 +++++++++++++++---- stable/rabbitmq/values.yaml | 21 ++++++++++++++++---- 7 files changed, 38 insertions(+), 59 deletions(-) delete mode 100644 stable/rabbitmq/templates/ldap-certs.yaml diff --git a/stable/rabbitmq/Chart.yaml b/stable/rabbitmq/Chart.yaml index 52f1003559..9f9c60caf4 100644 --- a/stable/rabbitmq/Chart.yaml +++ b/stable/rabbitmq/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: rabbitmq -version: 6.14.2 +version: 6.15.0 appVersion: 3.8.2 description: Open source message broker software that implements the Advanced Message Queuing Protocol (AMQP) keywords: diff --git a/stable/rabbitmq/README.md b/stable/rabbitmq/README.md index 566e3853e6..24f52fa0ba 100644 --- a/stable/rabbitmq/README.md +++ b/stable/rabbitmq/README.md @@ -90,11 +90,7 @@ The following table lists the configurable parameters of the RabbitMQ chart and | `ldap.server` | LDAP server | `""` | | `ldap.port` | LDAP port | `389` | | `ldap.user_dn_pattern` | DN used to bind to LDAP | `cn=${username},dc=example,dc=org` | -| `ldap.tls.enabled` | Enable TLS for LDAP connections | `false` | -| `ldap.tls.caCertificate` | CA certificate for LDAP connections | `nil` | -| `ldap.tls.serverCertificate` | Server certificate for LDAP connections | `nil` | -| `ldap.tls.serverKey` | Server key for LDAP connections | `nil` | -| `ldap.tls.existingSecret` | Existing secret with certificate content to LDAP credentials | `nil` | +| `ldap.tls.enabled` | Enable TLS for LDAP connections | `false` (if set to true, check advancedConfiguration parameter in values.yml) | | `service.type` | Kubernetes Service type | `ClusterIP` | | `service.port` | Amqp port | `5672` | | `service.tlsPort` | Amqp TLS port | `5671` | @@ -353,14 +349,7 @@ LDAP support can be enabled in the chart by specifying the `ldap.` parameters wh - `ldap.server`: LDAP server host. No defaults. - `ldap.port`: LDAP server port. `389`. - `ldap.user_dn_pattern`: DN used to bind to LDAP. `cn=${username},dc=example,dc=org`. - -It's also possible to connect to LDAP servers using TLS. The following parameters allow this configuration: - - `ldap.tls.enabled`: Enable TLS for LDAP connections. Defaults to `false`. -- `ldap.tls.caCertificate`: CA certificate for LDAP connections. No defaults. -- `ldap.tls.serverCertificate`: Server certificate for LDAP connections. No defaults. -- `ldap.tls.serverKey`: Server key for LDAP connections. No defaults. -- `ldap.tls.existingSecret`: Existing secret with certificate content to LDAP credentials. No defaults. For example: @@ -371,6 +360,8 @@ ldap.port="389" ldap.user_dn_pattern="cn=${username},dc=example,dc=org" ``` +If `ldap.tls.enabled` is set to true, consider using `ldap.port=636` and checking the settings in the advancedConfiguration. + ## Persistence The [Bitnami RabbitMQ](https://github.com/bitnami/bitnami-docker-rabbitmq) image stores the RabbitMQ data and configurations at the `/opt/bitnami/rabbitmq/var/lib/rabbitmq/` path of the container. diff --git a/stable/rabbitmq/templates/configuration.yaml b/stable/rabbitmq/templates/configuration.yaml index f983632869..acf71bb72b 100644 --- a/stable/rabbitmq/templates/configuration.yaml +++ b/stable/rabbitmq/templates/configuration.yaml @@ -26,14 +26,12 @@ data: {{- end }} {{- if .Values.ldap.enabled }} auth_backends.1 = rabbit_auth_backend_ldap + auth_backends.2 = internal auth_ldap.servers.1 = {{ .Values.ldap.server }} auth_ldap.port = {{ .Values.ldap.port }} auth_ldap.user_dn_pattern = {{ .Values.ldap.user_dn_pattern }} {{- if .Values.ldap.tls.enabled }} auth_ldap.use_ssl = true - auth_ldap.ssl_options.cacertfile = /opt/bitnami/rabbitmq/certs-ldap/ca_certificate.pem - auth_ldap.ssl_options.certfile = /opt/bitnami/rabbitmq/certs-ldap/server_certificate.pem - auth_ldap.ssl_options.keyfile = /opt/bitnami/rabbitmq/certs-ldap/server_key.pem {{- end }} {{- end }} diff --git a/stable/rabbitmq/templates/ldap-certs.yaml b/stable/rabbitmq/templates/ldap-certs.yaml deleted file mode 100644 index caed3e0605..0000000000 --- a/stable/rabbitmq/templates/ldap-certs.yaml +++ /dev/null @@ -1,19 +0,0 @@ -{{- if and (not .Values.ldap.tls.existingSecret) .Values.ldap.enabled .Values.ldap.tls.enabled }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "rabbitmq.fullname" . }}-ldap-certs - labels: - app: {{ template "rabbitmq.name" . }} - chart: {{ template "rabbitmq.chart" . }} - release: "{{ .Release.Name }}" - heritage: "{{ .Release.Service }}" -type: Opaque -data: - ca_certificate.pem: - {{ required "A valid .Values.ldap.tls.caCertificate entry required!" .Values.ldap.tls.caCertificate | b64enc | quote }} - server_certificate.pem: - {{ required "A valid .Values.ldap.tls.serverCertificate entry required!" .Values.ldap.tls.serverCertificate| b64enc | quote }} - server_key.pem: - {{ required "A valid .Values.ldap.tls.serverKey entry required!" .Values.ldap.tls.serverKey | b64enc | quote }} -{{- end }} diff --git a/stable/rabbitmq/templates/statefulset.yaml b/stable/rabbitmq/templates/statefulset.yaml index f021cf70b1..b3d2e8d510 100644 --- a/stable/rabbitmq/templates/statefulset.yaml +++ b/stable/rabbitmq/templates/statefulset.yaml @@ -115,10 +115,6 @@ spec: - name: {{ template "rabbitmq.fullname" . }}-certs mountPath: /opt/bitnami/rabbitmq/certs {{- end }} - {{- if .Values.ldap.tls.enabled }} - - name: {{ template "rabbitmq.fullname" . }}-ldap-certs - mountPath: /opt/bitnami/rabbitmq/certs-ldap - {{- end }} - name: data mountPath: "{{ .Values.persistence.path }}" {{- if .Values.rabbitmq.loadDefinition.enabled }} @@ -309,18 +305,6 @@ spec: - key: server_key.pem path: server_key.pem {{- end }} - {{- if and .Values.ldap.enabled .Values.ldap.tls.enabled }} - - name: {{ template "rabbitmq.fullname" . }}-ldap-certs - secret: - secretName: {{ if .Values.ldap.tls.existingSecret }}{{ .Values.ldap.tls.existingSecret }}{{- else }}{{ template "rabbitmq.fullname" . }}-ldap-certs{{- end }} - items: - - key: ca_certificate.pem - path: ca_certificate.pem - - key: server_certificate.pem - path: server_certificate.pem - - key: server_key.pem - path: server_key.pem - {{- end }} - name: config-volume configMap: name: {{ template "rabbitmq.fullname" . }}-config diff --git a/stable/rabbitmq/values-production.yaml b/stable/rabbitmq/values-production.yaml index c2fc3c5526..fb9129fb1f 100644 --- a/stable/rabbitmq/values-production.yaml +++ b/stable/rabbitmq/values-production.yaml @@ -145,6 +145,21 @@ rabbitmq: ## Configuration file content: advanced configuration ## Use this as additional configuraton in classic config format (Erlang term configuration format) + ## If you set LDAP with TLS/SSL enabled and you are using self-signed certificates, uncomment these lines. + ## advancedConfiguration: |- + ## [{ + ## rabbitmq_auth_backend_ldap, + ## [{ + ## ssl_options, + ## [{ + ## verify, verify_none + ## }, { + ## fail_if_no_peer_cert, + ## false + ## }] + ## ]} + ## }]. + ## advancedConfiguration: |- ## Enable encryption to rabbitmq @@ -167,11 +182,8 @@ ldap: port: "389" user_dn_pattern: cn=${username},dc=example,dc=org tls: + # If you enabled TLS/SSL you can set advaced options using the advancedConfiguration parameter. enabled: false - caCertificate: |- - serverCertificate: |- - serverKey: |- - # existingSecret: name-of-existing-secret-to-rabbitmq ## Kubernetes service type service: diff --git a/stable/rabbitmq/values.yaml b/stable/rabbitmq/values.yaml index 895bb56bd5..c1217c67c9 100644 --- a/stable/rabbitmq/values.yaml +++ b/stable/rabbitmq/values.yaml @@ -145,6 +145,22 @@ rabbitmq: ## Configuration file content: advanced configuration ## Use this as additional configuraton in classic config format (Erlang term configuration format) + ## + ## If you set LDAP with TLS/SSL enabled and you are using self-signed certificates, uncomment these lines. + ## advancedConfiguration: |- + ## [{ + ## rabbitmq_auth_backend_ldap, + ## [{ + ## ssl_options, + ## [{ + ## verify, verify_none + ## }, { + ## fail_if_no_peer_cert, + ## false + ## }] + ## ]} + ## }]. + ## advancedConfiguration: |- ## Enable encryption to rabbitmq @@ -167,11 +183,8 @@ ldap: port: "389" user_dn_pattern: cn=${username},dc=example,dc=org tls: + # If you enabled TLS/SSL you can set advaced options using the advancedConfiguration parameter. enabled: false - caCertificate: |- - serverCertificate: |- - serverKey: |- - # existingSecret: name-of-existing-secret-to-rabbitmq ## Kubernetes service type service: