mirror of
https://github.com/wahyd4/charts.git
synced 2026-08-09 05:06:29 +10:00
[bitnami/rabbitmq] Set advanced configuration from an existing secret (#14071)
* [rabbitmq] Set advanced configuration from an existing secret * [rabbitmq] fix statefulset template indentation * [rabbitmq] add secret mandatory key to values and readme Signed-off-by: Francisco Aguiar <FranAguiar@users.noreply.github.com>
This commit is contained in:
Francisco Aguiar
@@ -23,4 +23,4 @@ name: rabbitmq
|
||||
sources:
|
||||
- https://github.com/bitnami/containers/tree/main/bitnami/rabbitmq
|
||||
- https://www.rabbitmq.com
|
||||
version: 11.2.2
|
||||
version: 11.3.0
|
||||
|
||||
+95
-94
@@ -76,100 +76,101 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
|
||||
### Common parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- |
|
||||
| `nameOverride` | String to partially override rabbitmq.fullname template (will maintain the release name) | `""` |
|
||||
| `fullnameOverride` | String to fully override rabbitmq.fullname template | `""` |
|
||||
| `namespaceOverride` | String to fully override common.names.namespace | `""` |
|
||||
| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` |
|
||||
| `clusterDomain` | Kubernetes Cluster Domain | `cluster.local` |
|
||||
| `extraDeploy` | Array of extra objects to deploy with the release | `[]` |
|
||||
| `commonAnnotations` | Annotations to add to all deployed objects | `{}` |
|
||||
| `servicenameOverride` | String to partially override headless service name | `""` |
|
||||
| `commonLabels` | Labels to add to all deployed objects | `{}` |
|
||||
| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` |
|
||||
| `diagnosticMode.command` | Command to override all containers in the deployment | `["sleep"]` |
|
||||
| `diagnosticMode.args` | Args to override all containers in the deployment | `["infinity"]` |
|
||||
| `hostAliases` | Deployment pod host aliases | `[]` |
|
||||
| `dnsPolicy` | DNS Policy for pod | `""` |
|
||||
| `dnsConfig` | DNS Configuration pod | `{}` |
|
||||
| `auth.username` | RabbitMQ application username | `user` |
|
||||
| `auth.password` | RabbitMQ application password | `""` |
|
||||
| `auth.securePassword` | Whether to set the RabbitMQ password securely. This is incompatible with loading external RabbitMQ definitions and 'true' when not setting the auth.password parameter. | `true` |
|
||||
| `auth.existingPasswordSecret` | Existing secret with RabbitMQ credentials (must contain a value for `rabbitmq-password` key) | `""` |
|
||||
| `auth.erlangCookie` | Erlang cookie to determine whether different nodes are allowed to communicate with each other | `""` |
|
||||
| `auth.existingErlangSecret` | Existing secret with RabbitMQ Erlang cookie (must contain a value for `rabbitmq-erlang-cookie` key) | `""` |
|
||||
| `auth.tls.enabled` | Enable TLS support on RabbitMQ | `false` |
|
||||
| `auth.tls.autoGenerated` | Generate automatically self-signed TLS certificates | `false` |
|
||||
| `auth.tls.failIfNoPeerCert` | When set to true, TLS connection will be rejected if client fails to provide a certificate | `true` |
|
||||
| `auth.tls.sslOptionsVerify` | Should [peer verification](https://www.rabbitmq.com/ssl.html#peer-verification) be enabled? | `verify_peer` |
|
||||
| `auth.tls.caCertificate` | Certificate Authority (CA) bundle content | `""` |
|
||||
| `auth.tls.serverCertificate` | Server certificate content | `""` |
|
||||
| `auth.tls.serverKey` | Server private key content | `""` |
|
||||
| `auth.tls.existingSecret` | Existing secret with certificate content to RabbitMQ credentials | `""` |
|
||||
| `auth.tls.existingSecretFullChain` | Whether or not the existing secret contains the full chain in the certificate (`tls.crt`). Will be used in place of `ca.cert` if `true`. | `false` |
|
||||
| `logs` | Path of the RabbitMQ server's Erlang log file. Value for the `RABBITMQ_LOGS` environment variable | `-` |
|
||||
| `ulimitNofiles` | RabbitMQ Max File Descriptors | `65536` |
|
||||
| `maxAvailableSchedulers` | RabbitMQ maximum available scheduler threads | `""` |
|
||||
| `onlineSchedulers` | RabbitMQ online scheduler threads | `""` |
|
||||
| `memoryHighWatermark.enabled` | Enable configuring Memory high watermark on RabbitMQ | `false` |
|
||||
| `memoryHighWatermark.type` | Memory high watermark type. Either `absolute` or `relative` | `relative` |
|
||||
| `memoryHighWatermark.value` | Memory high watermark value | `0.4` |
|
||||
| `plugins` | List of default plugins to enable (should only be altered to remove defaults; for additional plugins use `extraPlugins`) | `rabbitmq_management rabbitmq_peer_discovery_k8s` |
|
||||
| `communityPlugins` | List of Community plugins (URLs) to be downloaded during container initialization | `""` |
|
||||
| `extraPlugins` | Extra plugins to enable (single string containing a space-separated list) | `rabbitmq_auth_backend_ldap` |
|
||||
| `clustering.enabled` | Enable RabbitMQ clustering | `true` |
|
||||
| `clustering.addressType` | Switch clustering mode. Either `ip` or `hostname` | `hostname` |
|
||||
| `clustering.rebalance` | Rebalance master for queues in cluster when new replica is created | `false` |
|
||||
| `clustering.forceBoot` | Force boot of an unexpectedly shut down cluster (in an unexpected order). | `false` |
|
||||
| `clustering.partitionHandling` | Switch Partition Handling Strategy. Either `autoheal` or `pause-minority` or `pause-if-all-down` or `ignore` | `autoheal` |
|
||||
| `loadDefinition.enabled` | Enable loading a RabbitMQ definitions file to configure RabbitMQ | `false` |
|
||||
| `loadDefinition.file` | Name of the definitions file | `/app/load_definition.json` |
|
||||
| `loadDefinition.existingSecret` | Existing secret with the load definitions file | `""` |
|
||||
| `command` | Override default container command (useful when using custom images) | `[]` |
|
||||
| `args` | Override default container args (useful when using custom images) | `[]` |
|
||||
| `lifecycleHooks` | Overwrite livecycle for the RabbitMQ container(s) to automate configuration before or after startup | `{}` |
|
||||
| `terminationGracePeriodSeconds` | Default duration in seconds k8s waits for container to exit before sending kill signal. | `120` |
|
||||
| `extraEnvVars` | Extra environment variables to add to RabbitMQ pods | `[]` |
|
||||
| `extraEnvVarsCM` | Name of existing ConfigMap containing extra environment variables | `""` |
|
||||
| `extraEnvVarsSecret` | Name of existing Secret containing extra environment variables (in case of sensitive data) | `""` |
|
||||
| `containerPorts.amqp` | | `5672` |
|
||||
| `containerPorts.amqpTls` | | `5671` |
|
||||
| `containerPorts.dist` | | `25672` |
|
||||
| `containerPorts.manager` | | `15672` |
|
||||
| `containerPorts.epmd` | | `4369` |
|
||||
| `containerPorts.metrics` | | `9419` |
|
||||
| `initScripts` | Dictionary of init scripts. Evaluated as a template. | `{}` |
|
||||
| `initScriptsCM` | ConfigMap with the init scripts. Evaluated as a template. | `""` |
|
||||
| `initScriptsSecret` | Secret containing `/docker-entrypoint-initdb.d` scripts to be executed at initialization time that contain sensitive data. Evaluated as a template. | `""` |
|
||||
| `extraContainerPorts` | Extra ports to be included in container spec, primarily informational | `[]` |
|
||||
| `configuration` | RabbitMQ Configuration file content: required cluster configuration | `""` |
|
||||
| `extraConfiguration` | Configuration file content: extra configuration to be appended to RabbitMQ configuration | `""` |
|
||||
| `advancedConfiguration` | Configuration file content: advanced configuration | `""` |
|
||||
| `ldap.enabled` | Enable LDAP support | `false` |
|
||||
| `ldap.uri` | LDAP connection string. | `""` |
|
||||
| `ldap.servers` | List of LDAP servers hostnames. This is valid only if ldap.uri is not set | `[]` |
|
||||
| `ldap.port` | LDAP servers port. This is valid only if ldap.uri is not set | `""` |
|
||||
| `ldap.userDnPattern` | Pattern used to translate the provided username into a value to be used for the LDAP bind. | `""` |
|
||||
| `ldap.binddn` | DN of the account used to search in the LDAP server. | `""` |
|
||||
| `ldap.bindpw` | Password for binddn account. | `""` |
|
||||
| `ldap.basedn` | Base DN path where binddn account will search for the users. | `""` |
|
||||
| `ldap.uidField` | Field used to match with the user name (uid, samAccountName, cn, etc). It matches with 'dn_lookup_attribute' in RabbitMQ configuration | `""` |
|
||||
| `ldap.uidField` | Field used to match with the user name (uid, samAccountName, cn, etc). It matches with 'dn_lookup_attribute' in RabbitMQ configuration | `""` |
|
||||
| `ldap.authorisationEnabled` | Enable LDAP authorisation. Please set 'advancedConfiguration' with tag, topic, resources and vhost mappings | `false` |
|
||||
| `ldap.tls.enabled` | Enabled TLS configuration. | `false` |
|
||||
| `ldap.tls.startTls` | Use STARTTLS instead of LDAPS. | `false` |
|
||||
| `ldap.tls.skipVerify` | Skip any SSL verification (hostanames or certificates) | `false` |
|
||||
| `ldap.tls.verify` | Verify connection. Valid values are 'verify_peer' or 'verify_none' | `verify_peer` |
|
||||
| `ldap.tls.certificatesMountPath` | Where LDAP certifcates are mounted. | `/opt/bitnami/rabbitmq/ldap/certs` |
|
||||
| `ldap.tls.certificatesSecret` | Secret with LDAP certificates. | `""` |
|
||||
| `ldap.tls.CAFilename` | CA certificate filename. Should match with the CA entry key in the ldap.tls.certificatesSecret. | `""` |
|
||||
| `ldap.tls.certFilename` | Client certificate filename to authenticate against the LDAP server. Should match with certificate the entry key in the ldap.tls.certificatesSecret. | `""` |
|
||||
| `ldap.tls.certKeyFilename` | Client Key filename to authenticate against the LDAP server. Should match with certificate the entry key in the ldap.tls.certificatesSecret. | `""` |
|
||||
| `extraVolumeMounts` | Optionally specify extra list of additional volumeMounts | `[]` |
|
||||
| `extraVolumes` | Optionally specify extra list of additional volumes . | `[]` |
|
||||
| `extraSecrets` | Optionally specify extra secrets to be created by the chart. | `{}` |
|
||||
| `extraSecretsPrependReleaseName` | Set this flag to true if extraSecrets should be created with <release-name> prepended. | `false` |
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- |
|
||||
| `nameOverride` | String to partially override rabbitmq.fullname template (will maintain the release name) | `""` |
|
||||
| `fullnameOverride` | String to fully override rabbitmq.fullname template | `""` |
|
||||
| `namespaceOverride` | String to fully override common.names.namespace | `""` |
|
||||
| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` |
|
||||
| `clusterDomain` | Kubernetes Cluster Domain | `cluster.local` |
|
||||
| `extraDeploy` | Array of extra objects to deploy with the release | `[]` |
|
||||
| `commonAnnotations` | Annotations to add to all deployed objects | `{}` |
|
||||
| `servicenameOverride` | String to partially override headless service name | `""` |
|
||||
| `commonLabels` | Labels to add to all deployed objects | `{}` |
|
||||
| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` |
|
||||
| `diagnosticMode.command` | Command to override all containers in the deployment | `["sleep"]` |
|
||||
| `diagnosticMode.args` | Args to override all containers in the deployment | `["infinity"]` |
|
||||
| `hostAliases` | Deployment pod host aliases | `[]` |
|
||||
| `dnsPolicy` | DNS Policy for pod | `""` |
|
||||
| `dnsConfig` | DNS Configuration pod | `{}` |
|
||||
| `auth.username` | RabbitMQ application username | `user` |
|
||||
| `auth.password` | RabbitMQ application password | `""` |
|
||||
| `auth.securePassword` | Whether to set the RabbitMQ password securely. This is incompatible with loading external RabbitMQ definitions and 'true' when not setting the auth.password parameter. | `true` |
|
||||
| `auth.existingPasswordSecret` | Existing secret with RabbitMQ credentials (must contain a value for `rabbitmq-password` key) | `""` |
|
||||
| `auth.erlangCookie` | Erlang cookie to determine whether different nodes are allowed to communicate with each other | `""` |
|
||||
| `auth.existingErlangSecret` | Existing secret with RabbitMQ Erlang cookie (must contain a value for `rabbitmq-erlang-cookie` key) | `""` |
|
||||
| `auth.tls.enabled` | Enable TLS support on RabbitMQ | `false` |
|
||||
| `auth.tls.autoGenerated` | Generate automatically self-signed TLS certificates | `false` |
|
||||
| `auth.tls.failIfNoPeerCert` | When set to true, TLS connection will be rejected if client fails to provide a certificate | `true` |
|
||||
| `auth.tls.sslOptionsVerify` | Should [peer verification](https://www.rabbitmq.com/ssl.html#peer-verification) be enabled? | `verify_peer` |
|
||||
| `auth.tls.caCertificate` | Certificate Authority (CA) bundle content | `""` |
|
||||
| `auth.tls.serverCertificate` | Server certificate content | `""` |
|
||||
| `auth.tls.serverKey` | Server private key content | `""` |
|
||||
| `auth.tls.existingSecret` | Existing secret with certificate content to RabbitMQ credentials | `""` |
|
||||
| `auth.tls.existingSecretFullChain` | Whether or not the existing secret contains the full chain in the certificate (`tls.crt`). Will be used in place of `ca.cert` if `true`. | `false` |
|
||||
| `logs` | Path of the RabbitMQ server's Erlang log file. Value for the `RABBITMQ_LOGS` environment variable | `-` |
|
||||
| `ulimitNofiles` | RabbitMQ Max File Descriptors | `65536` |
|
||||
| `maxAvailableSchedulers` | RabbitMQ maximum available scheduler threads | `""` |
|
||||
| `onlineSchedulers` | RabbitMQ online scheduler threads | `""` |
|
||||
| `memoryHighWatermark.enabled` | Enable configuring Memory high watermark on RabbitMQ | `false` |
|
||||
| `memoryHighWatermark.type` | Memory high watermark type. Either `absolute` or `relative` | `relative` |
|
||||
| `memoryHighWatermark.value` | Memory high watermark value | `0.4` |
|
||||
| `plugins` | List of default plugins to enable (should only be altered to remove defaults; for additional plugins use `extraPlugins`) | `rabbitmq_management rabbitmq_peer_discovery_k8s` |
|
||||
| `communityPlugins` | List of Community plugins (URLs) to be downloaded during container initialization | `""` |
|
||||
| `extraPlugins` | Extra plugins to enable (single string containing a space-separated list) | `rabbitmq_auth_backend_ldap` |
|
||||
| `clustering.enabled` | Enable RabbitMQ clustering | `true` |
|
||||
| `clustering.addressType` | Switch clustering mode. Either `ip` or `hostname` | `hostname` |
|
||||
| `clustering.rebalance` | Rebalance master for queues in cluster when new replica is created | `false` |
|
||||
| `clustering.forceBoot` | Force boot of an unexpectedly shut down cluster (in an unexpected order). | `false` |
|
||||
| `clustering.partitionHandling` | Switch Partition Handling Strategy. Either `autoheal` or `pause-minority` or `pause-if-all-down` or `ignore` | `autoheal` |
|
||||
| `loadDefinition.enabled` | Enable loading a RabbitMQ definitions file to configure RabbitMQ | `false` |
|
||||
| `loadDefinition.file` | Name of the definitions file | `/app/load_definition.json` |
|
||||
| `loadDefinition.existingSecret` | Existing secret with the load definitions file | `""` |
|
||||
| `command` | Override default container command (useful when using custom images) | `[]` |
|
||||
| `args` | Override default container args (useful when using custom images) | `[]` |
|
||||
| `lifecycleHooks` | Overwrite livecycle for the RabbitMQ container(s) to automate configuration before or after startup | `{}` |
|
||||
| `terminationGracePeriodSeconds` | Default duration in seconds k8s waits for container to exit before sending kill signal. | `120` |
|
||||
| `extraEnvVars` | Extra environment variables to add to RabbitMQ pods | `[]` |
|
||||
| `extraEnvVarsCM` | Name of existing ConfigMap containing extra environment variables | `""` |
|
||||
| `extraEnvVarsSecret` | Name of existing Secret containing extra environment variables (in case of sensitive data) | `""` |
|
||||
| `containerPorts.amqp` | | `5672` |
|
||||
| `containerPorts.amqpTls` | | `5671` |
|
||||
| `containerPorts.dist` | | `25672` |
|
||||
| `containerPorts.manager` | | `15672` |
|
||||
| `containerPorts.epmd` | | `4369` |
|
||||
| `containerPorts.metrics` | | `9419` |
|
||||
| `initScripts` | Dictionary of init scripts. Evaluated as a template. | `{}` |
|
||||
| `initScriptsCM` | ConfigMap with the init scripts. Evaluated as a template. | `""` |
|
||||
| `initScriptsSecret` | Secret containing `/docker-entrypoint-initdb.d` scripts to be executed at initialization time that contain sensitive data. Evaluated as a template. | `""` |
|
||||
| `extraContainerPorts` | Extra ports to be included in container spec, primarily informational | `[]` |
|
||||
| `configuration` | RabbitMQ Configuration file content: required cluster configuration | `""` |
|
||||
| `extraConfiguration` | Configuration file content: extra configuration to be appended to RabbitMQ configuration | `""` |
|
||||
| `advancedConfiguration` | Configuration file content: advanced configuration | `""` |
|
||||
| `advancedConfigurationExistingSecret` | Existing secret with the advanced configuration file (must contain a key `advanced.config`). | `""` |
|
||||
| `ldap.enabled` | Enable LDAP support | `false` |
|
||||
| `ldap.uri` | LDAP connection string. | `""` |
|
||||
| `ldap.servers` | List of LDAP servers hostnames. This is valid only if ldap.uri is not set | `[]` |
|
||||
| `ldap.port` | LDAP servers port. This is valid only if ldap.uri is not set | `""` |
|
||||
| `ldap.userDnPattern` | Pattern used to translate the provided username into a value to be used for the LDAP bind. | `""` |
|
||||
| `ldap.binddn` | DN of the account used to search in the LDAP server. | `""` |
|
||||
| `ldap.bindpw` | Password for binddn account. | `""` |
|
||||
| `ldap.basedn` | Base DN path where binddn account will search for the users. | `""` |
|
||||
| `ldap.uidField` | Field used to match with the user name (uid, samAccountName, cn, etc). It matches with 'dn_lookup_attribute' in RabbitMQ configuration | `""` |
|
||||
| `ldap.uidField` | Field used to match with the user name (uid, samAccountName, cn, etc). It matches with 'dn_lookup_attribute' in RabbitMQ configuration | `""` |
|
||||
| `ldap.authorisationEnabled` | Enable LDAP authorisation. Please set 'advancedConfiguration' with tag, topic, resources and vhost mappings | `false` |
|
||||
| `ldap.tls.enabled` | Enabled TLS configuration. | `false` |
|
||||
| `ldap.tls.startTls` | Use STARTTLS instead of LDAPS. | `false` |
|
||||
| `ldap.tls.skipVerify` | Skip any SSL verification (hostanames or certificates) | `false` |
|
||||
| `ldap.tls.verify` | Verify connection. Valid values are 'verify_peer' or 'verify_none' | `verify_peer` |
|
||||
| `ldap.tls.certificatesMountPath` | Where LDAP certifcates are mounted. | `/opt/bitnami/rabbitmq/ldap/certs` |
|
||||
| `ldap.tls.certificatesSecret` | Secret with LDAP certificates. | `""` |
|
||||
| `ldap.tls.CAFilename` | CA certificate filename. Should match with the CA entry key in the ldap.tls.certificatesSecret. | `""` |
|
||||
| `ldap.tls.certFilename` | Client certificate filename to authenticate against the LDAP server. Should match with certificate the entry key in the ldap.tls.certificatesSecret. | `""` |
|
||||
| `ldap.tls.certKeyFilename` | Client Key filename to authenticate against the LDAP server. Should match with certificate the entry key in the ldap.tls.certificatesSecret. | `""` |
|
||||
| `extraVolumeMounts` | Optionally specify extra list of additional volumeMounts | `[]` |
|
||||
| `extraVolumes` | Optionally specify extra list of additional volumes . | `[]` |
|
||||
| `extraSecrets` | Optionally specify extra secrets to be created by the chart. | `{}` |
|
||||
| `extraSecretsPrependReleaseName` | Set this flag to true if extraSecrets should be created with <release-name> prepended. | `false` |
|
||||
|
||||
|
||||
### Statefulset parameters
|
||||
|
||||
@@ -360,14 +360,13 @@ spec:
|
||||
secretName: {{ .Values.ldap.tls.certificatesSecret }}
|
||||
{{- end }}
|
||||
- name: configuration
|
||||
secret:
|
||||
secretName: {{ printf "%s-config" (include "common.names.fullname" .) }}
|
||||
items:
|
||||
- key: rabbitmq.conf
|
||||
path: rabbitmq.conf
|
||||
{{- if .Values.advancedConfiguration }}
|
||||
- key: advanced.config
|
||||
path: advanced.config
|
||||
projected:
|
||||
sources:
|
||||
- secret:
|
||||
name: {{ printf "%s-config" (include "common.names.fullname" .) }}
|
||||
{{- if and .Values.advancedConfigurationExistingSecret (not .Values.advancedConfiguration) }}
|
||||
- secret:
|
||||
name: {{ tpl .Values.advancedConfigurationExistingSecret . | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.loadDefinition.enabled }}
|
||||
- name: load-definition-volume
|
||||
|
||||
@@ -435,8 +435,17 @@ extraConfiguration: |-
|
||||
## {management, {constant, true}}]}
|
||||
## ]}].
|
||||
##
|
||||
## If both, advancedConfiguration and advancedConfigurationExistingSecret are set, then advancedConfiguration
|
||||
## will be used instead of the secret.
|
||||
#
|
||||
advancedConfiguration: |-
|
||||
|
||||
## @param advancedConfigurationExistingSecret Existing secret with the advanced configuration file (must contain a key `advanced.config`).
|
||||
## Use this as additional configuration in classic config format (Erlang term configuration format) as in advancedConfiguration
|
||||
## Do not use in combination with advancedConfiguration, will be ignored
|
||||
##
|
||||
advancedConfigurationExistingSecret: ""
|
||||
|
||||
## LDAP configuration
|
||||
##
|
||||
ldap:
|
||||
|
||||
Reference in New Issue
Block a user