From a1b42f2ae620c6c91c7f152787191829b1ec2522 Mon Sep 17 00:00:00 2001 From: Francisco Aguiar Date: Fri, 23 Dec 2022 14:44:20 +0000 Subject: [PATCH] [bitnami/rabbitmq] Set advanced configuration from an existing secret (#14071) * [rabbitmq] Set advanced configuration from an existing secret * [rabbitmq] fix statefulset template indentation * [rabbitmq] add secret mandatory key to values and readme Signed-off-by: Francisco Aguiar --- bitnami/rabbitmq/Chart.yaml | 2 +- bitnami/rabbitmq/README.md | 189 ++++++++++---------- bitnami/rabbitmq/templates/statefulset.yaml | 15 +- bitnami/rabbitmq/values.yaml | 9 + 4 files changed, 112 insertions(+), 103 deletions(-) diff --git a/bitnami/rabbitmq/Chart.yaml b/bitnami/rabbitmq/Chart.yaml index a3f0cc770..d3418ae04 100644 --- a/bitnami/rabbitmq/Chart.yaml +++ b/bitnami/rabbitmq/Chart.yaml @@ -23,4 +23,4 @@ name: rabbitmq sources: - https://github.com/bitnami/containers/tree/main/bitnami/rabbitmq - https://www.rabbitmq.com -version: 11.2.2 +version: 11.3.0 diff --git a/bitnami/rabbitmq/README.md b/bitnami/rabbitmq/README.md index 711ebfff8..890f4b2f2 100644 --- a/bitnami/rabbitmq/README.md +++ b/bitnami/rabbitmq/README.md @@ -76,100 +76,101 @@ The command removes all the Kubernetes components associated with the chart and ### Common parameters -| Name | Description | Value | -| ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- | -| `nameOverride` | String to partially override rabbitmq.fullname template (will maintain the release name) | `""` | -| `fullnameOverride` | String to fully override rabbitmq.fullname template | `""` | -| `namespaceOverride` | String to fully override common.names.namespace | `""` | -| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` | -| `clusterDomain` | Kubernetes Cluster Domain | `cluster.local` | -| `extraDeploy` | Array of extra objects to deploy with the release | `[]` | -| `commonAnnotations` | Annotations to add to all deployed objects | `{}` | -| `servicenameOverride` | String to partially override headless service name | `""` | -| `commonLabels` | Labels to add to all deployed objects | `{}` | -| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | -| `diagnosticMode.command` | Command to override all containers in the deployment | `["sleep"]` | -| `diagnosticMode.args` | Args to override all containers in the deployment | `["infinity"]` | -| `hostAliases` | Deployment pod host aliases | `[]` | -| `dnsPolicy` | DNS Policy for pod | `""` | -| `dnsConfig` | DNS Configuration pod | `{}` | -| `auth.username` | RabbitMQ application username | `user` | -| `auth.password` | RabbitMQ application password | `""` | -| `auth.securePassword` | Whether to set the RabbitMQ password securely. This is incompatible with loading external RabbitMQ definitions and 'true' when not setting the auth.password parameter. | `true` | -| `auth.existingPasswordSecret` | Existing secret with RabbitMQ credentials (must contain a value for `rabbitmq-password` key) | `""` | -| `auth.erlangCookie` | Erlang cookie to determine whether different nodes are allowed to communicate with each other | `""` | -| `auth.existingErlangSecret` | Existing secret with RabbitMQ Erlang cookie (must contain a value for `rabbitmq-erlang-cookie` key) | `""` | -| `auth.tls.enabled` | Enable TLS support on RabbitMQ | `false` | -| `auth.tls.autoGenerated` | Generate automatically self-signed TLS certificates | `false` | -| `auth.tls.failIfNoPeerCert` | When set to true, TLS connection will be rejected if client fails to provide a certificate | `true` | -| `auth.tls.sslOptionsVerify` | Should [peer verification](https://www.rabbitmq.com/ssl.html#peer-verification) be enabled? | `verify_peer` | -| `auth.tls.caCertificate` | Certificate Authority (CA) bundle content | `""` | -| `auth.tls.serverCertificate` | Server certificate content | `""` | -| `auth.tls.serverKey` | Server private key content | `""` | -| `auth.tls.existingSecret` | Existing secret with certificate content to RabbitMQ credentials | `""` | -| `auth.tls.existingSecretFullChain` | Whether or not the existing secret contains the full chain in the certificate (`tls.crt`). Will be used in place of `ca.cert` if `true`. | `false` | -| `logs` | Path of the RabbitMQ server's Erlang log file. Value for the `RABBITMQ_LOGS` environment variable | `-` | -| `ulimitNofiles` | RabbitMQ Max File Descriptors | `65536` | -| `maxAvailableSchedulers` | RabbitMQ maximum available scheduler threads | `""` | -| `onlineSchedulers` | RabbitMQ online scheduler threads | `""` | -| `memoryHighWatermark.enabled` | Enable configuring Memory high watermark on RabbitMQ | `false` | -| `memoryHighWatermark.type` | Memory high watermark type. Either `absolute` or `relative` | `relative` | -| `memoryHighWatermark.value` | Memory high watermark value | `0.4` | -| `plugins` | List of default plugins to enable (should only be altered to remove defaults; for additional plugins use `extraPlugins`) | `rabbitmq_management rabbitmq_peer_discovery_k8s` | -| `communityPlugins` | List of Community plugins (URLs) to be downloaded during container initialization | `""` | -| `extraPlugins` | Extra plugins to enable (single string containing a space-separated list) | `rabbitmq_auth_backend_ldap` | -| `clustering.enabled` | Enable RabbitMQ clustering | `true` | -| `clustering.addressType` | Switch clustering mode. Either `ip` or `hostname` | `hostname` | -| `clustering.rebalance` | Rebalance master for queues in cluster when new replica is created | `false` | -| `clustering.forceBoot` | Force boot of an unexpectedly shut down cluster (in an unexpected order). | `false` | -| `clustering.partitionHandling` | Switch Partition Handling Strategy. Either `autoheal` or `pause-minority` or `pause-if-all-down` or `ignore` | `autoheal` | -| `loadDefinition.enabled` | Enable loading a RabbitMQ definitions file to configure RabbitMQ | `false` | -| `loadDefinition.file` | Name of the definitions file | `/app/load_definition.json` | -| `loadDefinition.existingSecret` | Existing secret with the load definitions file | `""` | -| `command` | Override default container command (useful when using custom images) | `[]` | -| `args` | Override default container args (useful when using custom images) | `[]` | -| `lifecycleHooks` | Overwrite livecycle for the RabbitMQ container(s) to automate configuration before or after startup | `{}` | -| `terminationGracePeriodSeconds` | Default duration in seconds k8s waits for container to exit before sending kill signal. | `120` | -| `extraEnvVars` | Extra environment variables to add to RabbitMQ pods | `[]` | -| `extraEnvVarsCM` | Name of existing ConfigMap containing extra environment variables | `""` | -| `extraEnvVarsSecret` | Name of existing Secret containing extra environment variables (in case of sensitive data) | `""` | -| `containerPorts.amqp` | | `5672` | -| `containerPorts.amqpTls` | | `5671` | -| `containerPorts.dist` | | `25672` | -| `containerPorts.manager` | | `15672` | -| `containerPorts.epmd` | | `4369` | -| `containerPorts.metrics` | | `9419` | -| `initScripts` | Dictionary of init scripts. Evaluated as a template. | `{}` | -| `initScriptsCM` | ConfigMap with the init scripts. Evaluated as a template. | `""` | -| `initScriptsSecret` | Secret containing `/docker-entrypoint-initdb.d` scripts to be executed at initialization time that contain sensitive data. Evaluated as a template. | `""` | -| `extraContainerPorts` | Extra ports to be included in container spec, primarily informational | `[]` | -| `configuration` | RabbitMQ Configuration file content: required cluster configuration | `""` | -| `extraConfiguration` | Configuration file content: extra configuration to be appended to RabbitMQ configuration | `""` | -| `advancedConfiguration` | Configuration file content: advanced configuration | `""` | -| `ldap.enabled` | Enable LDAP support | `false` | -| `ldap.uri` | LDAP connection string. | `""` | -| `ldap.servers` | List of LDAP servers hostnames. This is valid only if ldap.uri is not set | `[]` | -| `ldap.port` | LDAP servers port. This is valid only if ldap.uri is not set | `""` | -| `ldap.userDnPattern` | Pattern used to translate the provided username into a value to be used for the LDAP bind. | `""` | -| `ldap.binddn` | DN of the account used to search in the LDAP server. | `""` | -| `ldap.bindpw` | Password for binddn account. | `""` | -| `ldap.basedn` | Base DN path where binddn account will search for the users. | `""` | -| `ldap.uidField` | Field used to match with the user name (uid, samAccountName, cn, etc). It matches with 'dn_lookup_attribute' in RabbitMQ configuration | `""` | -| `ldap.uidField` | Field used to match with the user name (uid, samAccountName, cn, etc). It matches with 'dn_lookup_attribute' in RabbitMQ configuration | `""` | -| `ldap.authorisationEnabled` | Enable LDAP authorisation. Please set 'advancedConfiguration' with tag, topic, resources and vhost mappings | `false` | -| `ldap.tls.enabled` | Enabled TLS configuration. | `false` | -| `ldap.tls.startTls` | Use STARTTLS instead of LDAPS. | `false` | -| `ldap.tls.skipVerify` | Skip any SSL verification (hostanames or certificates) | `false` | -| `ldap.tls.verify` | Verify connection. Valid values are 'verify_peer' or 'verify_none' | `verify_peer` | -| `ldap.tls.certificatesMountPath` | Where LDAP certifcates are mounted. | `/opt/bitnami/rabbitmq/ldap/certs` | -| `ldap.tls.certificatesSecret` | Secret with LDAP certificates. | `""` | -| `ldap.tls.CAFilename` | CA certificate filename. Should match with the CA entry key in the ldap.tls.certificatesSecret. | `""` | -| `ldap.tls.certFilename` | Client certificate filename to authenticate against the LDAP server. Should match with certificate the entry key in the ldap.tls.certificatesSecret. | `""` | -| `ldap.tls.certKeyFilename` | Client Key filename to authenticate against the LDAP server. Should match with certificate the entry key in the ldap.tls.certificatesSecret. | `""` | -| `extraVolumeMounts` | Optionally specify extra list of additional volumeMounts | `[]` | -| `extraVolumes` | Optionally specify extra list of additional volumes . | `[]` | -| `extraSecrets` | Optionally specify extra secrets to be created by the chart. | `{}` | -| `extraSecretsPrependReleaseName` | Set this flag to true if extraSecrets should be created with prepended. | `false` | +| Name | Description | Value | +| ------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- | +| `nameOverride` | String to partially override rabbitmq.fullname template (will maintain the release name) | `""` | +| `fullnameOverride` | String to fully override rabbitmq.fullname template | `""` | +| `namespaceOverride` | String to fully override common.names.namespace | `""` | +| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` | +| `clusterDomain` | Kubernetes Cluster Domain | `cluster.local` | +| `extraDeploy` | Array of extra objects to deploy with the release | `[]` | +| `commonAnnotations` | Annotations to add to all deployed objects | `{}` | +| `servicenameOverride` | String to partially override headless service name | `""` | +| `commonLabels` | Labels to add to all deployed objects | `{}` | +| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | +| `diagnosticMode.command` | Command to override all containers in the deployment | `["sleep"]` | +| `diagnosticMode.args` | Args to override all containers in the deployment | `["infinity"]` | +| `hostAliases` | Deployment pod host aliases | `[]` | +| `dnsPolicy` | DNS Policy for pod | `""` | +| `dnsConfig` | DNS Configuration pod | `{}` | +| `auth.username` | RabbitMQ application username | `user` | +| `auth.password` | RabbitMQ application password | `""` | +| `auth.securePassword` | Whether to set the RabbitMQ password securely. This is incompatible with loading external RabbitMQ definitions and 'true' when not setting the auth.password parameter. | `true` | +| `auth.existingPasswordSecret` | Existing secret with RabbitMQ credentials (must contain a value for `rabbitmq-password` key) | `""` | +| `auth.erlangCookie` | Erlang cookie to determine whether different nodes are allowed to communicate with each other | `""` | +| `auth.existingErlangSecret` | Existing secret with RabbitMQ Erlang cookie (must contain a value for `rabbitmq-erlang-cookie` key) | `""` | +| `auth.tls.enabled` | Enable TLS support on RabbitMQ | `false` | +| `auth.tls.autoGenerated` | Generate automatically self-signed TLS certificates | `false` | +| `auth.tls.failIfNoPeerCert` | When set to true, TLS connection will be rejected if client fails to provide a certificate | `true` | +| `auth.tls.sslOptionsVerify` | Should [peer verification](https://www.rabbitmq.com/ssl.html#peer-verification) be enabled? | `verify_peer` | +| `auth.tls.caCertificate` | Certificate Authority (CA) bundle content | `""` | +| `auth.tls.serverCertificate` | Server certificate content | `""` | +| `auth.tls.serverKey` | Server private key content | `""` | +| `auth.tls.existingSecret` | Existing secret with certificate content to RabbitMQ credentials | `""` | +| `auth.tls.existingSecretFullChain` | Whether or not the existing secret contains the full chain in the certificate (`tls.crt`). Will be used in place of `ca.cert` if `true`. | `false` | +| `logs` | Path of the RabbitMQ server's Erlang log file. Value for the `RABBITMQ_LOGS` environment variable | `-` | +| `ulimitNofiles` | RabbitMQ Max File Descriptors | `65536` | +| `maxAvailableSchedulers` | RabbitMQ maximum available scheduler threads | `""` | +| `onlineSchedulers` | RabbitMQ online scheduler threads | `""` | +| `memoryHighWatermark.enabled` | Enable configuring Memory high watermark on RabbitMQ | `false` | +| `memoryHighWatermark.type` | Memory high watermark type. Either `absolute` or `relative` | `relative` | +| `memoryHighWatermark.value` | Memory high watermark value | `0.4` | +| `plugins` | List of default plugins to enable (should only be altered to remove defaults; for additional plugins use `extraPlugins`) | `rabbitmq_management rabbitmq_peer_discovery_k8s` | +| `communityPlugins` | List of Community plugins (URLs) to be downloaded during container initialization | `""` | +| `extraPlugins` | Extra plugins to enable (single string containing a space-separated list) | `rabbitmq_auth_backend_ldap` | +| `clustering.enabled` | Enable RabbitMQ clustering | `true` | +| `clustering.addressType` | Switch clustering mode. Either `ip` or `hostname` | `hostname` | +| `clustering.rebalance` | Rebalance master for queues in cluster when new replica is created | `false` | +| `clustering.forceBoot` | Force boot of an unexpectedly shut down cluster (in an unexpected order). | `false` | +| `clustering.partitionHandling` | Switch Partition Handling Strategy. Either `autoheal` or `pause-minority` or `pause-if-all-down` or `ignore` | `autoheal` | +| `loadDefinition.enabled` | Enable loading a RabbitMQ definitions file to configure RabbitMQ | `false` | +| `loadDefinition.file` | Name of the definitions file | `/app/load_definition.json` | +| `loadDefinition.existingSecret` | Existing secret with the load definitions file | `""` | +| `command` | Override default container command (useful when using custom images) | `[]` | +| `args` | Override default container args (useful when using custom images) | `[]` | +| `lifecycleHooks` | Overwrite livecycle for the RabbitMQ container(s) to automate configuration before or after startup | `{}` | +| `terminationGracePeriodSeconds` | Default duration in seconds k8s waits for container to exit before sending kill signal. | `120` | +| `extraEnvVars` | Extra environment variables to add to RabbitMQ pods | `[]` | +| `extraEnvVarsCM` | Name of existing ConfigMap containing extra environment variables | `""` | +| `extraEnvVarsSecret` | Name of existing Secret containing extra environment variables (in case of sensitive data) | `""` | +| `containerPorts.amqp` | | `5672` | +| `containerPorts.amqpTls` | | `5671` | +| `containerPorts.dist` | | `25672` | +| `containerPorts.manager` | | `15672` | +| `containerPorts.epmd` | | `4369` | +| `containerPorts.metrics` | | `9419` | +| `initScripts` | Dictionary of init scripts. Evaluated as a template. | `{}` | +| `initScriptsCM` | ConfigMap with the init scripts. Evaluated as a template. | `""` | +| `initScriptsSecret` | Secret containing `/docker-entrypoint-initdb.d` scripts to be executed at initialization time that contain sensitive data. Evaluated as a template. | `""` | +| `extraContainerPorts` | Extra ports to be included in container spec, primarily informational | `[]` | +| `configuration` | RabbitMQ Configuration file content: required cluster configuration | `""` | +| `extraConfiguration` | Configuration file content: extra configuration to be appended to RabbitMQ configuration | `""` | +| `advancedConfiguration` | Configuration file content: advanced configuration | `""` | +| `advancedConfigurationExistingSecret` | Existing secret with the advanced configuration file (must contain a key `advanced.config`). | `""` | +| `ldap.enabled` | Enable LDAP support | `false` | +| `ldap.uri` | LDAP connection string. | `""` | +| `ldap.servers` | List of LDAP servers hostnames. This is valid only if ldap.uri is not set | `[]` | +| `ldap.port` | LDAP servers port. This is valid only if ldap.uri is not set | `""` | +| `ldap.userDnPattern` | Pattern used to translate the provided username into a value to be used for the LDAP bind. | `""` | +| `ldap.binddn` | DN of the account used to search in the LDAP server. | `""` | +| `ldap.bindpw` | Password for binddn account. | `""` | +| `ldap.basedn` | Base DN path where binddn account will search for the users. | `""` | +| `ldap.uidField` | Field used to match with the user name (uid, samAccountName, cn, etc). It matches with 'dn_lookup_attribute' in RabbitMQ configuration | `""` | +| `ldap.uidField` | Field used to match with the user name (uid, samAccountName, cn, etc). It matches with 'dn_lookup_attribute' in RabbitMQ configuration | `""` | +| `ldap.authorisationEnabled` | Enable LDAP authorisation. Please set 'advancedConfiguration' with tag, topic, resources and vhost mappings | `false` | +| `ldap.tls.enabled` | Enabled TLS configuration. | `false` | +| `ldap.tls.startTls` | Use STARTTLS instead of LDAPS. | `false` | +| `ldap.tls.skipVerify` | Skip any SSL verification (hostanames or certificates) | `false` | +| `ldap.tls.verify` | Verify connection. Valid values are 'verify_peer' or 'verify_none' | `verify_peer` | +| `ldap.tls.certificatesMountPath` | Where LDAP certifcates are mounted. | `/opt/bitnami/rabbitmq/ldap/certs` | +| `ldap.tls.certificatesSecret` | Secret with LDAP certificates. | `""` | +| `ldap.tls.CAFilename` | CA certificate filename. Should match with the CA entry key in the ldap.tls.certificatesSecret. | `""` | +| `ldap.tls.certFilename` | Client certificate filename to authenticate against the LDAP server. Should match with certificate the entry key in the ldap.tls.certificatesSecret. | `""` | +| `ldap.tls.certKeyFilename` | Client Key filename to authenticate against the LDAP server. Should match with certificate the entry key in the ldap.tls.certificatesSecret. | `""` | +| `extraVolumeMounts` | Optionally specify extra list of additional volumeMounts | `[]` | +| `extraVolumes` | Optionally specify extra list of additional volumes . | `[]` | +| `extraSecrets` | Optionally specify extra secrets to be created by the chart. | `{}` | +| `extraSecretsPrependReleaseName` | Set this flag to true if extraSecrets should be created with prepended. | `false` | ### Statefulset parameters diff --git a/bitnami/rabbitmq/templates/statefulset.yaml b/bitnami/rabbitmq/templates/statefulset.yaml index fa42b8a90..3d3750f5f 100644 --- a/bitnami/rabbitmq/templates/statefulset.yaml +++ b/bitnami/rabbitmq/templates/statefulset.yaml @@ -360,14 +360,13 @@ spec: secretName: {{ .Values.ldap.tls.certificatesSecret }} {{- end }} - name: configuration - secret: - secretName: {{ printf "%s-config" (include "common.names.fullname" .) }} - items: - - key: rabbitmq.conf - path: rabbitmq.conf - {{- if .Values.advancedConfiguration }} - - key: advanced.config - path: advanced.config + projected: + sources: + - secret: + name: {{ printf "%s-config" (include "common.names.fullname" .) }} + {{- if and .Values.advancedConfigurationExistingSecret (not .Values.advancedConfiguration) }} + - secret: + name: {{ tpl .Values.advancedConfigurationExistingSecret . | quote }} {{- end }} {{- if .Values.loadDefinition.enabled }} - name: load-definition-volume diff --git a/bitnami/rabbitmq/values.yaml b/bitnami/rabbitmq/values.yaml index 8af897742..0f723905d 100644 --- a/bitnami/rabbitmq/values.yaml +++ b/bitnami/rabbitmq/values.yaml @@ -435,8 +435,17 @@ extraConfiguration: |- ## {management, {constant, true}}]} ## ]}]. ## +## If both, advancedConfiguration and advancedConfigurationExistingSecret are set, then advancedConfiguration +## will be used instead of the secret. +# advancedConfiguration: |- +## @param advancedConfigurationExistingSecret Existing secret with the advanced configuration file (must contain a key `advanced.config`). +## Use this as additional configuration in classic config format (Erlang term configuration format) as in advancedConfiguration +## Do not use in combination with advancedConfiguration, will be ignored +## +advancedConfigurationExistingSecret: "" + ## LDAP configuration ## ldap: