mirror of
https://github.com/wahyd4/charts.git
synced 2026-08-16 08:37:06 +10:00
[bitnami/rabbitmq] LDAP standardisation for LDAP (#10451)
* LDAP standardisation for LDAP Signed-off-by: Fran Mulero <fmulero@vmware.com> * Update README.md with readme-generator-for-helm Signed-off-by: Bitnami Containers <containers@bitnami.com> * Add skipVerify and enable authorisation adding example Signed-off-by: Fran Mulero <fmulero@vmware.com> * Use a secret to store configuration Signed-off-by: Fran Mulero <fmulero@vmware.com> * Remove deprecated values Signed-off-by: Fran Mulero <fmulero@vmware.com> Co-authored-by: Bitnami Containers <containers@bitnami.com>
This commit is contained in:
Fran Mulero
co-authored by
Bitnami Containers
Bitnami Containers
parent
6d1b305b77
commit
cebd4aa703
@@ -23,4 +23,4 @@ name: rabbitmq
|
||||
sources:
|
||||
- https://github.com/bitnami/bitnami-docker-rabbitmq
|
||||
- https://www.rabbitmq.com
|
||||
version: 10.0.1
|
||||
version: 10.1.0
|
||||
|
||||
+91
-76
@@ -66,7 +66,7 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
| ------------------- | -------------------------------------------------------------- | --------------------- |
|
||||
| `image.registry` | RabbitMQ image registry | `docker.io` |
|
||||
| `image.repository` | RabbitMQ image repository | `bitnami/rabbitmq` |
|
||||
| `image.tag` | RabbitMQ image tag (immutable tags are recommended) | `3.10.2-debian-10-r0` |
|
||||
| `image.tag` | RabbitMQ image tag (immutable tags are recommended) | `3.10.2-debian-10-r7` |
|
||||
| `image.pullPolicy` | RabbitMQ image pull policy | `IfNotPresent` |
|
||||
| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` |
|
||||
| `image.debug` | Set to true if you would like to see extra information on logs | `false` |
|
||||
@@ -74,80 +74,95 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
|
||||
### Common parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- |
|
||||
| `nameOverride` | String to partially override rabbitmq.fullname template (will maintain the release name) | `""` |
|
||||
| `fullnameOverride` | String to fully override rabbitmq.fullname template | `""` |
|
||||
| `namespaceOverride` | String to fully override common.names.namespace | `""` |
|
||||
| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` |
|
||||
| `clusterDomain` | Kubernetes Cluster Domain | `cluster.local` |
|
||||
| `extraDeploy` | Array of extra objects to deploy with the release | `[]` |
|
||||
| `commonAnnotations` | Annotations to add to all deployed objects | `{}` |
|
||||
| `commonLabels` | Labels to add to all deployed objects | `{}` |
|
||||
| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` |
|
||||
| `diagnosticMode.command` | Command to override all containers in the deployment | `["sleep"]` |
|
||||
| `diagnosticMode.args` | Args to override all containers in the deployment | `["infinity"]` |
|
||||
| `hostAliases` | Deployment pod host aliases | `[]` |
|
||||
| `dnsPolicy` | DNS Policy for pod | `""` |
|
||||
| `dnsConfig` | DNS Configuration pod | `{}` |
|
||||
| `auth.username` | RabbitMQ application username | `user` |
|
||||
| `auth.password` | RabbitMQ application password | `""` |
|
||||
| `auth.existingPasswordSecret` | Existing secret with RabbitMQ credentials (must contain a value for `rabbitmq-password` key) | `""` |
|
||||
| `auth.erlangCookie` | Erlang cookie to determine whether different nodes are allowed to communicate with each other | `""` |
|
||||
| `auth.existingErlangSecret` | Existing secret with RabbitMQ Erlang cookie (must contain a value for `rabbitmq-erlang-cookie` key) | `""` |
|
||||
| `auth.tls.enabled` | Enable TLS support on RabbitMQ | `false` |
|
||||
| `auth.tls.autoGenerated` | Generate automatically self-signed TLS certificates | `false` |
|
||||
| `auth.tls.failIfNoPeerCert` | When set to true, TLS connection will be rejected if client fails to provide a certificate | `true` |
|
||||
| `auth.tls.sslOptionsVerify` | Should [peer verification](https://www.rabbitmq.com/ssl.html#peer-verification) be enabled? | `verify_peer` |
|
||||
| `auth.tls.caCertificate` | Certificate Authority (CA) bundle content | `""` |
|
||||
| `auth.tls.serverCertificate` | Server certificate content | `""` |
|
||||
| `auth.tls.serverKey` | Server private key content | `""` |
|
||||
| `auth.tls.existingSecret` | Existing secret with certificate content to RabbitMQ credentials | `""` |
|
||||
| `auth.tls.existingSecretFullChain` | Whether or not the existing secret contains the full chain in the certificate (`tls.crt`). Will be used in place of `ca.cert` if `true`. | `false` |
|
||||
| `logs` | Path of the RabbitMQ server's Erlang log file. Value for the `RABBITMQ_LOGS` environment variable | `-` |
|
||||
| `ulimitNofiles` | RabbitMQ Max File Descriptors | `65536` |
|
||||
| `maxAvailableSchedulers` | RabbitMQ maximum available scheduler threads | `""` |
|
||||
| `onlineSchedulers` | RabbitMQ online scheduler threads | `""` |
|
||||
| `memoryHighWatermark.enabled` | Enable configuring Memory high watermark on RabbitMQ | `false` |
|
||||
| `memoryHighWatermark.type` | Memory high watermark type. Either `absolute` or `relative` | `relative` |
|
||||
| `memoryHighWatermark.value` | Memory high watermark value | `0.4` |
|
||||
| `plugins` | List of default plugins to enable (should only be altered to remove defaults; for additional plugins use `extraPlugins`) | `rabbitmq_management rabbitmq_peer_discovery_k8s` |
|
||||
| `communityPlugins` | List of Community plugins (URLs) to be downloaded during container initialization | `""` |
|
||||
| `extraPlugins` | Extra plugins to enable (single string containing a space-separated list) | `rabbitmq_auth_backend_ldap` |
|
||||
| `clustering.enabled` | Enable RabbitMQ clustering | `true` |
|
||||
| `clustering.addressType` | Switch clustering mode. Either `ip` or `hostname` | `hostname` |
|
||||
| `clustering.rebalance` | Rebalance master for queues in cluster when new replica is created | `false` |
|
||||
| `clustering.forceBoot` | Force boot of an unexpectedly shut down cluster (in an unexpected order). | `false` |
|
||||
| `clustering.partitionHandling` | Switch Partition Handling Strategy. Either `autoheal` or `pause-minority` or `pause-if-all-down` or `ignore` | `autoheal` |
|
||||
| `loadDefinition.enabled` | Enable loading a RabbitMQ definitions file to configure RabbitMQ | `false` |
|
||||
| `loadDefinition.file` | Name of the definitions file | `/app/load_definition.json` |
|
||||
| `loadDefinition.existingSecret` | Existing secret with the load definitions file | `""` |
|
||||
| `command` | Override default container command (useful when using custom images) | `[]` |
|
||||
| `args` | Override default container args (useful when using custom images) | `[]` |
|
||||
| `lifecycleHooks` | Overwrite livecycle for the RabbitMQ container(s) to automate configuration before or after startup | `{}` |
|
||||
| `terminationGracePeriodSeconds` | Default duration in seconds k8s waits for container to exit before sending kill signal. | `120` |
|
||||
| `extraEnvVars` | Extra environment variables to add to RabbitMQ pods | `[]` |
|
||||
| `extraEnvVarsCM` | Name of existing ConfigMap containing extra environment variables | `""` |
|
||||
| `extraEnvVarsSecret` | Name of existing Secret containing extra environment variables (in case of sensitive data) | `""` |
|
||||
| `containerPorts.amqp` | | `5672` |
|
||||
| `containerPorts.amqpTls` | | `5671` |
|
||||
| `containerPorts.dist` | | `25672` |
|
||||
| `containerPorts.manager` | | `15672` |
|
||||
| `containerPorts.epmd` | | `4369` |
|
||||
| `containerPorts.metrics` | | `9419` |
|
||||
| `extraContainerPorts` | Extra ports to be included in container spec, primarily informational | `[]` |
|
||||
| `configuration` | RabbitMQ Configuration file content: required cluster configuration | `""` |
|
||||
| `extraConfiguration` | Configuration file content: extra configuration to be appended to RabbitMQ configuration | `""` |
|
||||
| `advancedConfiguration` | Configuration file content: advanced configuration | `""` |
|
||||
| `ldap.enabled` | Enable LDAP support | `false` |
|
||||
| `ldap.servers` | List of LDAP servers hostnames | `[]` |
|
||||
| `ldap.port` | LDAP servers port | `389` |
|
||||
| `ldap.user_dn_pattern` | Pattern used to translate the provided username into a value to be used for the LDAP bind | `cn=${username},dc=example,dc=org` |
|
||||
| `ldap.tls.enabled` | If you enable TLS/SSL you can set advanced options using the `advancedConfiguration` parameter | `false` |
|
||||
| `extraVolumeMounts` | Optionally specify extra list of additional volumeMounts | `[]` |
|
||||
| `extraVolumes` | Optionally specify extra list of additional volumes . | `[]` |
|
||||
| `extraSecrets` | Optionally specify extra secrets to be created by the chart. | `{}` |
|
||||
| `extraSecretsPrependReleaseName` | Set this flag to true if extraSecrets should be created with <release-name> prepended. | `false` |
|
||||
| Name | Description | Value |
|
||||
| ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- |
|
||||
| `nameOverride` | String to partially override rabbitmq.fullname template (will maintain the release name) | `""` |
|
||||
| `fullnameOverride` | String to fully override rabbitmq.fullname template | `""` |
|
||||
| `namespaceOverride` | String to fully override common.names.namespace | `""` |
|
||||
| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` |
|
||||
| `clusterDomain` | Kubernetes Cluster Domain | `cluster.local` |
|
||||
| `extraDeploy` | Array of extra objects to deploy with the release | `[]` |
|
||||
| `commonAnnotations` | Annotations to add to all deployed objects | `{}` |
|
||||
| `commonLabels` | Labels to add to all deployed objects | `{}` |
|
||||
| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` |
|
||||
| `diagnosticMode.command` | Command to override all containers in the deployment | `["sleep"]` |
|
||||
| `diagnosticMode.args` | Args to override all containers in the deployment | `["infinity"]` |
|
||||
| `hostAliases` | Deployment pod host aliases | `[]` |
|
||||
| `dnsPolicy` | DNS Policy for pod | `""` |
|
||||
| `dnsConfig` | DNS Configuration pod | `{}` |
|
||||
| `auth.username` | RabbitMQ application username | `user` |
|
||||
| `auth.password` | RabbitMQ application password | `""` |
|
||||
| `auth.existingPasswordSecret` | Existing secret with RabbitMQ credentials (must contain a value for `rabbitmq-password` key) | `""` |
|
||||
| `auth.erlangCookie` | Erlang cookie to determine whether different nodes are allowed to communicate with each other | `""` |
|
||||
| `auth.existingErlangSecret` | Existing secret with RabbitMQ Erlang cookie (must contain a value for `rabbitmq-erlang-cookie` key) | `""` |
|
||||
| `auth.tls.enabled` | Enable TLS support on RabbitMQ | `false` |
|
||||
| `auth.tls.autoGenerated` | Generate automatically self-signed TLS certificates | `false` |
|
||||
| `auth.tls.failIfNoPeerCert` | When set to true, TLS connection will be rejected if client fails to provide a certificate | `true` |
|
||||
| `auth.tls.sslOptionsVerify` | Should [peer verification](https://www.rabbitmq.com/ssl.html#peer-verification) be enabled? | `verify_peer` |
|
||||
| `auth.tls.caCertificate` | Certificate Authority (CA) bundle content | `""` |
|
||||
| `auth.tls.serverCertificate` | Server certificate content | `""` |
|
||||
| `auth.tls.serverKey` | Server private key content | `""` |
|
||||
| `auth.tls.existingSecret` | Existing secret with certificate content to RabbitMQ credentials | `""` |
|
||||
| `auth.tls.existingSecretFullChain` | Whether or not the existing secret contains the full chain in the certificate (`tls.crt`). Will be used in place of `ca.cert` if `true`. | `false` |
|
||||
| `logs` | Path of the RabbitMQ server's Erlang log file. Value for the `RABBITMQ_LOGS` environment variable | `-` |
|
||||
| `ulimitNofiles` | RabbitMQ Max File Descriptors | `65536` |
|
||||
| `maxAvailableSchedulers` | RabbitMQ maximum available scheduler threads | `""` |
|
||||
| `onlineSchedulers` | RabbitMQ online scheduler threads | `""` |
|
||||
| `memoryHighWatermark.enabled` | Enable configuring Memory high watermark on RabbitMQ | `false` |
|
||||
| `memoryHighWatermark.type` | Memory high watermark type. Either `absolute` or `relative` | `relative` |
|
||||
| `memoryHighWatermark.value` | Memory high watermark value | `0.4` |
|
||||
| `plugins` | List of default plugins to enable (should only be altered to remove defaults; for additional plugins use `extraPlugins`) | `rabbitmq_management rabbitmq_peer_discovery_k8s` |
|
||||
| `communityPlugins` | List of Community plugins (URLs) to be downloaded during container initialization | `""` |
|
||||
| `extraPlugins` | Extra plugins to enable (single string containing a space-separated list) | `rabbitmq_auth_backend_ldap` |
|
||||
| `clustering.enabled` | Enable RabbitMQ clustering | `true` |
|
||||
| `clustering.addressType` | Switch clustering mode. Either `ip` or `hostname` | `hostname` |
|
||||
| `clustering.rebalance` | Rebalance master for queues in cluster when new replica is created | `false` |
|
||||
| `clustering.forceBoot` | Force boot of an unexpectedly shut down cluster (in an unexpected order). | `false` |
|
||||
| `clustering.partitionHandling` | Switch Partition Handling Strategy. Either `autoheal` or `pause-minority` or `pause-if-all-down` or `ignore` | `autoheal` |
|
||||
| `loadDefinition.enabled` | Enable loading a RabbitMQ definitions file to configure RabbitMQ | `false` |
|
||||
| `loadDefinition.file` | Name of the definitions file | `/app/load_definition.json` |
|
||||
| `loadDefinition.existingSecret` | Existing secret with the load definitions file | `""` |
|
||||
| `command` | Override default container command (useful when using custom images) | `[]` |
|
||||
| `args` | Override default container args (useful when using custom images) | `[]` |
|
||||
| `lifecycleHooks` | Overwrite livecycle for the RabbitMQ container(s) to automate configuration before or after startup | `{}` |
|
||||
| `terminationGracePeriodSeconds` | Default duration in seconds k8s waits for container to exit before sending kill signal. | `120` |
|
||||
| `extraEnvVars` | Extra environment variables to add to RabbitMQ pods | `[]` |
|
||||
| `extraEnvVarsCM` | Name of existing ConfigMap containing extra environment variables | `""` |
|
||||
| `extraEnvVarsSecret` | Name of existing Secret containing extra environment variables (in case of sensitive data) | `""` |
|
||||
| `containerPorts.amqp` | | `5672` |
|
||||
| `containerPorts.amqpTls` | | `5671` |
|
||||
| `containerPorts.dist` | | `25672` |
|
||||
| `containerPorts.manager` | | `15672` |
|
||||
| `containerPorts.epmd` | | `4369` |
|
||||
| `containerPorts.metrics` | | `9419` |
|
||||
| `extraContainerPorts` | Extra ports to be included in container spec, primarily informational | `[]` |
|
||||
| `configuration` | RabbitMQ Configuration file content: required cluster configuration | `""` |
|
||||
| `extraConfiguration` | Configuration file content: extra configuration to be appended to RabbitMQ configuration | `""` |
|
||||
| `advancedConfiguration` | Configuration file content: advanced configuration | `""` |
|
||||
| `ldap.enabled` | Enable LDAP support | `false` |
|
||||
| `ldap.uri` | LDAP connection string. | `""` |
|
||||
| `ldap.servers` | List of LDAP servers hostnames. This is valid only if ldap.uri is not set | `[]` |
|
||||
| `ldap.port` | LDAP servers port. This is valid only if ldap.uri is not set | `""` |
|
||||
| `ldap.userDnPattern` | Pattern used to translate the provided username into a value to be used for the LDAP bind. | `""` |
|
||||
| `ldap.binddn` | DN of the account used to search in the LDAP server. | `""` |
|
||||
| `ldap.bindpw` | Password for binddn account. | `""` |
|
||||
| `ldap.basedn` | Base DN path where binddn account will search for the users. | `""` |
|
||||
| `ldap.uidField` | Field used to match with the user name (uid, samAccountName, cn, etc). It matches with 'dn_lookup_attribute' in RabbitMQ configuration | `""` |
|
||||
| `ldap.uidField` | Field used to match with the user name (uid, samAccountName, cn, etc). It matches with 'dn_lookup_attribute' in RabbitMQ configuration | `""` |
|
||||
| `ldap.authorisationEnabled` | Enable LDAP authorisation. Please set 'advancedConfiguration' with tag, topic, resources and vhost mappings | `false` |
|
||||
| `ldap.tls.enabled` | Enabled TLS configuration. | `false` |
|
||||
| `ldap.tls.startTls` | Use STARTTLS instead of LDAPS. | `false` |
|
||||
| `ldap.tls.skipVerify` | Skip any SSL verification (hostanames or certificates) | `false` |
|
||||
| `ldap.tls.verify` | Verify connection. Valid values are 'verify_peer' or 'verify_none' | `verify_peer` |
|
||||
| `ldap.tls.certificatesMountPath` | Where LDAP certifcates are mounted. | `/opt/bitnami/rabbitmq/ldap/certs` |
|
||||
| `ldap.tls.certificatesSecret` | Secret with LDAP certificates. | `""` |
|
||||
| `ldap.tls.CAFilename` | CA certificate filename. Should match with the CA entry key in the ldap.tls.certificatesSecret. | `""` |
|
||||
| `ldap.tls.certFilename` | Client certificate filename to authenticate against the LDAP server. Should match with certificate the entry key in the ldap.tls.certificatesSecret. | `""` |
|
||||
| `ldap.tls.certKeyFilename` | Client Key filename to authenticate against the LDAP server. Should match with certificate the entry key in the ldap.tls.certificatesSecret. | `""` |
|
||||
| `extraVolumeMounts` | Optionally specify extra list of additional volumeMounts | `[]` |
|
||||
| `extraVolumes` | Optionally specify extra list of additional volumes . | `[]` |
|
||||
| `extraSecrets` | Optionally specify extra secrets to be created by the chart. | `{}` |
|
||||
| `extraSecretsPrependReleaseName` | Set this flag to true if extraSecrets should be created with <release-name> prepended. | `false` |
|
||||
|
||||
|
||||
### Statefulset parameters
|
||||
@@ -322,7 +337,7 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
| `volumePermissions.enabled` | Enable init container that changes the owner and group of the persistent volume(s) mountpoint to `runAsUser:fsGroup` | `false` |
|
||||
| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` |
|
||||
| `volumePermissions.image.repository` | Init container volume-permissions image repository | `bitnami/bitnami-shell` |
|
||||
| `volumePermissions.image.tag` | Init container volume-permissions image tag | `10-debian-10-r431` |
|
||||
| `volumePermissions.image.tag` | Init container volume-permissions image tag | `10-debian-10-r436` |
|
||||
| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `IfNotPresent` |
|
||||
| `volumePermissions.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` |
|
||||
| `volumePermissions.resources.limits` | Init container volume-permissions resource limits | `{}` |
|
||||
|
||||
@@ -147,16 +147,16 @@ Validate values of rabbitmq - LDAP support
|
||||
{{- define "rabbitmq.validateValues.ldap" -}}
|
||||
{{- if .Values.ldap.enabled }}
|
||||
{{- $serversListLength := len .Values.ldap.servers }}
|
||||
{{- if or (not (gt $serversListLength 0)) (not (and .Values.ldap.port .Values.ldap.user_dn_pattern)) }}
|
||||
{{- $userDnPattern := coalesce .Values.ldap.user_dn_pattern .Values.ldap.userDnPattern }}
|
||||
{{- if or (and (not (gt $serversListLength 0)) (empty .Values.ldap.uri)) (and (not $userDnPattern) (not .Values.ldap.basedn)) }}
|
||||
rabbitmq: LDAP
|
||||
Invalid LDAP configuration. When enabling LDAP support, the parameters "ldap.servers",
|
||||
"ldap.port", and "ldap. user_dn_pattern" are mandatory. Please provide them:
|
||||
|
||||
Invalid LDAP configuration. When enabling LDAP support, the parameters "ldap.servers" or "ldap.uri" are mandatory
|
||||
to configure the connection and "ldap.userDnPattern" or "ldap.basedn" are necessary to lookup the users. Please provide them:
|
||||
$ helm install {{ .Release.Name }} bitnami/rabbitmq \
|
||||
--set ldap.enabled=true \
|
||||
--set ldap.servers[0]="lmy-ldap-server" \
|
||||
--set ldap.servers[0]=my-ldap-server" \
|
||||
--set ldap.port="389" \
|
||||
--set user_dn_pattern="cn=${username},dc=example,dc=org"
|
||||
--set ldap.userDnPattern="cn=${username},dc=example,dc=org"
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
+4
-3
@@ -1,5 +1,5 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ printf "%s-config" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
@@ -10,10 +10,11 @@ metadata:
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
rabbitmq.conf: |-
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.configuration "context" $) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.configuration "context" $) | b64enc | nindent 4 }}
|
||||
{{- if .Values.advancedConfiguration }}
|
||||
advanced.config: |-
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.advancedConfiguration "context" $) | nindent 4 }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.advancedConfiguration "context" $) | b64enc | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -32,7 +32,7 @@ spec:
|
||||
{{- if .Values.commonAnnotations }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 8 }}
|
||||
{{- end }}
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configuration.yaml") . | sha256sum }}
|
||||
checksum/config: {{ include (print $.Template.BasePath "/config-secret.yaml") . | sha256sum }}
|
||||
{{- if or (not .Values.auth.existingErlangSecret) (not .Values.auth.existingPasswordSecret) .Values.extraSecrets }}
|
||||
checksum/secret: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
@@ -300,6 +300,10 @@ spec:
|
||||
- name: certs
|
||||
mountPath: /opt/bitnami/rabbitmq/certs
|
||||
{{- end }}
|
||||
{{- if and .Values.ldap.tls.enabled .Values.ldap.tls.certificatesSecret }}
|
||||
- name: ldap-certs
|
||||
mountPath: {{ .Values.ldap.tls.certificatesMountPath }}
|
||||
{{- end }}
|
||||
{{- if .Values.loadDefinition.enabled }}
|
||||
- name: load-definition-volume
|
||||
mountPath: /app
|
||||
@@ -324,9 +328,14 @@ spec:
|
||||
- key: tls.key
|
||||
path: server_key.pem
|
||||
{{- end }}
|
||||
{{- if and .Values.ldap.tls.enabled .Values.ldap.tls.certificatesSecret }}
|
||||
- name: ldap-certs
|
||||
secret:
|
||||
secretName: {{ .Values.ldap.tls.certificatesSecret }}
|
||||
{{- end }}
|
||||
- name: configuration
|
||||
configMap:
|
||||
name: {{ printf "%s-config" (include "common.names.fullname" .) }}
|
||||
secret:
|
||||
secretName: {{ printf "%s-config" (include "common.names.fullname" .) }}
|
||||
items:
|
||||
- key: rabbitmq.conf
|
||||
path: rabbitmq.conf
|
||||
|
||||
@@ -331,15 +331,51 @@ configuration: |-
|
||||
ssl_options.keyfile = /opt/bitnami/rabbitmq/certs/server_key.pem
|
||||
{{- end }}
|
||||
{{- if .Values.ldap.enabled }}
|
||||
auth_backends.1 = rabbit_auth_backend_ldap
|
||||
auth_backends.1.authn = ldap
|
||||
auth_backends.1.authz = {{ ternary "ldap" "internal" .Values.ldap.authorisationEnabled }}
|
||||
auth_backends.2 = internal
|
||||
{{- range $index, $server := .Values.ldap.servers }}
|
||||
{{- $host := list }}
|
||||
{{- $port := ternary 636 389 .Values.ldap.tls.enabled }}
|
||||
{{- if .Values.ldap.uri }}
|
||||
{{- $hostPort := get (urlParse .Values.ldap.uri) "host" }}
|
||||
{{- $host = list (index (splitList ":" $hostPort) 0) -}}
|
||||
{{- if (contains ":" $hostPort) }}
|
||||
{{- $port = index (splitList ":" $hostPort) 1 -}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $index, $server := concat $host .Values.ldap.servers }}
|
||||
auth_ldap.servers.{{ add $index 1 }} = {{ $server }}
|
||||
{{- end }}
|
||||
auth_ldap.port = {{ .Values.ldap.port }}
|
||||
auth_ldap.user_dn_pattern = {{ .Values.ldap.user_dn_pattern }}
|
||||
auth_ldap.port = {{ coalesce .Values.ldap.port $port }}
|
||||
{{- if or .Values.ldap.user_dn_pattern .Values.ldap.userDnPattern }}
|
||||
auth_ldap.user_dn_pattern = {{ coalesce .Values.ldap.user_dn_pattern .Values.ldap.userDnPattern }}
|
||||
{{- end }}
|
||||
{{- if .Values.ldap.basedn }}
|
||||
auth_ldap.dn_lookup_base = {{ .Values.ldap.basedn }}
|
||||
{{- end }}
|
||||
{{- if .Values.ldap.uidField }}
|
||||
auth_ldap.dn_lookup_attribute = {{ .Values.ldap.uidField }}
|
||||
{{- end }}
|
||||
{{- if .Values.ldap.binddn }}
|
||||
auth_ldap.dn_lookup_bind.user_dn = {{ .Values.ldap.binddn }}
|
||||
auth_ldap.dn_lookup_bind.password = {{ required "'ldap.bindpw' is required when 'ldap.binddn' is defined" .Values.ldap.bindpw }}
|
||||
{{- end }}
|
||||
{{- if .Values.ldap.tls.enabled }}
|
||||
auth_ldap.use_ssl = true
|
||||
auth_ldap.use_ssl = {{ not .Values.ldap.tls.startTls }}
|
||||
auth_ldap.use_starttls = {{ .Values.ldap.tls.startTls }}
|
||||
{{- if .Values.ldap.tls.CAFilename }}
|
||||
auth_ldap.ssl_options.cacertfile = {{ .Values.ldap.tls.certificatesMountPath }}/{{ .Values.ldap.tls.CAFilename }}
|
||||
{{- end }}
|
||||
{{- if .Values.ldap.tls.certFilename }}
|
||||
auth_ldap.ssl_options.certfile = {{ .Values.ldap.tls.certificatesMountPath }}/{{ .Values.ldap.tls.certFilename }}
|
||||
auth_ldap.ssl_options.keyfile = {{ .Values.ldap.tls.certificatesMountPath }}/{{ required "'ldap.tls.certKeyFilename' is required when 'ldap.tls.certFilename' is defined" .Values.ldap.tls.certKeyFilename }}
|
||||
{{- end }}
|
||||
{{- if .Values.ldap.tls.skipVerify }}
|
||||
auth_ldap.ssl_options.verify = verify_none
|
||||
auth_ldap.ssl_options.fail_if_no_peer_cert = false
|
||||
{{- else if .Values.ldap.tls.verify }}
|
||||
auth_ldap.ssl_options.verify = {{ .Values.ldap.tls.verify }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
@@ -364,20 +400,12 @@ extraConfiguration: |-
|
||||
## @param advancedConfiguration Configuration file content: advanced configuration
|
||||
## Use this as additional configuration in classic config format (Erlang term configuration format)
|
||||
##
|
||||
## If you set LDAP with TLS/SSL enabled and you are using self-signed certificates, uncomment these lines.
|
||||
## LDAP authorisation example:
|
||||
## advancedConfiguration: |-
|
||||
## [{
|
||||
## rabbitmq_auth_backend_ldap,
|
||||
## [{
|
||||
## ssl_options,
|
||||
## [{
|
||||
## verify, verify_none
|
||||
## }, {
|
||||
## fail_if_no_peer_cert,
|
||||
## false
|
||||
## }]
|
||||
## ]}
|
||||
## }].
|
||||
## [{rabbitmq_auth_backend_ldap,[
|
||||
## {tag_queries, [{administrator, {constant, true}},
|
||||
## {management, {constant, true}}]}
|
||||
## ]}].
|
||||
##
|
||||
advancedConfiguration: |-
|
||||
|
||||
@@ -387,21 +415,60 @@ ldap:
|
||||
## @param ldap.enabled Enable LDAP support
|
||||
##
|
||||
enabled: false
|
||||
## @param ldap.servers List of LDAP servers hostnames
|
||||
## @param ldap.uri LDAP connection string.
|
||||
##
|
||||
uri: ""
|
||||
## @param ldap.servers List of LDAP servers hostnames. This is valid only if ldap.uri is not set
|
||||
##
|
||||
servers: []
|
||||
## @param ldap.port LDAP servers port
|
||||
## @param ldap.port LDAP servers port. This is valid only if ldap.uri is not set
|
||||
##
|
||||
port: "389"
|
||||
port: ""
|
||||
|
||||
## DEPRECATED ldap.user_dn_pattern it will removed in a future, please use userDnPattern instead
|
||||
## Pattern used to translate the provided username into a value to be used for the LDAP bind
|
||||
## @param ldap.user_dn_pattern Pattern used to translate the provided username into a value to be used for the LDAP bind
|
||||
## @param ldap.userDnPattern Pattern used to translate the provided username into a value to be used for the LDAP bind.
|
||||
## ref: https://www.rabbitmq.com/ldap.html#usernames-and-dns
|
||||
##
|
||||
user_dn_pattern: cn=${username},dc=example,dc=org
|
||||
userDnPattern: ""
|
||||
## @param ldap.binddn DN of the account used to search in the LDAP server.
|
||||
##
|
||||
binddn: ""
|
||||
## @param ldap.bindpw Password for binddn account.
|
||||
##
|
||||
bindpw: ""
|
||||
## @param ldap.basedn Base DN path where binddn account will search for the users.
|
||||
##
|
||||
basedn: ""
|
||||
## @param ldap.uidField Field used to match with the user name (uid, samAccountName, cn, etc). It matches with 'dn_lookup_attribute' in RabbitMQ configuration
|
||||
## ref: https://www.rabbitmq.com/ldap.html#usernames-and-dns
|
||||
##
|
||||
## @param ldap.uidField Field used to match with the user name (uid, samAccountName, cn, etc). It matches with 'dn_lookup_attribute' in RabbitMQ configuration
|
||||
uidField: ""
|
||||
## @param ldap.authorisationEnabled Enable LDAP authorisation. Please set 'advancedConfiguration' with tag, topic, resources and vhost mappings
|
||||
## ref: https://www.rabbitmq.com/ldap.html#authorisation
|
||||
##
|
||||
authorisationEnabled: false
|
||||
## @param ldap.tls.enabled Enabled TLS configuration.
|
||||
## @param ldap.tls.startTls Use STARTTLS instead of LDAPS.
|
||||
## @param ldap.tls.skipVerify Skip any SSL verification (hostanames or certificates)
|
||||
## @param ldap.tls.verify Verify connection. Valid values are 'verify_peer' or 'verify_none'
|
||||
## @param ldap.tls.certificatesMountPath Where LDAP certifcates are mounted.
|
||||
## @param ldap.tls.certificatesSecret Secret with LDAP certificates.
|
||||
## @param ldap.tls.CAFilename CA certificate filename. Should match with the CA entry key in the ldap.tls.certificatesSecret.
|
||||
## @param ldap.tls.certFilename Client certificate filename to authenticate against the LDAP server. Should match with certificate the entry key in the ldap.tls.certificatesSecret.
|
||||
## @param ldap.tls.certKeyFilename Client Key filename to authenticate against the LDAP server. Should match with certificate the entry key in the ldap.tls.certificatesSecret.
|
||||
##
|
||||
tls:
|
||||
## @param ldap.tls.enabled If you enable TLS/SSL you can set advanced options using the `advancedConfiguration` parameter
|
||||
##
|
||||
enabled: false
|
||||
startTls: false
|
||||
skipVerify: false
|
||||
verify: "verify_peer"
|
||||
certificatesMountPath: /opt/bitnami/rabbitmq/ldap/certs
|
||||
certificatesSecret: ""
|
||||
CAFilename: ""
|
||||
certFilename: ""
|
||||
certKeyFilename: ""
|
||||
|
||||
## @param extraVolumeMounts Optionally specify extra list of additional volumeMounts
|
||||
## Examples:
|
||||
|
||||
Reference in New Issue
Block a user