From cebd4aa70312bbd4f4da2763be41e60752d461d7 Mon Sep 17 00:00:00 2001 From: Fran Mulero Date: Mon, 30 May 2022 10:14:38 +0200 Subject: [PATCH] [bitnami/rabbitmq] LDAP standardisation for LDAP (#10451) * LDAP standardisation for LDAP Signed-off-by: Fran Mulero * Update README.md with readme-generator-for-helm Signed-off-by: Bitnami Containers * Add skipVerify and enable authorisation adding example Signed-off-by: Fran Mulero * Use a secret to store configuration Signed-off-by: Fran Mulero * Remove deprecated values Signed-off-by: Fran Mulero Co-authored-by: Bitnami Containers --- bitnami/rabbitmq/Chart.yaml | 2 +- bitnami/rabbitmq/README.md | 167 ++++++++++-------- bitnami/rabbitmq/templates/_helpers.tpl | 12 +- ...{configuration.yaml => config-secret.yaml} | 7 +- bitnami/rabbitmq/templates/statefulset.yaml | 15 +- bitnami/rabbitmq/values.yaml | 117 +++++++++--- 6 files changed, 206 insertions(+), 114 deletions(-) rename bitnami/rabbitmq/templates/{configuration.yaml => config-secret.yaml} (85%) diff --git a/bitnami/rabbitmq/Chart.yaml b/bitnami/rabbitmq/Chart.yaml index bec5f0417..ebd0660ba 100644 --- a/bitnami/rabbitmq/Chart.yaml +++ b/bitnami/rabbitmq/Chart.yaml @@ -23,4 +23,4 @@ name: rabbitmq sources: - https://github.com/bitnami/bitnami-docker-rabbitmq - https://www.rabbitmq.com -version: 10.0.1 +version: 10.1.0 diff --git a/bitnami/rabbitmq/README.md b/bitnami/rabbitmq/README.md index 84e4b99ee..21c49d7a8 100644 --- a/bitnami/rabbitmq/README.md +++ b/bitnami/rabbitmq/README.md @@ -66,7 +66,7 @@ The command removes all the Kubernetes components associated with the chart and | ------------------- | -------------------------------------------------------------- | --------------------- | | `image.registry` | RabbitMQ image registry | `docker.io` | | `image.repository` | RabbitMQ image repository | `bitnami/rabbitmq` | -| `image.tag` | RabbitMQ image tag (immutable tags are recommended) | `3.10.2-debian-10-r0` | +| `image.tag` | RabbitMQ image tag (immutable tags are recommended) | `3.10.2-debian-10-r7` | | `image.pullPolicy` | RabbitMQ image pull policy | `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | | `image.debug` | Set to true if you would like to see extra information on logs | `false` | @@ -74,80 +74,95 @@ The command removes all the Kubernetes components associated with the chart and ### Common parameters -| Name | Description | Value | -| ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- | -| `nameOverride` | String to partially override rabbitmq.fullname template (will maintain the release name) | `""` | -| `fullnameOverride` | String to fully override rabbitmq.fullname template | `""` | -| `namespaceOverride` | String to fully override common.names.namespace | `""` | -| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` | -| `clusterDomain` | Kubernetes Cluster Domain | `cluster.local` | -| `extraDeploy` | Array of extra objects to deploy with the release | `[]` | -| `commonAnnotations` | Annotations to add to all deployed objects | `{}` | -| `commonLabels` | Labels to add to all deployed objects | `{}` | -| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | -| `diagnosticMode.command` | Command to override all containers in the deployment | `["sleep"]` | -| `diagnosticMode.args` | Args to override all containers in the deployment | `["infinity"]` | -| `hostAliases` | Deployment pod host aliases | `[]` | -| `dnsPolicy` | DNS Policy for pod | `""` | -| `dnsConfig` | DNS Configuration pod | `{}` | -| `auth.username` | RabbitMQ application username | `user` | -| `auth.password` | RabbitMQ application password | `""` | -| `auth.existingPasswordSecret` | Existing secret with RabbitMQ credentials (must contain a value for `rabbitmq-password` key) | `""` | -| `auth.erlangCookie` | Erlang cookie to determine whether different nodes are allowed to communicate with each other | `""` | -| `auth.existingErlangSecret` | Existing secret with RabbitMQ Erlang cookie (must contain a value for `rabbitmq-erlang-cookie` key) | `""` | -| `auth.tls.enabled` | Enable TLS support on RabbitMQ | `false` | -| `auth.tls.autoGenerated` | Generate automatically self-signed TLS certificates | `false` | -| `auth.tls.failIfNoPeerCert` | When set to true, TLS connection will be rejected if client fails to provide a certificate | `true` | -| `auth.tls.sslOptionsVerify` | Should [peer verification](https://www.rabbitmq.com/ssl.html#peer-verification) be enabled? | `verify_peer` | -| `auth.tls.caCertificate` | Certificate Authority (CA) bundle content | `""` | -| `auth.tls.serverCertificate` | Server certificate content | `""` | -| `auth.tls.serverKey` | Server private key content | `""` | -| `auth.tls.existingSecret` | Existing secret with certificate content to RabbitMQ credentials | `""` | -| `auth.tls.existingSecretFullChain` | Whether or not the existing secret contains the full chain in the certificate (`tls.crt`). Will be used in place of `ca.cert` if `true`. | `false` | -| `logs` | Path of the RabbitMQ server's Erlang log file. Value for the `RABBITMQ_LOGS` environment variable | `-` | -| `ulimitNofiles` | RabbitMQ Max File Descriptors | `65536` | -| `maxAvailableSchedulers` | RabbitMQ maximum available scheduler threads | `""` | -| `onlineSchedulers` | RabbitMQ online scheduler threads | `""` | -| `memoryHighWatermark.enabled` | Enable configuring Memory high watermark on RabbitMQ | `false` | -| `memoryHighWatermark.type` | Memory high watermark type. Either `absolute` or `relative` | `relative` | -| `memoryHighWatermark.value` | Memory high watermark value | `0.4` | -| `plugins` | List of default plugins to enable (should only be altered to remove defaults; for additional plugins use `extraPlugins`) | `rabbitmq_management rabbitmq_peer_discovery_k8s` | -| `communityPlugins` | List of Community plugins (URLs) to be downloaded during container initialization | `""` | -| `extraPlugins` | Extra plugins to enable (single string containing a space-separated list) | `rabbitmq_auth_backend_ldap` | -| `clustering.enabled` | Enable RabbitMQ clustering | `true` | -| `clustering.addressType` | Switch clustering mode. Either `ip` or `hostname` | `hostname` | -| `clustering.rebalance` | Rebalance master for queues in cluster when new replica is created | `false` | -| `clustering.forceBoot` | Force boot of an unexpectedly shut down cluster (in an unexpected order). | `false` | -| `clustering.partitionHandling` | Switch Partition Handling Strategy. Either `autoheal` or `pause-minority` or `pause-if-all-down` or `ignore` | `autoheal` | -| `loadDefinition.enabled` | Enable loading a RabbitMQ definitions file to configure RabbitMQ | `false` | -| `loadDefinition.file` | Name of the definitions file | `/app/load_definition.json` | -| `loadDefinition.existingSecret` | Existing secret with the load definitions file | `""` | -| `command` | Override default container command (useful when using custom images) | `[]` | -| `args` | Override default container args (useful when using custom images) | `[]` | -| `lifecycleHooks` | Overwrite livecycle for the RabbitMQ container(s) to automate configuration before or after startup | `{}` | -| `terminationGracePeriodSeconds` | Default duration in seconds k8s waits for container to exit before sending kill signal. | `120` | -| `extraEnvVars` | Extra environment variables to add to RabbitMQ pods | `[]` | -| `extraEnvVarsCM` | Name of existing ConfigMap containing extra environment variables | `""` | -| `extraEnvVarsSecret` | Name of existing Secret containing extra environment variables (in case of sensitive data) | `""` | -| `containerPorts.amqp` | | `5672` | -| `containerPorts.amqpTls` | | `5671` | -| `containerPorts.dist` | | `25672` | -| `containerPorts.manager` | | `15672` | -| `containerPorts.epmd` | | `4369` | -| `containerPorts.metrics` | | `9419` | -| `extraContainerPorts` | Extra ports to be included in container spec, primarily informational | `[]` | -| `configuration` | RabbitMQ Configuration file content: required cluster configuration | `""` | -| `extraConfiguration` | Configuration file content: extra configuration to be appended to RabbitMQ configuration | `""` | -| `advancedConfiguration` | Configuration file content: advanced configuration | `""` | -| `ldap.enabled` | Enable LDAP support | `false` | -| `ldap.servers` | List of LDAP servers hostnames | `[]` | -| `ldap.port` | LDAP servers port | `389` | -| `ldap.user_dn_pattern` | Pattern used to translate the provided username into a value to be used for the LDAP bind | `cn=${username},dc=example,dc=org` | -| `ldap.tls.enabled` | If you enable TLS/SSL you can set advanced options using the `advancedConfiguration` parameter | `false` | -| `extraVolumeMounts` | Optionally specify extra list of additional volumeMounts | `[]` | -| `extraVolumes` | Optionally specify extra list of additional volumes . | `[]` | -| `extraSecrets` | Optionally specify extra secrets to be created by the chart. | `{}` | -| `extraSecretsPrependReleaseName` | Set this flag to true if extraSecrets should be created with prepended. | `false` | +| Name | Description | Value | +| ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- | +| `nameOverride` | String to partially override rabbitmq.fullname template (will maintain the release name) | `""` | +| `fullnameOverride` | String to fully override rabbitmq.fullname template | `""` | +| `namespaceOverride` | String to fully override common.names.namespace | `""` | +| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` | +| `clusterDomain` | Kubernetes Cluster Domain | `cluster.local` | +| `extraDeploy` | Array of extra objects to deploy with the release | `[]` | +| `commonAnnotations` | Annotations to add to all deployed objects | `{}` | +| `commonLabels` | Labels to add to all deployed objects | `{}` | +| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | +| `diagnosticMode.command` | Command to override all containers in the deployment | `["sleep"]` | +| `diagnosticMode.args` | Args to override all containers in the deployment | `["infinity"]` | +| `hostAliases` | Deployment pod host aliases | `[]` | +| `dnsPolicy` | DNS Policy for pod | `""` | +| `dnsConfig` | DNS Configuration pod | `{}` | +| `auth.username` | RabbitMQ application username | `user` | +| `auth.password` | RabbitMQ application password | `""` | +| `auth.existingPasswordSecret` | Existing secret with RabbitMQ credentials (must contain a value for `rabbitmq-password` key) | `""` | +| `auth.erlangCookie` | Erlang cookie to determine whether different nodes are allowed to communicate with each other | `""` | +| `auth.existingErlangSecret` | Existing secret with RabbitMQ Erlang cookie (must contain a value for `rabbitmq-erlang-cookie` key) | `""` | +| `auth.tls.enabled` | Enable TLS support on RabbitMQ | `false` | +| `auth.tls.autoGenerated` | Generate automatically self-signed TLS certificates | `false` | +| `auth.tls.failIfNoPeerCert` | When set to true, TLS connection will be rejected if client fails to provide a certificate | `true` | +| `auth.tls.sslOptionsVerify` | Should [peer verification](https://www.rabbitmq.com/ssl.html#peer-verification) be enabled? | `verify_peer` | +| `auth.tls.caCertificate` | Certificate Authority (CA) bundle content | `""` | +| `auth.tls.serverCertificate` | Server certificate content | `""` | +| `auth.tls.serverKey` | Server private key content | `""` | +| `auth.tls.existingSecret` | Existing secret with certificate content to RabbitMQ credentials | `""` | +| `auth.tls.existingSecretFullChain` | Whether or not the existing secret contains the full chain in the certificate (`tls.crt`). Will be used in place of `ca.cert` if `true`. | `false` | +| `logs` | Path of the RabbitMQ server's Erlang log file. Value for the `RABBITMQ_LOGS` environment variable | `-` | +| `ulimitNofiles` | RabbitMQ Max File Descriptors | `65536` | +| `maxAvailableSchedulers` | RabbitMQ maximum available scheduler threads | `""` | +| `onlineSchedulers` | RabbitMQ online scheduler threads | `""` | +| `memoryHighWatermark.enabled` | Enable configuring Memory high watermark on RabbitMQ | `false` | +| `memoryHighWatermark.type` | Memory high watermark type. Either `absolute` or `relative` | `relative` | +| `memoryHighWatermark.value` | Memory high watermark value | `0.4` | +| `plugins` | List of default plugins to enable (should only be altered to remove defaults; for additional plugins use `extraPlugins`) | `rabbitmq_management rabbitmq_peer_discovery_k8s` | +| `communityPlugins` | List of Community plugins (URLs) to be downloaded during container initialization | `""` | +| `extraPlugins` | Extra plugins to enable (single string containing a space-separated list) | `rabbitmq_auth_backend_ldap` | +| `clustering.enabled` | Enable RabbitMQ clustering | `true` | +| `clustering.addressType` | Switch clustering mode. Either `ip` or `hostname` | `hostname` | +| `clustering.rebalance` | Rebalance master for queues in cluster when new replica is created | `false` | +| `clustering.forceBoot` | Force boot of an unexpectedly shut down cluster (in an unexpected order). | `false` | +| `clustering.partitionHandling` | Switch Partition Handling Strategy. Either `autoheal` or `pause-minority` or `pause-if-all-down` or `ignore` | `autoheal` | +| `loadDefinition.enabled` | Enable loading a RabbitMQ definitions file to configure RabbitMQ | `false` | +| `loadDefinition.file` | Name of the definitions file | `/app/load_definition.json` | +| `loadDefinition.existingSecret` | Existing secret with the load definitions file | `""` | +| `command` | Override default container command (useful when using custom images) | `[]` | +| `args` | Override default container args (useful when using custom images) | `[]` | +| `lifecycleHooks` | Overwrite livecycle for the RabbitMQ container(s) to automate configuration before or after startup | `{}` | +| `terminationGracePeriodSeconds` | Default duration in seconds k8s waits for container to exit before sending kill signal. | `120` | +| `extraEnvVars` | Extra environment variables to add to RabbitMQ pods | `[]` | +| `extraEnvVarsCM` | Name of existing ConfigMap containing extra environment variables | `""` | +| `extraEnvVarsSecret` | Name of existing Secret containing extra environment variables (in case of sensitive data) | `""` | +| `containerPorts.amqp` | | `5672` | +| `containerPorts.amqpTls` | | `5671` | +| `containerPorts.dist` | | `25672` | +| `containerPorts.manager` | | `15672` | +| `containerPorts.epmd` | | `4369` | +| `containerPorts.metrics` | | `9419` | +| `extraContainerPorts` | Extra ports to be included in container spec, primarily informational | `[]` | +| `configuration` | RabbitMQ Configuration file content: required cluster configuration | `""` | +| `extraConfiguration` | Configuration file content: extra configuration to be appended to RabbitMQ configuration | `""` | +| `advancedConfiguration` | Configuration file content: advanced configuration | `""` | +| `ldap.enabled` | Enable LDAP support | `false` | +| `ldap.uri` | LDAP connection string. | `""` | +| `ldap.servers` | List of LDAP servers hostnames. This is valid only if ldap.uri is not set | `[]` | +| `ldap.port` | LDAP servers port. This is valid only if ldap.uri is not set | `""` | +| `ldap.userDnPattern` | Pattern used to translate the provided username into a value to be used for the LDAP bind. | `""` | +| `ldap.binddn` | DN of the account used to search in the LDAP server. | `""` | +| `ldap.bindpw` | Password for binddn account. | `""` | +| `ldap.basedn` | Base DN path where binddn account will search for the users. | `""` | +| `ldap.uidField` | Field used to match with the user name (uid, samAccountName, cn, etc). It matches with 'dn_lookup_attribute' in RabbitMQ configuration | `""` | +| `ldap.uidField` | Field used to match with the user name (uid, samAccountName, cn, etc). It matches with 'dn_lookup_attribute' in RabbitMQ configuration | `""` | +| `ldap.authorisationEnabled` | Enable LDAP authorisation. Please set 'advancedConfiguration' with tag, topic, resources and vhost mappings | `false` | +| `ldap.tls.enabled` | Enabled TLS configuration. | `false` | +| `ldap.tls.startTls` | Use STARTTLS instead of LDAPS. | `false` | +| `ldap.tls.skipVerify` | Skip any SSL verification (hostanames or certificates) | `false` | +| `ldap.tls.verify` | Verify connection. Valid values are 'verify_peer' or 'verify_none' | `verify_peer` | +| `ldap.tls.certificatesMountPath` | Where LDAP certifcates are mounted. | `/opt/bitnami/rabbitmq/ldap/certs` | +| `ldap.tls.certificatesSecret` | Secret with LDAP certificates. | `""` | +| `ldap.tls.CAFilename` | CA certificate filename. Should match with the CA entry key in the ldap.tls.certificatesSecret. | `""` | +| `ldap.tls.certFilename` | Client certificate filename to authenticate against the LDAP server. Should match with certificate the entry key in the ldap.tls.certificatesSecret. | `""` | +| `ldap.tls.certKeyFilename` | Client Key filename to authenticate against the LDAP server. Should match with certificate the entry key in the ldap.tls.certificatesSecret. | `""` | +| `extraVolumeMounts` | Optionally specify extra list of additional volumeMounts | `[]` | +| `extraVolumes` | Optionally specify extra list of additional volumes . | `[]` | +| `extraSecrets` | Optionally specify extra secrets to be created by the chart. | `{}` | +| `extraSecretsPrependReleaseName` | Set this flag to true if extraSecrets should be created with prepended. | `false` | ### Statefulset parameters @@ -322,7 +337,7 @@ The command removes all the Kubernetes components associated with the chart and | `volumePermissions.enabled` | Enable init container that changes the owner and group of the persistent volume(s) mountpoint to `runAsUser:fsGroup` | `false` | | `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | | `volumePermissions.image.repository` | Init container volume-permissions image repository | `bitnami/bitnami-shell` | -| `volumePermissions.image.tag` | Init container volume-permissions image tag | `10-debian-10-r431` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `10-debian-10-r436` | | `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `IfNotPresent` | | `volumePermissions.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | | `volumePermissions.resources.limits` | Init container volume-permissions resource limits | `{}` | diff --git a/bitnami/rabbitmq/templates/_helpers.tpl b/bitnami/rabbitmq/templates/_helpers.tpl index 88b26c1f4..c057e28a6 100644 --- a/bitnami/rabbitmq/templates/_helpers.tpl +++ b/bitnami/rabbitmq/templates/_helpers.tpl @@ -147,16 +147,16 @@ Validate values of rabbitmq - LDAP support {{- define "rabbitmq.validateValues.ldap" -}} {{- if .Values.ldap.enabled }} {{- $serversListLength := len .Values.ldap.servers }} -{{- if or (not (gt $serversListLength 0)) (not (and .Values.ldap.port .Values.ldap.user_dn_pattern)) }} +{{- $userDnPattern := coalesce .Values.ldap.user_dn_pattern .Values.ldap.userDnPattern }} +{{- if or (and (not (gt $serversListLength 0)) (empty .Values.ldap.uri)) (and (not $userDnPattern) (not .Values.ldap.basedn)) }} rabbitmq: LDAP - Invalid LDAP configuration. When enabling LDAP support, the parameters "ldap.servers", - "ldap.port", and "ldap. user_dn_pattern" are mandatory. Please provide them: - + Invalid LDAP configuration. When enabling LDAP support, the parameters "ldap.servers" or "ldap.uri" are mandatory + to configure the connection and "ldap.userDnPattern" or "ldap.basedn" are necessary to lookup the users. Please provide them: $ helm install {{ .Release.Name }} bitnami/rabbitmq \ --set ldap.enabled=true \ - --set ldap.servers[0]="lmy-ldap-server" \ + --set ldap.servers[0]=my-ldap-server" \ --set ldap.port="389" \ - --set user_dn_pattern="cn=${username},dc=example,dc=org" + --set ldap.userDnPattern="cn=${username},dc=example,dc=org" {{- end -}} {{- end -}} {{- end -}} diff --git a/bitnami/rabbitmq/templates/configuration.yaml b/bitnami/rabbitmq/templates/config-secret.yaml similarity index 85% rename from bitnami/rabbitmq/templates/configuration.yaml rename to bitnami/rabbitmq/templates/config-secret.yaml index 9ffb538c8..80e93e67c 100644 --- a/bitnami/rabbitmq/templates/configuration.yaml +++ b/bitnami/rabbitmq/templates/config-secret.yaml @@ -1,5 +1,5 @@ apiVersion: v1 -kind: ConfigMap +kind: Secret metadata: name: {{ printf "%s-config" (include "common.names.fullname" .) }} namespace: {{ include "common.names.namespace" . | quote }} @@ -10,10 +10,11 @@ metadata: {{- if .Values.commonAnnotations }} annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} {{- end }} +type: Opaque data: rabbitmq.conf: |- - {{- include "common.tplvalues.render" (dict "value" .Values.configuration "context" $) | nindent 4 }} + {{- include "common.tplvalues.render" (dict "value" .Values.configuration "context" $) | b64enc | nindent 4 }} {{- if .Values.advancedConfiguration }} advanced.config: |- - {{- include "common.tplvalues.render" (dict "value" .Values.advancedConfiguration "context" $) | nindent 4 }} + {{- include "common.tplvalues.render" (dict "value" .Values.advancedConfiguration "context" $) | b64enc | nindent 4 }} {{- end }} diff --git a/bitnami/rabbitmq/templates/statefulset.yaml b/bitnami/rabbitmq/templates/statefulset.yaml index b46b4ac16..fe90d80f1 100644 --- a/bitnami/rabbitmq/templates/statefulset.yaml +++ b/bitnami/rabbitmq/templates/statefulset.yaml @@ -32,7 +32,7 @@ spec: {{- if .Values.commonAnnotations }} {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 8 }} {{- end }} - checksum/config: {{ include (print $.Template.BasePath "/configuration.yaml") . | sha256sum }} + checksum/config: {{ include (print $.Template.BasePath "/config-secret.yaml") . | sha256sum }} {{- if or (not .Values.auth.existingErlangSecret) (not .Values.auth.existingPasswordSecret) .Values.extraSecrets }} checksum/secret: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} {{- end }} @@ -300,6 +300,10 @@ spec: - name: certs mountPath: /opt/bitnami/rabbitmq/certs {{- end }} + {{- if and .Values.ldap.tls.enabled .Values.ldap.tls.certificatesSecret }} + - name: ldap-certs + mountPath: {{ .Values.ldap.tls.certificatesMountPath }} + {{- end }} {{- if .Values.loadDefinition.enabled }} - name: load-definition-volume mountPath: /app @@ -324,9 +328,14 @@ spec: - key: tls.key path: server_key.pem {{- end }} + {{- if and .Values.ldap.tls.enabled .Values.ldap.tls.certificatesSecret }} + - name: ldap-certs + secret: + secretName: {{ .Values.ldap.tls.certificatesSecret }} + {{- end }} - name: configuration - configMap: - name: {{ printf "%s-config" (include "common.names.fullname" .) }} + secret: + secretName: {{ printf "%s-config" (include "common.names.fullname" .) }} items: - key: rabbitmq.conf path: rabbitmq.conf diff --git a/bitnami/rabbitmq/values.yaml b/bitnami/rabbitmq/values.yaml index f0624ce41..6156cd399 100644 --- a/bitnami/rabbitmq/values.yaml +++ b/bitnami/rabbitmq/values.yaml @@ -331,15 +331,51 @@ configuration: |- ssl_options.keyfile = /opt/bitnami/rabbitmq/certs/server_key.pem {{- end }} {{- if .Values.ldap.enabled }} - auth_backends.1 = rabbit_auth_backend_ldap + auth_backends.1.authn = ldap + auth_backends.1.authz = {{ ternary "ldap" "internal" .Values.ldap.authorisationEnabled }} auth_backends.2 = internal - {{- range $index, $server := .Values.ldap.servers }} + {{- $host := list }} + {{- $port := ternary 636 389 .Values.ldap.tls.enabled }} + {{- if .Values.ldap.uri }} + {{- $hostPort := get (urlParse .Values.ldap.uri) "host" }} + {{- $host = list (index (splitList ":" $hostPort) 0) -}} + {{- if (contains ":" $hostPort) }} + {{- $port = index (splitList ":" $hostPort) 1 -}} + {{- end }} + {{- end }} + {{- range $index, $server := concat $host .Values.ldap.servers }} auth_ldap.servers.{{ add $index 1 }} = {{ $server }} {{- end }} - auth_ldap.port = {{ .Values.ldap.port }} - auth_ldap.user_dn_pattern = {{ .Values.ldap.user_dn_pattern }} + auth_ldap.port = {{ coalesce .Values.ldap.port $port }} + {{- if or .Values.ldap.user_dn_pattern .Values.ldap.userDnPattern }} + auth_ldap.user_dn_pattern = {{ coalesce .Values.ldap.user_dn_pattern .Values.ldap.userDnPattern }} + {{- end }} + {{- if .Values.ldap.basedn }} + auth_ldap.dn_lookup_base = {{ .Values.ldap.basedn }} + {{- end }} + {{- if .Values.ldap.uidField }} + auth_ldap.dn_lookup_attribute = {{ .Values.ldap.uidField }} + {{- end }} + {{- if .Values.ldap.binddn }} + auth_ldap.dn_lookup_bind.user_dn = {{ .Values.ldap.binddn }} + auth_ldap.dn_lookup_bind.password = {{ required "'ldap.bindpw' is required when 'ldap.binddn' is defined" .Values.ldap.bindpw }} + {{- end }} {{- if .Values.ldap.tls.enabled }} - auth_ldap.use_ssl = true + auth_ldap.use_ssl = {{ not .Values.ldap.tls.startTls }} + auth_ldap.use_starttls = {{ .Values.ldap.tls.startTls }} + {{- if .Values.ldap.tls.CAFilename }} + auth_ldap.ssl_options.cacertfile = {{ .Values.ldap.tls.certificatesMountPath }}/{{ .Values.ldap.tls.CAFilename }} + {{- end }} + {{- if .Values.ldap.tls.certFilename }} + auth_ldap.ssl_options.certfile = {{ .Values.ldap.tls.certificatesMountPath }}/{{ .Values.ldap.tls.certFilename }} + auth_ldap.ssl_options.keyfile = {{ .Values.ldap.tls.certificatesMountPath }}/{{ required "'ldap.tls.certKeyFilename' is required when 'ldap.tls.certFilename' is defined" .Values.ldap.tls.certKeyFilename }} + {{- end }} + {{- if .Values.ldap.tls.skipVerify }} + auth_ldap.ssl_options.verify = verify_none + auth_ldap.ssl_options.fail_if_no_peer_cert = false + {{- else if .Values.ldap.tls.verify }} + auth_ldap.ssl_options.verify = {{ .Values.ldap.tls.verify }} + {{- end }} {{- end }} {{- end }} {{- if .Values.metrics.enabled }} @@ -364,20 +400,12 @@ extraConfiguration: |- ## @param advancedConfiguration Configuration file content: advanced configuration ## Use this as additional configuration in classic config format (Erlang term configuration format) ## -## If you set LDAP with TLS/SSL enabled and you are using self-signed certificates, uncomment these lines. +## LDAP authorisation example: ## advancedConfiguration: |- -## [{ -## rabbitmq_auth_backend_ldap, -## [{ -## ssl_options, -## [{ -## verify, verify_none -## }, { -## fail_if_no_peer_cert, -## false -## }] -## ]} -## }]. +## [{rabbitmq_auth_backend_ldap,[ +## {tag_queries, [{administrator, {constant, true}}, +## {management, {constant, true}}]} +## ]}]. ## advancedConfiguration: |- @@ -387,21 +415,60 @@ ldap: ## @param ldap.enabled Enable LDAP support ## enabled: false - ## @param ldap.servers List of LDAP servers hostnames + ## @param ldap.uri LDAP connection string. + ## + uri: "" + ## @param ldap.servers List of LDAP servers hostnames. This is valid only if ldap.uri is not set ## servers: [] - ## @param ldap.port LDAP servers port + ## @param ldap.port LDAP servers port. This is valid only if ldap.uri is not set ## - port: "389" + port: "" + + ## DEPRECATED ldap.user_dn_pattern it will removed in a future, please use userDnPattern instead ## Pattern used to translate the provided username into a value to be used for the LDAP bind - ## @param ldap.user_dn_pattern Pattern used to translate the provided username into a value to be used for the LDAP bind + ## @param ldap.userDnPattern Pattern used to translate the provided username into a value to be used for the LDAP bind. ## ref: https://www.rabbitmq.com/ldap.html#usernames-and-dns ## - user_dn_pattern: cn=${username},dc=example,dc=org + userDnPattern: "" + ## @param ldap.binddn DN of the account used to search in the LDAP server. + ## + binddn: "" + ## @param ldap.bindpw Password for binddn account. + ## + bindpw: "" + ## @param ldap.basedn Base DN path where binddn account will search for the users. + ## + basedn: "" + ## @param ldap.uidField Field used to match with the user name (uid, samAccountName, cn, etc). It matches with 'dn_lookup_attribute' in RabbitMQ configuration + ## ref: https://www.rabbitmq.com/ldap.html#usernames-and-dns + ## + ## @param ldap.uidField Field used to match with the user name (uid, samAccountName, cn, etc). It matches with 'dn_lookup_attribute' in RabbitMQ configuration + uidField: "" + ## @param ldap.authorisationEnabled Enable LDAP authorisation. Please set 'advancedConfiguration' with tag, topic, resources and vhost mappings + ## ref: https://www.rabbitmq.com/ldap.html#authorisation + ## + authorisationEnabled: false + ## @param ldap.tls.enabled Enabled TLS configuration. + ## @param ldap.tls.startTls Use STARTTLS instead of LDAPS. + ## @param ldap.tls.skipVerify Skip any SSL verification (hostanames or certificates) + ## @param ldap.tls.verify Verify connection. Valid values are 'verify_peer' or 'verify_none' + ## @param ldap.tls.certificatesMountPath Where LDAP certifcates are mounted. + ## @param ldap.tls.certificatesSecret Secret with LDAP certificates. + ## @param ldap.tls.CAFilename CA certificate filename. Should match with the CA entry key in the ldap.tls.certificatesSecret. + ## @param ldap.tls.certFilename Client certificate filename to authenticate against the LDAP server. Should match with certificate the entry key in the ldap.tls.certificatesSecret. + ## @param ldap.tls.certKeyFilename Client Key filename to authenticate against the LDAP server. Should match with certificate the entry key in the ldap.tls.certificatesSecret. + ## tls: - ## @param ldap.tls.enabled If you enable TLS/SSL you can set advanced options using the `advancedConfiguration` parameter - ## enabled: false + startTls: false + skipVerify: false + verify: "verify_peer" + certificatesMountPath: /opt/bitnami/rabbitmq/ldap/certs + certificatesSecret: "" + CAFilename: "" + certFilename: "" + certKeyFilename: "" ## @param extraVolumeMounts Optionally specify extra list of additional volumeMounts ## Examples: