# RabbitMQ Cluster Operator A Helm chart for the RabbitMQ Cluster Operator. This operator manages RabbitMQ clusters on Kubernetes, providing automated provisioning, scaling, and management of RabbitMQ instances. ## Prerequisites - Kubernetes 1.19+ - Helm 3.2.0+ - PV provisioner support in the underlying infrastructure (if persistence is enabled) ## Installing the Chart To install the chart with the release name `my-rabbitmq-operator`: ```bash $ helm install my-rabbitmq-operator oci://registry-1.docker.io/cloudpirates/rabbitmq-cluster-operator ``` Or install directly from the local chart: ```bash $ helm install my-rabbitmq-operator ./charts/rabbitmq-cluster-operator ``` The command deploys the RabbitMQ Cluster Operator on the Kubernetes cluster in the default configuration. The [Configuration](#configuration) section lists the parameters that can be configured during installation. ## Uninstalling the Chart To uninstall/delete the `my-rabbitmq-operator` deployment: ```bash $ helm uninstall my-rabbitmq-operator ``` The command removes all the Kubernetes components associated with the chart and deletes the release. ## Security & Signature Verification This Helm chart is cryptographically signed with Cosign to ensure authenticity and prevent tampering. **Public Key:** ``` -----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE5U+rM2d3hDjgP5T3cLShuuQIU9vR Z4/G+Nug6q5vRa+C3qUA1wXjbaJFAfcIrv5VjmYAYOj13shnPpp3Zh4fnQ== -----END PUBLIC KEY----- ``` To verify the helm chart before installation, copy the public key to the file `cosign.pub` and run cosign: ```bash cosign verify --key cosign.pub registry-1.docker.io/cloudpirates/rabbitmq-cluster-operator: ``` ## Configuration The following table lists the configurable values of the RabbitMQ chart and their defaults. ### Global Configuration | Name | Description | Value | | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | | `global.imageRegistry` | Global Docker image registry | `""` | | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` | | `global.defaultStorageClass` | Global default StorageClass for Persistent Volume(s) | `""` | | `global.storageClass` | DEPRECATED: use global.defaultStorageClass instead | `""` | | `global.compatibility.openshift.adaptSecurityContext` | Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) | `auto` | ### Common Configuration | Name | Description | Value | | ------------------------ | ---------------------------------------------------- | --------------- | | `kubeVersion` | Override Kubernetes version | `""` | | `nameOverride` | String to partially override common.names.fullname | `""` | | `fullnameOverride` | String to fully override common.names.fullname | `""` | | `namespaceOverride` | String to override the namespace for all resources | `""` | | `commonLabels` | Labels to add to all deployed objects | `{}` | | `commonAnnotations` | Annotations to add to all deployed objects | `{}` | | `clusterDomain` | Kubernetes cluster domain name | `cluster.local` | | `extraDeploy` | Array of extra objects to deploy with the release | `[]` | | `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled) | `false` | ### RabbitMQ Cluster Operator Configuration | Name | Description | Value | | ------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ | | `rabbitmqImage.registry` | RabbitMQ Image registry | `REGISTRY_NAME` | | `rabbitmqImage.repository` | RabbitMQ Image repository | `REPOSITORY_NAME/rabbitmq` | | `rabbitmqImage.tag` | RabbitMQ Image tag (immutable tags are recommended) | `4.3.2-management-alpine` | | `rabbitmqImage.pullSecrets` | RabbitMQ Image pull secrets | `[]` | | `credentialUpdaterImage.registry` | RabbitMQ Default User Credential Updater image registry | `REGISTRY_NAME` | | `credentialUpdaterImage.repository` | RabbitMQ Default User Credential Updater image repository | `REPOSITORY_NAME/rmq-default-credential-updater` | | `credentialUpdaterImage.tag` | RabbitMQ Default User Credential Updater image tag (immutable tags are recommended) | `1.0.15` | | `credentialUpdaterImage.pullSecrets` | RabbitMQ Default User Credential Updater image pull secrets | `[]` | | `clusterOperator.image.registry` | RabbitMQ Cluster Operator image registry | `REGISTRY_NAME` | | `clusterOperator.image.repository` | RabbitMQ Cluster Operator image repository | `REPOSITORY_NAME/rabbitmq-cluster-operator` | | `clusterOperator.image.tag` | RabbitMQ Cluster Operator image tag (immutable tags are recommended) | `2.22.1` | | `clusterOperator.image.pullPolicy` | RabbitMQ Cluster Operator image pull policy | `IfNotPresent` | | `clusterOperator.image.pullSecrets` | RabbitMQ Cluster Operator image pull secrets | `[]` | | `clusterOperator.revisionHistoryLimit` | sets number of replicaset to keep in k8s | `10` | | `clusterOperator.watchAllNamespaces` | Watch for resources in all namespaces | `true` | | `clusterOperator.watchNamespaces` | Watch for resources in the given namespaces (ignored if watchAllNamespaces=true) | `[]` | | `clusterOperator.replicaCount` | Number of RabbitMQ Cluster Operator replicas to deploy | `1` | | `clusterOperator.schedulerName` | Alternative scheduler | `""` | | `clusterOperator.topologySpreadConstraints` | Topology Spread Constraints for pod assignment | `[]` | | `clusterOperator.terminationGracePeriodSeconds` | In seconds, time the given to the %%MAIN_CONTAINER_NAME%% pod needs to terminate gracefully | `""` | | `clusterOperator.livenessProbe.enabled` | Enable livenessProbe on RabbitMQ Cluster Operator nodes | `true` | | `clusterOperator.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | | `clusterOperator.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `30` | | `clusterOperator.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | | `clusterOperator.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `5` | | `clusterOperator.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | | `clusterOperator.readinessProbe.enabled` | Enable readinessProbe on RabbitMQ Cluster Operator nodes | `true` | | `clusterOperator.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | | `clusterOperator.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `30` | | `clusterOperator.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | | `clusterOperator.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `5` | | `clusterOperator.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | | `clusterOperator.startupProbe.enabled` | Enable startupProbe on RabbitMQ Cluster Operator nodes | `false` | | `clusterOperator.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | | `clusterOperator.startupProbe.periodSeconds` | Period seconds for startupProbe | `30` | | `clusterOperator.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | | `clusterOperator.startupProbe.failureThreshold` | Failure threshold for startupProbe | `5` | | `clusterOperator.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | | `clusterOperator.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | | `clusterOperator.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | | `clusterOperator.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | | `clusterOperator.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | | `clusterOperator.pdb.create` | Enable a Pod Disruption Budget creation | `true` | | `clusterOperator.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` | | `clusterOperator.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable | `""` | | `clusterOperator.podSecurityContext.enabled` | Enabled RabbitMQ Cluster Operator pods' Security Context | `true` | | `clusterOperator.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` | | `clusterOperator.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` | | `clusterOperator.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` | | `clusterOperator.podSecurityContext.fsGroup` | Set RabbitMQ Cluster Operator pod's Security Context fsGroup | `1001` | | `clusterOperator.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` | | `clusterOperator.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` | | `clusterOperator.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` | | `clusterOperator.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `1001` | | `clusterOperator.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | | `clusterOperator.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` | | `clusterOperator.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `true` | | `clusterOperator.containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` | | `clusterOperator.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | | `clusterOperator.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | | `clusterOperator.command` | Override default container command (useful when using custom images) | `[]` | | `clusterOperator.args` | Override default container args (useful when using custom images) | `[]` | | `clusterOperator.logLevel` | Log level for the Cluster Operator. When set, adds `--zap-log-level=` to the default args (debug, info, error). Ignored when `clusterOperator.args` is set. | `""` | | `clusterOperator.extraArgs` | Additional container args appended to the default args (ignored when `clusterOperator.args` is set) | `[]` | | `clusterOperator.automountServiceAccountToken` | Mount Service Account token in pod | `true` | | `clusterOperator.hostAliases` | RabbitMQ Cluster Operator pods host aliases | `[]` | | `clusterOperator.podLabels` | Extra labels for RabbitMQ Cluster Operator pods | `{}` | | `clusterOperator.podAnnotations` | Annotations for RabbitMQ Cluster Operator pods | `{}` | | `clusterOperator.affinity` | Affinity for RabbitMQ Cluster Operator pods assignment | `{}` | | `clusterOperator.nodeSelector` | Node labels for RabbitMQ Cluster Operator pods assignment | `{}` | | `clusterOperator.tolerations` | Tolerations for RabbitMQ Cluster Operator pods assignment | `[]` | | `clusterOperator.updateStrategy.type` | RabbitMQ Cluster Operator statefulset strategy type | `RollingUpdate` | | `clusterOperator.priorityClassName` | RabbitMQ Cluster Operator pods' priorityClassName | `""` | | `clusterOperator.lifecycleHooks` | for the RabbitMQ Cluster Operator container(s) to automate configuration before or after startup | `{}` | | `clusterOperator.containerPorts.metrics` | RabbitMQ Cluster Operator container port (used for metrics) | `9782` | | `clusterOperator.containerPorts.health` | RabbitMQ Cluster Operator container port (used for /healthz and /readyz probes) | `8081` | | `clusterOperator.extraEnvVars` | Array with extra environment variables to add to RabbitMQ Cluster Operator nodes | `[]` | | `clusterOperator.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for RabbitMQ Cluster Operator nodes | `""` | | `clusterOperator.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for RabbitMQ Cluster Operator nodes | `""` | | `clusterOperator.extraVolumes` | Optionally specify extra list of additional volumes for the RabbitMQ Cluster Operator pod(s) | `[]` | | `clusterOperator.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the RabbitMQ Cluster Operator container(s) | `[]` | | `clusterOperator.sidecars` | Add additional sidecar containers to the RabbitMQ Cluster Operator pod(s) | `[]` | | `clusterOperator.initContainers` | Add additional init containers to the RabbitMQ Cluster Operator pod(s) | `[]` | | `clusterOperator.webhook.enabled` | Enable the RabbitmqCluster admission webhook (requires TLS serving certificates) | `false` | | `clusterOperator.webhook.existingWebhookCertSecret` | Name of an existing secret containing the webhook certificates (use it to avoid the chart generating one) | `""` | | `clusterOperator.webhook.existingWebhookCertCABundle` | PEM-encoded CA Bundle of the existing secret provided in existingWebhookCertSecret (only if useCertManager=false) | `""` | | `clusterOperator.webhook.service.type` | RabbitMQ Cluster Operator webhook service type | `ClusterIP` | | `clusterOperator.webhook.service.port` | RabbitMQ Cluster Operator webhook service port | `443` | | `clusterOperator.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | | `clusterOperator.networkPolicy.kubeAPIServerPorts` | List of possible endpoints to kube-apiserver (limit to your cluster settings to increase security) | `[]` | | `clusterOperator.networkPolicy.allowExternal` | Don't require injector label for connections | `true` | | `clusterOperator.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | | `clusterOperator.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | | `clusterOperator.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `[]` | | `clusterOperator.networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` | | `clusterOperator.networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` | | `clusterOperator.rbac.create` | Specifies whether RBAC resources should be created | `true` | | `clusterOperator.rbac.clusterRole.customRules` | Define custom access rules for the ClusterRole | `[]` | | `clusterOperator.rbac.clusterRole.extraRules` | Define extra access rules for the ClusterRole. This has no effect if customerRules is a non-empty array. | `[]` | | `clusterOperator.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | | `clusterOperator.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | | `clusterOperator.serviceAccount.annotations` | Add annotations | `{}` | | `clusterOperator.serviceAccount.automountServiceAccountToken` | Automount API credentials for a service account. | `false` | ### RabbitMQ Cluster Operator Metrics parameters | Name | Description | Value | | ---------------------------------------------------------- | ---------------------------------------------------------------------------------- | ------------------------ | | `clusterOperator.metrics.service.enabled` | Create a service for accessing the metrics endpoint | `false` | | `clusterOperator.metrics.service.type` | RabbitMQ Cluster Operator metrics service type | `ClusterIP` | | `clusterOperator.metrics.service.ports.http` | RabbitMQ Cluster Operator metrics service HTTP port | `80` | | `clusterOperator.metrics.service.nodePorts.http` | Node port for HTTP | `""` | | `clusterOperator.metrics.service.clusterIP` | RabbitMQ Cluster Operator metrics service Cluster IP | `""` | | `clusterOperator.metrics.service.extraPorts` | Extra ports to expose (normally used with the `sidecar` value) | `[]` | | `clusterOperator.metrics.service.loadBalancerIP` | RabbitMQ Cluster Operator metrics service Load Balancer IP | `""` | | `clusterOperator.metrics.service.loadBalancerSourceRanges` | RabbitMQ Cluster Operator metrics service Load Balancer sources | `[]` | | `clusterOperator.metrics.service.externalTrafficPolicy` | RabbitMQ Cluster Operator metrics service external traffic policy | `Cluster` | | `clusterOperator.metrics.service.annotations` | Additional custom annotations for RabbitMQ Cluster Operator metrics service | `{}` | | `clusterOperator.metrics.service.sessionAffinity` | Session Affinity for Kubernetes service, can be "None" or "ClientIP" | `None` | | `clusterOperator.metrics.service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` | | `clusterOperator.metrics.serviceMonitor.enabled` | Specify if a servicemonitor will be deployed for prometheus-operator | `false` | | `clusterOperator.metrics.serviceMonitor.namespace` | Namespace which Prometheus is running in | `""` | | `clusterOperator.metrics.serviceMonitor.jobLabel` | Specify the jobLabel to use for the prometheus-operator | `app.kubernetes.io/name` | | `clusterOperator.metrics.serviceMonitor.honorLabels` | Honor metrics labels | `false` | | `clusterOperator.metrics.serviceMonitor.selector` | Prometheus instance selector labels | `{}` | | `clusterOperator.metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended | `""` | | `clusterOperator.metrics.serviceMonitor.interval` | Scrape interval. If not set, the Prometheus default scrape interval is used | `""` | | `clusterOperator.metrics.serviceMonitor.metricRelabelings` | Specify additional relabeling of metrics | `[]` | | `clusterOperator.metrics.serviceMonitor.relabelings` | Specify general relabeling | `[]` | | `clusterOperator.metrics.serviceMonitor.labels` | Extra labels for the ServiceMonitor | `{}` | | `clusterOperator.metrics.serviceMonitor.path` | Define the path used by ServiceMonitor to scrap metrics | `""` | | `clusterOperator.metrics.serviceMonitor.params` | Define the HTTP URL parameters used by ServiceMonitor | `{}` | | `clusterOperator.metrics.podMonitor.enabled` | Create PodMonitor Resource for scraping metrics using PrometheusOperator | `false` | | `clusterOperator.metrics.podMonitor.jobLabel` | Specify the jobLabel to use for the prometheus-operator | `app.kubernetes.io/name` | | `clusterOperator.metrics.podMonitor.namespace` | Namespace which Prometheus is running in | `""` | | `clusterOperator.metrics.podMonitor.honorLabels` | Honor metrics labels | `false` | | `clusterOperator.metrics.podMonitor.selector` | Prometheus instance selector labels | `{}` | | `clusterOperator.metrics.podMonitor.interval` | Specify the interval at which metrics should be scraped | `30s` | | `clusterOperator.metrics.podMonitor.scrapeTimeout` | Specify the timeout after which the scrape is ended | `30s` | | `clusterOperator.metrics.podMonitor.additionalLabels` | Additional labels that can be used so PodMonitors will be discovered by Prometheus | `{}` | | `clusterOperator.metrics.podMonitor.path` | Define HTTP path to scrape for metrics. | `""` | | `clusterOperator.metrics.podMonitor.relabelings` | Specify general relabeling | `[]` | | `clusterOperator.metrics.podMonitor.metricRelabelings` | Specify additional relabeling of metrics | `[]` | | `clusterOperator.metrics.podMonitor.params` | Define the HTTP URL parameters used by PodMonitor | `{}` | ### RabbitMQ Messaging Topology Operator Parameters | Name | Description | Value | | ----------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- | | `msgTopologyOperator.enabled` | Deploy RabbitMQ Messaging Topology Operator as part of the installation | `true` | | `msgTopologyOperator.image.registry` | RabbitMQ Messaging Topology Operator image registry | `REGISTRY_NAME` | | `msgTopologyOperator.image.repository` | RabbitMQ Messaging Topology Operator image repository | `REPOSITORY_NAME/rmq-messaging-topology-operator` | | `msgTopologyOperator.image.tag` | RabbitMQ Messaging Topology Operator image tag (immutable tags are recommended) | `1.19.3` | | `msgTopologyOperator.image.pullPolicy` | RabbitMQ Messaging Topology Operator image pull policy | `IfNotPresent` | | `msgTopologyOperator.image.pullSecrets` | RabbitMQ Messaging Topology Operator image pull secrets | `[]` | | `msgTopologyOperator.revisionHistoryLimit` | sets number of replicaset to keep in k8s | `10` | | `msgTopologyOperator.watchAllNamespaces` | Watch for resources in all namespaces | `true` | | `msgTopologyOperator.watchNamespaces` | Watch for resources in the given namespaces ## @param clusterOperator.watchNamespaces [array] Watch for resources in the given namespaces (ignored if watchAllNamespaces=true) | `[]` | | `msgTopologyOperator.replicaCount` | Number of RabbitMQ Messaging Topology Operator replicas to deploy | `1` | | `msgTopologyOperator.topologySpreadConstraints` | Topology Spread Constraints for pod assignment | `[]` | | `msgTopologyOperator.schedulerName` | Alternative scheduler | `""` | | `msgTopologyOperator.terminationGracePeriodSeconds` | In seconds, time the given to the %%MAIN_CONTAINER_NAME%% pod needs to terminate gracefully | `""` | | `msgTopologyOperator.hostNetwork` | Boolean | `false` | | `msgTopologyOperator.dnsPolicy` | Alternative DNS policy | `ClusterFirst` | | `msgTopologyOperator.livenessProbe.enabled` | Enable livenessProbe on RabbitMQ Messaging Topology Operator nodes | `true` | | `msgTopologyOperator.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | | `msgTopologyOperator.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `30` | | `msgTopologyOperator.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | | `msgTopologyOperator.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `5` | | `msgTopologyOperator.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | | `msgTopologyOperator.readinessProbe.enabled` | Enable readinessProbe on RabbitMQ Messaging Topology Operator nodes | `true` | | `msgTopologyOperator.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | | `msgTopologyOperator.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `30` | | `msgTopologyOperator.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | | `msgTopologyOperator.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `5` | | `msgTopologyOperator.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | | `msgTopologyOperator.startupProbe.enabled` | Enable startupProbe on RabbitMQ Messaging Topology Operator nodes | `false` | | `msgTopologyOperator.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | | `msgTopologyOperator.startupProbe.periodSeconds` | Period seconds for startupProbe | `30` | | `msgTopologyOperator.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | | `msgTopologyOperator.startupProbe.failureThreshold` | Failure threshold for startupProbe | `5` | | `msgTopologyOperator.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | | `msgTopologyOperator.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | | `msgTopologyOperator.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | | `msgTopologyOperator.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | | `msgTopologyOperator.skipCreateAdmissionWebhookConfig` | skip creation of ValidationWebhookConfiguration | `false` | | `msgTopologyOperator.existingWebhookCertSecret` | name of a secret containing the certificates (use it to avoid certManager creating one) | `""` | | `msgTopologyOperator.existingWebhookCertCABundle` | PEM-encoded CA Bundle of the existing secret provided in existingWebhookCertSecret (only if useCertManager=false) | `""` | | `msgTopologyOperator.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | | `msgTopologyOperator.pdb.create` | Enable a Pod Disruption Budget creation | `true` | | `msgTopologyOperator.pdb.minAvailable` | Minimum number/percentage of pods that should remain scheduled | `""` | | `msgTopologyOperator.pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable | `""` | | `msgTopologyOperator.podSecurityContext.enabled` | Enabled RabbitMQ Messaging Topology Operator pods' Security Context | `true` | | `msgTopologyOperator.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` | | `msgTopologyOperator.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` | | `msgTopologyOperator.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` | | `msgTopologyOperator.podSecurityContext.fsGroup` | Set RabbitMQ Messaging Topology Operator pod's Security Context fsGroup | `1001` | | `msgTopologyOperator.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` | | `msgTopologyOperator.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` | | `msgTopologyOperator.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` | | `msgTopologyOperator.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `1001` | | `msgTopologyOperator.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | | `msgTopologyOperator.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` | | `msgTopologyOperator.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `true` | | `msgTopologyOperator.containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` | | `msgTopologyOperator.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | | `msgTopologyOperator.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | | `msgTopologyOperator.fullnameOverride` | String to fully override rmqco.msgTopologyOperator.fullname template | `""` | | `msgTopologyOperator.command` | Override default container command (useful when using custom images) | `[]` | | `msgTopologyOperator.args` | Override default container args (useful when using custom images) | `[]` | | `msgTopologyOperator.logLevel` | Log level for the Messaging Topology Operator. Adds `--zap-log-level=` to the default args (debug, info, error). Defaults to `info` because the operator logs at debug by default; set to `""` to keep the built-in default. Ignored when `msgTopologyOperator.args` is set. | `"info"` | | `msgTopologyOperator.extraArgs` | Additional container args appended to the default args (ignored when `msgTopologyOperator.args` is set) | `[]` | | `msgTopologyOperator.automountServiceAccountToken` | Mount Service Account token in pod | `true` | | `msgTopologyOperator.hostAliases` | RabbitMQ Messaging Topology Operator pods host aliases | `[]` | | `msgTopologyOperator.podLabels` | Extra labels for RabbitMQ Messaging Topology Operator pods | `{}` | | `msgTopologyOperator.podAnnotations` | Annotations for RabbitMQ Messaging Topology Operator pods | `{}` | | `msgTopologyOperator.affinity` | Affinity for RabbitMQ Messaging Topology Operator pods assignment | `{}` | | `msgTopologyOperator.nodeSelector` | Node labels for RabbitMQ Messaging Topology Operator pods assignment | `{}` | | `msgTopologyOperator.tolerations` | Tolerations for RabbitMQ Messaging Topology Operator pods assignment | `[]` | | `msgTopologyOperator.updateStrategy.type` | RabbitMQ Messaging Topology Operator statefulset strategy type | `RollingUpdate` | | `msgTopologyOperator.priorityClassName` | RabbitMQ Messaging Topology Operator pods' priorityClassName | `""` | | `msgTopologyOperator.lifecycleHooks` | for the RabbitMQ Messaging Topology Operator container(s) to automate configuration before or after startup | `{}` | | `msgTopologyOperator.containerPorts.metrics` | RabbitMQ Messaging Topology Operator container port (used for metrics, HTTPS) | `8443` | | `msgTopologyOperator.containerPorts.health` | RabbitMQ Messaging Topology Operator container port (used for /healthz and /readyz probes) | `8081` | | `msgTopologyOperator.extraEnvVars` | Array with extra environment variables to add to RabbitMQ Messaging Topology Operator nodes | `[]` | | `msgTopologyOperator.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for RabbitMQ Messaging Topology Operator nodes | `""` | | `msgTopologyOperator.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for RabbitMQ Messaging Topology Operator nodes | `""` | | `msgTopologyOperator.extraVolumes` | Optionally specify extra list of additional volumes for the RabbitMQ Messaging Topology Operator pod(s) | `[]` | | `msgTopologyOperator.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the RabbitMQ Messaging Topology Operator container(s) | `[]` | | `msgTopologyOperator.sidecars` | Add additional sidecar containers to the RabbitMQ Messaging Topology Operator pod(s) | `[]` | | `msgTopologyOperator.initContainers` | Add additional init containers to the RabbitMQ Messaging Topology Operator pod(s) | `[]` | | `msgTopologyOperator.service.type` | RabbitMQ Messaging Topology Operator webhook service type | `ClusterIP` | | `msgTopologyOperator.service.ports.webhook` | RabbitMQ Messaging Topology Operator webhook service HTTP port | `443` | | `msgTopologyOperator.service.nodePorts.http` | Node port for HTTP | `""` | | `msgTopologyOperator.service.clusterIP` | RabbitMQ Messaging Topology Operator webhook service Cluster IP | `""` | | `msgTopologyOperator.service.loadBalancerIP` | RabbitMQ Messaging Topology Operator webhook service Load Balancer IP | `""` | | `msgTopologyOperator.service.extraPorts` | Extra ports to expose (normally used with the `sidecar` value) | `[]` | | `msgTopologyOperator.service.loadBalancerSourceRanges` | RabbitMQ Messaging Topology Operator webhook service Load Balancer sources | `[]` | | `msgTopologyOperator.service.externalTrafficPolicy` | RabbitMQ Messaging Topology Operator webhook service external traffic policy | `Cluster` | | `msgTopologyOperator.service.annotations` | Additional custom annotations for RabbitMQ Messaging Topology Operator webhook service | `{}` | | `msgTopologyOperator.service.sessionAffinity` | Session Affinity for Kubernetes service, can be "None" or "ClientIP" | `None` | | `msgTopologyOperator.service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` | | `msgTopologyOperator.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | | `msgTopologyOperator.networkPolicy.kubeAPIServerPorts` | List of possible endpoints to kube-apiserver (limit to your cluster settings to increase security) | `[]` | | `msgTopologyOperator.networkPolicy.allowExternal` | Don't require injector label for connections | `true` | | `msgTopologyOperator.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | | `msgTopologyOperator.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | | `msgTopologyOperator.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `[]` | | `msgTopologyOperator.networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` | | `msgTopologyOperator.networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` | | `msgTopologyOperator.rbac.create` | Specifies whether RBAC resources should be created | `true` | | `msgTopologyOperator.rbac.clusterRole.customRules` | Define custom access rules for the ClusterRole | `[]` | | `msgTopologyOperator.rbac.clusterRole.extraRules` | Define extra access rules for the ClusterRole. This has no effect if customerRules is a non-empty array. | `[]` | | `msgTopologyOperator.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | | `msgTopologyOperator.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | | `msgTopologyOperator.serviceAccount.annotations` | Add annotations | `{}` | | `msgTopologyOperator.serviceAccount.automountServiceAccountToken` | Automount API credentials for a service account. | `false` | ### RabbitMQ Messaging Topology Operator Configuration | Name | Description | Value | | -------------------------------------------------------------- | ---------------------------------------------------------------------------------- | ------------------------ | | `msgTopologyOperator.metrics.service.enabled` | Create a service for accessing the metrics endpoint | `false` | | `msgTopologyOperator.metrics.service.type` | RabbitMQ Messaging Topology Operator metrics service type | `ClusterIP` | | `msgTopologyOperator.metrics.service.ports.http` | RabbitMQ Messaging Topology Operator metrics service port (target is HTTPS; metrics endpoint requires TLS as of v1.19.0) | `8443` | | `msgTopologyOperator.metrics.service.nodePorts.http` | Node port for the metrics service | `""` | | `msgTopologyOperator.metrics.service.clusterIP` | RabbitMQ Messaging Topology Operator metrics service Cluster IP | `""` | | `msgTopologyOperator.metrics.service.extraPorts` | Extra ports to expose (normally used with the `sidecar` value) | `[]` | | `msgTopologyOperator.metrics.service.loadBalancerIP` | RabbitMQ Messaging Topology Operator metrics service Load Balancer IP | `""` | | `msgTopologyOperator.metrics.service.loadBalancerSourceRanges` | RabbitMQ Messaging Topology Operator metrics service Load Balancer sources | `[]` | | `msgTopologyOperator.metrics.service.externalTrafficPolicy` | RabbitMQ Messaging Topology Operator metrics service external traffic policy | `Cluster` | | `msgTopologyOperator.metrics.service.annotations` | Additional custom annotations for RabbitMQ Messaging Topology Operator metrics service | `{}` | | `msgTopologyOperator.metrics.service.sessionAffinity` | Session Affinity for Kubernetes service, can be "None" or "ClientIP" | `None` | | `msgTopologyOperator.metrics.service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` | | `msgTopologyOperator.metrics.serviceMonitor.enabled` | Specify if a servicemonitor will be deployed for prometheus-operator | `false` | | `msgTopologyOperator.metrics.serviceMonitor.namespace` | Namespace which Prometheus is running in | `""` | | `msgTopologyOperator.metrics.serviceMonitor.jobLabel` | Specify the jobLabel to use for the prometheus-operator | `app.kubernetes.io/name` | | `msgTopologyOperator.metrics.serviceMonitor.selector` | Prometheus instance selector labels | `{}` | | `msgTopologyOperator.metrics.serviceMonitor.honorLabels` | Honor metrics labels | `false` | | `msgTopologyOperator.metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended | `""` | | `msgTopologyOperator.metrics.serviceMonitor.interval` | Scrape interval. If not set, the Prometheus default scrape interval is used | `""` | | `msgTopologyOperator.metrics.serviceMonitor.metricRelabelings` | Specify additional relabeling of metrics | `[]` | | `msgTopologyOperator.metrics.serviceMonitor.relabelings` | Specify general relabeling | `[]` | | `msgTopologyOperator.metrics.serviceMonitor.labels` | Extra labels for the ServiceMonitor | `{}` | | `msgTopologyOperator.metrics.podMonitor.enabled` | Create PodMonitor Resource for scraping metrics using PrometheusOperator | `false` | | `msgTopologyOperator.metrics.podMonitor.jobLabel` | Specify the jobLabel to use for the prometheus-operator | `app.kubernetes.io/name` | | `msgTopologyOperator.metrics.podMonitor.namespace` | Namespace which Prometheus is running in | `""` | | `msgTopologyOperator.metrics.podMonitor.honorLabels` | Honor metrics labels | `false` | | `msgTopologyOperator.metrics.podMonitor.selector` | Prometheus instance selector labels | `{}` | | `msgTopologyOperator.metrics.podMonitor.interval` | Specify the interval at which metrics should be scraped | `30s` | | `msgTopologyOperator.metrics.podMonitor.scrapeTimeout` | Specify the timeout after which the scrape is ended | `30s` | | `msgTopologyOperator.metrics.podMonitor.additionalLabels` | Additional labels that can be used so PodMonitors will be discovered by Prometheus | `{}` | | `msgTopologyOperator.metrics.podMonitor.relabelings` | Specify general relabeling | `[]` | | `msgTopologyOperator.metrics.podMonitor.metricRelabelings` | Specify additional relabeling of metrics | `[]` | ## RabbitmqCluster admission webhook Starting with cluster-operator `v2.22.0`, the operator ships mutating (defaulting) and validating admission webhooks for `RabbitmqCluster` resources. This chart keeps them **disabled by default**: the operator is started with `ENABLE_WEBHOOKS=false`, which preserves the behavior of chart versions prior to `0.4.0`. Enabling the webhook adds server-side defaulting and validation (for example, rejecting unsafe `spec.override.statefulSet` fields such as `hostNetwork` or `serviceAccountName`). Because the webhook is served over TLS, enabling it requires serving certificates. ### Option 1 — chart-generated self-signed certificate (default when enabled) The chart generates a self-signed CA and certificate and stores them in a `Secret`, injecting the CA into the webhook configurations' `caBundle`. On a subsequent `helm upgrade` the existing `Secret` is read back from the cluster (via Helm's `lookup`) and reused, so the certificate stays stable and the `Secret` and `caBundle` remain mutually consistent. ```bash helm upgrade --install my-rabbitmq-operator \ oci://registry-1.docker.io/cloudpirates/rabbitmq-cluster-operator \ --set clusterOperator.webhook.enabled=true ``` > [!WARNING] > The `genCA`/`genSignedCert` template functions are **not** deterministic — they produce a new certificate on > every render. Stability comes solely from Helm's `lookup` reading the previously created `Secret`, which only > works when the render has live cluster access (a real `helm install`/`helm upgrade`). Tools that render > client-side without cluster access — `helm template`, or **Argo CD / Flux in their default rendering mode** — > cannot see the existing `Secret` and will regenerate the certificate on every sync. For GitOps workflows use > Option 2 (cert-manager) or Option 3 (bring your own secret) instead. ### Option 2 — cert-manager If cert-manager is installed in the cluster, set `useCertManager=true`. The chart creates a self-signed `Issuer` and a `Certificate`, and relies on cert-manager's CA injector for the webhook `caBundle`. ```bash helm upgrade --install my-rabbitmq-operator \ oci://registry-1.docker.io/cloudpirates/rabbitmq-cluster-operator \ --set clusterOperator.webhook.enabled=true \ --set useCertManager=true ``` ### Option 3 — bring your own certificate Provide an existing TLS secret (and, when not using cert-manager, its CA bundle): ```bash helm upgrade --install my-rabbitmq-operator \ oci://registry-1.docker.io/cloudpirates/rabbitmq-cluster-operator \ --set clusterOperator.webhook.enabled=true \ --set clusterOperator.webhook.existingWebhookCertSecret=my-webhook-cert \ --set-file clusterOperator.webhook.existingWebhookCertCABundle=ca.pem ``` > [!NOTE] > When the webhook is disabled the operator still applies the default RabbitMQ image via the > `DEFAULT_RABBITMQ_IMAGE` environment variable; only admission-time defaulting and validation are skipped. ## Upgrading ### To 0.4.0 Upgrading the cluster operator to `v2.22.1` triggers a **rolling restart of the StatefulSets** of every managed `RabbitmqCluster`. To control the timing, pause reconciliation before upgrading and resume it once the operator is ready. `v2.22.0` also switched the RabbitMQ startup probe from an exec check to an HTTP check, which requires RabbitMQ `4.2.4+` or `4.3.0+`. The chart default (`4.3.2-management-alpine`) satisfies this; clusters pinned to older RabbitMQ versions must set the `rabbitmq.com/legacy-startup-probe: "true"` annotation.