[bitnami/rabbitmq] Add support for autogenerated certs (#6528)

* [bitnami/rabbitmq] Add support for autogenerated certs

* Update README.md, chart version bump and minor changes

* Update README.md

* Fix linting issue

* Update README.md and add commonAnnotations to tls-secret.yaml

* Apply suggestions

* Add TLS validation check

* Update _helpers.tpl

bitnami/rabbitmq/Chart.yaml

@@ -23,4 +23,4 @@ name: rabbitmq
 sources:
   - https://github.com/bitnami/bitnami-docker-rabbitmq
   - https://www.rabbitmq.com
-version: 8.15.3
+version: 8.16.0

bitnami/rabbitmq/README.md

@@ -79,6 +79,7 @@ The following table lists the configurable parameters of the RabbitMQ chart and
 | `auth.erlangCookie`                | Erlang cookie                                                                                                                            | _random 32 character long alphanumeric string_          |
 | `auth.existingErlangSecret`        | Existing secret with RabbitMQ Erlang cookie (must contain a value for `rabbitmq-erlang-cookie` key)                                      | `nil` (evaluated as a template)                         |
 | `auth.tls.enabled`                 | Enable TLS support on RabbitMQ                                                                                                           | `false`                                                 |
+| `auth.tls.autoGenerated`           | Generate automatically self-signed TLS certificates                                                                                      | `talse`                                                 |
 | `auth.tls.failIfNoPeerCert`        | When set to true, TLS connection will be rejected if client fails to provide a certificate                                               | `true`                                                  |
 | `auth.tls.sslOptionsVerify`        | Should [peer verification](https://www.rabbitmq.com/ssl.html#peer-verification) be enabled?                                              | `verify_peer`                                           |
 | `auth.tls.caCertificate`           | Certificate Authority (CA) bundle content                                                                                                | `nil`                                                   |

bitnami/rabbitmq/templates/_helpers.tpl

@@ -84,7 +84,7 @@ Get the erlang secret.
 {{/*
 Get the TLS secret.
 */}}
-{{- define "rabbitmq.secretTLSName" -}}
+{{- define "rabbitmq.tlsSecretName" -}}
     {{- if .Values.auth.tls.existingSecret -}}
         {{- printf "%s" .Values.auth.tls.existingSecret -}}
     {{- else -}}
@@ -92,6 +92,15 @@ Get the TLS secret.
     {{- end -}}
 {{- end -}}
 
+{{/*
+Return true if a TLS credentials secret object should be created
+*/}}
+{{- define "rabbitmq.createTlsSecret" -}}
+{{- if and .Values.auth.tls.enabled (not .Values.auth.tls.existingSecret) }}
+    {{- true -}}
+{{- end -}}
+{{- end -}}
+
 {{/*
 Return the proper RabbitMQ plugin list
 */}}
@@ -150,6 +159,7 @@ Compile all warnings into a single message, and call fail.
 {{- $messages := append $messages (include "rabbitmq.validateValues.ldap" .) -}}
 {{- $messages := append $messages (include "rabbitmq.validateValues.memoryHighWatermark" .) -}}
 {{- $messages := append $messages (include "rabbitmq.validateValues.ingress.tls" .) -}}
+{{- $messages := append $messages (include "rabbitmq.validateValues.auth.tls" .) -}}
 {{- $messages := without $messages "" -}}
 {{- $message := join "\n" $messages -}}
 
@@ -221,3 +231,17 @@ rabbitmq: ingress.tls
       - Relay on Helm to create self-signed certificates by setting `ingress.selfSigned=true`
 {{- end -}}
 {{- end -}}
+
+{{/* 
+Validate values of RabbitMQ - Auth TLS enabled 
+*/}}
+{{- define "rabbitmq.validateValues.auth.tls" -}}
+{{- if and .Values.auth.tls.enabled (not .Values.auth.tls.autoGenerated) (not .Values.auth.tls.existingSecret) (not .Values.auth.tls.caCertificate) (not .Values.auth.tls.serverCertificate) (not .Values.auth.tls.serverKey) }}
+rabbitmq: auth.tls
+    You enabled TLS for RabbitMQ but you did not enable any of the available mechanisms to create the TLS secret.
+    Please use any of these alternatives:
+      - Provide an existing secret containing the TLS certificates using `auth.tls.existingSecret`
+      - Provide the plain text certificates using `auth.tls.caCertificate`, `auth.tls.serverCertificate` and `auth.tls.serverKey`.
+      - Enable auto-generated certificates using `auth.tls.autoGenerated`.
+{{- end -}}
+{{- end -}}

bitnami/rabbitmq/templates/certs.yaml

@@ -1,19 +0,0 @@
-{{- if and .Values.auth.tls.enabled (not .Values.auth.tls.existingSecret) }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ include "rabbitmq.fullname" . }}-certs
-  namespace: {{ .Release.Namespace | quote }}
-  labels: {{- include "common.labels.standard" . | nindent 4 }}
-  {{- if .Values.commonAnnotations }}
-  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
-  {{- end }}
-type: kubernetes.io/tls
-data:
-  ca.crt:
-    {{ required "A valid .Values.auth.tls.caCertificate entry required!" .Values.auth.tls.caCertificate | b64enc | quote }}
-  tls.crt:
-    {{ required "A valid .Values.auth.tls.serverCertificate entry required!" .Values.auth.tls.serverCertificate| b64enc | quote }}
-  tls.key:
-    {{ required "A valid .Values.auth.tls.serverKey entry required!" .Values.auth.tls.serverKey | b64enc | quote }}
-{{- end }}

bitnami/rabbitmq/templates/statefulset.yaml

@@ -35,9 +35,6 @@ spec:
         {{- if or (not .Values.auth.existingErlangSecret) (not .Values.auth.existingPasswordSecret) .Values.extraSecrets }}
         checksum/secret: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
         {{- end }}
-        {{- if and .Values.auth.tls.enabled (not .Values.auth.tls.existingSecret) }}
-        checksum/secret-cert: {{ include (print $.Template.BasePath "/certs.yaml") . | sha256sum }}
-        {{- end }}
         {{- if or .Values.podAnnotations .Values.metrics.enabled }}
         {{- include "rabbitmq.podAnnotations" . | nindent 8 }}
         {{- end }}
@@ -318,7 +315,7 @@ spec:
         {{- if .Values.auth.tls.enabled }}
         - name: certs
           secret:
-            secretName: {{ template "rabbitmq.secretTLSName" . }}
+            secretName: {{ template "rabbitmq.tlsSecretName" . }}
             items:
               - key: {{ ternary "tls.crt" "ca.crt" .Values.auth.tls.existingSecretFullChain }}
                 path: ca_certificate.pem

bitnami/rabbitmq/templates/tls-secrets.yaml

@@ -40,5 +40,35 @@ data:
   tls.crt: {{ $cert.Cert | b64enc | quote }}
   tls.key: {{ $cert.Key | b64enc | quote }}
   ca.crt: {{ $ca.Cert | b64enc | quote }}
+---
 {{- end }}
 {{- end }}
+{{- if (include "rabbitmq.createTlsSecret" . )}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "rabbitmq.fullname" . }}-certs
+  namespace: {{ .Release.Namespace | quote }}
+  labels: {{- include "common.labels.standard" . | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+type: kubernetes.io/tls
+data:
+  {{- if or (not .Values.auth.tls.autoGenerated ) (and .Values.auth.tls.caCertificate .Values.auth.tls.serverCertificate .Values.auth.tls.serverKey) }}
+  ca.crt: {{ required "A valid .Values.auth.tls.caCertificate entry required!" .Values.auth.tls.caCertificate | b64enc | quote }}
+  tls.crt: {{ required "A valid .Values.auth.tls.serverCertificate entry required!" .Values.auth.tls.serverCertificate| b64enc | quote }}
+  tls.key: {{ required "A valid .Values.auth.tls.serverKey entry required!" .Values.auth.tls.serverKey | b64enc | quote }}
+  {{- else }}
+  {{- $ca := genCA "rabbitmq-internal-ca" 365 }}
+  {{- $fullname := include "rabbitmq.fullname" . }}
+  {{- $releaseNamespace := .Release.Namespace }}
+  {{- $clusterDomain := .Values.clusterDomain }}
+  {{- $serviceName := include "rabbitmq.fullname" . }}
+  {{- $altNames := list (printf "*.%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) $fullname }}
+  {{- $crt := genSignedCert $fullname nil $altNames 365 $ca }}
+  ca.crt: {{ $ca.Cert | b64enc | quote }}
+  tls.crt: {{ $crt.Cert | b64enc | quote }}
+  tls.key: {{ $crt.Key | b64enc | quote }}
+  {{- end }}
+{{- end }}

bitnami/rabbitmq/values.yaml

@@ -81,6 +81,7 @@ auth:
   ##
   tls:
     enabled: false
+    autoGenerated: false
     failIfNoPeerCert: true
     sslOptionsVerify: verify_peer
     caCertificate: |-