190 lines
5.3 KiB
YAML
190 lines
5.3 KiB
YAML
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: rabbitmq-credentials
|
|
type: Opaque
|
|
stringData:
|
|
username: admin
|
|
password: "$RABBITMQ_PASS"
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: rabbitmq-config
|
|
data:
|
|
rabbitmq.conf: |
|
|
listeners.tcp = none
|
|
listeners.ssl.default = 5671
|
|
ssl_options.certfile = /etc/rabbitmq/tls/tls.crt
|
|
ssl_options.keyfile = /etc/rabbitmq/tls/tls.key
|
|
ssl_options.verify = verify_none
|
|
ssl_options.fail_if_no_peer_cert = false
|
|
management.listener.port = 15672
|
|
management.listener.ssl = false
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: rabbitmq-data
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: 10Gi
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: rabbitmq
|
|
spec:
|
|
serviceName: rabbitmq
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: rabbitmq
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: rabbitmq
|
|
spec:
|
|
imagePullSecrets:
|
|
- name: regcred
|
|
securityContext:
|
|
fsGroup: 999
|
|
initContainers:
|
|
- name: fix-permissions
|
|
image: localhost:32000/busybox:1.36
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
chown -R 999:999 /var/lib/rabbitmq
|
|
chmod 700 /var/lib/rabbitmq
|
|
if [ -f /var/lib/rabbitmq/.erlang.cookie ]; then
|
|
chmod 600 /var/lib/rabbitmq/.erlang.cookie
|
|
fi
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /var/lib/rabbitmq
|
|
containers:
|
|
- name: rabbitmq
|
|
image: localhost:32000/rabbitmq:3.11-management
|
|
ports:
|
|
- containerPort: 5671
|
|
name: amqps
|
|
- containerPort: 15672
|
|
name: management
|
|
env:
|
|
- name: RABBITMQ_CONFIG_FILE
|
|
value: /etc/rabbitmq/conf/rabbitmq
|
|
- name: RABBITMQ_ERLANG_COOKIE
|
|
value: "$RABBITMQ_ERLANG_COOKIE"
|
|
- name: RABBITMQ_DEFAULT_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: rabbitmq-credentials
|
|
key: username
|
|
- name: RABBITMQ_DEFAULT_PASS
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: rabbitmq-credentials
|
|
key: password
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /etc/rabbitmq/conf
|
|
readOnly: true
|
|
- name: tls
|
|
mountPath: /etc/rabbitmq/tls
|
|
readOnly: true
|
|
- name: data
|
|
mountPath: /var/lib/rabbitmq
|
|
lifecycle:
|
|
postStart:
|
|
exec:
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
until rabbitmqctl status >/dev/null 2>&1; do
|
|
echo "Waiting for RabbitMQ to start..."
|
|
sleep 5
|
|
done
|
|
echo "Creating virtual hosts"
|
|
rabbitmqctl add_vhost email || true
|
|
rabbitmqctl add_vhost tg || true
|
|
rabbitmqctl add_vhost vk || true
|
|
rabbitmqctl add_vhost fb || true
|
|
rabbitmqctl add_vhost ok || true
|
|
rabbitmqctl add_vhost max || true
|
|
rabbitmqctl add_vhost inst || true
|
|
|
|
rabbitmqctl set_permissions -p email admin ".*" ".*" ".*" || true
|
|
rabbitmqctl set_permissions -p tg admin ".*" ".*" ".*" || true
|
|
rabbitmqctl set_permissions -p vk admin ".*" ".*" ".*" || true
|
|
rabbitmqctl set_permissions -p fb admin ".*" ".*" ".*" || true
|
|
rabbitmqctl set_permissions -p ok admin ".*" ".*" ".*" || true
|
|
rabbitmqctl set_permissions -p max admin ".*" ".*" ".*" || true
|
|
rabbitmqctl set_permissions -p inst admin ".*" ".*" ".*" || true
|
|
|
|
rabbitmqctl set_user_tags admin administrator || true
|
|
|
|
echo "Virtual hosts created and configured for admin user."
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: rabbitmq-config
|
|
items:
|
|
- key: rabbitmq.conf
|
|
path: rabbitmq.conf
|
|
- name: tls
|
|
secret:
|
|
secretName: rabbitmq-tls
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: rabbitmq-data
|
|
podManagementPolicy: Parallel
|
|
updateStrategy:
|
|
type: RollingUpdate
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: rabbitmq
|
|
spec:
|
|
selector:
|
|
app: rabbitmq
|
|
ports:
|
|
- name: amqps
|
|
port: 5671
|
|
targetPort: 5671
|
|
nodePort: 31023
|
|
- name: management
|
|
port: 15672
|
|
targetPort: 15672
|
|
type: NodePort
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: rabbitmq-management
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: google-public-ca
|
|
nginx.ingress.kubernetes.io/use-forwarded-headers: "true"
|
|
spec:
|
|
tls:
|
|
- hosts:
|
|
- rabbit.spiritofweb.ru
|
|
secretName: rabbitmq-tls
|
|
rules:
|
|
- host: rabbit.spiritofweb.ru
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: rabbitmq
|
|
port:
|
|
number: 15672
|