Task
Install new RabbitMQ cluster on OCP4/OCD.
Steps:
1. Install Cluster Operator
2. Install RabbitMQ app cluster
Notes:
- If your production deployment is stuck at Pending, the first thing to commonly check is whether the production pre-requisite Local Path Provisioner is installed and check the cluster's logs.
- Production deployment requires cluster with 3 worker nodes, each in a different zone, with each having available/free 4 vCPU, and 10 GB memory.
- Requires storage class named ssd
1. Install Operator:
a. Login
$ oc login -u kubeadmin <apihost>:6443
<enter password and confirm login>
b. Install the operator:
Notes:
- Installs to Project/Namespace: rabbitmq-system
- Deployment name: rabbitmq-cluster-operator
$ oc apply -f https://github.com/rabbitmq/cluster-operator/releases/latest/download/cluster-operator.yml
<wait>
c. Verify the operator is running:
$ oc -n rabbitmq-system get all
<confirm pod, deployment.app, and replicaset all exist and pod running>
d. Verify availability:
$ oc get customresourcedefinititions.apiextensions.k8s.io
<verify rabbitmqclusters.rabbitmpq.com listed>
e. Pod Security Policies enabled? If so, add a cluster Role and a cluster RoleBinding so a RabbitMQ cluster can be scheduled (deployed).
Note:
- Need to know what our RabbitMQ cluster project name/namespace will be: e.g. mw-rabbitmq-cluster-ns
- Need to know what our RabbitMQ cluster name will be: e.g. mw-rabbitmq-cluster
- Need to know what the already existing podsecuritypolicy to use: mw-podsecuritypolicy
- Create cluster role:
$ oc create role rabbitmq:psp:unprivileged --verb=use --resource=podsecuritypolicy --resource-name=mw-podsecuritypolicy
<confirm role rabbitmq:psp:unprivileged created>
- Create cluster rolebinding:
$ oc create rolebinding rabbitmq-mycluster:psp:unprivileged --role=rabbitmq:psp:unprivileged --serviceaccount=mw-rabbitmq-cluster-ns:mw-rabbitmq-cluster
<confirm rolebinding rabbitmq-mycluster:psp:unprivileged created>
2. Install Hello World Cluster:
a. Run test install script:
Note:
- The RabbitMQ Github has multiple examples. The simpliest test install is the Hello World one. Useful to install first to confirm operability.
$ oc apply -f https://raw.githubusercontent.com/rabbitmq/cluster-operator/main/docs/examples/hello-world/rabbitmq.yaml
- Check the logs for any issues with:
$ oc logs hello-world-server-0
< view logs>
b. Get the management UI username, password, and service port for the hello-world test cluster:
- Get UI username:
$ MQUSER="$(oc get secret hello-world-default-user -o jsonpath='{.data.username}' | base64 --decode)"
$ echo "username: $MQUSER"
<view username>
- Get UI password:
$ MQPWD="$(oc get secret hello-world-default-user -o jsonpath='{.data.password}' | base64 --decode)"
$ echo "password: $MQPWD"
<view password>
- Get exposed service port:
$ oc get service/hello-world
<view port>
- If not yet exposed:
$ oc expose deployment/hello-world
<confirm opened>
- or-
$ oc port-forward "service/hello-world" 15672
<confirm opened>
$ oc get service/hello-world
<view port - e.g. 15672>
- View in browser or curl
c. Afterward testing, delete the hello-world cluster, and proceed to production pre-requisites:
$ oc delete rabbitmqclusters.rabbitmq.com hello-world
<confirm successful>
d. Install Local Path Provisioner required for production clusters:
$ oc apply -f https://raw.githubusercontent.com/rancher/local-path-provisioner/master/deploy/local-path-storage.yaml
$ oc annotate storageclass local-path storageclass.kubernetes.io/is-default-class=true
c. Install storage class ssd:
- Exact YAML depends on cloud provisioner(s) available
$ cat /home/myadminid/tmp/storage-ssd.yaml
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: ssd
provisioner: kubernetes.io/
parameters:
type: pd-ssd
$ oc apply -f /home/myadminid/tmp/storage-ssd.yaml
e. Install an example production-ready cluster named production-ready:
$ oc apply -f https://raw.githubusercontent.com/rabbitmq/cluster-operator/main/docs/examples/production-ready/rabbitmq.yaml
<wait>
$ oc apply -f https://raw.githubusercontent.com/rabbitmq/cluster-operator/main/docs/examples/production-ready/pod-disruption-budget.yaml
<wait>
f. Confirm deployment and pods running as previously tested with hello-world example above.
---
Minimum RBAC Access needed for K8s/OKD/OCP 4 if not using kubeadmin or equivilent user id:
- Namespace
- CustomResourceDefinition
- Deployment
- ServiceAccount
- Role
- ClusterRole
- RoleBinding
- ClusterRoleBinding
- Service
- ValidatingWebhookConfiguration
Production Prerequisites:
rabbitmq.com/docs/production-checklist
OCP/OKD Arbitrary non-root user IDs vs native/standard RabbitMQ fixed non-root IDs:
- Operator default = fixed non-root UIDs
- Operator requires override of securityContext of the RabbitMQ pods, example:
apiVersion: rabbitmq.com/v1beta1
kind: RabbitmqCluster
metadata:
...
spec:
...
override:
statefulSet:
spec:
template:
spec:
securityContext: {}
containers:
- name: rabbitmq
securityContext: {}
initContainers:
- name: setup-container
securityContext: {}
previous page
|