{"id":20572189,"url":"https://github.com/mcaimi/amq-broker-helm","last_synced_at":"2025-04-14T17:08:26.612Z","repository":{"id":42615642,"uuid":"278097822","full_name":"mcaimi/amq-broker-helm","owner":"mcaimi","description":"RedHat AMQ Broker Templates and Helm Charts for OpenShift with support for injecting custom broker and security configuration.","archived":false,"fork":false,"pushed_at":"2023-07-24T08:56:27.000Z","size":267,"stargazers_count":5,"open_issues_count":0,"forks_count":7,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-04-14T17:08:18.981Z","etag":null,"topics":["amq-broker","artemis-mq","helm","kubernetes","openshift","redhat"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mcaimi.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2020-07-08T13:32:24.000Z","updated_at":"2023-08-30T11:51:54.000Z","dependencies_parsed_at":"2024-04-22T15:25:14.239Z","dependency_job_id":"73ca91f9-d866-4614-ae6a-930ae4224534","html_url":"https://github.com/mcaimi/amq-broker-helm","commit_stats":null,"previous_names":["mcaimi/amq-broker-helm"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcaimi%2Famq-broker-helm","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcaimi%2Famq-broker-helm/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcaimi%2Famq-broker-helm/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mcaimi%2Famq-broker-helm/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mcaimi","download_url":"https://codeload.github.com/mcaimi/amq-broker-helm/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248923763,"owners_count":21183953,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["amq-broker","artemis-mq","helm","kubernetes","openshift","redhat"],"created_at":"2024-11-16T05:18:46.030Z","updated_at":"2025-04-14T17:08:26.585Z","avatar_url":"https://github.com/mcaimi.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# RED HAT AMQ BROKER HELM CHART\n\nThis chart handles the deployment of RedHat AMQ broker instances on both OCP and generic k8s distributions. These deployment flavors are supported:\n\n1. Standalone AMQ Broker\n2. Choice between `Deployment` and `StatefulSet`\n3. TLS optional\n4. Persistence is optional. (Needs a supported StorageClass)\n5. NodePorts and Passthrough Routes\n6. Optional Prometheus monitoring\n7. Optional Clustering (WIP)\n8. Deployment compatibility with both Openshift and base Kubernetes\n\n|NAME                              | DESCRIPTION                                              | DEFAULT VALUE |\n|----------------------------------|----------------------------------------------------------|----------------|\n| kind                             | Deploy broker as Deployment or StatefulSet               | `Deployment` |\n| clustered                        | Deploy a clustered broker                                | `False` |\n| platform                         | Choose platform type (openshift or kubernetes)           | `openshift` |\n| application.name                 | The name for the application.                            | `amq-broker-persistence` |\n| application.amq_broker_version   | Broker Image tag                                         | `7.7` |\n| application.amq_broker_image     | Broker Image name                                        | `registry.redhat.io/amq7/amq-broker` |\n| application.pullPolicy           | Pull policy                                              | `IfNotPresent` |\n| application.replicas             | Number of replicas for a clustered broker                | `2` |\n| application.volume_capacity      | Size of persistent volume                                | `1G` |\n| service.console                  | Jolokia console port and configuration | See values.yaml |\n| service.acceptors                | Array of acceptors. Only the multiplex is exposed by default | See values.yaml |\n| ingress                          | Ingress configuration (only applies to kubernetes platform | See values.yaml |\n| ingress.passthrough              | Passthrough ingress rule options (k8s only)              | See values.yaml |\n| ingress.console                  | Artemis console ingress rule options (k8s only)          | See values.yaml |\n| tls.keystore                     | Name of the keystore file                                | See values.yaml |\n| tls.truststore                   | Name of the truststoreile                                | See values.yaml |\n| tls.keystore_password            | Password to unlock the keystore on container boot        | See values.yaml |\n| tls.truststore_password          | Password to unlock the truststore on container boot      | See values.yaml |\n| nodeport.enabled                 | Create node port to expose AMQ to clients outside of the cluster | `30002` |\n| nodeport.port                    | Node port number used when enabled | `30002` |\n| passthrough_route.enabled        | Create a passthrough route to allow inbound TCP/SNI connections to a TLS-enabled broker | `False` |\n| passthrough_route.hostname       | Host name to use when building the route. the openshift_appdomain parameter gets appended to this value. | None |\n| parameters.append_ns             | Append the namespace string to hostnames before building route manifests. This is useful to keep the URL unique. | `False` |\n| parameters.tls_enabled           | Enable or disable TLS support for acceptors | `false` |\n| parameters.jolokia_passthrough   | Configure TLS for the jolokia console as a passthrough route or an edge terminated route if tls_enabled is set to true | `false` |\n| parameters.amq_protocols         | Protocols to configure, separated by commas. Allowed values are: `openwire`, `amqp`, `stomp`, `mqtt` and `hornetq`. | `openwire,amqp,stomp,mqtt,hornetq` |\n| parameters.amq_broker_name       | Broker name (TODO is this used? Same as application.name ) | `broker` |\n| parameters.amq_global_max_size   | Maximum amount of memory which message data may consume ( TODO: 100 gb as default is a bit high for most systems) | `\"100 gb\"` |\n| parameters.amq_require_login     | Determines whether or not the broker will allow anonymous access, or require login | `False` |\n| parameters.amq_extra_args        | Extra arguments for broker creation  | `` |\n| parameters.amq_anycast_prefix    | Anycast prefix applied to the multiplexed protocol port 61616   | `jmx.queue.` |\n| parameters.amq_multicast_prefix  | Multicast prefix applied to the multiplexed protocol port 61616   | `jmx.topic.` |\n| parameters.amq_enable_metrics_plugin | Whether to enable artemis metrics plugin | `False` |\n| parameters.amq_journal_type      | Journal type to use; aio or nio supported | `nio` |\n| parameters.amq_data_dir          | Directory for storing data | `/opt/amq/data` |\n| templates.service                | Template for service name | See values.yaml |\n| templates.deployment             | Template for deployment name | See values.yaml |\n| templates.route                  | Template for route name | See values.yaml |\n| templates.broker_image           | Template for image name | See values.yaml |\n| templates.override_cm            | Template for ConfigMap name containing overrides | See values.yaml |\n| templates.config_cm              | Template for ConfigMap nggame | See values.yaml |\n| templates.app_secret             | Template for name of a secret containing credential data such as users and passwords | See values.yaml |\n| templates.pvc_name               | Template for persistent volume name | See values.yaml |\n| security.enabled                 | Enabled security | `true` |\n| security.secrets                 | Array of names of additional secrets to mount into /opt/amq/conf  | [] |\n| security.createSecret            | Create secret with users and passwords. Disable when secrets is created outside of this chart. For example by ExternalSecret | `true` |\n| security.jaasUsers.key           | Specify the key (filename) of the user/password file in the secret | `artemis-users.properties` |\n| admin.user                       | Admin user. Mandatory even if security.createSecret is `false`) | `admin` |\n| admin.password                   | Admin password. Optional. Only used if security.createSecret is `true` | `password` |\n| admin.role                       | Admin role name | `admin` |\n| users                            | Array of additional users. Only used if security.createSecret is `true` else users are expected to be defined in secret. | [] |\n| queue.defaults                   | Default values for queues parameters | [] |\n| queue.addresses                  | Array of queues to create. | [] |\n| metrics.enabled                  | Enable metrics in AMQ and let Prometheus collect metrics using ServiceMonitor | `false` |\n| metrics.jvm_memory               | Enable JVM memory metrics | `true` |\n| metrics.jvm_gc                   | Enable JVM garbage collection statistics in metrics | `false` |\n| metrics.jvm_threads              | Enable JVM Thread statistics | `false` |\n| metrics.servicemonitor.port      | Collect metrics from this port. Default is the management port.  | `8161` |\n| metrics.servicemonitor.interval  | Metrics are collected with fixed interval.  | `20s` |\n| resources                        | Kubernetes limits and resources to attach to pod templates | See values.yaml |\n\n## INSTALLATION\n\nThe most basic deployment can be performed by following these steps:\n\n### Disk Persistence:\n\nEvery deployment flavor (TLS and Non-TLS) can be made persistent by setting the `persitent` flag to `true`:\n\n```\napplication:\n  [...]\n  volume_capacity: \"1G\"\n  persistent: true\n```\n\n### Non-TLS AMQ Brokers\n\n- Customize the application name in `values.yaml`:\n\n```\napplication:\n  name: amq-broker-persistence-ssl\n  [...]\n  volume_capacity: \"1G\"\n```\n\n```\nparameters:\n  [...]\n  amq_data_dir: \"/opt/amq/data\"\n  tls_enabled: false\n  [...]\n```\n\nIf needed, the broker can be consumed by clients running outside OCP by deploying a NodePort resource:\n\n```\nnodeport:\n  [...]\n  enabled: true\n```\n\nSince no TLS passthrough is possible without proper tls support, the passthrough_route should be disabled:\n\n```\npassthrough_route:\n  enabled: false\n  [...]\n```\n\n### TLS-enabled AMQ Brokers\n\n- Create (or import) a keystore/truststore pair for this broker: look [here](https://github.com/mcaimi/amq-custom-templates-openshift/blob/master/README.md) for an howto. Put the files under `tls/` and update the tls section in `values.yaml`:\n\n```\ntls:\n  keystore: keystore.ks\n  truststore: keystore.ts\n  keystore_password: kspwd\n  truststore_password: tspwd\n```\n\n- Customize the application name in `values.yaml`:\n\n```\napplication:\n  name: amq-broker-artemis\n  [...]\n  volume_capacity: \"1G\"\n```\n\n```\nparameters:\n  [...]\n  tls_enabled: true\n  jolokia_passthrough: false # set this to true if you want to use the same keystore for the jolokia console too. in this case the route will be created as passthrough\n  amq_data_dir: \"/opt/amq/data\"\n  [...]\n```\n\nFor TLS-enabled brokers, both the NodePort and the Passthrough route options are working. Both can be enabled at the same time.\n\n### Common Setup\n\nThe application name will be used as a prefix for most of the objects deployed by the Chart itself.\n\n- Update the Admin user name and password in `values.yaml`\n\n```\nadmin:\n  user: admin\n  password: password\n  role: admin\n``` \n\n- If needed, enable and choose a node port TCP value and corresponding service for the external service in `values.yaml`:\n\n```\nnodeport:\n  port: 30003\n  service: multiplex\n  enabled: true\n```\nthis port needs to be in the allowed NodePort range set up in the kubelet (typically in the range 30000-32768)\n\n- Install the Chart under your preferred project\n\n```\n$ oc new-project amq-demo-artemis\n$ helm install amq-broker-artemis .\n```\n\nAfter a while and depending on what options are enabled in the values file, the broker should be up and running:\n\n```\n$ oc get all\nNAME                                         READY   STATUS    RESTARTS   AGE\npod/amq-broker-artemis-dc-6f7658dbc7-xgxll   1/1     Running   0          86s\n\nNAME                                      TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)              AGE\nservice/amq-broker-artemis-nodeport-svc   NodePort    172.30.208.78    \u003cnone\u003e        61616:30003/TCP      87s\nservice/amq-broker-artemis-svc            ClusterIP   172.30.194.187   \u003cnone\u003e        61616/TCP,8161/TCP   87s\n\nNAME                                    READY   UP-TO-DATE   AVAILABLE   AGE\ndeployment.apps/amq-broker-artemis-dc   1/1     1            1           87s\n\nNAME                                               DESIRED   CURRENT   READY   AGE\nreplicaset.apps/amq-broker-artemis-dc-6f7658dbc7   1         1         1       87s\n\nNAME                                                        HOST/PORT                                                               PATH   SERVICES                 PORT   TERMINATION     WILDCARD\nroute.route.openshift.io/amq-broker-artemis-route-console   amq-broker-artemis-route-console-amq-helm-test.apps.lab01.gpslab.club          amq-broker-artemis-svc   8161   edge/Redirect   None\n```\n\n## ADDING QUEUES, USERS AND ROLES\n\nTo add multiple users to the broker edit the `users` section in `values.yaml`. For example, this setup here:\n\n```\nusers:\n  - name: demouser\n    password: \"demo\"\n    role: user\n  - name: anotheruser\n    password: \"demo1\"\n    role: user\n```\n\nwould be rendered by the Helm Chart into these two files:\n\n- `artemis-users.properties`\n\n```\n    ## CUSTOMCONFIG\n    \n    # ADMIN USER\n    admin = password\n    \n    # ADDITIONAL USERS\n    demouser = demo\n    anotheruser = demo1\n```\n\n- `artemis-roles.properties`\n\n```\n    ## CUSTOMCONFIG\n    # ADMIN ROLE MAPPING\n    admin = admin\n\n    # ADDITIONAL ROLE MAPPING\n    user = demouser\n    user = anotheruser\n```\n\nUsers and passwords may be stored in an existing secret instead of as clear text in the values.yaml: disable the creation of the built-in user secret and specify the name of an existing secret.\n\nSet the `jaasUsers.key` to the filename used in the secret. Note that the filename have to be something different from `artemis-users.properties` as the default file will be mounted in the same directory in the container.  \n\nFor example: \n```\nsecurity:\n  secrets:\n    - broker-external-secret\n  createSecret: false\n  jaasUsers:\n    key: my-secured-artemis-users.properties\n\n```\n\n*Note*, that the AMQ_USER and AMQ_PASSWORD *must* be set, as the broker still uses these environment parameters:\n\n```\nstringData:\n  AMQ_USER: broker-admin\n  AMQ_PASSWORD: mySecretPassword\n  my-secured-artimis-users.properties: |\n    # ADMIN USER\n    broker-admin = mySecretPassword\n    # ADDITIONAL USERS\n    consumer-user = otherSecretPassword\ntype: Opaque\n```\n\nThe `queues` section in `values.yaml` allows to add custom queues to the broker at install time. For example, this setup:\n\n```\nqueues:\n  defaults:\n    [...]\n  addresses:\n    - name: demoQueue\n      permissions:\n        - grant: consume\n          roles:\n            - admin\n            - user\n        - grant: browse\n          roles:\n            - admin\n            - user\n        - grant: send\n          roles:\n            - admin\n            - user\n        - grant: manage\n          roles:\n            - admin\n```\n\nwould result in this rendered section inside `broker.xml`:\n\n```\n           \u003csecurity-setting match=\"demoQueue\"\u003e\n             \u003cpermission type=\"consume\" roles=\"admin,user,\" /\u003e\n             \u003cpermission type=\"browse\" roles=\"admin,user,\" /\u003e\n             \u003cpermission type=\"send\" roles=\"admin,user,\" /\u003e\n             \u003cpermission type=\"manage\" roles=\"admin,\" /\u003e\n           \u003c/security-setting\u003e\n```\n\nthe defaults section under the queues stanza contains the values set for every queue if not overridden on a per queue basis.\n\n## Metering\n\nAn optional prometheus ServiceMonitor is shipped with the chart. See values.yaml (metering stanza) for configuration.\n\n## Clustering\n\nOptional clustering is somewhat supported, but it is still considered WIP.\n\n## Kubernetes support\n\nAMQ Broker can be deployed also on standard Kubernetes clusters:\n\n1. Ingress Rules are deployed instead of Openshift Routes for both the console and the passthrough route\n2. A valid RedHat pull secret needs to be explicitly created in order to pull the AMQ broker images from registry.redhat.io:\n\n```\n$ kubectl create secret docker-registry \u003cPULL SECRET NAME\u003e \\\n          --docker-server=registry.redhat.io \\\n          --docker-username=\u003cCUSTOMER PORTAL USERNAME\u003e \\\n          --docker-password=\u003cCUSTOMER PORTAL PASSWORD\u003e \\\n          --docker-email=\u003cemail address\u003e\n```\n\nThe secret created with the command shown above needs to be set up in the _values.yaml_ file:\n\n```\n[...]\napplication:\n[...]\n  pullSecretName: \u003cPULL SECRET NAME\u003e\n[...]\n```\n\n## KEYSTORE CREATION MINI-HOWTO\n\nIn order to deploy SSL-enabled templates, a secret with valid Java Truststore and Keystore files must be created.\nTo create a keystore:\n\n1. Generate a self-signed certificate for the broker keystore:\n```\n$ keytool -genkey -alias broker -keyalg RSA -keystore broker.ks\n```\n\n2. Export the certificate so that it can be shared with clients:\n```\n$ keytool -export -alias broker -keystore broker.ks -file broker_cert\n```\n\n3. Generate a self-signed certificate for the client keystore:\n```\n$ keytool -genkey -alias client -keyalg RSA -keystore client.ks\n```\n\n4. Create a client truststore that imports the broker certificate:\n```\n$ keytool -import -alias broker -keystore client.ts -file broker_cert\n```\n\n5. Export the client’s certificate from the keystore:\n```\n$ keytool -export -alias client -keystore client.ks -file client_cert\n```\n\n6. Import the client’s exported certificate into a broker SERVER truststore:\n```\n$ keytool -import -alias client -keystore broker.ts -file client_cert\n```\n\n## DISCLAIMER\n\nThis chart is distributed as-is under the GPLv3 license and it's currently being developed as a private project to experiment alternative installation methods to the default AMQ Operator supported by RedHat.\nThis repo and the code it contains is not by any means endorsed or supported by RedHat or by any of the software subscriptions RedHat offers.\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmcaimi%2Famq-broker-helm","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmcaimi%2Famq-broker-helm","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmcaimi%2Famq-broker-helm/lists"}