topology failed to declare with rabbitmq Cert

[sb185296]

Describe the bug

A clear and concise description of what the bug is.

To Reproduce

Steps to reproduce the behavior:

1. install rabbit operator + messaging latest veration
2. use AKS
3. enable cert on RabbitMQ
4. run that yaml

---
apiVersion: v1
kind: Secret
metadata:
  name: test-user-credentials
type: Opaque
stringData:
  username: "test"
  password: "Qwe12345"
---
apiVersion: rabbitmq.com/v1beta1
kind: User
metadata:
  name: test-user
spec:
  rabbitmqClusterReference:
    name: rabbitcluster
  importCredentialsSecret:
    name: test-user-credentials
---
apiVersion: rabbitmq.com/v1beta1
kind: Permission
metadata:
  name: testuser-permission
spec:
  vhost: "test-vhost"
  user: "test-user" # name corresponds to the username we provided in "test-user-credentials" secret
  permissions:
    write: ".*"
    configure: ""
    read: ".*"
  rabbitmqClusterReference:
    name: rabbitcluster

5. See error

error from aks :

{"level":"error","ts":1673201299.0511668,"msg":"failed to delete permission","controller":"permission","controllerGroup":"rabbitcluster.com","controllerKind":"Permission","Permission":{"name":"testuser-permission","namespace":"test"},"namespace":"test","name":"testuser-permission","reconcileID":"cf7ba322-99b1-45e9-98bc-efc67c7384e3","error":"Delete \"https://rabbitcluster.svc:15671/api/permissions/test-vhost/test-user\": x509: certificate is valid for qww.canarytokens.com, qww.canarytokens.com, qww.canarytokens.com, api-qww.canarytokens.com, qww.canarytokens.com, qww.canarytokens.com, not rabbitcluster.svc","stacktrace":"github.com/rabbitcluster/messaging-topology-operator/controllers.(*TopologyReconciler).Reconcile\n\t/bitnami/blacksmith-sandox/rmq-messaging-topology-operator-1.10.0/src/github.com/rabbitcluster/rmq-messaging-topology-operator/controllers/topology_controller.go:70\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/bitnami/blacksmith-sandox/rmq-messaging-topology-operator-1.10.0/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:121\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/bitnami/blacksmith-sandox/rmq-messaging-topology-operator-1.10.0/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:320\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/bitnami/blacksmith-sandox/rmq-messaging-topology-operator-1.10.0/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:273\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/bitnami/blacksmith-sandox/rmq-messaging-topology-operator-1.10.0/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:234"}

Screenshots

its happened only when we enable TLS
on create or delete :\

[sb185296]

hi
we i see that MD
https://github.com/rabbitmq/messaging-topology-operator/blob/ae22d642f65f05ed897169b7fa86a1bebc3acbad/docs/proposals/20220105-start-certificate-support.md

but its not really work

we are using ingress
and we put in the RabbitmqCluster
this annotation
messaging.rabbitmq.com/override-url :"https://myrabbit.example.com"

but i get same error :\

[lukebakken]

Your screenshot redacts the most important part of the error message, making it difficult to assist you.

@Zerpet are the reproduction steps provided sufficient? I don't know enough to say one way or the other.

[Zerpet]

This issue is similar as reported in #233.

The resolution is using a connection secret, as described in this document. The feature described in the document was initially designed to interact with non-Operator managed clusters, but it can be safely used with Operator managed clusters to address this problem. The UX with TLS + external names is not great at the moment, but at least there's a workaround.

[sb185296]

hi ,

i am not really undresand agien what to do

here : https://rabbitmq.com/kubernetes/operator/install-topology-operator.html#non-default-k8s-domain
its says just o pass this
- name: MESSAGING_DOMAIN_NAME
value: "my.cluster.domain"

but then i need to create a wilde card CERT ? or can i use the name that will be create like : rabbithq.r10.svc.test.***.com

whay i cant just use

annotation messaging.rabbitmq.com/override-url with value "https://myrabbit.example.com".

messaging-topology-operator/docs/proposals/20220105-start-certificate-support.md

Line 100 in f43013b

For example, the annotation `messaging.rabbitmq.com/override-url` with value `"https://myrabbit.example.com"`.

[Zerpet]

The override-url annotation was never implemented if my memory serves me well. You have to follow the steps in this link: https://rabbitmq.com/kubernetes/operator/using-topology-operator.html#non-operator

It looks like you followed instructions for a different scenario (non-default internal kubernetes domain).

Copying from the link above, you have to create a Secret that looks similar to this:

---
apiVersion: v1
kind: Secret
metadata:
  name: my-rabbit-creds # <----- important
type: Opaque
stringData:
  username: a-user # has to be an existing user
  password: a-secure-password
  uri: https://my.rabbit:15672 # HTTPS + management api port

Then use the name of this Secret in your Topology object manifests:

---
apiVersion: rabbitmq.com/v1beta1
kind: Queue
metadata:
  name: qq-example
spec:
  name: my-queue
  rabbitmqClusterReference:
    connectionSecret:
      name: my-rabbit-creds # <----- same name as above. Must be same namespace.

[sb185296]

hi thanks for the reply

but i am using managed RabbitMQ
with the MESSAGING

i try with and without

- name: MESSAGING_DOMAIN_NAME
value: "my.cluster.domain"

but i use with MESSAGING_DOMAIN_NAME
i try to reach the real NEW fqdn

error: "Put "https://rabbithq.r10.svc.test.*.com:15671/api/users/test": dial tcp 13.65.174.163:15671: connect: connection timed out"

what i run

---
apiVersion: v1
kind: Secret
metadata:
  name: shay-user-credentials
  namespace: test
type: Opaque
stringData:
  username: "test"
  password: "Qwe12345"
  uri: httpS://rabbithq:15671
---
apiVersion: rabbitmq.com/v1beta1
kind: User
metadata:
  name: shay-user
  namespace: test
spec:
  rabbitmqClusterReference:
    name: rabbithq
  importCredentialsSecret:
    name: shay-user-credentials
---
apiVersion: rabbitmq.com/v1beta1
kind: Permission
metadata:
  name: shay-user-permission
  namespace: test
spec:
  vhost: "/"
  user: "shay-user" # name corresponds to the username we provided in "shay-user-credentials" secret
  permissions:
    write: ".*"
    configure: ""
    read: ".*"
  rabbitmqClusterReference:
    name: rabbithq

[Zerpet]

The feature described in the document was initially designed to interact with non-Operator managed clusters, but it can be safely used with Operator managed clusters

[sb185296]

but why its not works :(
what do i miss on that ?

[sb185296]

now when i add the cert with the wildcard its really try toreach to the worng URL

error: "Put "https://rabbithq.r10.svc.test.*.com:15671/api/users/test": dial tcp 13.65.174.163:15671: connect: connection timed out"