求可正常传递Erlang Cookie的Kubernetes RabbitMQ集群YAML

问题根源 #

1. 原配置覆盖容器command后，仅执行了写Cookie的操作，未启动RabbitMQ服务，导致容器异常退出
2. /var/lib/rabbitmq目录默认属于rabbitmq用户，手动以root身份写入Cookie文件会引发权限问题
3. 单实例Deployment不适合部署RabbitMQ集群，需用StatefulSet保障节点的稳定网络标识
4. 硬编码Erlang Cookie在命令中存在安全风险，且不符合K8s最佳实践

修正后的完整配置 #

1. 存储Erlang Cookie的Secret

apiVersion: v1
kind: Secret
metadata:
  name: rabbitmq-erlang-cookie
type: Opaque
data:
  # 执行 `echo -n "VOLPAY" | base64` 获取编码值
  erlang.cookie: VkxQQVk=

2. RabbitMQ集群StatefulSet与服务配置

apiVersion: v1
kind: Service
metadata:
  name: rabbitmq-headless
  labels:
    app: rabbitmq
spec:
  clusterIP: None
  ports:
  - port: 5672
    name: amqp
  - port: 15672
    name: management
  - port: 25672
    name: inter-node
  selector:
    app: rabbitmq
---
apiVersion: v1
kind: Service
metadata:
  name: rabbitmq
  labels:
    app: rabbitmq
spec:
  type: NodePort # 可根据需求改为LoadBalancer
  ports:
  - port: 5672
    targetPort: 5672
    name: amqp
  - port: 15672
    targetPort: 15672
    name: management
  selector:
    app: rabbitmq
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: rabbitmq
spec:
  serviceName: rabbitmq-headless
  replicas: 3 # 可调整集群节点数量
  selector:
    matchLabels:
      app: rabbitmq
  template:
    metadata:
      labels:
        app: rabbitmq
    spec:
      containers:
      - name: rabbitmq
        image: rabbitmq:3.10-management
        ports:
        - containerPort: 5672
          name: amqp
        - containerPort: 15672
          name: management
        - containerPort: 25672
          name: inter-node
        env:
        - name: RABBITMQ_DEFAULT_USER
          value: "guest"
        - name: RABBITMQ_DEFAULT_PASS
          value: "guest"
        - name: RABBITMQ_ERLANG_COOKIE
          valueFrom:
            secretKeyRef:
              name: rabbitmq-erlang-cookie
              key: erlang.cookie
        - name: RABBITMQ_NODENAME
          value: "rabbit@$(HOSTNAME).rabbitmq-headless.default.svc.cluster.local"
        - name: RABBITMQ_CLUSTER_NODE_TYPE
          value: "disc"
        volumeMounts:
        - name: rabbitmq-data
          mountPath: /var/lib/rabbitmq
        resources:
          limits:
            cpu: 2
            memory: 6Gi
          requests:
            cpu: 1
            memory: 2Gi
  volumeClaimTemplates:
  - metadata:
      name: rabbitmq-data
    spec:
      accessModes: ["ReadWriteOnce"]
      resources:
        requests:
          storage: 10Gi

关键配置说明 #

• Secret存储Cookie：通过Base64编码存储Erlang Cookie，避免明文泄露，容器通过环境变量RABBITMQ_ERLANG_COOKIE自动读取，无需手动写入文件
• StatefulSet+Headless Service：为每个RabbitMQ节点分配稳定主机名，满足集群节点发现的网络需求
• 持久化存储：通过volumeClaimTemplates为每个节点绑定独立PVC，保障集群数据持久化
• 集群模式配置：设置RABBITMQ_NODENAME让节点以集群模式启动，RABBITMQ_CLUSTER_NODE_TYPE指定节点为磁盘节点

部署与验证步骤 #

1. 创建Erlang Cookie Secret：

   kubectl apply -f rabbitmq-secret.yaml
   

2. 部署RabbitMQ集群：

   kubectl apply -f rabbitmq-cluster.yaml
   

3. 验证集群状态：

   kubectl exec -it rabbitmq-0 -- rabbitmqctl cluster_status
   

   输出中应显示所有节点已成功加入集群

内容的提问来源于stack exchange，提问作者Seenivasan UM