cloud-host/backend/helm/cloudhost-app/templates/rabbitmq-deployment.yaml

{{- if .Values.rabbitmq.enabled }}
{{- $name       := include "cloudhost-app.name" . -}}
{{- $ns         := include "cloudhost-app.namespace" . -}}
{{- $rabbitName := printf "%s-rabbitmq" $name -}}
{{- /* Preserve the existing password across upgrades — RabbitMQ only applies
       RABBITMQ_DEFAULT_PASS on first boot, so a regenerated secret would
       diverge from the credentials stored in the persisted volume. */ -}}
{{- $rabbitSecretName := printf "%s-secret" $rabbitName -}}
{{- $existingRabbit := lookup "v1" "Secret" $ns $rabbitSecretName -}}
{{- $rabbitPass := "" -}}
{{- if and $existingRabbit $existingRabbit.data (index $existingRabbit.data "password") -}}
{{- $rabbitPass = index $existingRabbit.data "password" | b64dec -}}
{{- else -}}
{{- $rabbitPass = randAlphaNum 16 -}}
{{- end -}}
---
apiVersion: v1
kind: Secret
metadata:
  name: {{ $rabbitSecretName }}
  namespace: {{ $ns }}
  labels:
    app: {{ $rabbitName }}
    {{- include "cloudhost-app.labels" . | nindent 4 }}
  annotations:
    "helm.sh/resource-policy": keep
type: Opaque
data:
  username: {{ "appuser" | b64enc | quote }}
  password: {{ $rabbitPass | b64enc | quote }}
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: {{ $rabbitName }}-data
  namespace: {{ $ns }}
  labels:
    app: {{ $rabbitName }}
    {{- include "cloudhost-app.labels" . | nindent 4 }}
  annotations:
    "helm.sh/resource-policy": keep
spec:
  accessModes:
    - ReadWriteOnce
  {{- if .Values.global.storageClass }}
  storageClassName: {{ .Values.global.storageClass | quote }}
  {{- end }}
  resources:
    requests:
      storage: {{ .Values.rabbitmq.storageSize | default "2Gi" | quote }}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ $rabbitName }}
  namespace: {{ $ns }}
  labels:
    app: {{ $rabbitName }}
    {{- include "cloudhost-app.labels" . | nindent 4 }}
spec:
  replicas: 1
  # RWO volume + single replica: recreate instead of rolling update.
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: {{ $rabbitName }}
  template:
    metadata:
      labels:
        app: {{ $rabbitName }}
    spec:
      containers:
        - name: rabbitmq
          image: {{ include "cloudhost-app.baseImage" (dict "root" $ "image" (printf "rabbitmq:%s-management-alpine" (.Values.rabbitmq.version | default "3.13"))) }}
          ports:
            - containerPort: 5672
              name: amqp
            - containerPort: 15672
              name: management
          env:
            - name: RABBITMQ_DEFAULT_USER
              valueFrom:
                secretKeyRef:
                  name: {{ $rabbitSecretName }}
                  key: username
            - name: RABBITMQ_DEFAULT_PASS
              valueFrom:
                secretKeyRef:
                  name: {{ $rabbitSecretName }}
                  key: password
          volumeMounts:
            - name: rabbitmq-data
              mountPath: /var/lib/rabbitmq
          resources:
            requests:
              cpu: {{ .Values.rabbitmq.resources.cpuRequest | default "100m" | quote }}
              memory: {{ .Values.rabbitmq.resources.memoryRequest | default "256Mi" | quote }}
            limits:
              cpu: {{ .Values.rabbitmq.resources.cpuLimit | default "500m" | quote }}
              memory: {{ .Values.rabbitmq.resources.memoryLimit | default "512Mi" | quote }}
          readinessProbe:
            exec:
              command: ["rabbitmq-diagnostics", "-q", "ping"]
            initialDelaySeconds: 20
            periodSeconds: 10
            timeoutSeconds: 5
          livenessProbe:
            exec:
              command: ["rabbitmq-diagnostics", "-q", "status"]
            initialDelaySeconds: 60
            periodSeconds: 30
            timeoutSeconds: 10
        {{- include "cloudhost-app.logShipperContainers" (dict "root" . "workloadName" $rabbitName "workloadType" "rabbitmq") | nindent 8 }}
      volumes:
        - name: rabbitmq-data
          persistentVolumeClaim:
            claimName: {{ $rabbitName }}-data
        {{- include "cloudhost-app.logShipperVolumes" (dict "root" . "workloadName" $rabbitName) | nindent 8 }}
---
apiVersion: v1
kind: Service
metadata:
  name: {{ $rabbitName }}
  namespace: {{ $ns }}
  labels:
    app: {{ $rabbitName }}
    {{- include "cloudhost-app.labels" . | nindent 4 }}
spec:
  type: ClusterIP
  selector:
    app: {{ $rabbitName }}
  ports:
    - port: 5672
      targetPort: 5672
      protocol: TCP
      name: amqp
    - port: 15672
      targetPort: 15672
      protocol: TCP
      name: management
{{- end }}