S01E08: Secure public RabbitMQ

[Gsantomaggio]

TGIR S01E08: Secure public RabbitMQ

• Proposed via rabbitmq/tgir#16
• Hosted by @GSantomaggio & @gerhardlazu
• Published on: 2020-12-31
• Link: https://www.youtube.com/watch?v=mPuMBB9_MRI

How do you make your RabbitMQ clusters public & secure? Think HTTPS & AMQPS. What about using a single IP for multiple RabbitMQ clusters? And what about connection throttling?

We try out RabbitMQ Cluster Operator v1.3, cert-manager v1.1 & Traefik v2.3 on Digital Ocean Kubernetes v1.19.3.

Topics covered:

• cert-manager with CloudFlare DNS
• SNI in RabbitMQ, PerfTest & Erlang
• Istio as an alternative to Traefik

Related to #16

LINKS

• cert-manager
• Traefik
• cluster-operator - disableNonTLSListeners
• cluster-operator - Prometheus TLS
• cluster-operator - 1.2.0 to 1.3.0 rolling StatefulSet update?
• RabbitMQ PerfTest - -sni option
• What is SNI?
• RabbitMQ - Using TLS in the Java Client
• Handle two RabbitMQ clusters with ISTIO

[stefano-v]

So great! Thanks @gerhard and @Gsantomaggio . Can't wait to test it. I saw you used traefik, would it be any issue if I replace it with HAProxy ?

[gerhard]

That's great to hear! I would be most interested in the HAProxy version. Link back here so that we can take a look too.

@Gsantomaggio is looking into Istio next, and I'm keen on Linkerd. Trying out different proxies & service meshes with RabbitMQ sound like a great way of learning about the different strengths and weaknesses. It's a fantastic idea 😉

[Gsantomaggio]

Ciao Stefano, Glad to hear :) Let us know! Thank you