RabbitMQ Operator Does Not Automatically Reconcile Credential Changes in Secret Objects

Products

• VMware Tanzu RabbitMQ

Issue/Introduction

When using the RabbitMQ Kubernetes Operator, updating the Secret object that contains user credentials does not automatically update the credentials in RabbitMQ. As a result, credential rotation via Secret updates alone does not take effect.

Environment

RabbitMQ on Kubernetes

Cause

The RabbitMQ Operator does not monitor Secret objects associated with user credentials, and updates to these Secrets do not trigger reconciliation.

 

Resolution

To apply updated credentials, a manual reconciliation trigger is required.

This can be achieved by adding or modifying an annotation (or label) on the corresponding users.rabbitmq.com resource, which forces the Operator to reconcile:

kubectl annotate users.rabbitmq.com app-developer-user  "reconcile-at=$(date +%s)" --overwrite

After this annotation update, the Operator re-runs reconciliation and re-imports the credentials from the Secret.

Additional Information

Refer to the below documentation for more information: 

https://www.rabbitmq.com/kubernetes/operator/using-topology-operator#provided-sec-users