RabbitMQ

Production-ready RabbitMQ message broker for Kubernetes. Supports single-node and multi-node cluster architectures, quorum queues (default), management UI with dedicated Ingress, Prometheus metrics, and TLS listeners.

Key Features

• Official Alpine image — default docker.io/library/rabbitmq:4.3.6-alpine with chart-managed plugins
• Hardened Management UI — CSP excludes unsafe-eval and unsafe-inline, with a configurable Referrer-Policy
• Two architectures — single-node (one StatefulSet replica) or cluster (StatefulSet with peer discovery)
• Quorum queues by default — queueDefaults.type: quorum for durable, replicated HA queues
• Dedicated management ingress — management.ingress is separate from the AMQP service
• Gateway API support — optional HTTPRoute for the management UI
• External Secrets Operator — source username, password, and Erlang cookie from an external provider
• Dual-stack Services — optional Service ipFamilyPolicy and ipFamilies controls
• Partition handling — pause_minority strategy prevents split-brain in cluster mode
• PDB support — optional PodDisruptionBudget to protect cluster quorum during node maintenance
• TLS listeners — configurable AMQP/S and management TLS from an existing Secret
• Prometheus metrics — built-in metrics plugin with optional ServiceMonitor
• Low idle CPU defaults — disables Erlang scheduler busy-wait and uses lightweight TCP probes
• Hardened pod defaults — numeric non-root identity, RuntimeDefault seccomp, read-only root filesystem, no privilege escalation, no Linux capabilities, and no mounted ServiceAccount token
• Upgrade-safe credentials — chart-managed username, password, and Erlang cookie survive both --reset-values and --reuse-values

Port Reference

Runtime Efficiency

The chart defaults to the official Alpine RabbitMQ image and controls enabled plugins through the rendered enabled_plugins file. The base Alpine image already contains the management, Prometheus, and Kubernetes peer-discovery plugins, so management.enabled, metrics.enabled, architecture: cluster, and plugins.extra decide what is active without switching image variants.

By default, runtime.disableSchedulerBusyWait: true renders:

RABBITMQ_SERVER_ADDITIONAL_ERL_ARGS: +sbwt none +sbwtdcpu none +sbwtdio none

This lowers idle CPU in containerized RabbitMQ deployments. Startup, liveness, and readiness probes use TCP checks against the active AMQP listener instead of repeatedly starting rabbitmq-diagnostics.

RabbitMQ 4.3.6 fixes exchange binding cleanup, quorum reconciliation, classic queue recovery, AMQP 1.0 validation and credential expiry. Review the upstream v4.3.6 release. RabbitMQ 4.3.5 fixed quorum queue recovery, rolling-upgrade queries, direct reply-to duplicates, and STOMP frame-size limits. The chart renders management.headers.referrer_policy = no-referrer by default. Set management.referrerPolicy: "" only when you intentionally want the browser’s default policy.

Security and Upgrades

The default pod runs as RabbitMQ UID 100 and GID 101 with RuntimeDefault seccomp. Privilege escalation is disabled, all Linux capabilities are dropped, and the root filesystem is read-only. The data PVC and an ephemeral /tmp volume are the only writable paths. A non-root init container restores the Erlang cookie to owner-only mode after Kubernetes applies the volume filesystem group, which keeps PVCs created by older chart versions compatible.

RabbitMQ 4.1 and later discovers Kubernetes peers from StatefulSet ordinals without querying the Kubernetes API, so automountServiceAccountToken defaults to false.

During an upgrade, the chart reuses all three values from its existing managed Secret: username, password, and Erlang cookie. This prevents Helm --reset-values from making the Secret disagree with users stored in the persistent broker database. Changing the auth.* values does not rotate an existing RabbitMQ user; perform live rotation with RabbitMQ administration tooling, then synchronize an existing Secret or External Secrets provider.

The workload template merges the hardened security baseline by key, so an upgrade with --reuse-values applies new defaults even when the previous release stored empty security-context maps. Explicit per-key security overrides and an explicit automountServiceAccountToken value remain authoritative.

The supported in-place path from earlier public chart versions uses the official image identity 100:101. If a release used a custom image, inspect the existing cookie before upgrading:

kubectl exec -n <namespace> <rabbitmq-pod> -- stat -c '%u:%g %a' /var/lib/rabbitmq/.erlang.cookie

Keep podSecurityContext.runAsUser, runAsGroup, and fsGroup aligned with that image’s numeric identity. To move a PVC to 100:101, stop RabbitMQ and perform an explicitly authorized one-time ownership migration first. The hardened chart does not silently run a root volume-permissions container.

Installation

HTTPS repository:

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install rabbitmq helmforge/rabbitmq -f values.yaml

OCI registry:

helm install rabbitmq oci://ghcr.io/helmforgedev/helm/rabbitmq -f values.yaml

Deployment Examples

# values.yaml — RabbitMQ single-node with management UI and persistence
architecture: single-node

auth:
  username: admin
  existingSecret: rabbitmq-credentials
  existingSecretPasswordKey: rabbitmq-password

queueDefaults:
  type: quorum # modern default — use classic only for legacy compatibility

singleNode:
  persistence:
    enabled: true
    size: 10Gi

management:
  enabled: true
  ingress:
    enabled: true
    ingressClassName: traefik
    annotations:
      cert-manager.io/cluster-issuer: letsencrypt-prod
    hosts:
      - host: rabbitmq.example.com
        paths:
          - path: /
            pathType: Prefix
    tls:
      - secretName: rabbitmq-tls
        hosts:
          - rabbitmq.example.com

resources:
  requests:
    memory: 256Mi
    cpu: 100m
  limits:
    memory: 1Gi
    cpu: 500m

# values.yaml — 3-node RabbitMQ cluster with fixed Erlang cookie and PDB
architecture: cluster

auth:
  username: admin
  existingSecret: rabbitmq-credentials # must contain password AND erlang cookie
  existingSecretPasswordKey: rabbitmq-password
  existingSecretErlangCookieKey: rabbitmq-erlang-cookie

queueDefaults:
  type: quorum

cluster:
  replicaCount: 3
  partitionHandling: pause_minority
  gracefulShutdown:
    enabled: true
  persistence:
    enabled: true
    size: 10Gi

pdb:
  enabled: true
  minAvailable: 2 # always maintain quorum (majority of 3)

management:
  enabled: true
  ingress:
    enabled: true
    ingressClassName: traefik
    hosts:
      - host: rabbitmq.example.com
        paths:
          - path: /
            pathType: Prefix

resources:
  requests:
    memory: 512Mi
    cpu: 250m
  limits:
    memory: 2Gi
    cpu: '1'

# values.yaml — RabbitMQ with TLS for AMQP and management UI
architecture: single-node

auth:
  username: admin
  existingSecret: rabbitmq-credentials

tls:
  enabled: true
  existingSecret: rabbitmq-tls-secret # must contain ca.crt, tls.crt, tls.key
  caFilename: ca.crt
  certFilename: tls.crt
  keyFilename: tls.key
  verify: verify_peer
  failIfNoPeerCert: false

management:
  enabled: true
  ingress:
    enabled: true
    ingressClassName: traefik
    useTlsPort: true # route ingress to management HTTPS port (15671)
    hosts:
      - host: rabbitmq.example.com
        paths:
          - path: /
            pathType: Prefix

singleNode:
  persistence:
    enabled: true
    size: 10Gi

# values.yaml — RabbitMQ with Prometheus metrics and ServiceMonitor
architecture: single-node

auth:
  username: admin
  existingSecret: rabbitmq-credentials

singleNode:
  persistence:
    enabled: true
    size: 10Gi

metrics:
  enabled: true
  serviceMonitor:
    enabled: true
    interval: 30s
    labels:
      release: prometheus # match your Prometheus Operator selector label

management:
  enabled: true

# values.yaml — RabbitMQ credentials managed by External Secrets Operator
auth:
  username: admin
  existingSecret: rabbitmq-credentials
  existingSecretUsernameKey: rabbitmq-username
  existingSecretPasswordKey: rabbitmq-password
  existingSecretErlangCookieKey: rabbitmq-erlang-cookie

externalSecrets:
  enabled: true
  apiVersion: external-secrets.io/v1
  refreshInterval: '0'
  secretStoreRef:
    name: platform-secrets
    kind: ClusterSecretStore
  data:
    - secretKey: rabbitmq-username
      remoteRef:
        key: rabbitmq/admin
        property: username
    - secretKey: rabbitmq-password
      remoteRef:
        key: rabbitmq/admin
        property: password
    - secretKey: rabbitmq-erlang-cookie
      remoteRef:
        key: rabbitmq/cluster
        property: erlangCookie

# values.yaml — expose the RabbitMQ management UI through Gateway API
management:
  enabled: true
  gateway:
    enabled: true
    hostnames:
      - rabbitmq.example.com
    parentRefs:
      - name: public-gateway
        namespace: gateway-system

Configuration Reference

Core

Image

Authentication

Queue Defaults

Single-Node Mode

Cluster Mode

Management UI

TLS

Plugins

Custom Configuration

Runtime

Probes

PodDisruptionBudget

Metrics

Service

Gateway API

The chart can expose the management UI with Gateway API by rendering an HTTPRoute that targets the management Service port. Use this when your cluster standardizes north-south HTTP traffic through Gateway API.

External Secrets Operator

Use External Secrets for RabbitMQ credentials when passwords and Erlang cookies are owned by a secret manager.

Resources and Security

Scheduling

Extra

More Information

• RabbitMQ Official Documentation
• Quorum Queues Guide
• RabbitMQ Clustering Guide
• HelmForge RabbitMQ Chart Source