Installing the chart

Prerequisites

• Kubernetes 1.19+
• Helm 3.2.0+
• PV provisioner support in the underlying infrastructure

Installation steps

Step 1: Optional. Mirror the Helm chart and/or its images to your own registry

By default, when you mirror a chart or image from the Docker Hardened Images catalog, the chart or image is mirrored to your namespace in Docker Hub. If you want to then mirror to your own third-party registry, you can follow the instructions in How to mirror an image ⁠ for either the chart, the image, or both.

The same regctl tool that is used for mirroring container images can also be used for mirroring Helm charts, as Helm charts are OCI artifacts.

For example:

 regctl image copy \
     "${SRC_CHART_REPO}:${TAG}" \
     "${DEST_REG}/${DEST_CHART_REPO}:${TAG}" \
     --referrers \
     --referrers-src "${SRC_ATT_REPO}" \
     --referrers-tgt "${DEST_REG}/${DEST_CHART_REPO}" \
     --force-recursive

Step 2: Create a Kubernetes secret for pulling images

The Docker Hardened Images that the chart uses must be stored in a private repository, in either Docker Hub, or in your own registry. To allow your Kubernetes cluster to pull those images, you need to create a Kubernetes secret with your Docker Hub credentials or with the credentials for your own registry.

Follow the authentication instructions for DHI in Kubernetes⁠.

For example:

kubectl create secret docker-registry helm-pull-secret \
  --docker-server=https://index.docker.io/v1/ \
  --docker-username=<DHI username> \
  --docker-password=<DHI token> \
  --docker-email=<DHI email>

Step 3: Configure and update the image references in the Helm chart

DHI charts reference images stored in private repositories. While many standard Helm charts use default image locations that are accessible to everyone, DHI images must first be mirrored to your own Docker Hub namespace or private registry. Since each organization will have their own unique repository location, the Helm chart must be updated to point to the correct image locations specific to your organization's Docker Hub namespace or registry.

To do this, you can either use pre-rendering or post-rendering. Pre-rendering uses a values override file to set the image references, while post-rendering uses a script to rewrite the image references after Helm has rendered the templates. The following first shows how to use pre-rendering. If you want to use post-rendering instead, skip to the post-rendering section.

• To use pre-rendering:

  Create a file named dhi-images.yaml file with the following:

  image:
   registry: registry-1.docker.io
    repository: <your-namespace>/dhi-rabbitmq
  initImage:
   registry: registry-1.docker.io
    repository: <your-namespace>/dhi-busybox
  

  Copy

  Replace docker.io with your own registry if you are using one. Replace <your-namespace> with your Docker Hub namespace or with your own namespace in your own registry.

• To use post-rendering, instead of pre-rendering:

  Create a script named post-renderer.sh using the following command:

  cat > post-renderer.sh << 'EOF'
  #!/usr/bin/env bash
  set -euo pipefail
  
  if [ $# -lt 1 ]; then
    echo "Usage: $0 <new-prefix>" >&2
    exit 1
  fi
  
  # Replaces dhi/ or docker.io/dhi with the specified PREFIX
  PREFIX="$1"
  sed -E "s|(image: )\"?(docker\.io/)?dhi/|\1$PREFIX|g"
  EOF
  chmod +x post-renderer.sh
  

  Copy

  This script will replace all references to dhi/ or docker.io/dhi/ with the prefix you provide when running helm install.

Create a configuration values file to configure the RabbitMQ K8s deployment.

cat > values-override.yaml << 'EOF'
## @param extraVolumes Additional volumes to add to the pod
extraVolumes:
  - name: tmp
    emptyDir: {}
  - name: var-tmp
    emptyDir: {}
  - name: home
    emptyDir: {}

## @param extraVolumeMounts Additional volume mounts to add to the RabbitMQ container
extraVolumeMounts:
  - name: tmp
    mountPath: /tmp
  - name: var-tmp
    mountPath: /var/tmp
  - name: home
    mountPath: /home/rabbitmq

extraEnv:
  - name: HOME
    value: "/home/rabbitmq"
  - name: RABBITMQ_HOME
    value: "/var/lib/rabbitmq"

readinessProbe:
  ## @param readinessProbe.enabled Enable readinessProbe on RabbitMQ containers
  enabled: true
  ## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
  initialDelaySeconds: 30
  ## @param readinessProbe.periodSeconds Period seconds for readinessProbe
  periodSeconds: 10
  ## @param readinessProbe.timeoutSeconds Timeout seconds for readinessProbe
  timeoutSeconds: 10
  ## @param readinessProbe.failureThreshold Failure threshold for readinessProbe
  failureThreshold: 6
  ## @param readinessProbe.successThreshold Success threshold for readinessProbe
  successThreshold: 1

## @section Startup probe
startupProbe:
  ## @param startupProbe.enabled Enable startupProbe on RabbitMQ containers
  enabled: true
  ## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe
  initialDelaySeconds: 10
  ## @param startupProbe.periodSeconds Period seconds for startupProbe
  periodSeconds: 10
  ## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe
  timeoutSeconds: 10
  ## @param startupProbe.failureThreshold Failure threshold for startupProbe
  failureThreshold: 30
  ## @param startupProbe.successThreshold Success threshold for startupProbe
  successThreshold: 1
EOF

Step 4: Install the Helm chart

To install the chart, use helm install. The command differs slightly depending on whether you are using post-rendering or pre-rendering. Also, if the chart is in a private repository, make sure you use helm login to log in before running helm install. Optionally, you can also use the --dry-run flag to test the installation without actually installing anything.

• Pre-rendering:

  helm install my-rabbitmq oci://registry-1.docker.io/<your-namespace>/dhi-rabbitmq-chart --version <version> \
    --set "imagePullSecrets[0].name=helm-pull-secret" \
    -f dhi-images.yaml -f values-override.yaml
  

  Copy

  Replace <your-namespace> and <version> accordingly. If the chart is in your own registry, replace registry-1.docker.io/<your-namespace> with your own registry and namespace. Replace helm-pull-secret with the name of the image pull secret you created earlier.

• Post-rendering:

  helm install my-rabbitmq oci://registry-1.docker.io/<your-namespace>/dhi-rabbitmq-chart --version <version> \
    --set "imagePullSecrets[0].name=helm-pull-secret" \
    -f values-override.yaml \
    --post-renderer ./post-renderer.sh --post-renderer-args "<your-registry-and-repository>"
  

  Copy

  Replace <your-namespace> and <version> accordingly. If the chart is in your own registry, replace registry-1.docker.io/<your-namespace> with your own registry and namespace. Replace <your-registry-and-repository> with the registry and repository prefix you want to use for the images, for example, gcr.io/my-project/dhi-, or your-namespace/ if you are using Docker Hub. Replace helm-pull-secret with the name of the image pull secret you created earlier.

Step 5: Verify the installation

After a few seconds RabbitMQ should be up and running:

$ kubectl get pods
NAME                           READY   STATUS    RESTARTS   AGE
my-rabbitmq-rabbitmq-chart-0   1/1     Running   0          44s