OpenStack-Ansible RabbitMQ server

This Ansible role deploys RabbitMQ. When multiple hosts are present in the rabbitmq_all inventory group, a cluster is created.

Table of Contents

• Scenario - Configuring RabbitMQ
  • Add a TLS encrypted listener to RabbitMQ
  • Enable encrypted connections to RabbitMQ

Default variables

## APT Cache Options
cache_timeout: 600

# Set the package install state for distribution packages
# Options are 'present' and 'latest'
rabbitmq_package_state: "latest"

# Inventory group containing the hosts for the cluster
rabbitmq_host_group: "rabbitmq_all"

rabbitmq_primary_cluster_node: "{{ hostvars[groups[rabbitmq_host_group][0]]['ansible_hostname'] }}"

# Upgrading the RabbitMQ package requires shutting down the cluster. This variable makes upgrading
#  the version an explicit action.
rabbitmq_upgrade: false

# If the user does not want to upgrade but needs to rerun the playbooks for any reason the
#  upgrade/version state can be ignored by setting `rabbitmq_ignore_version_state=true`
rabbitmq_ignore_version_state: false

rabbitmq_package_url: "{{ _rabbitmq_package_url }}"
rabbitmq_package_version: "{{ _rabbitmq_package_version }}"
rabbitmq_release_version: "{{ _rabbitmq_release_version }}"
rabbitmq_package_sha256: "{{ _rabbitmq_package_sha256 }}"
rabbitmq_package_path: "{{ _rabbitmq_package_path }}"

# Choose file, distro, external_repo for rabbitmq_install_method.
rabbitmq_install_method: "file"

# Name of the rabbitmq cluster
rabbitmq_cluster_name: rabbitmq_cluster1

# Specify a partition recovery strategy (autoheal | pause_minority | ignore)
rabbitmq_cluster_partition_handling: pause_minority

# Rabbitmq open file limits
rabbitmq_ulimit: 4096

# Configure rabbitmq plugins
rabbitmq_plugins:
  - name: rabbitmq_management
    state: enabled

# RabbitMQ SSL support
rabbitmq_ssl_cert: /etc/rabbitmq/rabbitmq.pem
rabbitmq_ssl_key: /etc/rabbitmq/rabbitmq.key
rabbitmq_ssl_ca_cert: /etc/rabbitmq/rabbitmq-ca.pem

# Set rabbitmq_ssl_self_signed_regen to true if you want to generate a new
# SSL certificate for RabbitMQ when this playbook runs.  You can also change
# the subject of the self-signed certificate here if you prefer.
rabbitmq_ssl_self_signed_regen: false
rabbitmq_ssl_self_signed_subject: "/C=US/ST=Texas/L=San Antonio/O=IT/CN={{ container_name }}"

# Define user-provided SSL certificates in:
# /etc/openstack_deploy/user_variables.yml
#rabbitmq_user_ssl_cert: <path to cert on ansible deployment host>
#rabbitmq_user_ssl_key: <path to cert on ansible deployment host>
#rabbitmq_user_ssl_ca_cert: <path to cert on ansible deployment host>

# RabbitMQ erlang VM parameters
rabbitmq_async_threads: 128
rabbitmq_process_limit: 1048576

# RabbitMQ collect statistics interval
rabbitmq_collect_statistics_interval: 5000

# RabbitMQ Management rates mode
rabbitmq_management_rates_mode: basic

# Precompile RabbitMQ with HiPE
rabbitmq_hipe_compile: False

# Disable non-TLS listeners
rabbitmq_disable_non_tls_listeners: False

# RabbitMQ policies
# Used to tune performance characteristics of OpenStack messaging
#
# Example override that uses HA queues only for telemetry and sets message
# expiry for RPC messages
#
# rabbitmq_policies:
#   - name: "heat_rpc_expire"
#     pattern: '^heat-engine-listener\\.'
#     tags: "expires=3600000"
#     priority: 1
#   - name: "results_expire"
#     pattern: '^results\\.'
#     tags: "expires=3600000"
#     priority: 1
#   - name: "tasks_expire"
#     pattern: '^results\\.'
#     tags: "expires=3600000"
#     priority: 1
#   - name: "ha-notif"
#     pattern: '^(event|metering|notifications)\.'
#     tags: "ha-sync-mode=automatic"
#     priority: 0
#
rabbitmq_policies:
  - name: "HA"
    pattern: '^(?!amq\.).*'
    tags: "ha-mode=all"

Required variables

# RabbitMQ cluster shared secret
rabbitmq_cookie_token: secrete

Example playbook

- name: Install RabbitMQ server
  hosts: rabbitmq_all
  user: root
  roles:
    - { role: "rabbitmq_server", tags: [ "rabbitmq-server" ] }
  vars:
    rabbitmq_cookie_token: secrete