ssl - 如果定义了k8s API tls密码，则在k8s上的Rabbitmq对等发现失败

我使用头盔图在k8s上部署了2个RabbitMQ吊舱。
该图表可以很好地部署并首先很好地聚集。
然后为k8s API添加tls定义：

--tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

然后RabbitMQ对等发现插件无法集群。

[root@control-01]$ # kubectl get pod -o wide
oe-crmq-0                                   0/1       CrashLoopBackOff   7          33m       192.168.1.186   worker-01
oe-crmq-1                                   0/1       CrashLoopBackOff   7          32m       192.168.1.105   worker-02
[root@control-01]$ # kubectl logs oe-crmq-0
  ##  ##
  ##  ##      RabbitMQ 3.7.5. Copyright (C) 2007-2018 Pivotal Software, Inc.
  ##########  Licensed under the MPL.  See http://www.rabbitmq.com/
  ######  ##
  ##########  Logs: /var/log/rabbitmq/[email protected]
                    /var/log/rabbitmq/rabbit@oe-crmq-0_upgrade.log

              Starting broker...
{"Kernel pid terminated",application_controller,"{application_start_failure,rabbit,{bad_return,{{rabbit,start,[normal,[]]},{'EXIT',{{case_clause,{error,\"{failed_connect,[{to_address,{\\"kubernetes.default.svc.cluster.local\\",8443}},\n                 {inet,[inet],etimedout}]}\"}},[{rabbit_mnesia,init_from_config,0,[{file,\"src/rabbit_mnesia.erl\"},{line,164}]},{rabbit_mnesia,init_with_lock,3,[{file,\"src/rabbit_mnesia.erl\"},{line,144}]},{rabbit_mnesia,init,0,[{file,\"src/rabbit_mnesia.erl\"},{line,111}]},{rabbit_boot_steps,'-run_step/2-lc$^1/1-1-',1,[{file,\"src/rabbit_boot_steps.erl\"},{line,49}]},{rabbit_boot_steps,run_step,2,[{file,\"src/rabbit_boot_steps.erl\"},{line,49}]},{rabbit_boot_steps,'-run_boot_steps/1-lc$^0/1-0-',1,[{file,\"src/rabbit_boot_steps.erl\"},{line,26}]},{rabbit_boot_steps,run_boot_steps,1,[{file,\"src/rabbit_boot_steps.erl\"},{line,26}]},{rabbit,start,2,[{file,\"src/rabbit.erl\"},{line,801}]}]}}}}}"}
Kernel pid terminated (application_controller) ({application_start_failure,rabbit,{bad_return,{{rabbit,start,[normal,[]]},{'EXIT',{{case_clause,{error,"{failed_connect,[{to_address,{\"kubernetes.defau

Crash dump is being written to: /var/log/rabbitmq/erl_crash.dump...done

因此，我尝试在advanced.config中为RabbitMQ添加密码：

bash-4.2$ cat advanced.config
%% List allowed ciphers
[
    {ssl, [{versions, ['tlsv1.2']},
           {ssl_optons, [{ciphers, [
                            {ecdhe_rsa,aes_128_gcm,null,sha256}
                            ]}, {fail_if_no_peer_cert,false}]}]}
].

虽然此配置没有带来太多改进。连接到kubernetes.default.svc.cluster.local时仍然超时。

最佳答案

将erlang升级到最新版本后，问题得以解决。

关于ssl - 如果定义了k8s API tls密码，则在k8s上的Rabbitmq对等发现失败，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/51947837/