rabbitmq

Renders RabbitMQ Cluster Operator and Messaging Topology Operator resources, with their ConfigMaps and Secrets, from inventory parameters.

kubernetes operators database

Latest: 1.0.3 · 2026-10-16
License: Apache-2.0
Owners: Moep90
Source: github.com/kadet-hub/generators · 0 repo stars, shared by 35 generators
Thumbs up: 👍 0 on GitHub Discussions
Popularity: 18 · 458 pulls

Request a feature Report a problem

Badge

Show the latest listed version in your README. shields.io draws the badge from this page's badge.json, which every catalog build updates; once no version is listed, it reads "not listed".

[![kadet-hub](https://img.shields.io/endpoint?url=https://kadet-hub.org/generators/rabbitmq/badge.json)](https://kadet-hub.org/generators/rabbitmq/)

RabbitMQ Generator

Published on kadet-hub: pin a released version by digest from its catalog page.

Built for RabbitMQ Cluster Operator 2.23.1 and Messaging Topology Operator 1.20.4 (rabbitmq.com/v1beta1, the only served and storage version of every kind, not deprecated). The bundled rabbitmq.com JSON Schemas are MPL-2.0, derived from the upstream CRDs of both operators (see schemas/rabbitmq.com/NOTICE); the generator code is Apache-2.0. ConfigMaps and Secrets are checked against the Kubernetes 1.37.1 schemas.

Kapitan kadet generator for RabbitMQ on Kubernetes:

RabbitmqCluster (Cluster Operator): a RabbitMQ cluster
Queue, Exchange, Binding, Policy, Vhost, User, Permission, Federation, Shovel (Messaging Topology Operator): topology inside that cluster
ConfigMap and Secret: client configuration and the URI Secrets that Federation and Shovel read

Usage

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/rabbitmq@sha256:<digest>
        output_path: lib/rabbitmq
    compile:
      - output_path: manifests/rabbitmq/
        input_type: kadet
        output_type: yml
        input_paths:
          - lib/rabbitmq

Inventory contract

All keys live under parameters.generators.rabbitmq.

Key	Kind	Output key
`namespace`		Default namespace. Falls back to `parameters.namespace`, then `default`.
`cluster_reference`		Default `rabbitmqClusterReference` of every topology kind, see below.
`rabbitmqcluster.<name>`	RabbitmqCluster	`<namespace>/<name>-rabbitmqcluster`
`queue.<name>`, `exchange.<name>`, `binding.<name>`, `policy.<name>`, `vhost.<name>`, `user.<name>`, `permission.<name>`, `federation.<name>`, `shovel.<name>`	the kind	`<namespace>/<name>-<kind lowercased>`
`rabbitmq_resources.users.<name>`	User, one Permission per `permissions` entry	`<namespace>/<name>-user`, `<namespace>/<permission>-permission`
`rabbitmq_resources.vhosts.<name>`	Vhost	`<namespace>/<name>-vhost`
`secrets.<name>`	Secret	`<namespace>/<name>-secret`
`configs.<name>`	ConfigMap	`<namespace>/<name>-cm`

Every entry accepts namespace, labels and annotations. The CRD kinds take their spec from spec, passed through unchanged, and topology kinds also accept cluster_reference.

Defaults and shorthands

Precedence, lowest first: generator defaults, spec, flat keys and shorthands; a flat key that overrides a spec value logs a warning.

Input	Result
entry key of Queue, Exchange, Policy, Vhost, Federation, Shovel	`spec.name`
`cluster_reference: <name>` on an entry or generator-wide	`spec.rabbitmqClusterReference: {name: <name>}`

spec.name is the object’s name inside RabbitMQ and required by the CRD. The webhook forbids changing it after creation, so set spec.name when the RabbitMQ name differs from the entry key, for example a queue named analytics.reports.

rabbitmqClusterReference is required on every topology kind. A dict passes through, for example {name: production, namespace: messaging} for a cluster in another namespace, which the cluster has to allow with the annotation rabbitmq.com/topology-allowed-namespaces.

The generator leaves operator defaults out: RabbitmqCluster replicas: 1, persistence.storage: 10Gi and the resource requests and limits (CRD defaults); Queue durable: true, set by the defaulting webhook; Federation reconnectDelay: 1 (CRD default since 1.20.4); vhost: / and deletionPolicy: delete. It sets no default that grants access: Permission vhost and permissions, User tags and the Federation and Shovel uriSecret stay unset unless the inventory names them, and a resource without them fails QA-7 at compile time and the API server at apply time.

`rabbitmq_resources`

Key	Result
`users.<name>.cluster_reference`	`rabbitmqClusterReference` of the User and its Permissions; string or dict
`users.<name>.secret_name`	`spec.importCredentialsSecret`; string or `{name: ...}`
`users.<name>.user_tags`	`spec.tags`
`users.<name>.permissions.<permission>`	Permission with `userReference: {name: <name>}` (or `user`/`user_reference` from the entry), `vhost` and `read_permission`, `write_permission`, `configure_permission` as `permissions.read`, `.write`, `.configure`
`vhosts.<name>.cluster_reference`	`rabbitmqClusterReference`; string or dict

A Permission references the User emitted from its entry by userReference, because without secret_name the operator generates a random username; user: <RabbitMQ username> or user_reference on the permission entry wins. Credentials Secrets for secret_name come from External Secrets or a Kapitan ref, not from this generator.

`secrets` and `configs`

Key	Default	Result
`name`	entry key	`metadata.name`
`data.<key>`		one of `value`, `template` (Jinja2 file, context from `values`) or `file`; `b64_encode: true` base64-encodes the value
`string_data.<key>`		Secrets only: same sources as `data`, emitted as `stringData`
`directory`		every file in the directory, sorted by name; Secrets base64-encode them
`type`	`Opaque`	Secrets only
`versioned`	`false`	appends an 8 character content hash to `metadata.name`; the output key keeps the plain name

use_tesoro: true emits Secret data and directory items unencoded as stringData. Labels and annotations under parameters.generators.manifest.default_config.globals.config_maps and .secrets are added when present. Kapitan’s --cache does not see edits to files read through file, template and directory.

Example

parameters:
  generators:
    rabbitmq:
      namespace: messaging
      cluster_reference: production
      rabbitmqcluster:
        production:
          spec:
            replicas: 3
            persistence:
              storage: 50Gi
            rabbitmq:
              additionalPlugins:
                - rabbitmq_federation
      queue:
        orders:
          spec:
            type: quorum
            vhost: orders
      exchange:
        events:
          spec:
            type: topic
            durable: true
      policy:
        federate-events:
          spec:
            pattern: ^events$
            applyTo: exchanges
            definition:
              federation-upstream: upstream-dc
      federation:
        upstream-dc:
          spec:
            uriSecret:
              name: upstream-dc-uri
            exchange: events
      rabbitmq_resources:
        vhosts:
          orders: {}
        users:
          orders-app:
            secret_name: orders-app-credentials
            permissions:
              orders-app-orders:
                vhost: orders
                configure_permission: ^orders.*
                write_permission: ^orders.*
                read_permission: ^orders.*
      secrets:
        upstream-dc-uri:
          string_data:
            uri:
              value: amqps://upstream.example.com:5671?auth_mechanism=external

tests/fixtures/inventory/targets/complete.yml covers every kind, a cross-namespace reference and a flat key overriding spec.

Versions

Add a version's inventory entry, then compile with the consumer workflow, which verifies the artifact and runs Kapitan in the sandbox.

Free of charge, as is and on a best-effort basis: use at your own risk, and review the compiled output before you apply it. Terms

This catalog was built from index serial 47. Set index_serial: 47 in .kapitan-sandbox.yaml and the consumer workflow refuses any older index, so a rolled-back index cannot bring back a yanked version.

Checks find known patterns; they do not prove a generator safe. What a listing covers

Version	Built for (schema-checked)
1.0.3	Kubernetes 1.37.1 RabbitMQ Cluster Operator / Messaging Topology Operator 2.23.1 / 1.20.4
1.0.2	Kubernetes 1.35.0 RabbitMQ Cluster Operator / Messaging Topology Operator 2.23.0 / 1.20.3
1.0.1	Kubernetes 1.35.0 RabbitMQ Cluster Operator / Messaging Topology Operator 2.23.0 / 1.20.3
1.0.0	Kubernetes 1.35.0 RabbitMQ Cluster Operator / Messaging Topology Operator 2.23.0 / 1.20.3

1.0.3# 2026-10-16

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/rabbitmq:1.0.3@sha256:7d7586b162faa9105d8d7dd5d330ec150fa66c5870925bb7857f4deb6e335aeb
        output_path: lib/rabbitmq

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/rabbitmq@sha256:7d7586b162faa9105d8d7dd5d330ec150fa66c5870925bb7857f4deb6e335aeb \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3274602640, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: reclass-rs, omegaconf
With --cache: passed
krab: compatible
Built for (schema-checked): Kubernetes 1.37.1
RabbitMQ Cluster Operator / Messaging Topology Operator 2.23.1 / 1.20.4
Source: rabbitmq-v1.0.3 · 93fd55e50e2552ed10b2ef02f33b5cdae62b6e95 · rabbitmq
Binaries: none
Output capabilities: none
Digest: sha256:7d7586b162faa9105d8d7dd5d330ec150fa66c5870925bb7857f4deb6e335aeb

Checks

Checked by the release run on 2026-10-16, gate at 08aa32a4e924.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

Fixture output against 1.0.2: 0 files, 0 hunks.

Output diff

1.0.2# 2026-10-14

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/rabbitmq:1.0.2@sha256:5d2ac0cd7f8bd606daad43a3e2ff9a33afb19cd97bd763662d508450f66fd372
        output_path: lib/rabbitmq

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/rabbitmq@sha256:5d2ac0cd7f8bd606daad43a3e2ff9a33afb19cd97bd763662d508450f66fd372 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3250334736, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): Kubernetes 1.35.0
RabbitMQ Cluster Operator / Messaging Topology Operator 2.23.0 / 1.20.3
Source: rabbitmq-v1.0.2 · e4891e8fd85ca0a19ebf361e8b54fd6473fd8a2f · rabbitmq
Binaries: none
Output capabilities: none
Digest: sha256:5d2ac0cd7f8bd606daad43a3e2ff9a33afb19cd97bd763662d508450f66fd372

Checks

Checked by the release run on 2026-10-14, gate at 92d0d7420ff5.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

1.0.1# 2026-10-13

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/rabbitmq:1.0.1@sha256:7d0fc479f951094669aa5d2b216471cc138a8dc6305ca3b4c03afc2c0d7b06dc
        output_path: lib/rabbitmq

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/rabbitmq@sha256:7d0fc479f951094669aa5d2b216471cc138a8dc6305ca3b4c03afc2c0d7b06dc \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3244142002, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): Kubernetes 1.35.0
RabbitMQ Cluster Operator / Messaging Topology Operator 2.23.0 / 1.20.3
Source: rabbitmq-v1.0.1 · 9166cb30e0ae4874bc8f229c6a6823eff7451d04 · rabbitmq
Binaries: none
Output capabilities: none
Digest: sha256:7d0fc479f951094669aa5d2b216471cc138a8dc6305ca3b4c03afc2c0d7b06dc

Checks

Checked by the release run on 2026-10-13, gate at ba634ff54963.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

1.0.0# 2026-10-11

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/rabbitmq:1.0.0@sha256:8b3dcef1c1b1d0945aff7563f963123df4e2b4b0bc9c451acf0d393f3b3354ed
        output_path: lib/rabbitmq

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/rabbitmq@sha256:8b3dcef1c1b1d0945aff7563f963123df4e2b4b0bc9c451acf0d393f3b3354ed \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3212106036, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared: >=0.36.3,<0.37
Kapitan checked: 0.36.3
Backends checked: not recorded
With --cache: not recorded
krab: compatible
Built for (schema-checked): Kubernetes 1.35.0
RabbitMQ Cluster Operator / Messaging Topology Operator 2.23.0 / 1.20.3
Source: rabbitmq-v1.0.0 · c3fd859273b2e76315c54f56052dc743669ac318 · rabbitmq
Binaries: none
Output capabilities: none
Digest: sha256:8b3dcef1c1b1d0945aff7563f963123df4e2b4b0bc9c451acf0d393f3b3354ed

Checks

Checked by the release run on 2026-10-11, gate at 4f27fde613c7.

Secrets gitleaks 8.30.1
No secret matched the marketplace's gitleaks rules.
Malware ClamAV 1.5.4
No file matched a ClamAV signature.
Malicious package heuristics GuardDog 3.2.0
No GuardDog threat rule matched.
Dangerous code Semgrep 1.180.0
No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
Python errors Ruff 0.17.0
No syntax error or undefined name (Ruff, error rules only).
File tree tree_check.py
No symlink, executable or banned file; imports within the allowlist.
Sandboxed compile gVisor 20261005, Kapitan 0.36.3
The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
Output capabilities Conftest 0.71.1
The compiled output uses only the capabilities the manifest declares.
CI detection Kapitan 0.36.3
The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

RabbitMQ Generator

Usage

Inventory contract

Defaults and shorthands

rabbitmq_resources

secrets and configs

Example

Versions

Inventory

Verify

Checks

Output diff

Inventory

Verify

Checks

Output diff

Inventory

Verify

Checks

Output diff

Inventory

Verify

Checks

Output diff

`rabbitmq_resources`

`secrets` and `configs`