RabbitMQ Broker

BigHammer workers and APIs use RabbitMQ for Celery task queues. The broker is not part of the bighammer umbrella chart — deploy it as a separate Helm release (or point apps at an existing broker).

Prerequisites

• External Secrets Operator installed
• Workload Identity for ESO → Key Vault
• Key Vault secret bh-rabbitmq-password (same password used by the broker and app pods)
• SecretStore in bh-control-plane (created by bighammer platform chart or your bootstrap)

Choose an installation path

Option	When to use
A — BigHammer bhrabbitmq chart (recommended)	Standard BigHammer on AKS; chart published to ECR OCI
B — Upstream Bitnami chart	You manage Bitnami RabbitMQ yourself; align service name and secrets with bighammer
C — Existing broker	Corporate or shared RabbitMQ already running; configure bighammer workers only

All paths must expose AMQP on port 5672 and use a password synced from bh-rabbitmq-password in Key Vault (unless you override global.remoteSecrets.rabbitmq).

---

Option A — BigHammer bhrabbitmq chart (OCI)

BigHammer publishes the bhrabbitmq chart to AWS ECR. Mirror to your ACR per Release Manifest & Distribution.

Item	Value
Release name	bhrabbitmq (fixed — matches fullnameOverride)
Namespace	bh-control-plane
Service DNS	bhrabbitmq.bh-control-plane.svc.cluster.local:5672
OCI chart (BH source)	oci://<bh-aws-account-id>.dkr.ecr.<bh-catalog-aws-region>.amazonaws.com/azure/bh-helm-release/bhrabbitmq
Your ACR OCI	oci://<registry>.azurecr.io/bh-helm-release/bhrabbitmq
Chart version	Pin to published tag from your release manifest

1. Create the password in Key Vault

az keyvault secret set --vault-name <VAULT> \
  --name bh-rabbitmq-password \
  --value 'your-secure-password'

See Key Vault Secrets for the full global.remoteSecrets mapping.

2. Authenticate to ACR (after mirror)

az acr login --name <registry>
export ACR_OCI_CHART=oci://<registry>.azurecr.io/bh-helm-release/bhrabbitmq
export CHART_VERSION=<chart-version>

3. Prepare AKS values overlay

Create values-azure-rabbitmq.yaml:

global:
  cloudProvider: azure
  secretStore:
    kind: SecretStore
    name: azure-secret-store

externalSecrets:
  enabled: true
  passwordRemoteKey: bh-rabbitmq-password

auth:
  existingPasswordSecret: bhrabbitmq-credentials
  existingSecretPasswordKey: rabbitmq-password

storageClass:
  enabled: true
  name: bh-rabbitmq-sc
  provisioner: disk.csi.azure.com
  parameters:
    skuName: Standard_LRS

persistence:
  storageClass: bh-rabbitmq-sc

replicaCount: 1
ingress:
  enabled: false

4. Install

helm pull "${ACR_OCI_CHART}" --version "${CHART_VERSION}"
tar -xzf "bhrabbitmq-${CHART_VERSION}.tgz"

helm upgrade --install bhrabbitmq ./bhrabbitmq \
  -f bhrabbitmq/values.yaml \
  -f values-azure-rabbitmq.yaml \
  -n bh-control-plane \
  --create-namespace

5. Verify

kubectl get pods -n bh-control-plane -l app.kubernetes.io/name=rabbitmq
kubectl get externalsecret -n bh-control-plane | grep rabbitmq

---

Option B — Upstream Bitnami RabbitMQ chart

If you install Bitnami RabbitMQ directly:

Setting	Align with BigHammer
Service name	bhrabbitmq or update worker RABBITMQ_HOST in values
Password secret	ExternalSecret from Key Vault bh-rabbitmq-password
Namespace	bh-control-plane (recommended)

Workers expect AMQP URL pattern:

amqp://user:<password>@bhrabbitmq.bh-control-plane.svc.cluster.local:5672//

---

Option C — Existing RabbitMQ broker

Configure bighammer worker values only:

global:
  remoteSecrets:
    rabbitmq:
      password: bh-rabbitmq-password   # must match broker password in Key Vault

  bhcatalogworker:
    env:
      RABBITMQ_HOST: <your-broker-host>
      RABBITMQ_PORT: "5672"

Ensure network policy and firewall allow AKS nodes → broker on TCP 5672.

---

Install order

1. Key Vault secret bh-rabbitmq-password
2. Workload Identity + ESO (cluster preparation steps 1–2)
3. helm upgrade --install bhrabbitmq ...
4. Verify ExternalSecret synced before platform Helm install

---

Troubleshooting

Symptom	Fix
ExternalSecret error	Key Vault name bh-rabbitmq-password; ESO identity has Secrets User
Connection refused from workers	Service DNS bhrabbitmq.bh-control-plane.svc.cluster.local:5672
Auth failure	Same password in Key Vault and broker auth.existingPasswordSecret

---

Platform chart coupling

The bighammer chart does not install RabbitMQ. Deploy the broker before platform workers start, or workers will crash-loop on AMQP connection errors.

Order: Cluster preparation step 5 → Platform Deployment.

---

Related

Topic	Link
Secrets reference	Key Vault Secrets
Mirror workflow	Release Manifest & Distribution
GCP equivalent	GCP RabbitMQ Broker