Skip to content

feat(infra): add TLS encryption for RabbitMQ AMQP communication#3445

Merged
sunghyun1000 merged 8 commits intomainfrom
t2490-secure-rabbitmq
Apr 3, 2026
Merged

feat(infra): add TLS encryption for RabbitMQ AMQP communication#3445
sunghyun1000 merged 8 commits intomainfrom
t2490-secure-rabbitmq

Conversation

@sunghyun1000
Copy link
Copy Markdown
Member

@sunghyun1000 sunghyun1000 commented Feb 22, 2026

Description

Switched the RabbitMQ connection from plaintext to TLS. Local test environments still use the existing plaintext connection, while TLS is applied only to staging and production environments.

Additional context


Before submitting the PR, please make sure you do the following

@tasoo-oos tasoo-oos marked this pull request as ready for review February 22, 2026 16:22
Comment thread apps/backend/libs/amqp/src/amqp.module.ts Outdated
Comment thread apps/iris/src/connector/rabbitmq/consumer.go Outdated
@sunghyun1000 sunghyun1000 enabled auto-merge April 2, 2026 15:57
@tasoo-oos
Copy link
Copy Markdown
Contributor

아직 몇 가지 중요한 누락/불일치가 보입니다.

  • apps/iris/src/connector/rabbitmq/producer.go
  • apps/plag/src/connector/rabbitmq/consumer.go
  • apps/plag/src/connector/rabbitmq/producer.go

위 파일들은 아직도 InsecureSkipVerify: true 를 사용하고 있어서, 현재 PR만으로는 RabbitMQ TLS 검증 전환이 완전히 끝난 상태는 아닙니다. 커밋 메시지나 PR 설명이 실제 변경 범위보다 조금 더 넓게 적힌 것 같습니다.

또한 plag 쪽은 RABBITMQ_PORT=5671, RABBITMQ_SSL='true' 로 TLS 사용은 켜졌는데, CA 인증서 secret 반영/마운트가 빠져 있습니다.

  • infra/k8s/plag/base/deployment.yaml
  • infra/k8s/plag/base/kustomization.yaml
  • infra/k8s/rabbitmq/base/tls-certificate.yaml

현재 reflector 허용 namespace에도 plag 가 없어서, plag 를 CA 검증 방식으로 바꾸면 배포 시점에 바로 실패할 가능성이 있습니다.

추가로 Go 쪽 RABBITMQ_SSL 판별은 아직 != "" 기준이라서, 값이 "false" 여도 amqps:// 를 사용할 수 있습니다.

  • apps/iris/main.go
  • apps/plag/main.go

TS 쪽처럼 Go 쪽도 == "true" 로 맞추는 게 안전해 보입니다.

사소하지만 AppendCertsFromPEM 반환값을 확인하지 않고 있어서, 인증서가 비어 있거나 잘못된 경우 원인 파악이 어려울 수 있습니다.

이 부분들까지 같이 정리되면 “RabbitMQ TLS 검증 전환 완료”라고 보기 더 적절할 것 같습니다.

Copy link
Copy Markdown
Contributor

@tasoo-oos tasoo-oos left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@sunghyun1000 sunghyun1000 added this pull request to the merge queue Apr 3, 2026
@github-merge-queue github-merge-queue Bot removed this pull request from the merge queue due to a conflict with the base branch Apr 3, 2026
@sunghyun1000 sunghyun1000 enabled auto-merge April 3, 2026 16:34
@sunghyun1000 sunghyun1000 force-pushed the t2490-secure-rabbitmq branch from 3585b46 to f0c583d Compare April 3, 2026 16:42
@sunghyun1000 sunghyun1000 added this pull request to the merge queue Apr 3, 2026
Merged via the queue into main with commit 59fb951 Apr 3, 2026
11 checks passed
@sunghyun1000 sunghyun1000 deleted the t2490-secure-rabbitmq branch April 3, 2026 16:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants