<p>I am setting up a minikube which contains an activeMQ message queue together with InfluxDB and Grafana.</p>

<p>For Grafana, I was able to set the admin password via the deployment:</p>

<pre><code>  containers:
  - env:
    - name: GF_INSTALL_PLUGINS
      value: grafana-piechart-panel, blackmirror1-singlestat-math-panel
    - name: GF_SECURITY_ADMIN_USER
      value: &lt;grafanaadminusername&gt;
    - name: GF_SECURITY_ADMIN_PASSWORD
      value: &lt;grafanaadminpassword&gt;
    image: grafana/grafana:6.6.0
    name: grafana
    volumeMounts:
    - mountPath: /etc/grafana/provisioning
      name: grafana-volume
      subPath: provisioning/
    - mountPath: /var/lib/grafana/dashboards
      name: grafana-volume
      subPath: dashboards/
    - mountPath: /etc/grafana/grafana.ini
      name: grafana-volume
      subPath: grafana.ini
      readOnly: true
  restartPolicy: Always
  volumes:
  - name: grafana-volume
    hostPath:
      path: /grafana
</code></pre>

<p>For influxdb I set the user/passwd via a secret:</p>

<pre><code>apiVersion: v1  

kind: Secret  
metadata:  
  name: influxdb
  namespace: default
type: Opaque  
stringData:  
  INFLUXDB_CONFIG_PATH: /etc/influxdb/influxdb.conf  
  INFLUXDB_ADMIN_USER: &lt;influxdbadminuser&gt;
  INFLUXDB_ADMIN_PASSWORD: &lt;influxdbbadminpassword&gt;
  INFLUXDB_DB: &lt;mydb&gt;
</code></pre>

<p>Currently, my ActiveMQ deployment looks like this:</p>

<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: activemq
spec:
  replicas: 1
  selector:
    matchLabels:
      app: activemq
  template:
    metadata:
      labels:
        app: activemq
    spec:
      containers:
      - name: web
        image: rmohr/activemq:5.15.9
        imagePullPolicy: IfNotPresent
        ports:
          - containerPort: 61616
          - containerPort: 8161
        resources:
          limits:
            memory: 512Mi
</code></pre>

<p>How do I achieve the similar result (password and admin user via config file) for ActiveMQ? Even better if this is achieved via encrypted secret, which I didn't manage yet in case of influxDB and Grafana</p>

<p>I would do this the following way:</p>

<p><a href="https://activemq.apache.org/encrypted-passwords" rel="nofollow noreferrer">Here</a> you have nicely described encrypted passwords in <strong>ActiveMQ</strong>.</p>

<p>First you need to prepare such encrypted password. <strong>ActiveMQ</strong> has a built-in utility for that:</p>

<blockquote>
  <p>As of ActiveMQ 5.4.1 you can encrypt your passwords and safely store
  them in configuration files. To encrypt the password, you can use the
  newly added encrypt command like:</p>

<pre><code>$ bin/activemq encrypt --password activemq --input mypassword
...
Encrypted text: eeWjNyX6FY8Fjp3E+F6qTytV11bZItDp
</code></pre>
  
  <p>Where the password you want to encrypt is passed with the input argument, while the password argument is a secret used by the encryptor. In a similar fashion you can test-out your passwords like:</p>

<pre><code>$ bin/activemq decrypt  --password activemq --input eeWjNyX6FY8Fjp3E+F6qTytV11bZItDp
...
Decrypted text: mypassword
</code></pre>
  
  <p>Note: It is recommended that you use only alphanumeric characters for
  the password. Special characters, such as $/^&amp;, are not supported.</p>
  
  <p>The next step is to add the password to the appropriate configuration
  file, $ACTIVEMQ_HOME/conf/credentials-enc.properties by default.</p>

<pre><code>activemq.username=system
activemq.password=ENC(mYRkg+4Q4hua1kvpCCI2hg==)
guest.password=ENC(Cf3Jf3tM+UrSOoaKU50od5CuBa8rxjoL)
...
jdbc.password=ENC(eeWjNyX6FY8Fjp3E+F6qTytV11bZItDp)
</code></pre>
</blockquote>

<p>You probably don't even have to rebuilt your image so it contains the appropriate configuration file with encrypted password. You can add it as <code>ConfigMap</code> data to a <code>volume</code>. You can read how to do that <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#add-configmap-data-to-a-volume" rel="nofollow noreferrer">here</a> so I'll rather avoid another copy-pasting from documentation. Alternatively you may want to use <a href="https://kubernetes.io/docs/concepts/storage/volumes/#secret" rel="nofollow noreferrer">secret volume</a>. It's not the most important point here as it is just a way of substituting your original <strong>ActiveMQ</strong> configuration file in your <code>Pod</code> by your custom configuration file and you probably already know how to do that.</p>

<p>There is one more step on <strong>ActiveMQ</strong> side to configure. This config file can be also passed via <code>ConfigMaP</code> like in the previous example.</p>

<blockquote>
  <p>Finally, you need to instruct your property loader to encrypt
  variables when it loads properties to the memory. Instead of standard
  property loader we’ll use the special one (see
  \$ACTIVEMQ_HOME/conf/activemq-security.xml) to achieve this.</p>

<pre><code>&lt;bean id="environmentVariablesConfiguration" class="org.jasypt.encryption.pbe.config.EnvironmentStringPBEConfig"&gt;
  &lt;property name="algorithm" value="PBEWithMD5AndDES" /&gt;
  &lt;property name="passwordEnvName" value="ACTIVEMQ\_ENCRYPTION\_PASSWORD" /&gt;
&lt;/bean&gt;

&lt;bean id="configurationEncryptor" class="org.jasypt.encryption.pbe.StandardPBEStringEncryptor"&gt;
  &lt;property name="config" ref="environmentVariablesConfiguration" /&gt;
&lt;/bean&gt; 

&lt;bean id="propertyConfigurer" class="org.jasypt.spring31.properties.EncryptablePropertyPlaceholderConfigurer"&gt;

  &lt;constructor-arg ref="configurationEncryptor" /&gt; 
  &lt;property name="location" value="file:${activemq.base}/conf/credentials-enc.properties"/&gt; 
&lt;/bean&gt;
</code></pre>
</blockquote>

<p>This way we instructed our <strong>ActiveMQ</strong> to load our <code>encryptor password</code> from the <code>ACTIVEMQ_ENCRYPTION_PASSWORD</code> environment variable and then use it to decrypt passwords from <code>credential-enc.properties file</code>.</p>

<p>Now let's take care about <code>ACTIVEMQ_ENCRYPTION_PASSWORD</code> env var content.</p>

<p>We can set such environment variable in our <code>Pod</code> via <code>Secret</code>. First we need to <a href="https://kubernetes.io/docs/concepts/configuration/secret/#creating-a-secret-manually" rel="nofollow noreferrer">create one</a>. Then we need to <a href="https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-environment-variables" rel="nofollow noreferrer">use it as environment variable</a>.</p>

<p>I hope it helps.</p>
