TopolearnShared brokers need isolation and access control, and policies let you change queue behaviour without code deploys.
Virtual hosts partition a broker: each vhost has its own exchanges, queues, bindings and permissions, and clients connect to exactly one. Use a vhost per application or environment. A vhost can set a default_queue_type (such as quorum) and limits like max-connections and max-queues.
Users authenticate with passwords, x509 certificates, or OAuth 2 tokens through a plugin; LDAP is also supported. Each user has tags that control management access (administrator, monitoring, management, none) and permissions per vhost, given as three regular expressions over resource names:
- configure: declare and delete exchanges and queues,
- write: publish to exchanges and bind,
- read: consume from queues and bind.
".*" ".*" ".*" grants everything; production services should get narrower patterns, such as a publisher that can only write to ^orders$.
Policies apply settings to queues and exchanges matching a name pattern: dead-lettering, TTL, max length, delivery limit, alternate exchanges and more. They can be changed at runtime, unlike arguments passed at declaration. When several policies match, the one with the highest priority wins; operator policies set by administrators cap values such as max length on top of user policies.
Example
# vhost per application, quorum queues by default
rabbitmqctl add_vhost orders --default-queue-type quorum
# a publisher that may only write to the "orders" exchange
rabbitmqctl add_user order-api 'S3cret!'
rabbitmqctl set_permissions -p orders order-api '^$' '^orders$' '^$'
# configure write read
# a worker that consumes from queues prefixed orders.
rabbitmqctl add_user order-worker 'An0ther!'
rabbitmqctl set_permissions -p orders order-worker '^orders\..*' '' '^orders\..*'
# policy: DLX and length limit for all orders.* queues
rabbitmqctl set_policy -p orders --apply-to queues --priority 10 orders-defaults \
'^orders\.' '{"dead-letter-exchange":"dlx","max-length":100000}'
rabbitmqctl list_policies -p orders
rabbitmqctl delete_user guestRemember
- vhosts isolate applications; clients connect to one vhost
- Permissions are configure/write/read regexes per vhost
- Policies configure DLX, TTL and limits at runtime by name pattern
Watch out for
- Giving every application administrator access to the default vhost.