Page Comparison

...

1. Create a Secret from TLS certificate files. Use the following command:

   Code Block
   language bash
   kubectl create secret generic tls-certificates \ --from-file path/to/keystore.jks \ --from-file path/to/truststore.jks -n <namespace>

2. Add the Secret to your values.yaml file to mount to the HiveMQ pods:

   Code Block
   language yaml
   hivemq: ... secrets: - name: tls-certificates path: /opt/hivemq/conf

   This will mount both JKS files at the specified Path.

3. Store the passwords in the Kubernetes secret using the following command:

   Code Block
   language bash
   kubectl create secret generic tls-passwords \ --from-literal=keystore_pass='password1' \ --from-literal=truststore_pass='password2' -n <namespace>

4. Create environment variables to access the passwords in the HiveMQ listener’s configurations. Update your values.yaml file with the following configuration:

   Code Block
   language yaml
   hivemq: ...     env: - name: KEYSTORE_PASS valueFrom: secretKeyRef: key: keystore_pass name: tls-passwords - name: TRUSTSTORE_PASS valueFrom: secretKeyRef: key: truststore_pass name: tls-passwords

5. To enable the TLS listener, please add the following block to your values.yaml and add the correct JKS file name and the environment variables names for passwords used while creating the Keystore.

   Code Block
   language xml
   hivemq: ... listenerConfiguration: | <tls-tcp-listener> <port>8883</port> <bind-address>0.0.0.0</bind-address> <proxy-protocol>true</proxy-protocol> <tls> <keystore> <path>conf/keystore.jks</path> <password>${KEYSTORE_PASS}</password> <private-key-password>${KEYSTORE_PASS}</private-key-password> </keystore> <client-authentication-mode>OPTIONAL</client-authentication-mode> <truststore> <path>conf/truststore.jks</path> <password>${TRUSTSTORE_PASS}</password> </truststore> </tls> </tls-tcp-listener>

6. In the values.yaml, edit the mqtt port so that it corresponds to the new listener. Update the MQTT port number from 1883 to 8883 in both the Ports section of your values.yaml file and, in case you are exposing these ports via service, then update that file as well.

   Code Block
   language yaml
   hivemq: ports: - expose: true name: mqtt patch: - '[{"op":"add","path":"/spec/selector/hivemq.com~1node-offline","value":"false"},{"op":"add","path":"/metadata/annotations","value":{"service.spec.externalTrafficPolicy":"Local"}}]' port: 8883

7. Deploy the above changes to the Kubernetes cluster

   Code Block
   language bash
   helm upgrade hivemq --install hivemq/hivemq-operator \ -f values.yaml -n <namespace>

8. Verify the logs to check if TLS is enabled or not

   Code Block
   kubectl logs <pod name> -n <namespace>

9. You will see the following logs if all changes are deployed correctly.

   

10. You can also test the connection via the MQTT CLI tool

Troubleshooting

1. Error: 'No subject alternative names present'
   Meaning: the server CA file, supplied by to the client, contains CN that is not the same as the --hostname
   Example command:

   Code Block
   language bash
   mqtt subscribe --topic # --jsonOutput \ --hostname 127.0.0.1 --port 8883 \ --cafile server.pem

   Code Block
   Unable to connect. Reason: 'No subject alternative names present'

   Reason: When the server.pem has CN that is not the IP address. For example, the server certificate has CN “example.domain.com”.
   Workaround: On the client machine, edit the /etc/hosts and append <ip-address> example.domain.com. This way you can use the command successfully:

   Code Block
   language bash
   mqtt subscribe --topic # --jsonOutput \ --hostname example.domain.com --port 8883 \ --cafile server.pem

\uD83D\uDCCB Related articles

...