Page Comparison

...

Create a Secret from TLS certificate files. Use the following command:

Code Block

language	bash

kubectl create secret generic tls-certificates \
  --from-file path/to/keystore.jks \
  --from-file path/to/truststore.jks -n <namespace>

Add the Secret to your values.yaml file to mount to the HiveMQ pods:
Code Block
language yaml
hivemq: ... secrets: - name: tls-certificates path: /opt/hivemq/conf
This will mount both JKS files at the specified Path.

Store the passwords in the Kubernetes secret using the following command:

Code Block

language	bash

kubectl create secret generic tls-passwords \
  --from-literal=keystore_pass='password1' \
  --from-literal=truststore_pass='password2' -n <namespace>

Create environment variables to access the passwords in the HiveMQ listener’s configurations. Update your values.yaml file with the following configuration:

Code Block

language	yaml

hivemq:
  ...
  
  env:
    - name: KEYSTORE_PASS
      valueFrom:
        secretKeyRef:
          key: keystore_pass
          name: tls-passwords
    - name: TRUSTSTORE_PASS
      valueFrom:
        secretKeyRef:
          key: truststore_pass
          name: tls-passwords

To enable the TLS listener, please add the following block to your values.yaml and add the correct JKS file name and the environment variables names for passwords used while creating the Keystore.

Code Block

language	xml

hivemq:
  ...
  listenerConfiguration: |
    <tls-tcp-listener>
        <port>8883</port>
        <bind-address>0.0.0.0</bind-address>
        <proxy-protocol>true</proxy-protocol>
        <tls>
            <keystore>
                <path>conf/keystore.jks</path>
                <password>${KEYSTORE_PASS}</password>
                <private-key-password>${KEYSTORE_PASS}</private-key-password>
            </keystore>
            <client-authentication-mode>REQUIRED<mode>OPTIONAL</client-authentication-mode>
            <truststore>
                <path>conf/truststore.jks</path>
                <password>${TRUSTSTORE_PASS}</password>
            </truststore>
        </tls>
    </tls-tcp-listener>

In the values.yaml, edit the mqtt port so that it corresponds to the new listener. Update the MQTT port number from 1883 to 8883 in both the Ports section of your values.yaml file and, in case you are exposing these ports via service, then update that file as well.

Code Block

language	yaml

hivemq:
  ports:
    - expose: true
      name: mqtt
      patch:
      - '[{"op":"add","path":"/spec/selector/hivemq.com~1node-offline","value":"false"},{"op":"add","path":"/metadata/annotations","value":{"service.spec.externalTrafficPolicy":"Local"}}]'
      port: 8883

Deploy the above changes to the Kubernetes cluster

Code Block

language	bash

helm upgrade hivemq --install hivemq/hivemq-operator \
  -f values.yaml -n <namespace>

Verify the logs to check if TLS is enabled or not
Code Block
kubectl logs <pod name> -n <namespace>
You will see the following logs if all changes are deployed correctly.
You can also test the connection via the MQTT CLI tool

...

Versions Compared

Old Version 2

New Version 3

Key