Page Comparison

...

Install External Secrets Kubernetes Operator

1. Add the repo to the Helm:

   Code Block
   language bash
   helm repo add external-secrets https://charts.external-secrets.io

2. Install external-secrets/external-secrets in the same namespace as HiveMQ Platform.

   Code Block
   language bash
   helm install external-secrets external-secrets/external-secrets --namespace hivemq

3. Create the secret required for the external-secrets to access the external vault. The secret should contain the VAULT_TOKEN. In our article, the token is root

   Code Block
   language bash
   kubectl create secret generic secret-token-for-vault --from-literal token=root --namespace hivemq

   OR

   Code Block
   language bash
   kubectl apply -f 1-secret-token-for-vault.yaml --namespace hivemq

   View file
   name 1-secret-token-for-vault.yaml

   Code Block
   language yaml
   apiVersion: v1 kind: Secret metadata: name: secret-token-for-vault data: token: cm9vdA== # "root"

4. Create the Secret Store required for the external-secrets to access the external vault. The definition should contain the vault URL and reference to the secret with the token, and also the path (path in the kv-2 engine in the external vault from which the token is allowed to read)

   Code Block
   language yaml
   apiVersion: external-secrets.io/v1beta1 kind: SecretStore metadata: name: secretstore-vault spec: provider: vault: server: "http://[ VAULT_ADDR ]:8200" path: "hivemq-mqtt/obc-poc" version: "v2" auth: # points to a secret that contains a vault token # https://www.vaultproject.io/docs/auth/token tokenSecretRef: name: "secret-token-for-vault" key: "token"

   View file
   name 2-secretstore.yaml

   Code Block
   language bash
   kubectl apply -f 2-secretstore.yaml --namespace hivemq

   Now the external-secrets should be able to access the external vault successfully

5. Create an external-secret that will fetch the keystore from the external vault and put it to the Kubernetes secret hivemq-keystore-v, key keystore.

   Code Block
   language yaml
   apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: name: external-secret-for-keystore spec: refreshInterval: "15s" secretStoreRef: name: secretstore-vault kind: SecretStore data: - remoteRef: decodingStrategy: Base64 key: "hivemq-mqtt/obc-poc/opt/hivemq/conf/broker-keystore" property: keystore secretKey: keystore target: name: hivemq-keystore-v

6. Apply the rest of the external secrets manifests in the same fashion:
   

   View file
   name 3-external-secret-for-keystore.yaml

   
   

   View file
   name 3.1-external-secret-for-keystore-password.yaml

   
   

   View file
   name 3.2-external-secret-for-keystore-key-password.yaml

   
   

   View file
   name 4-external-secret-for-truststore.yaml

   
   

   View file
   name 4.1-external-secret-for-truststore-password.yaml

   
   

   View file
   name 5-external-secret-for-license.yaml

   
   

7. If everything works, the following Kubernetes Secrets will be created automatically:

   Code Block
   language bash
   kubectl get secrets --namespace hivemq

   Code Block
   language text
   hivemq-keystore-passphrase-v Opaque 1 54m hivemq-keystore-password-v Opaque 1 54m hivemq-keystore-v Opaque 1 54m hivemq-license-v Opaque 1 24m hivemq-truststore-password-v Opaque 1 54m hivemq-truststore-v Opaque 1 54m

...