Page Comparison

Installation of PostgreSQL Client

• A PostgreSQL client installed locally (we use psql (PostgreSQL) 14.10)

  1. MacOS: brew install PostgreSQL

  2. Windows: link

  3. Linux: link

Installation of PostgreSQL server

1. Add the PostgreSQL repo to your Helm:

   Code Block
   language bash
   helm repo add bitnami https://charts.bitnami.com/bitnami

2. Update the repo to the latest version:

   Code Block
   language bash
   helm repo update bitnami

3. Create a new namespace to place the PostgreSql in:

   Code Block
   kubectl create namespace db

4. Switch the KubeCtl context to the new namespace:

   Code Block
   kubectl config set-context --current --namespace=db

5. Install PostgreSQL to the new namespace:

   Code Block
   language bash
   helm upgrade postgres --install bitnami/postgresql --namespace db

6. If everything is correct, then PostgreSQL in installed to namespace “db”. The default name for the admin user is “postgres”. To get the password for "postgres" user run the following command and note the password:

   Code Block
   language bash
   export PGPASSWORD=$(kubectl get secret --namespace db postgres-postgresql -o jsonpath="{.data.postgres-password}" | base64 -d) && echo $PGPASSWORD

Create tables for the ESE

1. Port-forward service postgres-postgresql to localhost:

   Code Block
   language bash
   kubectl port-forward svc/postgres-postgresql 5432:5432

2. Create a new database. When asked “Password for user postgres: ", input the value of the PGPASSWORD variable:

   Code Block
   language bash
   psql -h localhost -p 5432 -U postgres -c 'CREATE DATABASE "ese-db";'

Insert test credentials into the ESE database

1. Save the attached script

   View file
   name postgresql_create.sql

   to the file. Execute the script to create all the necessary tables in the ese-db.

   Code Block
   language bash
   psql -h localhost -p 5432 -U postgres -d ese-db -a -f postgresql_create.sql

2. Save the attached script

   View file
   name create-users.sql

   to the file. If asked “Password for user postgres: ", input the value of the PGPASSWORD variable.

   Code Block
   language bash
   psql -h localhost -p 5432 -U postgres -d ese-db -a -f create-users.sql

3. Check your work. If asked “Password for user postgres: ", input the value of the PGPASSWORD variable.

   Code Block
   language bash
   psql -h localhost -p 5432 -U postgres -d ese-db -c 'SELECT * from public.users;'

Setting up the ESE license as a ConfigMap

...

1. HiveMQ Enterprise Security Extension requires a separate license file, e.g. ese-license.elic, in the $HIVEMQ_HOME/license directory. To add the ese-license.elic along with the hivemq-license.lic, create a new configmap hivemq-license including all desired license files:

   Code Block
   language bash
   kubectl create configmap hivemq-license --namespace=hivemq \ --from-file hivemq-license.lic \ --from-file ese-license.elic

2. Edit the values.yaml file of the hivemq-operator, section hivemq.configMaps. Update this:

   Code Block
   configMaps: [] # ConfigMaps to mount to the HiveMQ pods. These can be mounted to existing directories without shadowing the folder contents as well. #- name: hivemq-license # path: /opt/hivemq/license

   To this:

   Code Block
   configMaps: - name: hivemq-license path: /opt/hivemq/license

   This will mount the content of the configMap hivemq-license to the directory /opt/hivemq/license of the hivemq-broker pods.

3. Finally, disable the default security extension. By default, the HiveMQ distribution comes with the allow-all extension that permits all MQTT connections without requiring authentication. Before you use HiveMQ in production, add an appropriate security extension and remove the HiveMQ allow-all extension.
   To disable the extension, set the HIVEMQ_ALLOW_ALL_CLIENTS environment variable to false.
   Edit the values.yaml file of the hivemq-operator, section hivemq.env. Update this:

   Code Block
   hivemq: ... env: [] ## Skip config validation # - name: "HIVEMQ_SKIP_CONFIG_VALIDATION" # value: "true" ## Add custom environment variables (e.g. for your extension) here. # - name: MY_CUSTOM_ENV # value: some-value

   To this:

   Code Block
   env: - name: "HIVEMQ_ALLOW_ALL_CLIENTS" value: "false"

Configuring the extension

1. Download a simple configuration file for Enterprise Security Extensions in the example below.
   Replace the “password” in <db-password>password</db-password> with the value of PGPASSWORD variable.

   View file
   name config.xml

2. In the hivemq namespace create a configMap ese-config from the file config.xml

   Code Block
   language bash
   kubectl create configmap ese-config --from-file config.xml --namespace hivemq

3. Edit values.yaml file of hivemq-operator and update section hivemq.extensions, having name: hivemq-enterprise-security-extension
   Update the old hivemq-enterprise-security-extension block from this:

   Code Block
   language yaml
   - name: hivemq-enterprise-security-extension extensionUri: preinstalled enabled: false # Note that this is just an example initialization routine. Make sure this points to the current JDBC version you require for your configuration. initialization: | # Download JDBC driver for PostgreSQL [[ ! -f drivers/postgres-jdbc.jar ]] && curl -L https://jdbc.postgresql.org/download/postgresql-42.2.14.jar --output drivers/jdbc/postgres.jar

   To this:

   Code Block
   language yaml
   - name: hivemq-enterprise-security-extension extensionUri: preinstalled enabled: true configMap: ese-config initialization: | [[ ! -f conf/config.xml ]] && [[ -f /conf-override/extensions/hivemq-enterprise-security-extension/config.xml ]] && ln -s /conf-override/extensions/hivemq-enterprise-security-extension/config.xml conf/config.xml && [[ ! -f drivers/postgres-jdbc.jar ]] && curl -L https://jdbc.postgresql.org/download/postgresql-42.7.1.jar --output drivers/jdbc/postgres.jar

4. Re-deploy hivemq-operator with updated values.yaml

   Code Block
   helm upgrade hivemq --install hivemq/hivemq-operator --values values.yaml --namespace hivemq

   – for ease of use we switch the namespace back to hivemq kubectl config set-context --current --namespace=hivemq

5. If everything is correct, The HiveMQ log contains info about using the correct license:

...

2024-01-30 10:36:12,693 INFO  - Using valid license (ese-license.elic) for enterprise extension with name "HiveMQ Enterprise Security Extension", valid until 2024-03-31.
2024-01-30 10:36:12,943 INFO  - Starting extension with id "hivemq-enterprise-security-extension" at /opt/hivemq/extensions/hivemq-enterprise-security-extension
2024-01-30 10:36:13,599 INFO  - HiveMQ Enterprise Security Extension: Successfully loaded configuration from '/opt/hivemq/extensions/hivemq-enterprise-security-extension/conf/config.xml'.
2024-01-30 10:36:13,602 INFO  - Starting HiveMQ Enterprise Security Extension.
2024-01-30 10:36:14,152 INFO  - Started HiveMQ Enterprise Security Extension successfully in 1206ms.
2024-01-30 10:36:14,152 INFO  - Extension "HiveMQ Enterprise Security Extension" version 4.24.0 started successfully.

End-to-end testing

1. Find the MQTTListenerURL or IP using the following command (hivemq-hivemq-mqtt in our case with IP 20.79.142.120)

   Code Block
   kubectl get services --namespace hivemq

   

2. Subscribe (update url/ip for host, taken from last step, localhost in case of port forward)

   Code Block
   language bash
   mqtt subscribe --topic "topic/+/status" --qos 1 --host 20.79.142.120 --port 1883 --showTopics \ --user backendservice --password backendpassword

3. Publish (update url/ip for host, taken from last step, localhost in case of port forward)

   Code Block
   language bash
   mqtt publish --identifier TheClient1 --topic topic/TheClient1/status \ --host 20.79.142.120 --port 1883 --qos 1 \ --user frontendclient --password clientpassword --message "test"

4. If everything is correct, the subscriber will receive Test

   

Next steps

Please read official documentation for more configuration options https://docs.hivemq.com/hivemq-enterprise-security-extension/latest/index.html

...