Setup ESE with PostgreSQL using HiveMQ Operator

Installation of PostgreSQL Client

• A PostgreSQL client installed locally (we use psql (PostgreSQL) 14.10)

  1. MacOS: brew install PostgreSQL

  2. Windows: link

  3. Linux: link

Installation of PostgreSQL server

1. Add the PostgreSQL repo to your Helm:

   helm repo add bitnami https://charts.bitnami.com/bitnami

2. Update the repo to the latest version:

   helm repo update bitnami

3. Create a new namespace to place the PostgreSql in:

   kubectl create namespace db

4. Switch the KubeCtl context to the new namespace:

   kubectl config set-context --current --namespace=db

5. Install PostgreSQL to the new namespace:

   helm upgrade postgres --install bitnami/postgresql --namespace db

6. If everything is correct, then PostgreSQL in installed to namespace “db”. The default name for the admin user is “postgres”. To get the password for "postgres" user run the following command and note the password:

   export PGPASSWORD=$(kubectl get secret --namespace db postgres-postgresql -o jsonpath="{.data.postgres-password}" | base64 -d) && echo $PGPASSWORD

Create tables for the ESE

1. Port-forward service postgres-postgresql to localhost:

   kubectl port-forward svc/postgres-postgresql 5432:5432

2. Create a new database. When asked “Password for user postgres: ", input the value of the PGPASSWORD variable:

   psql -h localhost -p 5432 -U postgres -c 'CREATE DATABASE "ese-db";'

Insert test credentials into the ESE database

1. Save the attached script to the file. Execute the script to create all the necessary tables in the ese-db.

   psql -h localhost -p 5432 -U postgres -d ese-db -a -f postgresql_create.sql

2. Save the attached script to the file. If asked “Password for user postgres: ", input the value of the PGPASSWORD variable.

   psql -h localhost -p 5432 -U postgres -d ese-db -a -f create-users.sql

3. Check your work. If asked “Password for user postgres: ", input the value of the PGPASSWORD variable.

   psql -h localhost -p 5432 -U postgres -d ese-db -c 'SELECT * from public.users;'

Setting up the ESE license as a ConfigMap

1. HiveMQ Enterprise Security Extension requires a separate license file, e.g. ese-license.elic, in the $HIVEMQ_HOME/license directory. To add the ese-license.elic along with the hivemq-license.lic, create a new configmap hivemq-license including all desired license files:

   kubectl create configmap hivemq-license --namespace=hivemq \
     --from-file hivemq-license.lic \
     --from-file ese-license.elic

2. Edit the values.yaml file of the hivemq-operator, section hivemq.configMaps. Update this:

     configMaps: []
     # ConfigMaps to mount to the HiveMQ pods. These can be mounted to existing directories without shadowing the folder contents as well.
     #- name: hivemq-license
     #  path: /opt/hivemq/license

   To this:

     configMaps: 
       - name: hivemq-license
         path: /opt/hivemq/license

   This will mount the content of the configMap hivemq-license to the directory /opt/hivemq/license of the hivemq-broker pods.

3. Finally, disable the default security extension. By default, the HiveMQ distribution comes with the allow-all extension that permits all MQTT connections without requiring authentication. Before you use HiveMQ in production, add an appropriate security extension and remove the HiveMQ allow-all extension.
   To disable the extension, set the HIVEMQ_ALLOW_ALL_CLIENTS environment variable to false.
   Edit the values.yaml file of the hivemq-operator, section hivemq.env. Update this:

   hivemq:
   ...
   
     env: []
     ## Skip config validation
     #     - name: "HIVEMQ_SKIP_CONFIG_VALIDATION"
     #      value: "true"
     ## Add custom environment variables (e.g. for your extension) here.
     # - name: MY_CUSTOM_ENV
     #   value: some-value

   To this:

     env:
       - name: "HIVEMQ_ALLOW_ALL_CLIENTS"
         value: "false"

Configuring the extension

1. Download a simple configuration file for Enterprise Security Extensions in the example below.
   Replace the “password” in <db-password>password</db-password> with the value of PGPASSWORD variable.

2. In the hivemq namespace create a configMap ese-config from the file config.xml

   kubectl create configmap ese-config --from-file config.xml --namespace hivemq

3. Edit values.yaml file of hivemq-operator and update section hivemq.extensions, having name: hivemq-enterprise-security-extension
   Update the old hivemq-enterprise-security-extension block from this:

       - name: hivemq-enterprise-security-extension
         extensionUri: preinstalled
         enabled: false
         # Note that this is just an example initialization routine. Make sure this points to the current JDBC version you require for your configuration.
         initialization: |
           # Download JDBC driver for PostgreSQL
           [[ ! -f drivers/postgres-jdbc.jar ]] &&
           curl -L https://jdbc.postgresql.org/download/postgresql-42.2.14.jar --output drivers/jdbc/postgres.jar

   To this:

       - name: hivemq-enterprise-security-extension
         extensionUri: preinstalled
         enabled: true
         configMap: ese-config
         initialization: |
           [[ ! -f conf/config.xml ]] &&
           [[ -f /conf-override/extensions/hivemq-enterprise-security-extension/config.xml ]] &&
           ln -s /conf-override/extensions/hivemq-enterprise-security-extension/config.xml conf/config.xml &&
           [[ ! -f drivers/postgres-jdbc.jar ]] &&
           curl -L https://jdbc.postgresql.org/download/postgresql-42.7.1.jar --output drivers/jdbc/postgres.jar 

4. Re-deploy hivemq-operator with updated values.yaml

   helm upgrade hivemq --install hivemq/hivemq-operator --values values.yaml --namespace hivemq

   – for ease of use we switch the namespace back to hivemq kubectl config set-context --current --namespace=hivemq

5. If everything is correct, The HiveMQ log contains info about using the correct license:

kubectl logs deployment/hivemq --namespace=hivemq | grep -i 'security'

The output would contain the following data around license and extension:

2024-01-30 10:36:12,693 INFO  - Using valid license (ese-license.elic) for enterprise extension with name "HiveMQ Enterprise Security Extension", valid until 2024-03-31.
2024-01-30 10:36:12,943 INFO  - Starting extension with id "hivemq-enterprise-security-extension" at /opt/hivemq/extensions/hivemq-enterprise-security-extension
2024-01-30 10:36:13,599 INFO  - HiveMQ Enterprise Security Extension: Successfully loaded configuration from '/opt/hivemq/extensions/hivemq-enterprise-security-extension/conf/config.xml'.
2024-01-30 10:36:13,602 INFO  - Starting HiveMQ Enterprise Security Extension.
2024-01-30 10:36:14,152 INFO  - Started HiveMQ Enterprise Security Extension successfully in 1206ms.
2024-01-30 10:36:14,152 INFO  - Extension "HiveMQ Enterprise Security Extension" version 4.24.0 started successfully.

End-to-end testing

1. Find the MQTTListenerURL or IP using the following command (hivemq-hivemq-mqtt in our case with IP 20.79.142.120)

   kubectl get services --namespace hivemq

   

2. Subscribe (update url/ip for host, taken from last step, localhost in case of port forward)

   mqtt subscribe --topic "topic/+/status" --qos 1 --host 20.79.142.120 --port 1883 --showTopics \
     --user backendservice --password backendpassword

3. Publish (update url/ip for host, taken from last step, localhost in case of port forward)

   mqtt publish --identifier TheClient1 --topic topic/TheClient1/status \
    --host 20.79.142.120 --port 1883 --qos 1 \
     --user frontendclient --password clientpassword --message "test"

4. If everything is correct, the subscriber will receive Test

   

Next steps

Please read official documentation for more configuration options https://docs.hivemq.com/hivemq-enterprise-security-extension/latest/index.html