add TLS config

ConfigMap-ingress-nginx.yaml

@@ -4,5 +4,5 @@ metadata:
   name: tcp-services
   namespace: nginx
 data:
-  "1883": "mosquitto/mosquitto-mqtt:1883"
+  "8883": "mosquitto/mosquitto-mqtts:8883"
-  "9001": "mosquitto/mosquitto-ws:9001"
+  "9443": "mosquitto/mosquitto-wss:9443"

ConfigMap.yaml

@@ -16,12 +16,20 @@ data:
     password_file /mosquitto/secrets/passwd
     allow_anonymous false
     
-    # MQTTS listener
+    # MQTT over TLS
-    listener 1883
+    listener 8883
     protocol mqtt
+    cafile /mosquitto/certs/ca.crt
+    certfile /mosquitto/certs/tls.crt
+    keyfile /mosquitto/certs/tls.key
+    require_certificate false
 
-    # WS Listener
+    # WebSocket over TLS
-    listener 9001
+    listener 9443
     protocol websockets
+    cafile /mosquitto/certs/ca.crt
+    certfile /mosquitto/certs/tls.crt
+    keyfile /mosquitto/certs/tls.key
+    require_certificate false
     
     

deployment.yaml

@@ -17,8 +17,8 @@ spec:
       - name: mosquitto
         image: eclipse-mosquitto
         ports:
-        - containerPort: 1883
+        - containerPort: 8883
-        - containerPort: 9001
+        - containerPort: 9443
         volumeMounts:
         - mountPath: /mosquitto/config/mosquitto.conf
           subPath: mosquitto.conf
@@ -27,6 +27,9 @@ spec:
           name: passwd 
         - mountPath: /mosquitto/data/
           name: data
+        - mountPath: /mosquitto/certs
+          name: tls-certs
+          readOnly: true
       volumes:
       - name: config
         configMap:
@@ -37,3 +40,6 @@ spec:
       - name: data
         persistentVolumeClaim:
           claimName: mosquitto-data 
+      - name: tls-certs
+        secret:
+          secretName: mosquitto-tls            

ingress.yaml

@@ -1,22 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: mosquitto-ws
-  namespace: mosquitto
-  annotations:
-    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"  # Required for WebSocket
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"  # Keep connections alive
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: mosquitto.infrastructure.helmholz.cloud
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: mosquitto-ws
-            port: 
-              number: 9001

mosquitto-internal-tls.yaml

@@ -0,0 +1,58 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: mosquitto-selfsigned
+  namespace: mosquitto
+spec:
+  selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: mosquitto-ca
+  namespace: mosquitto
+spec:
+  isCA: true
+  commonName: mosquitto-ca
+  secretName: mosquitto-ca-secret
+  issuerRef:
+    name: mosquitto-selfsigned
+    kind: Issuer
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: mosquitto-ca-issuer
+  namespace: mosquitto
+spec:
+  ca:
+    secretName: mosquitto-ca-secret
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: mosquitto-internal-cert
+  namespace: mosquitto
+spec:
+  secretName: mosquitto-tls
+  duration: 8760h # 1 year
+  renewBefore: 720h # 30 days before expiration
+  subject:
+    organizations:
+      - internal
+  commonName: mosquitto.mosquitto.svc
+  dnsNames:
+    - mosquitto.infrastructure.helmholz.cloud
+    - mosquitto
+    - mosquitto.mosquitto
+    - mosquitto.mosquitto.svc
+    - mosquitto-mqtts
+    - mosquitto-mqtts.mosquitto
+    - mosquitto-mqtts.mosquitto.svc
+    - mosquitto-wss
+    - mosquitto-wss.mosquitto
+    - mosquitto-wss.mosquitto.svc
+  issuerRef:
+    name: mosquitto-ca-issuer
+    kind: Issuer

svc.yaml

@@ -1,30 +1,30 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: mosquitto-mqtt
+  name: mosquitto-mqtts
   namespace: mosquitto
 spec:
   type: ClusterIP
   selector:
     app: mosquitto
   ports:
-  - name: mqtt
+  - name: mqtts
-    port: 1883
+    port: 8883
-    targetPort: 1883
+    targetPort: 8883
     protocol: TCP
 
 ---
 apiVersion: v1
 kind: Service
 metadata:
-  name: mosquitto-ws
+  name: mosquitto-wss
   namespace: mosquitto
 spec:
   type: ClusterIP
   selector:
     app: mosquitto
   ports:
-  - name: mqttws
+  - name: mqttwss
-    port: 9001
+    port: 9443
-    targetPort: 9001
+    targetPort: 9443
     protocol: TCP