From cf938362f7f3e3ac1ab1be5515d6bf03fe062044 Mon Sep 17 00:00:00 2001
From: "noussair.hamrit" <noussair.hamrit@helmholz.de>
Date: Fri, 25 Apr 2025 12:52:42 +0200
Subject: [PATCH] add ACL config

---
 ConfigMap.yaml               |  1 +
 deployment.yaml              |  9 ++++++++-
 mosquitto-acl-secret.yaml    | 13 +++++++++++++
 mosquitto-passwd-secret.yaml |  2 +-
 4 files changed, 23 insertions(+), 2 deletions(-)
 create mode 100644 mosquitto-acl-secret.yaml

diff --git a/ConfigMap.yaml b/ConfigMap.yaml
index dc3dd20..da93c18 100644
--- a/ConfigMap.yaml
+++ b/ConfigMap.yaml
@@ -15,6 +15,7 @@ data:
 
     password_file /mosquitto/secrets/passwd
     allow_anonymous false
+    acl_file /mosquitto/config/acl.conf
     
     # MQTT over TLS
     listener 8883
diff --git a/deployment.yaml b/deployment.yaml
index 6626403..0aae192 100644
--- a/deployment.yaml
+++ b/deployment.yaml
@@ -30,6 +30,10 @@ spec:
         - mountPath: /mosquitto/certs
           name: tls-certs
           readOnly: true
+        - mountPath: /mosquitto/config/acl.conf
+          name: acl
+          subPath: acl
+          readOnly: true  
       volumes:
       - name: config
         configMap:
@@ -42,4 +46,7 @@ spec:
           claimName: mosquitto-data 
       - name: tls-certs
         secret:
-          secretName: mosquitto-tls            
\ No newline at end of file
+          secretName: mosquitto-tls    
+      - name: acl
+        secret:
+          secretName: mosquitto-acl                  
\ No newline at end of file
diff --git a/mosquitto-acl-secret.yaml b/mosquitto-acl-secret.yaml
new file mode 100644
index 0000000..97af15c
--- /dev/null
+++ b/mosquitto-acl-secret.yaml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mosquitto-acl
+  namespace: mosquitto
+type: Opaque
+stringData:
+  acl: |
+    user pubuser
+    topic readwrite #
+
+    user subuser
+    topic read #
diff --git a/mosquitto-passwd-secret.yaml b/mosquitto-passwd-secret.yaml
index b2fee12..cc06d0d 100644
--- a/mosquitto-passwd-secret.yaml
+++ b/mosquitto-passwd-secret.yaml
@@ -5,4 +5,4 @@ metadata:
   namespace: mosquitto
 type: Opaque
 data:
-  passwd: bW9zcXVpdHRvOiQ3JDEwMSRUQXFxNU0rZUhpNzNDK3ZrJEV3Yy9hWWs3Z1I2R3lqWDBVL0d1aGxYOEVVVlQvSDBQRjd5STlWbS9VaUZjR2I3THpCcWVMa0dZQUIzcjhNWXR2dEJDL0hMUlBCL1FUZ1JVanhudDN3PT0=
+  passwd: cHVidXNlcjokNyQxMDEkNVpqdWxBaTdRS1dMRk1XRiRhM3VJeExDeVBaaTVJS3J4U2NTWGVSeiswLzVVbzFjSzJzb1E1WEphNFE0allXeTNXUFVlTUdiWjR1ZzBuM1hsTHVaekdncS9YcHBZNHN0OXlNd2Q4Zz09CnN1YnVzZXI6JDckMTAxJDEyc3BWb3JmeEJKdGVHdVQkanh0RlFFWVRaRnEyUjZ2elFuYysreXR1R2FId3IwdzNqTDVGdk1MMlBWVXEvSlQyczRZR2hnWUJ6V2NBVE5oUi9SZFN3bU1jd2l2N3MzUnZpSWdlcnc9PQ==