Mosquitto MQTT Broker on Kubernetes
This project deploys a secure Mosquitto MQTT broker inside Kubernetes with:
- TLS Encryption (auto-generated via cert-manager with a self-signed CA)
- User Authentication (username/password using Kubernetes Secrets)
- Access Control List (ACL) for fine-grained publish/subscribe permissions
- Persistent Storage using PVCs
- TCP passthrough for MQTT over TLS and WebSocket Secure (WSS) via Ingress-NGINX
📂 Project Structure
├── ConfigMap-ingress-nginx.yaml # TCP passthrough ConfigMap for NGINX (ports 8883/9443)
├── ConfigMap.yaml # Mosquitto main configuration (mosquitto.conf)
├── README.md # This documentation
├── deployment.yaml # Mosquitto Kubernetes Deployment
├── mosquitto-acl-secret.yaml # ACL file as a Kubernetes Secret
├── mosquitto-internal-tls.yaml # TLS Certificate and CA with cert-manager
├── mosquitto-passwd-secret.yaml # Password file as a Kubernetes Secret
├── namespace.yaml # Namespace definition
├── pvc.yaml # Persistent Volume Claim for Mosquitto data
└── svc.yaml # Mosquitto Services (ClusterIP)
🔒 User Authentication
There are two users configured :
| Username | Permissions | Description |
|---|---|---|
| pubuser | publish + subscribe | Used by publishers |
| subuser | subscribe only | Used by all subscribers |
Passwords are securely stored in mosquitto-passwd-secret.yaml
📜 ACL Rules
ACL (Access Control List) enforces:
- pubuser: can publish and subscribe on all topics (
#) - subuser: can only subscribe to all topics (
#)
ACL file is stored in mosquitto-acl-secret.yaml.
🔐 TLS Security
- Self-signed CA generated via cert-manager
- Broker certificates issued automatically
- Clients must trust the
ca.crt(exported from Kubernetes)
📡 MQTT Ports
| Service | Port | Description |
|---|---|---|
| MQTT over TLS | 8883 | Secure MQTT |
| WebSocket Secure (WSS) | 9443 | Secure WebSocket for MQTT |
TCP ports are passed directly to Mosquitto via NGINX Ingress TCP services.