Tls Secrets, how can be passed to Mqtts and Https listeners

[alessandroros]

Hello,
first of all thanks for this great job.
I'm using IBM Cloud and I'm trying to use the tls secret provided by a service called "IBM Cloud Secret Manager", it's a public certificate automatically rotated at need by this IBM cloud service.
Reading this configuration with extraVolumes and extraVolumeMounts I was not able to catch one part: do I need to have also the certificates as files? by reading the yaml it seems so:
ssl_options { cacertfile = "/mounted/cert/ca.crt" certfile = "/mounted/cert/tls.crt" keyfile = "/mounted/cert/tls.key" }
Currently I only have the tls secret and it's automatically refreshed once needed, there's no way to pass the secret on it?
I'm not an expert in k8s, so please be patient. 😄
I'm using the latest version of the operator 2.1.1 and emqx 5.0.14.

Thanks for any help.

[Rory-Z]

Hi, @alessandroros I'm sorry I don't know the IBM Cloud Secret Manager", I guess it like the cert-manager ?

You can do it like the following:

1. You need one of the TLS secret, glad you've created it !
2. You need mount the certificates file to EMQX container, the spec.coreTemplate.spec.extraVolumes / spec.replicantTemplate.spec.extraVolumeMounts and spec.coreTemplate.spec.extraVolumeMounts / spec.replicantTemplate.spec.extraVolumeMounts and help you.
3. You need set EMQX SSL listener and the EMQX Dashboard, you can via .spec.bootstrapConfig to set it in EMQX Custom Resource.

[alessandroros]

Hi @Rory-Z , thanks for the reply.
Yes I can confirm it works perfectly the SSL now. The part where I was wrong is the mountPath. By using the path "mounted/cert" the logs were giving me error concerning the "failure on mounting the volume".
What I did was to check on my pod which volume were already mounted, and then used a folder on that volume. So for example what I did was to change all "/mounted/cert/" paths with "/opt/emqx/data/cert".
This path was already in use by emqx pods, I'm not sure if it's the correct way to do that but it was working 😄

[Rory-Z]

Hi @alessandroros you can mount any path in EMQX container, that's all right.

I'm not sure why you got the error of "failure on mounting the volume", if this error is the result of a permission denied, maybe you can try add SecurityContext like https://github.com/emqx/emqx-operator/blob/main/docs/en_US/deployment/gcp-gke-deployment.md#persistence

Anyway, the EMQX is working, that's good.