k8s-mosquitto.yaml

apiVersion: v1
kind: Secret
metadata:
  name: mqtt-certs
data:
  # base64 encoded X509 certificate files
  ca.crt: LS0tLS1CRUdJTi...WEZuaFUzCmJ3bmZwYzRKNWNHdzg3c3AxSzY3R2Q3VHpFTUJPdXp5alE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  server.crt: LS0tLS1CRUdJTi...bUhVPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  server.key: LS0tLS1CRUdJTi...FLM3hNbklkWTRuaUtzbFoKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: mqtt-config
  labels:
    app: postgres
data:
  iot.conf: |
    port 8883

    cafile /mosquitto/certs/ca.crt
    keyfile /mosquitto/certs/server.key
    certfile /mosquitto/certs/server.crt

    require_certificate true
    use_identity_as_username true

    allow_anonymous false
    #password_file /mosquitto/passwd_mqtt
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mqtt
spec:
  selector:
    matchLabels:
      app: mqtt
      tier: backend
      track: stable
  replicas: 1
  template:
    metadata:
      labels:
        app: mqtt
        tier: backend
        track: stable
    spec:
      containers:
        - name: mqtt
          image: eclipse-mosquitto
          volumeMounts:
            - name: config-volume
              mountPath: /mosquitto/config
            - name: certs
              mountPath: /mosquitto/certs
          ports:
            - containerPort: 8883
      volumes:
        - name: config-volume
          configMap:
            name: mqtt-config
            items:
              - key: iot.conf
                path: mosquitto.conf
        - name: certs
          secret:
            secretName: mqtt-certs
---
apiVersion: v1
kind: Service
metadata:
  name: mqtt
spec:
  selector:
    app: mqtt
    tier: backend
  ports:
    - port: 8883
      protocol: TCP