I'm using helm chart to deploy VerneMQ on Kubernetes cluster using the instructed steps to enable mqtts.
values.yaml
service:
mqtts:
enabled: true
secretMounts:
- name: vernemq-certificates
secretName: vernemq-cert
path: /etc/ssl/vernemq
additionalEnv:
- name: DOCKER_VERNEMQ_ACCEPT_EULA
value: "yes"
- name: DOCKER_VERNEMQ_LISTENER__SSL__CAFILE
value: "/etc/ssl/vernemq/tls.crt"
- name: DOCKER_VERNEMQ_LISTENER__SSL__CERTFILE
value: "/etc/ssl/vernemq/tls.crt"
- name: DOCKER_VERNEMQ_LISTENER__SSL__KEYFILE
value: "/etc/ssl/vernemq/tls.key"
- name: DOCKER_VERNEMQ_LISTENER__SSL__DEFAULT
value: "127.0.0.1:8883"
- name: DOCKER_VERNEMQ_LISTENER__TCP__DEFAULT
value: "127.0.0.1:8883"
The verne-cluster is successfuly deployed but it's not listening on port 8883. The client is disconnected with error Client network socket disconnected before secure TLS connection was established
.
I tested the connection using a tcp nginx ingress, port-frowarding
and using nc
tool from a debug pod on the same namespace to test the port, all indicating the port 8883 was not listening. However the service is enabled for it and inside the container, the service indicates is open.
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:9100 0.0.0.0:* LISTEN 126/beam.smp
tcp 0 0 10.255.21.22:8080 0.0.0.0:* LISTEN 126/beam.smp
tcp 0 0 0.0.0.0:4369 0.0.0.0:* LISTEN 186/epmd
tcp 0 0 127.0.0.1:8883 0.0.0.0:* LISTEN 126/beam.smp
tcp 0 0 10.255.21.22:44053 0.0.0.0:* LISTEN 126/beam.smp
tcp 0 0 127.0.0.1:8888 0.0.0.0:* LISTEN 126/beam.smp
tcp 0 0 10.255.21.22:8888 0.0.0.0:* LISTEN 126/beam.smp
tcp 0 0 127.0.0.1:1883 0.0.0.0:* LISTEN 126/beam.smp
tcp 0 0 :::4369 :::* LISTEN 186/epmd
The only lead I have is the in the error.log
, but I've try a fiew configuration variables and none have worked out
[error] <0.434.0>@vmq_ranch_config:reconfigure_listeners_for_type:{269,13} can't reconfigure mqtts listener({127,0,0,1}, 8883) with Options [{max_connections,10000},{nr_of_acceptors,10},{mountpoint,[]},{cafile,"/etc/ssl/vernemq/tls.crt"},{depth,1},{certfile,"/etc/ssl/vernemq/tls.crt"},{eccs,[secp521r1,brainpoolP512r1,brainpoolP384r1,secp384r1,brainpoolP256r1,secp256k1,secp256r1,secp224k1,secp224r1,secp192k1,secp192r1,secp160k1,secp160r1,secp160r2]},{keyfile,"/etc/ssl/vernemq/tls.key"},{require_certificate,false},{tls_version,'tlsv1.2'},{use_identity_as_username,false},{allowed_protocol_versions,[3,4,131]},{allow_anonymous_override,false}] due to {already_started,<0.458.0>}