Generate an api key (programatically) #953

klemen-df · 2023-09-21T13:44:22Z

klemen-df
Sep 21, 2023

I would like to programatically generate an api key - any advice how to do this with this operator?

Nov 8, 2023

Hi @badsector3 , the EMQX Operator 2.2.4 has been released, and now we can set the boot strap API keys from k8s secret, you can check https://github.com/emqx/emqx-operator/releases/tag/2.2.4

View full answer

Rory-Z · 2023-09-21T15:44:47Z

Rory-Z
Sep 21, 2023
Maintainer

If you didn't set any api key, the EMQX Operator will generate a default api key, you can get it after deploy EMQX customer resource, like kubectl get secret

0 replies

klemen-df · 2023-09-21T16:08:44Z

klemen-df
Sep 21, 2023
Author

Hi, I would like to set an additional one (multiple). Kind regards, Klemen Poslano iz Outlook za Android<https://aka.ms/AAb9ysg> Classified as Business

…

________________________________ From: Rory ***@***.***> Sent: Thursday, September 21, 2023 5:45:02 PM To: emqx/emqx-operator ***@***.***> Cc: Klemen Kobetic ***@***.***>; Author ***@***.***> Subject: Re: [emqx/emqx-operator] Generate an api key (programatically) (Discussion #953) If you didn't set any api key, the EMQX Operator will generate a default api key, you can get it after deploy EMQX customer resource, like kubectl get secret — Reply to this email directly, view it on GitHub<#953 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AWKTNTP6X26YQOZUPD6LGWLX3ROH5ANCNFSM6AAAAAA5BSQENQ>. You are receiving this because you authored the thread.Message ID: ***@***.***>

0 replies

Rory-Z · 2023-09-22T02:36:47Z

Rory-Z
Sep 22, 2023
Maintainer

Hi @KlemenDanfoss you can add you owner api key in EMQX customer resource by .spec.bootstrapAPIKeys

0 replies

klemen-df · 2023-09-29T12:58:37Z

klemen-df
Sep 29, 2023
Author

Hi @Rory-Z , I would like to set additional keys (also) after deployment.

For now it says that 'bootstrap APIKey cannot be updated'

Using operator 2.1.2 and emqx 5.0.24.

2 replies

Rory-Z Oct 7, 2023
Maintainer

Sorry for delay, I just finished my vacation.
For now, you can not change APIKeys after deployment, because the EMQX did not support it, but you can change APIKeys via EMQX dashboard.
Maybe we will supporting this feature in future versions.

klemen-df Oct 10, 2023
Author

ty

badsector3 · 2023-10-11T14:45:21Z

badsector3
Oct 11, 2023

Instead of creating new topic, I just add here. I try to add my own bootstrapAPIKey, but the values have to be read from k8s secret.
I was able to make it work using helm update --install but cannot make it to work with ArgoCD.

I use the following CRD:

apiVersion: apps.emqx.io/v2beta1
kind: EMQX
metadata:
  name: {{ include "emqx-operator-crd.fullname" . }}
  labels:
     {{- include "emqx-operator-crd.labels" . | nindent 4 }}
spec:
   {{- $secretData := (lookup "v1" "Secret" "mqtt" "emqx-operator-crd-bootstrap").data }}
  bootstrapAPIKeys:
    - key: {{ $secretData.NAME | b64dec | quote }}
      secret: {{ $secretData.SECRET | b64dec | quote }}

The bootstrapAPIKeys works fine if I just provide plane key/secret, but from obvious reasons I cannot commit such creds to Github.
I tried to replace the secret generated by the operator emqx-operator-crd-bootstrap-api-key but it doesn't work. Complaining about missing bootstrap_api_key which exists.
I tried to mount external volume and replace the destination path, but it doesn't work either

Any ideas how to solve it? I need to add own bootstrapAPIKey which is used by other microservice

3 replies

badsector3 Oct 11, 2023

Yeah, just confirmed where the problem is if I change the EMQX_API_KEY__BOOTSTRAP_FILE

failed to get node statues by API: failed to get API http://10.x.x.x:18083/api/v5/nodes, status : 401 Unauthorized, body: {"code":"BAD_API_KEY_OR_SECRET","message":"Check api_key/api_secret"}

so the CRD looks now:

apiVersion: apps.emqx.io/v2beta1
kind: EMQX
metadata:
  name: {{ include "emqx-operator-crd.fullname" . }}
  labels:
     {{- include "emqx-operator-crd.labels" . | nindent 4 }}
spec:
  coreTemplate:
    spec: 
      extraVolumes:
      - name: emqx-license
        secret:
          secretName: {{ .Values.emqxLicenseSecretName }}   
      - name: emqx-bootstrap-api-key
        secret:
          secretName: {{ .Values.emqxBootstrapAPIKey }}                   
      extraVolumeMounts:
      - name: emqx-license
        mountPath: "/opt/emqx/etc/emqx.lic"
        subPath: "emqx.lic"
        readOnly: true                  
      - name: emqx-bootstrap-api-key
        mountPath: "/opt/emqx/data/custom_bootstrap_api_key"
        subPath: "bootstrap_api_key"
        readOnly: true             
      env:
        - name: EMQX_API_KEY__BOOTSTRAP_FILE
          value: "/opt/emqx/data/custom_bootstrap_api_key"

badsector3 Oct 11, 2023

Replacing the bootstrapAPIKey by creating custom secret emqx-operator-crd-bootstrap-api-key error:

{"level":"error","ts":"2023-10-11T19:05:39Z","msg":"Reconciler error","controller":"emqx","controllerGroup":"apps.emqx.io","controllerKind":"EMQX","eMQX":{"name":"emqx-operator-crd","namespace":"mqtt"},"namespace":"mqtt","name":"emqx-operator-crd","reconcileID":"d889f271-9611-4793-9dfe-a3cb56054b52","error":"failed to get bootstrap user: the secret does not contain the bootstrap_api_key","errorVerbose":"the secret does not contain the bootstrap_api_key\ngithub.com/emqx/emqx-operator/controllers/apps/v2beta1.getBootstrapAPIKey\n\t/workspace/controllers/apps/v2beta1/emqx_controller.go:237\ngithub.com/emqx/emqx-operator/controllers/apps/v2beta1.newRequester\n\t/workspace/controllers/apps/v2beta1/emqx_controller.go:158\ngithub.com/emqx/emqx-operator/controllers/apps/v2beta1.(*EMQXReconciler).Reconcile\n\t/workspace/controllers/apps/v2beta1/emqx_controller.go:104\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:121\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:320\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:273\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:234\nruntime.goexit\n\t/usr/local/go/src/runtime/asm_amd64.s:1598\nfailed to get bootstrap user\ngithub.com/emqx/emqx-operator/controllers/apps/v2beta1.(*EMQXReconciler).Reconcile\n\t/workspace/controllers/apps/v2beta1/emqx_controller.go:110\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:121\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:320\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:273\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:234\nruntime.goexit\n\t/usr/local/go/src/runtime/asm_amd64.s:1598","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:273\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/go/pkg/mod/sigs.k8s.io/[email protected]/pkg/internal/controller/controller.go:234"}

BTW the new secret looks fine to me:

apiVersion: v1
data:
  bootstrap_api_key: xxxxxxx
immutable: false
kind: Secret

Rory-Z Oct 12, 2023
Maintainer

Hi @badsector3 nice try, but this may cause some features of EMQX Operator to be not work.

Rory-Z · 2023-10-12T02:34:53Z

Rory-Z
Oct 12, 2023
Maintainer

Hi @badsector3 @KlemenDanfoss the bootstrapAPIKeys will support secret in coming soon, any ideas for the following CRD example :

apiVersion: apps.emqx.io/v2beta1
kind: EMQX
metadata:
  name: emqx
spec:
  image: emqx:5.1
  bootstrapAPIKeys:
  - key: foo
    secret: bar
  ## support secret
  - secretRef:
      key:
        secretName: some-secret
        secretKey: some-key
      secret:
        secretName: some-secret
        secretKey: some-key

Please note that secret resources are only valid when emqx is started. Once emqx is completed, they become meaningless, whether modified or deleted.

10 replies

badsector3 Oct 13, 2023

Thx @Rory-Z. I have an issue though here.

I changed the config as you suggested, and operator reloaded the core pod.
I can see the new licence based on secret once I exec to the pod and list the envs variables (env) but there is nothing in /opt/emqx/etc/emqx.lic and obviously UI still shows evaluation license and 100 confections.
Looks to be not working if updated.

Checking if the same when deployed fresh.

badsector3 Oct 13, 2023

Yeap - it doesn't work. Removed all, I can see the env variable EMQX__LICENSE__KEY=MjIwMTExxxxxx but nothing in /opt/emqx/etc/emqx.lic and no license loaded in UI.

If I add the license in config section then it works fine and /opt/emqx/etc/emqx.lic is created

apiVersion: apps.emqx.io/v2beta1
kind: EMQX
metadata:
  name: {{ include "emqx-operator-crd.fullname" . }}
  labels:
     {{- include "emqx-operator-crd.labels" . | nindent 4 }}
spec:
  config:
    data: |
      log.console.level = debug
      license {
        key = "xxxxxx"
      }

Rory-Z Oct 18, 2023
Maintainer

Hi @badsector3 , I'm sorry, the env name should EMQX_LICENSE__KEY, not EMQX__LICENSE__KEY

Rory-Z Oct 18, 2023
Maintainer

And in EMQX 5, there is no emqx.lic file anymore, the license is now a regular configuration in emqx.conf.

badsector3 Oct 18, 2023

Thanks @Rory-Z - works like a charm.

So only need to wait for new version of operator which should allow me to use k8s secret for bootstrapAPIKey now.

Rory-Z · 2023-11-08T08:47:48Z

Rory-Z
Nov 8, 2023
Maintainer

Hi @badsector3 , the EMQX Operator 2.2.4 has been released, and now we can set the boot strap API keys from k8s secret, you can check https://github.com/emqx/emqx-operator/releases/tag/2.2.4

1 reply

badsector3 Dec 20, 2023

Just tested. Works like a charm. Thanks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Generate an api key (programatically) #953

{{title}}

Replies: 7 comments 16 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Generate an api key (programatically) #953

Replies: 7 comments · 16 replies

Rory-Z Sep 21, 2023 Maintainer

klemen-df Sep 21, 2023 Author

Rory-Z Sep 22, 2023 Maintainer

klemen-df Sep 29, 2023 Author

Rory-Z Oct 7, 2023 Maintainer

klemen-df Oct 10, 2023 Author

Rory-Z Oct 12, 2023 Maintainer

Rory-Z Oct 12, 2023 Maintainer

Rory-Z Oct 18, 2023 Maintainer

Rory-Z Oct 18, 2023 Maintainer

Rory-Z Nov 8, 2023 Maintainer

Replies: 7 comments 16 replies

Rory-Z
Sep 21, 2023
Maintainer

klemen-df
Sep 21, 2023
Author

Rory-Z
Sep 22, 2023
Maintainer

klemen-df
Sep 29, 2023
Author

Rory-Z Oct 7, 2023
Maintainer

klemen-df Oct 10, 2023
Author

Rory-Z Oct 12, 2023
Maintainer

Rory-Z
Oct 12, 2023
Maintainer

Rory-Z Oct 18, 2023
Maintainer

Rory-Z Oct 18, 2023
Maintainer

Rory-Z
Nov 8, 2023
Maintainer