ACL not applying on deployment update

[MacherelR]

Hi everyone,
I've been trying for a moment now to create and apply ACLs to my emqx cluster.
My system is the following: Deployed emqx-operator following the getting started from Readme.md, and initially applied basic emqx deployment.
Now my deployment.yaml file looks as follows:

apiVersion: v1
kind: ConfigMap
metadata:
  name: emqx-acl-config
data:
  acl.conf: |
    {allow, all, subscribe, ["registration/request"]}.
    {deny, all, subscribe, ["$SYS/#", "#"]}.
    {allow, {user, {re, "^device-[0-9a-zA-Z]+$"}}, subscribe, ["private/%u/#"]}.
    {allow, {user, {re, "^device-[0-9a-zA-Z]+$"}}, publish, ["private/%u/#"]}.
---
apiVersion: apps.emqx.io/v2beta1
kind: EMQX
metadata:
   name: emqx
spec:
   image: emqx:5.1
   imagePullPolicy: IfNotPresent
   config:
      data: |
         listeners.tcp.test {
            bind = "0.0.0.0:1884"
            max_connections = 1024000
         }
         allow_anonymous = false
         acl_nomatch = deny
   coreTemplate:
      spec:
         extraVolumes:
           - name: my-owner-acl
             configMap:
               name: emqx-acl-config
         extraVolumeMounts:
           - name: my-owner-acl
             mountPath: /opt/emqx/etc/acl.conf
             subPath: acl.conf
   replicantTemplate:
      spec:
         extraVolumes:
           - name: my-owner-acl
             configMap:
               name: emqx-acl-config
         extraVolumeMounts:
           - name: my-owner-acl
             mountPath: /opt/emqx/etc/acl.conf
             subPath: acl.conf
   listenersServiceTemplate:
      spec:
         type: LoadBalancer
   dashboardServiceTemplate:
      spec:
         type: LoadBalancer 

As you can see, I wrote the configmap declaration in the same file so that only one kubectl apply command is needed.
But when I do apply this file I get configmap/emqx-acl-config configured and emqx.apps.emqx.io/emqx configured
When this is the first deployment everything works like charm but when I modify my ACLs and redo the kubectl apply -f command the acls don't seem tu update themselves, is there a way to force restart the deployment or the pods ?

Rémy

[Rory-Z]

Hi @MacherelR I'm sorry, EMQX Operator can not auto reloader ACL file, I think you can reload ACL file by two ways:

1. You can restart EMQX pods after update ACL file .
2. You can disable and enable EMQX Authorization by EMQX APIs, please check this document: https://docs.emqx.com/en/enterprise/v5.3/admin/api-docs.html#tag/Authorization/paths/~1authorization~1sources~1%7Btype%7D/put

[Rory-Z]

Hello @savonarola could you please take a look

[savonarola]

Hello!

You should use secret to sign the token. Example for jwt.io:

Then, a client will be able to connect, passing

• the generated token as password
• mqttx_4f52cd40 as clientid
• arbitrary string username

[savonarola]

Aslo please note that specifying secret in k8s config is not secure.

Maybe you should consider taking it from a k8s secret and passing it to EMQX through env.

[MacherelR]

Okay thank you very much !
So if I resume I should define a secret for my namespace in k8s such as for example :

apiVersion: v1
kind: Secret
metadata:
  name: emqx-secret
type: Opaque
data:
  emqxsecret: <SECRETVal>

Then generate (for testing purposes) a jwt token in jwt.io by specifying SECRETVal in the field you showed me.
But now how should I link it to emqx conf value ?
should I do something like :

authentication = [{
            from = password
            mechanism = jwt
            enable = true
            secret = EMQXSECRET (how to specify it is an env variable ?)
            secret_base64_encoded = true
            algorithm = hmac-based
            use_jwks = false
            verify_claims {
               clientid = "${clientid}"
            }
            acl_claim_name = "acl"
         }]

And then define an env Variable with the SECRETVal for the emqx deployment is that right ?
Thanks a lot in advance for your help and expertise !

[savonarola]

Hi! You may:

• just skip secret key in the config part
• mount the secret as EMQX_AUTHENTICATION__1__SECRET env variable to the pods

EMQX will merge config and envs.