expose acceptor flag

[lordigon]

Hi all,
I'm using minikube on my Mac to test Artemis k8s features and I'm executing some tests with TLS with a CR like

apiVersion: broker.amq.io/v1beta1
kind: ActiveMQArtemis
metadata:
  name: ex-aao
spec:
  deploymentPlan:
    size: 1
    image: placeholder
    initImage: artemis-custom-jaas-init:1.0.0
    extraMounts:
      configMaps:
        - "cert-jaas-config"
  acceptors:
    - name: sslacceptor
      protocols: all
      port: 61617
      expose: true
      sslEnabled: true
      needClientAuth: true
      verifyHost: false

minikube was installed with ingress enabled.
I cannot access the port 61617 with external client also if the flag expose is set to true.
Is it a miniube issue or I miss some configuration step?

[brusdev]

This is a known issue and it will be fixed by #475 that requires ingress SSL Passthrough. To enable ingress with SSL Passthrough on minikube you need to enable the ingress addon and to patch the ingress deployment, i.e.

# Enable Ingress Addon
minikube addons enable ingress

# Enable Ingress SSL Passthrough
minikube kubectl -- patch deployment -n ingress-nginx ingress-nginx-controller --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value":"--enable-ssl-passthrough"}]'

Until #475 will be merged you can use a NodePort service.

[lordigon]

@brusdev Is it possible to change Artemis service type from ClusterIP to NodePort via Operator? Or you mean creating another one of type NodePort?

[lordigon]

I made another test without using TLS with this CR

apiVersion: broker.amq.io/v1beta1
kind: ActiveMQArtemis
metadata:
  name: ex-aao
spec:
  deploymentPlan:
    size: 1
    image: placeholder
  acceptors:
    - name: mqtt-acceptor
      protocols: MQTT
      port: 61616
      expose: true
      sslEnabled: false

and deploying it to a k8s cluster created on AWS.
Looking at ingress configuration I get the following

kubectl get ing
NAME                             CLASS    HOSTS                 ADDRESS                                                                      PORTS   AGE
ex-aao-mqtt-acceptor-0-svc-ing   <none>   www.mgmtconsole.com   aac0a37fe77a5401c80cd3ed3b235a6a-1068472325.eu-central-1.elb.amazonaws.com   80      149m

but trying to send mqtt messages via mosquitto_pub I got this error sending on TCP port 80

mosquitto_pub -d -h aac0a37fe77a5401c80cd3ed3b235a6a-1068472325.eu-central-1.elb.amazonaws.com -p 80 -i dev-16070 -t test/measures -m "Test message"
Client dev-16070 sending CONNECT
Error: A network protocol error occurred when communicating with the broker.

and this one using TCP port 61616

mosquitto_pub -d -h aac0a37fe77a5401c80cd3ed3b235a6a-1068472325.eu-central-1.elb.amazonaws.com -p 61616 -i dev-16070 -t test/measures -m "Test message"
Error: Operation timed out

Did I make some configuration error or something else is missing?

[brusdev]

@lordigon the operator creates Ingress on Kubernetes and Route on Openshift for acceptors with expose true, there is no way to NodePort service via Operator.

The only way to connect to an acceptor from outside the Kubernetes cluster would be to use TLS because the Ingress Controller needs the SNI hostname to forward the traffic to the target pod.

The Ingress resources created by the operator for acceptors with expose and sslEnabled don't work, they will be fixed in v1.0.11 see #475.

Until v1.0.11 you can create NodePort service to connect to an acceptor from outside the Kubernetes cluster .

[lordigon]

Hi @brusdev,
I tried Artemis Operator v1.0.11 that contains fix #475 and i installed a crd like the following

apiVersion: broker.amq.io/v1beta1
kind: ActiveMQArtemis
metadata:
  name: exoo
spec:
  deploymentPlan:
    size: 1
    image: placeholder
    labels:
      app: artemis-cluster
  acceptors:
    - name: mqtt-tls-acceptor
      protocols: MQTT
      port: 61617
      expose: true
      sslEnabled: true
      needClientAuth: true
      verifyHost: false
  console:
    expose: false

but any ingress has been installed in the namespace.
I'm trying it on minikube where I enable sslpasstrough as you suggested.
is it correct or I'm missing some configuration steps?
I need to connect to Artemis via MQTT client from outside the k8s cluster.

Another question: for dev/test purposes is it possible to expose outside the cluster plain MQQT acceptor?

[brusdev]

The ingress resource isn't created because the acceptor name is longer than 13 characters, the following CR works:

apiVersion: broker.amq.io/v1beta1
kind: ActiveMQArtemis
metadata:
  name: exoo
spec:
  deploymentPlan:
    size: 1
    image: placeholder
    labels:
      app: artemis-cluster
  acceptors:
    - name: mqtt-tls
      protocols: MQTT
      port: 61617
      expose: true
      sslEnabled: true
      needClientAuth: true
      verifyHost: false
  console:
    expose: false

To expose outside the cluster plain MQQT acceptor you could create a NodePort service.