feat: mosquitto high availability

[volschin]

https://github.com/vaskozl/home-infra/blob/main/cluster/automation/mosquitto/hr.yaml

[github-actions]

--- HelmRelease: home/mosquitto Service: home/mosquitto

+++ HelmRelease: home/mosquitto Service: home/mosquitto

@@ -7,13 +7,13 @@

     app.kubernetes.io/instance: mosquitto
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: mosquitto
     app.kubernetes.io/service: mosquitto
   annotations:
     external-dns.alpha.kubernetes.io/hostname: mqtt...PLACEHOLDER..
-    lbipam.cilium.io/ips: 10.1.1.135
+    lbipam.cilium.io/ips: 192.168.2.30
 spec:
   type: LoadBalancer
   ports:
   - port: 1883
     targetPort: 1883
     protocol: TCP
--- HelmRelease: home/mosquitto Deployment: home/mosquitto

+++ HelmRelease: home/mosquitto Deployment: home/mosquitto

@@ -1,106 +0,0 @@

----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mosquitto
-  labels:
-    app.kubernetes.io/component: mosquitto
-    app.kubernetes.io/instance: mosquitto
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: mosquitto
-  annotations:
-    reloader.stakater.com/auto: 'true'
-spec:
-  revisionHistoryLimit: 3
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/component: mosquitto
-      app.kubernetes.io/name: mosquitto
-      app.kubernetes.io/instance: mosquitto
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/component: mosquitto
-        app.kubernetes.io/instance: mosquitto
-        app.kubernetes.io/name: mosquitto
-    spec:
-      enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
-      securityContext:
-        fsGroup: 2000
-        fsGroupChangePolicy: OnRootMismatch
-        runAsGroup: 2000
-        runAsUser: 2000
-      hostIPC: false
-      hostNetwork: false
-      hostPID: false
-      dnsPolicy: ClusterFirst
-      initContainers:
-      - args:
-        - cp /tmp/secret/* /mosquitto/external_config/; mosquitto_passwd -U /mosquitto/external_config/mosquitto_pwd;
-          chmod 0600 /mosquitto/external_config/mosquitto_pwd;
-        command:
-        - /bin/sh
-        - -c
-        image: public.ecr.aws/docker/library/eclipse-mosquitto:2.0.18
-        name: init-config
-        volumeMounts:
-        - mountPath: /mosquitto/external_config
-          name: mosquitto-externalconfig
-        - mountPath: /tmp/secret
-          name: mosquitto-secret
-      containers:
-      - image: public.ecr.aws/docker/library/eclipse-mosquitto:2.0.18
-        livenessProbe:
-          failureThreshold: 3
-          initialDelaySeconds: 0
-          periodSeconds: 10
-          tcpSocket:
-            port: 1883
-          timeoutSeconds: 1
-        name: app
-        readinessProbe:
-          failureThreshold: 3
-          initialDelaySeconds: 0
-          periodSeconds: 10
-          tcpSocket:
-            port: 1883
-          timeoutSeconds: 1
-        resources:
-          limits:
-            memory: 10M
-          requests:
-            cpu: 5m
-            memory: 10M
-        startupProbe:
-          failureThreshold: 30
-          initialDelaySeconds: 0
-          periodSeconds: 5
-          tcpSocket:
-            port: 1883
-          timeoutSeconds: 1
-        volumeMounts:
-        - mountPath: /data
-          name: data
-        - mountPath: /mosquitto/config/mosquitto.conf
-          name: mosquitto-configfile
-          subPath: mosquitto.conf
-        - mountPath: /mosquitto/external_config
-          name: mosquitto-externalconfig
-      volumes:
-      - name: data
-        persistentVolumeClaim:
-          claimName: mosquitto-data
-      - configMap:
-          name: mosquitto-configmap
-        name: mosquitto-configfile
-      - emptyDir: {}
-        name: mosquitto-externalconfig
-      - name: mosquitto-secret
-        secret:
-          secretName: mosquitto-secret
-
--- HelmRelease: home/mosquitto StatefulSet: home/mosquitto

+++ HelmRelease: home/mosquitto StatefulSet: home/mosquitto

@@ -0,0 +1,91 @@

+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: mosquitto
+  labels:
+    app.kubernetes.io/component: mosquitto
+    app.kubernetes.io/instance: mosquitto
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: mosquitto
+  annotations:
+    reloader.stakater.com/auto: 'true'
+spec:
+  revisionHistoryLimit: 3
+  replicas: 2
+  podManagementPolicy: OrderedReady
+  updateStrategy:
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: mosquitto
+      app.kubernetes.io/name: mosquitto
+      app.kubernetes.io/instance: mosquitto
+  serviceName: mosquitto
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: mosquitto
+        app.kubernetes.io/instance: mosquitto
+        app.kubernetes.io/name: mosquitto
+    spec:
+      enableServiceLinks: false
+      serviceAccountName: default
+      automountServiceAccountToken: true
+      securityContext:
+        fsGroup: 568
+        runAsGroup: 568
+        runAsNonRoot: true
+        runAsUser: 568
+        seccompProfile:
+          type: RuntimeDefault
+      hostIPC: false
+      hostNetwork: false
+      hostPID: false
+      dnsPolicy: ClusterFirst
+      containers:
+      - args:
+        - sh
+        - -c
+        - exec mosquitto -c "/config/$(hostname).conf"
+        image: ghcr.io/vaskozl/mosquitto:2.0.18@sha256:729993997bace33e2399ae69ada6a93f537d2b8ba94a87e0110977f874e962c7
+        livenessProbe:
+          failureThreshold: 3
+          initialDelaySeconds: 0
+          periodSeconds: 10
+          tcpSocket:
+            port: 1883
+          timeoutSeconds: 1
+        name: app
+        readinessProbe:
+          failureThreshold: 3
+          initialDelaySeconds: 0
+          periodSeconds: 10
+          tcpSocket:
+            port: 1883
+          timeoutSeconds: 1
+        resources:
+          limits:
+            memory: 200Mi
+          requests:
+            cpu: 2m
+            memory: 8Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+        - mountPath: /config
+          name: config
+        - mountPath: /data
+          name: data
+      volumes:
+      - configMap:
+          name: mosquitto-config-5fh5596777
+        name: config
+      - name: data
+        persistentVolumeClaim:
+          claimName: mosquitto-data
+

[github-actions]

--- kubernetes/apps Kustomization: flux-system/cluster-apps Namespace: flux-system/home

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Namespace: flux-system/home

@@ -6,11 +6,11 @@

     goldilocks.fairwinds.com/enabled: 'true'
     kustomize.toolkit.fluxcd.io/name: cluster-apps
     kustomize.toolkit.fluxcd.io/namespace: flux-system
     kustomize.toolkit.fluxcd.io/prune: disabled
     pod-security.kubernetes.io/audit: restricted
     pod-security.kubernetes.io/audit-version: v1.30
-    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/enforce: privileged
     pod-security.kubernetes.io/enforce-version: v1.30
     volsync.backube/privileged-movers: 'true'
   name: home
 
--- kubernetes/apps/home/mosquitto/app Kustomization: flux-system/mosquitto HelmRelease: home/mosquitto

+++ kubernetes/apps/home/mosquitto/app Kustomization: flux-system/mosquitto HelmRelease: home/mosquitto

@@ -18,79 +18,61 @@

     controllers:
       mosquitto:
         annotations:
           reloader.stakater.com/auto: 'true'
         containers:
           app:
+            args:
+            - sh
+            - -c
+            - exec mosquitto -c "/config/$(hostname).conf"
             image:
-              repository: public.ecr.aws/docker/library/eclipse-mosquitto
-              tag: 2.0.18
+              repository: ghcr.io/vaskozl/mosquitto
+              tag: 2.0.18@sha256:729993997bace33e2399ae69ada6a93f537d2b8ba94a87e0110977f874e962c7
             probes:
               liveness:
                 enabled: true
               readiness:
                 enabled: true
-              startup:
-                enabled: true
-                spec:
-                  failureThreshold: 30
-                  periodSeconds: 5
             resources:
               limits:
-                memory: 10M
+                memory: 200Mi
               requests:
-                cpu: 5m
-                memory: 10M
-        initContainers:
-          init-config:
-            args:
-            - cp /tmp/secret/* /mosquitto/external_config/; mosquitto_passwd -U /mosquitto/external_config/mosquitto_pwd;
-              chmod 0600 /mosquitto/external_config/mosquitto_pwd;
-            command:
-            - /bin/sh
-            - -c
-            image:
-              repository: public.ecr.aws/docker/library/eclipse-mosquitto
-              tag: 2.0.18
-        pod:
-          securityContext:
-            fsGroup: 2000
-            fsGroupChangePolicy: OnRootMismatch
-            runAsGroup: 2000
-            runAsUser: 2000
+                cpu: 2m
+                memory: 8Mi
+            securityContext:
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                - ALL
+              readOnlyRootFilesystem: true
+        replicas: 2
+        type: statefulset
+    defaultPodOptions:
+      securityContext:
+        fsGroup: 568
+        runAsGroup: 568
+        runAsNonRoot: true
+        runAsUser: 568
+        seccompProfile:
+          type: RuntimeDefault
     persistence:
+      config:
+        name: mosquitto-config-5fh5596777
+        type: configMap
       data:
         advancedMounts:
           mosquitto:
             app:
             - path: /data
         existingClaim: mosquitto-data
-      mosquitto-configfile:
-        advancedMounts:
-          mosquitto:
-            app:
-            - path: /mosquitto/config/mosquitto.conf
-              subPath: mosquitto.conf
-        name: mosquitto-configmap
-        type: configMap
-      mosquitto-externalconfig:
-        globalMounts:
-        - path: /mosquitto/external_config
-        type: emptyDir
-      mosquitto-secret:
-        advancedMounts:
-          mosquitto:
-            init-config:
-            - path: /tmp/secret
-        name: mosquitto-secret
-        type: secret
     service:
       app:
         annotations:
           external-dns.alpha.kubernetes.io/hostname: mqtt...PLACEHOLDER..
-          lbipam.cilium.io/ips: 10.1.1.135
+          lbipam.cilium.io/ips: 192.168.2.30
         controller: mosquitto
         ports:
           mqtt:
             enabled: true
             port: 1883
         type: LoadBalancer
--- kubernetes/apps/home/mosquitto/app Kustomization: flux-system/mosquitto ExternalSecret: home/mosquitto

+++ kubernetes/apps/home/mosquitto/app Kustomization: flux-system/mosquitto ExternalSecret: home/mosquitto

@@ -1,33 +0,0 @@

----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  labels:
-    app.kubernetes.io/name: mosquitto
-    kustomize.toolkit.fluxcd.io/name: mosquitto
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: mosquitto
-  namespace: home
-spec:
-  dataFrom:
-  - extract:
-      key: mosquitto
-    rewrite:
-    - regexp:
-        source: (.*)
-        target: mosquitto_$1
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: bitwarden-secrets-manager
-  target:
-    creationPolicy: Owner
-    name: mosquitto-secret
-    template:
-      data:
-        mosquitto_pwd: |
-          {{ .mosquitto_username }}:{{ .mosquitto_password }}
-          {{ .mosquitto_zigbee2mqtt_username }}:{{ .mosquitto_zigbee2mqtt_password }}
-          {{ .mosquitto_esp_username }}:{{ .mosquitto_esp_password }}
-          {{ .mosquitto_home_assistant_username }}:{{ .mosquitto_home_assistant_password }}
-      engineVersion: v2
-
--- kubernetes/apps/home/mosquitto/app Kustomization: flux-system/mosquitto ConfigMap: home/mosquitto-configmap

+++ kubernetes/apps/home/mosquitto/app Kustomization: flux-system/mosquitto ConfigMap: home/mosquitto-configmap

@@ -1,22 +0,0 @@

----
-apiVersion: v1
-data:
-  mosquitto.conf: |
-    per_listener_settings false
-    listener 1883
-    allow_anonymous false
-    persistence true
-    persistence_location /data
-    autosave_interval 1800
-    connection_messages false
-    autosave_interval 60
-    password_file /mosquitto/external_config/mosquitto_pwd
-kind: ConfigMap
-metadata:
-  labels:
-    app.kubernetes.io/name: mosquitto
-    kustomize.toolkit.fluxcd.io/name: mosquitto
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: mosquitto-configmap
-  namespace: home
-
--- kubernetes/apps/home/mosquitto/app Kustomization: flux-system/mosquitto ConfigMap: home/mosquitto-config-5fh5596777

+++ kubernetes/apps/home/mosquitto/app Kustomization: flux-system/mosquitto ConfigMap: home/mosquitto-config-5fh5596777

@@ -0,0 +1,22 @@

+---
+apiVersion: v1
+data:
+  mosquitto-0.conf: |
+    listener 1883
+    allow_anonymous true
+  mosquitto-1.conf: |
+    listener 1883
+    allow_anonymous true
+
+    connection broker0
+    address mosquitto-0.mosquitto
+    topic # both 0
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/name: mosquitto
+    kustomize.toolkit.fluxcd.io/name: mosquitto
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: mosquitto-config-5fh5596777
+  namespace: home
+