.

mosquitto/mosquitto.yaml

@@ -13,10 +13,8 @@ data:
     allow_anonymous false
     password_file /mosquitto/config/passwords
 
-    # Optional WebSocket support
     listener 9001
     protocol websockets
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
@@ -55,18 +53,25 @@ spec:
             - name: websocket
               containerPort: 9001
           volumeMounts:
-            - name: config
-              mountPath: /mosquitto/config
+            - name: mosquitto-config
+              mountPath: /mosquitto/config/mosquitto.conf
+              subPath: mosquitto.conf
+              readOnly: true
+            - name: mosquitto-passwords
+              mountPath: /mosquitto/config/passwords
+              subPath: passwords
+              readOnly: true
             - name: data
               mountPath: /mosquitto/data
       volumes:
-        - name: config
-          projected:
-            sources:
-              - configMap:
-                  name: mosquitto-config
-              - secret:
-                  name: mosquitto-passwords
+        - name: mosquitto-config
+          configMap:
+            name: mosquitto-config
+            defaultMode: 0444
+        - name: mosquitto-passwords
+          secret:
+            secretName: mosquitto-passwords
+            defaultMode: 0444
         - name: data
           persistentVolumeClaim:
             claimName: mosquitto-data

mosquitto/secrets.yaml

@@ -1,4 +1,3 @@
----
 apiVersion: v1
 kind: Secret
 metadata:
@@ -6,6 +5,5 @@ metadata:
   namespace: mosquitto
 type: Opaque
 data:
-  # generate with: mosquitto_passwd -c passwords frigate && base64 -w0 passwords
-  # asecurefrigate
   passwords: ZnJpZ2F0ZTokNyQxMDAwJFNScmNLQXU0b2RQRkFIUGQrVkZlZmhXcDBpRkpsSnV4WmlhTFd4UlN5OFFuMTJrU2d4b0phMDVRWk5FbzR4UHdrckFOZTNrS3U2cTVyOGc2UWZ0TUZ3PT0kYUtnclRvMEwrOStiSVFoWVZEVGpGOEprMm5XdnR1TkpHUmdPVmw2eklTQS9CQU91bXcvK1BmNEVDVy9JMzZmT2RIM0ZyeFUwWm83a3RBVWZGc3J0N2c9PQ==
+---