Skip to content

Commit fbaed86

Browse files
jlianjlian
committed
Minor optimizations
1 parent 13d6ee9 commit fbaed86

File tree

1 file changed

+56
-96
lines changed

1 file changed

+56
-96
lines changed

‎articles/iot-operations/manage-mqtt-broker/howto-test-connection.md

Lines changed: 56 additions & 96 deletions
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,7 @@ Since the [default broker listener](howto-configure-brokerlistener.md#default-br
147147

148148
The easiest way to test connectivity is to use the *NodePort* service type in the listener. With that, you can use `<nodeExternalIP>:<NodePort>` to connect like in [Kubernetes documentation](https://kubernetes.io/docs/tutorials/services/connect-applications-service/#exposing-the-service).
149149

150-
For example, create a new broker listener with node port service type listening on port 1883:
150+
For example, to create a new broker listener with node port service type, service name `aio-broker-nodeport`, and listening on port 1884 (node port 31884):
151151

152152
# [Portal](#tab/portal)
153153

@@ -156,38 +156,21 @@ For example, create a new broker listener with node port service type listening
156156
1. Select **MQTT broker listener for NodePort** > **Create**. You can only create one listener per service type. If you already have a listener of the same service type, you can add more ports to the existing listener.
157157

158158
> [!CAUTION]
159-
> Setting authentication to **None** and not configuring TLS [turns off authentication and TLS for testing purposes only.](#only-turn-off-tls-and-authentication-for-testing)
159+
> Setting authentication to **None** and not configuring TLS [turns off authentication and TLS for testing purposes only.](#only-turn-off-tls-and-authentication-for-testing).
160160

161161
Enter the following settings:
162162

163163
| Setting | Value |
164164
| -------------- | ------------------------------------------------ |
165-
| Name | nodeport |
166-
| Service name | aio-broker-nodeport |
167-
| Port | 1883 |
168-
| Authentication | Choose **default** or **None** |
169-
| Authorization | Choose **default** |
165+
| Name | `aio-broker-nodeport` |
166+
| Service name | Leave empty or `aio-broker-nodeport` |
167+
| Port | 1884 |
168+
| Authentication | Choose from existing or **None** |
169+
| Authorization | Choose from existing or **None** |
170170
| Protocol | Choose **MQTT** |
171-
| Node port | 31883 |
172-
173-
1. Add TLS settings to the listener by selecting **TLS** on the port.
174-
175-
| Setting | Description |
176-
| -------------- | --------------------------------------------------------------------------------------------- |
177-
| TLS | Select the *Add* button. |
178-
| TLS mode | Choose **Manual** or **Automatic**. |
179-
| Issuer name | Name of the cert-manager issuer. Required. |
180-
| Issuer kind | Kind of the cert-manager issuer. Required. |
181-
| Issuer group | Group of the cert-manager issuer. Required. |
182-
| Private key algorithm | Algorithm for the private key. |
183-
| Private key rotation policy | Policy for rotating the private key. |
184-
| DNS names | DNS subject alternate names for the certificate. |
185-
| IP addresses | IP addresses of the subject alternate names for the certificate. |
186-
| Secret name | Kubernetes secret containing an X.509 client certificate. |
187-
| Duration | Total lifetime of the TLS server certificate Defaults to 90 days. |
188-
| Renew before | When to begin renewing the certificate. |
189-
190-
1. Select **Apply** to save the TLS settings.
171+
| Node port | 31884 |
172+
173+
1. Add TLS settings to the listener by selecting **TLS** > **Add** on the port. This step isn't required if you don't need TLS for testing. For more information, see [BrokerListener](howto-configure-brokerlistener.md).
191174
1. Select **Create** to create the listener.
192175

193176
# [Bicep](#tab/bicep)
@@ -198,8 +181,7 @@ For example, create a new broker listener with node port service type listening
198181
```bicep
199182
param aioInstanceName string = '<AIO_INSTANCE_NAME>'
200183
param customLocationName string = '<CUSTOM_LOCATION_NAME>'
201-
param listenerServiceName string = 'aio-broker-nodeport'
202-
param listenerName string = 'nodeport'
184+
param listenerName string = 'aio-broker-nodeport'
203185
204186
resource aioInstance 'Microsoft.IoTOperations/instances@2024-09-15-preview' existing = {
205187
name: aioInstanceName
@@ -221,20 +203,16 @@ resource nodePortListener 'Microsoft.IoTOperations/instances/brokers/listeners@2
221203
name: customLocation.id
222204
type: 'CustomLocation'
223205
}
224-
225206
properties: {
226-
serviceName: listenerServiceName
227207
serviceType: 'NodePort'
228208
ports: [
229209
{
230-
authenticationRef: 'default'
231-
port: 1883
232-
nodePort: 31883
210+
port: 1884
211+
nodePort: 31884 // Must be in the range 30000-32767
212+
authenticationRef: 'default' // Add BrokerAuthentication reference, omit setting turns off authentication for testing only
233213
tls: {
234-
mode: 'Manual'
235-
manual: {
236-
secretRef: 'server-cert-secret'
237-
}
214+
// Add TLS settings
215+
// Omitting section turns off TLS for testing only
238216
}
239217
}
240218
]
@@ -260,17 +238,18 @@ Create a file named `broker-nodeport.yaml` with the following configuration. Rep
260238
apiVersion: mqttbroker.iotoperations.azure.com/v1beta1
261239
kind: BrokerListener
262240
metadata:
263-
name: nodeport
241+
name: aio-broker-nodeport
264242
namespace: azure-iot-operations
265243
spec:
266244
brokerRef: default
267245
serviceType: NodePort
268-
serviceName: aio-broker-nodeport
269246
ports:
270247
- port: 1883
271-
nodePort: 31883 # Must be in the range 30000-32767
272-
authenticationRef: default # Add BrokerAuthentication reference
273-
tls: # Add TLS settings
248+
nodePort: 31884 # Must be in the range 30000-32767
249+
authenticationRef: default # Add BrokerAuthentication reference, omit setting turns off authentication for testing only
250+
tls:
251+
# Add TLS settings
252+
# Omitting section turns off TLS for testing only
274253
```
275254

276255
Then, use `kubectl` to deploy the configuration:
@@ -281,6 +260,9 @@ kubectl apply -f broker-nodeport.yaml
281260

282261
---
283262

263+
> [!NOTE]
264+
> By Kubernetes default, the node port number [must be in the range 30000-32767](https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport).
265+
284266
Get the node's external IP address:
285267

286268
```bash
@@ -303,7 +285,7 @@ The output should look similar to the following:
303285
Use the external IP address and the node port to connect to the broker. For example, to publish a message to the broker:
304286

305287
```bash
306-
mosquitto_pub --host <EXTERNAL_IP> --port 31883 --message "hello" --topic "world" --debug # Add authentication and TLS options matching listener settings
288+
mosquitto_pub --host <EXTERNAL_IP> --port 31884 --message "hello" --topic "world" --debug # Add authentication and TLS options matching listener settings
307289
```
308290

309291
If there's no external IP in the output, you might be using a Kubernetes setup that doesn't expose the node's external IP address by default, like many setups of k3s, k3d, or minikube. In that case, you can access the broker with the internal IP along with the node port from machines on the same network. For example, to get the internal IP address of the node:
@@ -326,7 +308,7 @@ Then, use the internal IP address and the node port to connect to the broker fro
326308

327309
Another way to expose the broker to the internet is to use the *LoadBalancer* service type. This method is more complex and might require additional configuration, like setting up port forwarding.
328310

329-
For example, to create a new broker listener with load balancer service type listening on port 1883:
311+
For example, to create a new broker listener with load balancer service type, service name `aio-broker-loadbalancer`, and listening on port 1883:
330312

331313
# [Portal](#tab/portal)
332314

@@ -341,31 +323,15 @@ For example, to create a new broker listener with load balancer service type lis
341323

342324
| Setting | Value |
343325
| -------------- | ------------------------------------------------ |
344-
| Name | loadbalancer |
345-
| Service name | aio-broker-loadbalancer |
326+
| Name | `aio-broker-loadbalancer` |
327+
| Service name | Leave empty or `aio-broker-loadbalancer` |
346328
| Port | 1883 |
347-
| Authentication | Choose **default** |
348-
| Authorization | Choose **default** or **None** |
329+
| Authentication | Choose from existing or **None** |
330+
| Authorization | Choose from existing or **None** |
349331
| Protocol | Choose **MQTT** |
350332

351-
1. You can add TLS settings to the listener by selecting **TLS** on the port.
352-
353-
| Setting | Description |
354-
| -------------- | --------------------------------------------------------------------------------------------- |
355-
| TLS | Select the *Add* button. |
356-
| TLS mode | Choose **Manual** or **Automatic**. |
357-
| Issuer name | Name of the cert-manager issuer. Required. |
358-
| Issuer kind | Kind of the cert-manager issuer. Required. |
359-
| Issuer group | Group of the cert-manager issuer. Required. |
360-
| Private key algorithm | Algorithm for the private key. |
361-
| Private key rotation policy | Policy for rotating the private key. |
362-
| DNS names | DNS subject alternate names for the certificate. |
363-
| IP addresses | IP addresses of the subject alternate names for the certificate. |
364-
| Secret name | Kubernetes secret containing an X.509 client certificate. |
365-
| Duration | Total lifetime of the TLS server certificate Defaults to 90 days. |
366-
| Renew before | When to begin renewing the certificate. |
367-
368-
1. Select **Apply** to save the TLS settings.
333+
1. Add TLS settings to the listener by selecting **TLS** > **Add** on the port. This step isn't required if you don't need TLS for testing. For more information, see [BrokerListener](howto-configure-brokerlistener.md).
334+
1. Select **Create** to create the listener.
369335
1. Select **Create** to create the listener.
370336

371337
# [Bicep](#tab/bicep)
@@ -376,8 +342,7 @@ For example, to create a new broker listener with load balancer service type lis
376342
```bicep
377343
param aioInstanceName string = '<AIO_INSTANCE_NAME>'
378344
param customLocationName string = '<CUSTOM_LOCATION_NAME>'
379-
param listenerServiceName string = 'aio-broker-loadbalancer'
380-
param listenerName string = 'loadbalancer'
345+
param listenerName string = 'aio-broker-loadbalancer'
381346
382347
resource aioInstance 'Microsoft.IoTOperations/instances@2024-09-15-preview' existing = {
383348
name: aioInstanceName
@@ -401,17 +366,14 @@ resource loadBalancerListener 'Microsoft.IoTOperations/instances/brokers/listene
401366
}
402367
403368
properties: {
404-
serviceName: listenerServiceName
405369
serviceType: 'LoadBalancer'
406370
ports: [
407371
{
408-
authenticationRef: 'default'
409372
port: 1883
373+
authenticationRef: 'default' // Add BrokerAuthentication reference, omit setting turns off authentication for testing only
410374
tls: {
411-
mode: 'Manual'
412-
manual: {
413-
secretRef: 'server-cert-secret'
414-
}
375+
// Add TLS settings
376+
// Omitting section turns off TLS for testing only
415377
}
416378
}
417379
]
@@ -437,16 +399,17 @@ Create a file named `broker-loadbalancer.yaml` with configuration like the follo
437399
apiVersion: mqttbroker.iotoperations.azure.com/v1beta1
438400
kind: BrokerListener
439401
metadata:
440-
name: loadbalancer
402+
name: aio-broker-loadbalancer
441403
namespace: azure-iot-operations
442404
spec:
443405
brokerRef: default
444406
serviceType: LoadBalancer
445-
serviceName: aio-broker-loadbalancer
446407
ports:
447408
- port: 1883
448-
authenticationRef: default # Add BrokerAuthentication reference
449-
tls: # Add TLS settings
409+
authenticationRef: default # Add BrokerAuthentication reference, omit setting turns off authentication for testing only
410+
tls:
411+
# Add TLS settings
412+
# Omitting section turns off TLS for testing only
450413
```
451414

452415
Use `kubectl` to deploy the configuration:
@@ -558,22 +521,22 @@ The reason that MQTT broker uses TLS and service accounts authentication by defa
558521

559522
1. In the Azure portal, go to your IoT Operations instance.
560523
1. Under **Azure IoT Operations resources**, select **MQTT Broker**.
561-
1. Select **MQTT broker listener for NodePort** > **Create**. You can only create one listener per service type. If you already have a listener of the same service type, you can add more ports to the existing listener.
524+
1. Select **MQTT broker listener for NodePort** or **MQTT broker listener for LoadBalancer** > **Create**. You can only create one listener per service type. If you already have a listener of the same service type, you can add more ports to the existing listener.
562525

563526
> [!CAUTION]
564527
> Setting authentication to **None** and not configuring TLS [turns off authentication and TLS for testing purposes only.](#only-turn-off-tls-and-authentication-for-testing)
565528

566529
Enter the following settings:
567530

568-
| Setting | Value |
569-
| -------------- | ------------------------------------------------ |
570-
| Name | Enter a name for the listener |
571-
| Service name | Enter a service name |
572-
| Port | 1883 |
573-
| Authentication | Choose **None** |
574-
| Authorization | Choose **None** |
575-
| Protocol | Choose **MQTT** |
576-
| Node port | 31883 if using node port |
531+
| Setting | Value |
532+
| -------------- | ----------------------------------------------------- |
533+
| Name | Enter a name for the listener |
534+
| Service name | Enter a service name |
535+
| Port | Enter a port number |
536+
| Authentication | Choose **None** |
537+
| Authorization | Choose **None** |
538+
| Protocol | Choose **MQTT** |
539+
| Node port | Enter a number between 30000-32767 if using node port |
577540

578541
1. Select **Create** to create the listener.
579542

@@ -585,7 +548,6 @@ The reason that MQTT broker uses TLS and service accounts authentication by defa
585548
```bicep
586549
param aioInstanceName string = '<AIO_INSTANCE_NAME>'
587550
param customLocationName string = '<CUSTOM_LOCATION_NAME>'
588-
param listenerServiceName string = '<SERVICE_NAME>'
589551
param listenerName string = '<LISTENER_NAME>'
590552
591553
resource aioInstance 'Microsoft.IoTOperations/instances@2024-09-15-preview' existing = {
@@ -610,12 +572,11 @@ resource nodePortListener 'Microsoft.IoTOperations/instances/brokers/listeners@2
610572
}
611573
612574
properties: {
613-
serviceName: listenerServiceName
614575
serviceType: <SERVICE_TYPE> // 'LoadBalancer' or 'NodePort'
615576
ports: [
616577
{
617-
port: 1883
618-
nodePort: 31883 //If using NodePort
578+
port: <PORT_NUMBER>
579+
nodePort: <PORT_NUMBER_BETWEEN_30000_32767> // If using NodePort
619580
// Omitting authenticationRef and tls for testing only
620581
}
621582
]
@@ -641,10 +602,9 @@ metadata:
641602
spec:
642603
brokerRef: default
643604
serviceType: <SERVICE_TYPE> # LoadBalancer or NodePort
644-
serviceName: <SERVICE_NAME>
645605
ports:
646-
- port: 1883
647-
nodePort: 31883 # If using NodePort
606+
- port: <PORT_NUMBER>
607+
nodePort: <PORT_NUMBER_BETWEEN_30000_32767> # If using NodePort
648608
# Omitting authenticationRef and tls for testing only
649609
```
650610

0 commit comments

Comments
 (0)