使用Edgex(levski)版本的框架接入device-mqtt，为什么只能使用no-secty模式？

[lyh0302]

使用levski版本框架实现deice-mqtt设备接入，考虑用到valut、edgex-security-bootstrapper等服务，所以采用编译时去掉no-secty参数，但启动的后，报错：
"Unable to retrieve MQTT credentials from SecretProvider at path 'message-burror retreiving secret path: 'Received a '404' response from the secret store'. Retrying for 42.720178068s"，很想请教下这是什么原因导致的。

[cloudxxx8]

the error message shows the secret path is wrong. please make sure the config of your secret path is correct.

[lyh0302]

我只直接通过docker-compose文件pull下来的镜像，没有采用源码编译生成镜像的方式，我不太清楚应该如何去确定我的secretPath是哪个，还想请教下，如何去获取该配置以及如何正确配置。

[cloudxxx8]

please describe your questions in English, and there will be more people can help you.
also, please describe your steps about how to recreate your issue.

[lyh0302]

I tried modifying MQTTBROKERINFO_CREDENTIALSPATH config to device-mqtt, edgex-mqtt-broker, etc. but it still didn't work.

[lenny-goodell]

@lyh0302 ,
Which EdgeX release are you using?
Does your MQTT Broker require credentials?
Note that MQTTBROKERINFO_CREDENTIALSPATH is the name of the secret in the service's SecretStore that contains the credentials.
You must must sure the service's SecretStore contains your secret.
There are two types on SecretStores Secure (Vault) or Insecure( InsecureSecrets in service configuration)
Are you running EdgeX in secure mode or non-secure-mode?, i.e. if Vault running or not?

If you are running in Secure Mode

See here for more details about secure SecretStore: https://docs.edgexfoundry.org/2.3/security/Ch-SecretStore/

If running in Non-secure Mode

the credentials need to be in the service's InsecureSecrets configuration, which is where the default MQTTBROKERINFO_CREDENTIALSPATH is set for.
https://github.com/edgexfoundry/device-mqtt-go/blob/v2.3.0/cmd/res/configuration.toml#L12-L16
####If your broker needs username password, then set the following.
WRITABLE_INSECURESECRETS_MQTT_SECRETS_USERNAME
WRITABLE_INSECURESECRETS_MQTT_SECRETS_PASSWORD

If no credentials needed

Don't set MQTTBROKERINFO_AUTHMODE, i.e. leave it set to none

[lenny-goodell]

@lyh0302 , note that you must clear configuration in Consul for a service when you remove env overrides since those values have been stored in Consul and will be used even though you have removed the override. Best is to do a docker down -v (or make clean from compose builder) to clear all data and then restart the services.

[lyh0302]

Thanks, bro. Thank you very much for your help. I have solved the problem with your help. I have recorded relevant problems to avoid making mistakes again!

[NguyenKhanh27]

Sorry for my misunderstanding, the insecure only works for no secty what if I want to do the usernamepassword for device-mqtt-service but in secure mode? is there configuration for that?

[lenny-goodell]

Sorry for my misunderstanding, the insecure only works for no secty what if I want to do the usernamepassword for device-mqtt-service but in secure mode? is there configuration for that?

First, you must run EdgeX in secure mode. Reference secure mode compose file is here:
https://github.com/edgexfoundry/edgex-compose/blob/v3.1/docker-compose.yml
From compose builder run make gen ds-mqtt mqtt-broker
Remove the mqtt-broker: service if you already have one running externally for the devices. Also adjust Device MQTT's config in environment to use your external MQTT Broker.

Second, you must seed Device MQTT's secure secret store with the MQTT Broker credentials (this is the external broker used by the devices)

• This can be do using the /Secret API on Device MQTT. See /secret is swagger docs here: https://docs.edgexfoundry.org/3.1/microservices/device/ApiReference/
• Or use seeding file described here: https://docs.edgexfoundry.org/3.1/security/SeedingServiceSecrets/
• The seeded secret must contain the following key/values:
  • username: <your username>
  • password: <your password>

Third, you must tell Device MQTT to use the credentials from it secret store by setting the following environment variables in the service environment section:

• MQTTBROKERINFO_AUTHMODE: usernamepassword
• MQTTBROKERINFO_CREDENTIALSNAME:

is the name you used when seeding the credentials into the service's secret store.