How to apply mtls between pods with istio sidecar proxy to kafka pods

[DMSwimTech]

Hey,

I saw that there was some discussion around the topic but I couldn't wrap my head around it.

I have pods that are being effected by istio and I have Strimzi Kafka pods which are not being effected at all by istio.

My issue is that the pods can't connect because they are failing on the mtls handshake.

Strimzi and Istio setup uses self sign certificate. My suspicion was that they are not trusting each one certifricate and I tried to use the following:

  listeners:
    - name: plain
      port: 9092
      type: internal
      tls: false
    - name: tls
      port: 9093
      type: internal
      tls: true
      authentication:
        type: tls
        tlsTrustedCertificates:
        - secretName: istio-ca-root-cert
          certificate: ca.crt

and I add serviceEntry for istio.

Unfortunately for me that didn't work and help will be appreciate

[scholzj]

Strimzi currently does not support any integration with Istio.

[DMSwimTech]

Strimzi is not effected at all from istio. I just want connectivity between the pods in the mesh to kafka that resides outside of it.

What is the correct way to achieve mtls with kafka pods?

[scholzj]

Ah, ok. The type: tls authentication does setup TLS client authentication. But it is using the Clients CA certificate which is part of the Strimzi cluster. There is no field tlsTrustedCertificates which would configure the trusted certificate. You can provide your own Clients CA if you want: https://strimzi.io/docs/operators/latest/full/using.html#installing-your-own-ca-certificates-str ... but that will apply to all listeners.

[DMSwimTech]

So if I understood correctly I need the same CA for both kafka strimzi and istio in order to have successful tls handshake.

[scholzj]

If you want to use the Istio client certificates as client certificates in Kafka then yes.