Strimzi 0.19 port TLS with scram-sha-512

[purbanow]

Based on the docs - Strimzi 0.19 is supporting three ports (plain/tls/external).

1. Is it possible to run port TLS with scram-sha-512? So the config would look like this:

    listeners:
      tls:
        type: nodeport
        tls: true
        authentication:
          type: scram-sha-512
    authorization:
      type: simple

2. Is it possible then to connect to Kafka broker in namespace A using the above port from namespace B?

I know that it's possible to do the above questions using an external port but I want to expose 2 ports with different requirements.

Thanks a lot

[scholzj]

Re 1) The tls: true stands for encryption. So by setting this, you do not set any authentication. So when you combine it with the authentication type: scram-sha-512, you get the SCRAM authentication over TLS encrypted connection. The only thing wrong in your example is the type: nodeport which should not be there.

Re 2) This is a bit more complicated as it depends on your Kubernetes networking etc. In general, it should be possible without any problems in most cases. You just connect to the bootstrap address as presented in the status of the Kafka resource. But in some cases it could be that there is some network level isolation between namespaces etc. => in that case you would need someone to enable the connections between namespaces etc.

[purbanow]

Thanks a lot for sooo quick response.

2. Currently I'm testing it using minikube with two different namespaces.

For the following config is working like a charm the connection from service in namespace A and Strimzi in namespace B:

    listeners:
      external:
        type: nodeport
        tls: true
        authentication:
          type: scram-sha-512
    authorization:
      type: simple

note: I'm using port 9094

For the following config, I'm getting NoBrokersAvailable when I'm trying to make a connection from service in namespace A and Strimzi in namespace B

    listeners:
      tls:
        tls: true
        authentication:
          type: scram-sha-512
    authorization:
      type: simple

note: I'm using port 9093

[scholzj]

Maybe if you share the log and the derails of how you connect, something will come up there. But as I said, there can be many things causing issues there. The first thing to try might be if you can connect with Telnet or OpenSSL => that should tell you if it works on the network level or not. If that does not work, you will need to figure it out in your Kube cluster I'm afraid.

[purbanow]

Okie, it's working for me now. Thanks a lot.