Strimzi
Replies: 3 comments 7 replies
-
|
Beta Was this translation helpful? Give feedback.
7 replies
-
|
I am aware of strimzi not supporting isto. I have had this setup with kafka running without istio and my pods running with istio container and the DR disabling Tls when pods are connecting to kafka. That was working. I am seeking for advise on how to make that connection again since something has broken along the way. Outside of istio, do you see any issue with using the kafka-cluster-ca-cert in the pod truststore and applying that to the client properties that way it has been done? |
Beta Was this translation helpful? Give feedback.
-
|
Well, anything around the Cluster CA would normally show different errors. |
Beta Was this translation helpful? Give feedback.
-
|
I see. Okay. Does this offer any clues? Earlier in the logs, I saw this happen. |
Beta Was this translation helpful? Give feedback.
-
|
Not really to be honest. The second part suggests that it connected to the broker and got the right server certificate. But from the snippets it is hard to say if it completed. The first part still suggests the same issue. One of the obvious options is that your mesh is trying to proxy it as a HTTP(S) traffic -> that would cause error like this. But I do not know Istio enough to know how to avoid it and if it is related etc. |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for your time and input Jakub. |
Beta Was this translation helpful? Give feedback.
-
|
@ananthk01 have you tried creating a ca-bundle crt of all broker certs and adding that to truststore. For example: KAFKA_CLUSTER_NAME=<your-kafka-cluster-name>
$ for i in {0..2}; do
openssl x509 -in <(openssl s_client -connect ${KAFKA_CLUSTER_NAME}-kafka-${i}.${KAFKA_CLUSTER_NAME}-kafka-brokers.kafka.svc:9093 -prexit 2>/dev/null) >> ~/ca-bundle.crt;
done
$ echo "yes" | keytool -import -trustcacerts -file ~/ca-bundle.crt -keystore <your-truststore.jks> -alias ca-bundle
$ cat ~/client.properties
bootstrap.servers=xxxx:9093
security.protocol=SSL
ssl.truststore.location=/path/to/truststore.jks
ssl.truststore.password=pass
ssl.keystore.location=/path/to/user.p12
ssl.keystore.password=pass
$ /kafka-console-producer.sh --broker-list ${KAFKA_BOOTSTRAP_SVC}:9093 --topic ${TOPIC_NAME} --producer.config ~/client.properties |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
Hi @ananthk01 , Can you please help me in understanding of Strimzi not supporting ISTIO ?. This will help me in deciding further actions. |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
We are having issues with AdminClient, Producer and Consumer connecting to kafka using ssl/9093. This has been a recent development. For certificate handling, we do not do anything special. The strimzi kafka-cluster-ca-cert secret is loaded into the pods truststore and is maintained as part of the respective client configs.
Operator version: 0.27.1
Kafka version: 3.0
Spring boot version: 2.6.x
In the kafka artifact I see that the certificate contents is the same as the one loaded on to the pods. Following is pulled from Lens.
Actual kafka.yaml.
The
listenerssections was configured in the following 2 ways,Broker:
AdminClient config;
Error:
Broker properties:
AdminClient:
Error:
What was tried:
ssl.endpoint.identification.algorithmas empty. This property is not accepted by the operator. Log seen below.Creating a custom certificate with SAN maintained (bootstrap and brokers full name) seems to work but this is a workaround and doesn't take away from the fact that what seems to have worked before has broken.
Can you please advise on
Beta Was this translation helpful? Give feedback.
All reactions