kafka strimzi not able to connect using internal/external load balancer

[monish-devendran]

apiVersion: kafka.strimzi.io/v1beta2
kind: Kafka
metadata:
  name:my-cluster
spec:
  kafka:
    version: 3.2.0
    replicas: 1
    template:
      externalBootstrapService:
        metadata:
          annotations:
            cloud.google.com/load-balancer-type: "Internal"
      perPodService:
        metadata:
          annotations:
            cloud.google.com/load-balancer-type: "Internal"
    listeners:
      - name: plain
        port: 9092
        type: internal
        tls: false
      - name: external
        port: 9094
        type: loadbalancer
        tls: true
        configuration:
          bootstrap:
            annotations:
              cloud.google.com/load-balancer-type: "Internal"
    config:
      offsets.topic.replication.factor: 1
      transaction.state.log.replication.factor: 1
      transaction.state.log.min.isr: 1
      log.message.format.version: "3.2"
    storage:
      type: jbod
      volumes:
      - id: 0
        type: persistent-claim
        size: 100Gi
        deleteClaim: false
    readinessProbe:
      initialDelaySeconds: 15
      timeoutSeconds: 5
    livenessProbe:
      initialDelaySeconds: 15
      timeoutSeconds: 5
  zookeeper:
    replicas: 1
    readinessProbe:
      initialDelaySeconds: 15
      timeoutSeconds: 5
    livenessProbe:
      initialDelaySeconds: 15
      timeoutSeconds: 5
    storage:
      type: persistent-claim
      size: 100Gi
      deleteClaim: false
  entityOperator:
    topicOperator: {}
    userOperator: {}
  kafkaExporter:
    topicRegex: ".*"
    groupRegex: ".*"

[monish-devendran]

i tried telnet the loadbalancer IP it works with and says connected. but when i use it under kcat im getting error.

kcat -b 10.138.0.20:9094 -L
% ERROR: Failed to acquire metadata: Local: Broker transport failure (Are the brokers reachable? Also try increasing the metadata timeout with -m ?)

[scholzj]

Well, the first issue IMHO is that you have TLS encryption enabled in the listener (tls: true). But in your kcat you do not configure TLS. So I think the error you get sounds like it might correspond. You need to either disable the TLS or configure it in the client. Maybe trying to disable it first to see it works without it and then if it does, you know that the issue is TLS could be the best approach. You can of course also check the loadbalancers that they were created as internal in your infrastructure.