How to connect to Kafka cluster (that has tls encryption enabled) from a Nodejs Kubernetes Pod

[spoorthyredi2]

Hi,

I have tested my Strmizi Kafka cluster with ssl using my Kafka-CLI Java clients and having cert imported to cacerts and mentioning ssl config parameters in a properties file.
I have also tested my Nodejs Kubernetes Pods connect to Cluster via Plaintext Listener.

Now, how can I do the same via Node apps running on Kubernetes Pods, but with SSL enabled listener?
The connection URL is not changing, so what difference is it going to make to the code ? And how do we give the Cert and its password. Any input will help

[spoorthyredi2]

This is the KafkaJS snippet for ssl .

For java client testing, I have only used the ca.crt and ca.password from the "cluster-ca-cert" secret.
So here , it says
ca -- This is the location to the system cacerts file
key -- is this the ca.password ? or ca.key ?
cert -- This is the cluster ca.crt file path

Is my above understanding correct

[scholzj]

So if you connect to plainloaddb, then you use only TLS encryption (and server authentication, butnot TLS client authentication). So you will need to configure the ca option. But not the cert or key options.

[spoorthyredi2]

Yes right....that's what we used...

1. and the value in ca option should have the same value as of the ca.crt from the cluster-ca-secret right?

[scholzj]

That should be the ca.crt from the <cluster-name>-cluster-ca-cert secret. Yes.

[spoorthyredi2]

Ok.but that dint work for us.

I used the base64 decode of ca.crt and it just dint work... we had to set NODE_TLS_REJECT_UNAUTHORIZED to false only then it worked

[scholzj]

You probably did something wrong then. Hard to say without knowing the exact steps or the details of the Javascript client I'm afraid 🤷

[archupsg03]

Am facing issues in java client itself. Can you help me sharing the steps to make strimzi work