kafka broker flooded with SSL handshake failed msgs.

[ervikrant06]

Using strimzi operator 0.32.0: Whenever kafka cluster is deployed using custom client or cluster certificate or both . kafka broker POD stdout logs are filled with following messages

I confirm no consumer with invalid cert is communicating with this cluster. 9094 is external TLS listener.

2022-12-07 05:51:22,307 INFO [SocketServer listenerType=ZK_BROKER, nodeId=1] Failed authentication with /xx.xx.139.0 (channelId=xx.xx.129.75:9094-xx.xx.139.0:50136-38563) (SSL handshake failed) (org.apache.kafka.common.network.Selector) [data-plane-kafka-network-thread-1-ListenerName(EXTERNAL-9094)-SSL-12]
2022-12-07 05:51:22,384 INFO [SocketServer listenerType=ZK_BROKER, nodeId=1] Failed authentication with /xx.xx.139.0 (channelId=xx.xx.129.75:9094-xx.xx.139.0:5170-38564) (SSL handshake failed) (org.apache.kafka.common.network.Selector) [data-plane-kafka-network-thread-1-ListenerName(EXTERNAL-9094)-SSL-10]
2022-12-07 05:51:22,490 INFO [SocketServer listenerType=ZK_BROKER, nodeId=1] Failed authentication with /xx.xx.139.0 (channelId=xx.xx.129.75:9094-xx.xx.139.0:46414-38564) (SSL handshake failed) (org.apache.kafka.common.network.Selector) [data-plane-kafka-network-thread-1-ListenerName(EXTERNAL-9094)-SSL-11]

Is't broker to zookeeper comm which is causing the issue?

Any other thoughts what could have been causing it?

[scholzj]

It is some misconfigured application connecting to the listener on port 9094. It can be regular Kafka client which is badly configured, or it can be some kind of TCP probe which is just trying to connect as part of some healthcheck etc.