The port 12181 is being listened by the Zookeeper pod, while the service started for this pod is listening on port 2181, causing the inability to access the Zookeeper pod through the service.

[YLChen-007]

The port 12181 is being listened by the Zookeeper pod, while the service started for this pod is listening on port 2181, causing the inability to access the Zookeeper pod through the service.

the ports open by ZooKeeper Pod：

the port expose by ZooKeeper Pod:

kubectl describe  pod/my-cluster-zookeeper-0 -n my-cluster-operator-namespace  

summary :
Port: tcp-clients 2181/TCP
TargetPort: 2181/TCP

Details

kubectl describe pod/my-cluster-zookeeper-0 -n my-cluster-operator-namespace
Name: my-cluster-zookeeper-0
Namespace: my-cluster-operator-namespace
Priority: 0
Service Account: my-cluster-zookeeper
Node: worker1/192.168.122.243
Start Time: Fri, 14 Apr 2023 23:21:06 +0800
Labels: app.kubernetes.io/instance=my-cluster
app.kubernetes.io/managed-by=strimzi-cluster-operator
app.kubernetes.io/name=zookeeper
app.kubernetes.io/part-of=strimzi-my-cluster
statefulset.kubernetes.io/pod-name=my-cluster-zookeeper-0
strimzi.io/cluster=my-cluster
strimzi.io/component-type=zookeeper
strimzi.io/controller=strimzipodset
strimzi.io/controller-name=my-cluster-zookeeper
strimzi.io/kind=Kafka
strimzi.io/name=my-cluster-zookeeper
strimzi.io/pod-name=my-cluster-zookeeper-0
Annotations: cni.projectcalico.org/containerID: 70f62163d980317f3a7cd1584d5fefd775117877427bef89e4ec1658ca4842ff
cni.projectcalico.org/podIP: 172.16.235.176/32
cni.projectcalico.org/podIPs: 172.16.235.176/32
strimzi.io/cluster-ca-cert-generation: 0
strimzi.io/logging-hash: 0f057cb0
strimzi.io/revision: fc064147
Status: Running
IP: 172.16.235.176
IPs:
IP: 172.16.235.176
Controlled By: StrimziPodSet/my-cluster-zookeeper
Containers:
zookeeper:
Container ID: containerd://f79f70f39171908df5f8c5c2c62a73e0430f270f8cf4fe4728e1edb010c4b096
Image: quay.io/strimzi/kafka:0.33.2-kafka-3.4.0
Image ID: quay.io/strimzi/kafka@sha256:40a847f8455ec6ea9ff9fe1fff20b1ed01f848326dc13977d13ac911f0cb40b7
Ports: 2888/TCP, 3888/TCP, 2181/TCP
Host Ports: 0/TCP, 0/TCP, 0/TCP
Command:
/opt/kafka/zookeeper_run.sh
State: Running
Started: Sat, 15 Apr 2023 12:24:08 +0800
Last State: Terminated
Reason: Error
Exit Code: 137
Started: Sat, 15 Apr 2023 12:23:25 +0800
Finished: Sat, 15 Apr 2023 12:23:55 +0800
Ready: True
Restart Count: 3
Liveness: exec [/opt/kafka/zookeeper_healthcheck.sh] delay=15s timeout=5s period=10s #success=1 #failure=3
Readiness: exec [/opt/kafka/zookeeper_healthcheck.sh] delay=15s timeout=5s period=10s #success=1 #failure=3
Environment:
ZOOKEEPER_METRICS_ENABLED: false
ZOOKEEPER_SNAPSHOT_CHECK_ENABLED: true
STRIMZI_KAFKA_GC_LOG_ENABLED: false
KAFKA_HEAP_OPTS: -Xms128M
ZOOKEEPER_CONFIGURATION: tickTime=2000
initLimit=5
syncLimit=2
autopurge.purgeInterval=1
admin.enableServer=false

Mounts:
  /opt/kafka/cluster-ca-certs/ from cluster-ca-certs (rw)
  /opt/kafka/custom-config/ from zookeeper-metrics-and-logging (rw)
  /opt/kafka/zookeeper-node-certs/ from zookeeper-nodes (rw)
  /tmp from strimzi-tmp (rw)
  /var/lib/zookeeper from data (rw)
  /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-srkdx (ro)

Conditions:
Type Status
Initialized True
Ready True
ContainersReady True
PodScheduled True
Volumes:
data:
Type: PersistentVolumeClaim (a reference to a PersistentVolumeClaim in the same namespace)
ClaimName: data-my-cluster-zookeeper-0
ReadOnly: false
strimzi-tmp:
Type: EmptyDir (a temporary directory that shares a pod's lifetime)
Medium: Memory
SizeLimit: 5Mi
zookeeper-metrics-and-logging:
Type: ConfigMap (a volume populated by a ConfigMap)
Name: my-cluster-zookeeper-config
Optional: false
zookeeper-nodes:
Type: Secret (a volume populated by a Secret)
SecretName: my-cluster-zookeeper-nodes
Optional: false
cluster-ca-certs:
Type: Secret (a volume populated by a Secret)
SecretName: my-cluster-cluster-ca-cert
Optional: false
kube-api-access-srkdx:
Type: Projected (a volume that contains injected data from multiple sources)
TokenExpirationSeconds: 3607
ConfigMapName: kube-root-ca.crt
ConfigMapOptional:
DownwardAPI: true
QoS Class: BestEffort
Node-Selectors:
Tolerations: node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:

kubectl describe  svc/my-cluster-zookeeper-client  -n my-cluster-operator-namespace

Details

Name: my-cluster-zookeeper-client
Namespace: my-cluster-operator-namespace
Labels: app.kubernetes.io/instance=my-cluster
app.kubernetes.io/managed-by=strimzi-cluster-operator
app.kubernetes.io/name=zookeeper
app.kubernetes.io/part-of=strimzi-my-cluster
strimzi.io/cluster=my-cluster
strimzi.io/component-type=zookeeper
strimzi.io/kind=Kafka
strimzi.io/name=my-cluster-zookeeper
Annotations:
Selector: strimzi.io/cluster=my-cluster,strimzi.io/kind=Kafka,strimzi.io/name=my-cluster-zookeeper
Type: ClusterIP
IP Family Policy: SingleStack
IP Families: IPv4
IP: 10.107.235.72
IPs: 10.107.235.72
Port: tcp-clients 2181/TCP
TargetPort: 2181/TCP
Endpoints: 172.16.189.66:2181,172.16.235.176:2181,172.16.235.188:2181
Session Affinity: None
Events:

[scholzj]

The port 2181 is the secured port which is expected to be exposed and used. The port 12181 is intentionally not exposed as it is not secure. It is used only internally for health checks.

[YLChen-007]

Thank you very much. It can work fine!