Strimzi
Replies: 6 comments 15 replies
-
|
I guess you might need to share the configs of the Kafka cluster and of the client - not sure it is possible to get some useful info just from this error message. |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
Here is the Kafka cluster config: kafka-cluster.yaml Kafka-user.yaml and I am trying to use provectus Kafka UI with the following config
|
Beta Was this translation helpful? Give feedback.
5 replies
-
|
I think you are using the wrong port -> you seem to configure the client with |
Beta Was this translation helpful? Give feedback.
-
|
I am facing the following error while changing the port to 443. I configure Kafka via the following document. and also using NLB with public IP attached so that I can whitelisted the IP.. |
Beta Was this translation helpful? Give feedback.
-
|
You cannot change the port to 443 in the Kafka configuration. You have to configure the client to use 9094. |
Beta Was this translation helpful? Give feedback.
-
|
Facing certificate error while changing port to 9094 NOTE: I have user kafka-user crt and pem key with tls.crt from let encrypt certificate. is this correct
|
Beta Was this translation helpful? Give feedback.
-
|
I guess you would need to explain how did you created the keystore and truststore. |
Beta Was this translation helpful? Give feedback.
-
|
openssl pkcs12 -export \
-inkey user.key \
-in user.cert \
-out client.keystore.p12 \
-name kafka-user
keytool -import \
-file ca.crt\
-alias CA \
-keystore client.truststore.jks
User.key and user.crt i get from secret created by kafkauser.
And ca.crt i get from secret created by lets encrypt certificate.(tls.crt)
Get Outlook for iOS<https://aka.ms/o0ukef>
…________________________________
From: Jakub Scholz ***@***.***>
Sent: Saturday, May 13, 2023 8:53:45 PM
To: strimzi/strimzi-kafka-operator ***@***.***>
Cc: amitdrana ***@***.***>; Author ***@***.***>
Subject: Re: [strimzi/strimzi-kafka-operator] Application facing issue while connecting with 9094 port where TLS is enabled with cert-manager integration (Discussion #8507)
I guess you would need to explain how did you created the keystore and truststore.
—
Reply to this email directly, view it on GitHub<#8507 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ALBNQJFCURGJQQX4EIPE6DDXF6RQDANCNFSM6AAAAAAX7N4HEY>.
You are receiving this because you authored the thread.Message ID: ***@***.***>
|
Beta Was this translation helpful? Give feedback.
7 replies
-
|
You cannot sign a user certificate with Let's Encrypt as that is used for server certificates. The truststore / broker certificates and the client certificates are separate. So if the user cert works on the 9093 port, it should be correct and the problem has to be in your truststore. It is hard to say without a complete logs. Maybe you can try to: |
Beta Was this translation helpful? Give feedback.
-
|
Here are the logs for OpenSSL s_client. and I try to remove the truststore cert but find an error certificate error Also, I am using NLB not ALB .. |
Beta Was this translation helpful? Give feedback.
-
|
The OpenSSL output looks good. So I think the issue must be with your truststore / keystore. |
Beta Was this translation helpful? Give feedback.
-
|
I remove the let's encrypt CA and used to local one to solve the issue for now. I just want one more help from your side. can we release the Broker load balancer? |
Beta Was this translation helpful? Give feedback.
-
Sorry, but what do you mean with releasing it? |
Beta Was this translation helpful? Give feedback.
-
|
Just want to use one loadbalancer for bootstrap. And broker through internal services
Get Outlook for iOS<https://aka.ms/o0ukef>
…________________________________
From: Jakub Scholz ***@***.***>
Sent: Monday, May 15, 2023 1:30:28 PM
To: strimzi/strimzi-kafka-operator ***@***.***>
Cc: amitdrana ***@***.***>; Author ***@***.***>
Subject: Re: [strimzi/strimzi-kafka-operator] Application facing issue while connecting with 9094 port where TLS is enabled with cert-manager integration (Discussion #8507)
can we release the Broker load balancer?
Sorry, but what do you mean with releasing it?
—
Reply to this email directly, view it on GitHub<#8507 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ALBNQJCZTWKLZBOBTOR73A3XGHPBZANCNFSM6AAAAAAX7N4HEY>.
You are receiving this because you authored the thread.Message ID: ***@***.***>
|
Beta Was this translation helpful? Give feedback.
1 reply
-
|
That is not how Kafka works. Where does your application run? Inside the same Kubernetes cluster as the Kafka cluster or somewhere outside? |
Beta Was this translation helpful? Give feedback.
-
|
Outside
Get Outlook for iOS<https://aka.ms/o0ukef>
…________________________________
From: Jakub Scholz ***@***.***>
Sent: Monday, May 15, 2023 1:58:28 PM
To: strimzi/strimzi-kafka-operator ***@***.***>
Cc: amitdrana ***@***.***>; Author ***@***.***>
Subject: Re: [strimzi/strimzi-kafka-operator] Application facing issue while connecting with 9094 port where TLS is enabled with cert-manager integration (Discussion #8507)
That is not how Kafka works. Where does your application run? Inside the same Kubernetes cluster as the Kafka cluster or somewhere outside?
—
Reply to this email directly, view it on GitHub<#8507 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ALBNQJDRYA6VSC4IHJE73QTXGHSKZANCNFSM6AAAAAAX7N4HEY>.
You are receiving this because you authored the thread.Message ID: ***@***.***>
|
Beta Was this translation helpful? Give feedback.
2 replies
-
|
In that case, the client needs a direct access to each broker -> so the per-broker loadbalancers are criticial for this. You can read more about how this actually works for example in this blog post: https://strimzi.io/blog/2019/04/17/accessing-kafka-part-1/ |
Beta Was this translation helpful? Give feedback.
-
|
Got it.. |
Beta Was this translation helpful? Give feedback.
-
|
Facing this error now in the connector Broker Logs: |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
Hi,
I have integrated the cert-manager with Kafka on the 9094 port; everything is working fine from Kafka's end, but when applications connect to 9094 with Let's Encrypt CA certificates and user keys, they is facing the following issue:
o.a.k.c.networkclient: [AdminClient clientId=kafka-ui-admin-1683812394-302] Disconnecting from node -1 due to socket connection setup timeout. The timeout value is 8614 ms.2023-05-11 13:40:19,943 INFO [kafka-admin-client-thread | kafka-ui-admin-1683812394-302] o.a.k.c.NetworkClient: [AdminClient clientId=kafka-ui-admin-1683812394-302] Disconnecting from node -1 due to socket connection setup timeout. The timeout value is 16757 ms.2023-05-11 13:40:24,385 INFO [kafka-admin-client-thread | kafka-ui-admin-1683812394-302] o.a.k.c.a.i.AdminMetadataManager: [AdminClient clientId=kafka-ui-admin-1683812394-302] Metadata update failedorg.apache.kafka.common.errors.TimeoutException: Timed out waiting to send the call. Call: fetchMetadatabut working fine with the strimzi Kafka CA certificate and user keys on the 9093 port, where TLS is also enabled.
Beta Was this translation helpful? Give feedback.
All reactions