Not allowed to produce messages from a producer hosted in a different namespace to kafka brokers with SCRAM-SHA512 / SASL : SSL Handshake failed

[oesebus]

Hello
I am blocked since a couple of days because i am not able to connect to Kafka brokers from a .NET Client using Confluent.Kafka library and MassTransit .

Kafka.Sepc :

status:
  clusterId: HrBMOd-dSFWlvlJbj8oqHA
  conditions:
    - lastTransitionTime: '2023-09-07T12:51:07.810076146Z'
      status: 'True'
      type: Ready
  listeners:
    - addresses:
        - host: gwp-strimzi-cluster-kafka-bootstrap.techno-tools-kafka.svc
          port: 9092
      bootstrapServers: gwp-strimzi-cluster-kafka-bootstrap.techno-tools-kafka.svc:9092
      name: plain
      type: plain
    - addresses:
        - host: gwp-strimzi-cluster-kafka-bootstrap.techno-tools-kafka.svc
          port: 9093
      bootstrapServers: gwp-strimzi-cluster-kafka-bootstrap.techno-tools-kafka.svc:9093
      certificates:
        - |
          -----BEGIN CERTIFICATE-----
          MIIFLTCCAxWgAwIBAgIUEDvqBtv7NUWw99VwFZPNiUTg4sswDQYJKoZIhvcNAQEN
          BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
          LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
          AQUAA4ICDwAwggIKAoICAQDFOLN25c+9ZsyWtKu0XdBxJWRR9BxIoVOLj2XARy8X
          NNqoGkIOH7Y7nC5sjKXZmKBI3ouCDlwNCjgLCufQ/PgcgWnBFzP6jO/oEC6ra20J
          +RR5Lzropc7SrGYhlg5toJFTicSHuO8QOIcfWEWP8jtysobj015tm839ADgcBmCs
          FdiwdechbaatST95ncW8uZHh3L8Hc97dyT4Ds3WjUY7iORqwRXY9z+YwQYMOIrZJ
          2FEGehxYX0kkgEEKfTIbP08FZnUBIplwYT6QnCJteOWPzcMZrZCV5Jn+Vy7Bi62A
          +bu821omS088lp5ZmH9n1yej5dg3i/XxigWd0SfHfKezeDnWciT7T1Ay0y59P75M
          2ZSUP9Xz4jK2UUzpTf3eDgNHetzLTB8XOl6loJcmHz3qjr+TjkSpOMOxyKHNu19q
          TuWEdC6FmRwCjyXU3pjHwKtH9ZoC4dbYl8JZ/mj5q7z8hu7+ETqMH/xKQI5NqRZh
          edcwGTEvfpykJcVyDCeT0OEiYbmAYv5Et5zI6yuZt68IzT7qxs/2pR9BcOW3pIPo
          Zs2VNSmeCe/ChgZLM8mhqip+aBuWDhyO1ON/3YuKckCe/zulpHdtjELOIOkSPWXH
          VQIDAQABo0UwQzAdBgNVHQ4EFgQUB7y4CzC7QsraewgXXJVP3a1ephwwEgYDVR0T
          AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
          AHok/JdmOePOtMLd7lZ9H8gm5WUKA+UF+F1kfk7ErKH/1IpWR/H1JUQ5Zzzjoz/Q
          sS6praY6wNf9fBo0BEGLXWsiqUGJSixb7mdVACbTF64Wy0v+SOfVvQqyYLj1MqAh
          33+Q71CAwJvc6nihZKtFzDyUsvkeIQ2SylSrL4OwsiHzNYM44tyLBcuyyZ7NHe7V
          JCvn+wYWE7ZPHpuiIcWoe8bLCPt9jMGu+2FBRjjSnoeHaQ1t+nL6asX62PtXpI0u
          FflNjKFNg94qLUddz1H3DbYYDxsk5O6xvw7N3DnKYuJlcx5SnallRTp3rOPqpCFu
          aqUpccIgHKp58HFka9Ava8EUXP8QKQ57V25gM7PQaB9mBMeSS1dBVIH1C7laFwUJ
          2I164A8YOBsov9xEjGhlo/S48QxS35fs43F8vD+7hFExG3XxGQ2+kqyWbFsOR/SG
          uejj1z2SyO3ucRH19LKZwGhFauaA3J45uRCu+7vilRb19CTrs5NkNy7cmYhB/60K
          rioa2nJ0ux/VrpSfjEV5Tz06AKC773dSE4pTVYDKKfSYkoy9fpbCF2RTnB0XYxtm
          XOhWpQxELRe5bLeAweMtZtrX6imp+KQHEGkv4G6iYRNLbhkdKWLCtveikJCQrN9j
          O50135ZpoHaw1AaODJxykix/2d7UoynKRpyF5uONwlmn
          -----END CERTIFICATE-----
      name: tls
      type: tls
    - addresses:
        - host: kafka-0
          port: 30758
      bootstrapServers: kafka-0:30758
      name: external
      type: external
  observedGeneration: 30
spec:
  entityOperator:
    topicOperator: {}
    userOperator: {}
  kafka:
    authorization:
      superUsers:
        - gambit
      type: simple
    config:
      allow.everyone.if.no.acl.found: true
      auto.create.topics.enable: false
      default.replication.factor: 1
      inter.broker.protocol.version: '3.4'
      log.retention.bytes: 1073741824
      log.retention.hours: 168
      min.insync.replicas: 1
      num.partitions: 1
      offsets.topic.replication.factor: 1
      transaction.state.log.min.isr: 1
      transaction.state.log.replication.factor: 1
      unclean.leader.election.enable: false
    listeners:
      - authentication:
          type: scram-sha-512
        name: plain
        port: 9092
        tls: false
        type: internal
      - name: tls
        port: 9093
        tls: true
        type: internal
      - configuration:
          brokers:
            - advertisedHost: kafka-0
              broker: 0
        name: external
        port: 9094
        tls: false
        type: nodeport
    replicas: 1
    resources:
      limits:
        cpu: 2
        memory: 4Gi
      requests:
        cpu: 500m
        memory: 2Gi
    storage:
      deleteClaim: false
      size: 10Gi
      type: persistent-claim
    version: 3.4.0
  zookeeper:
    replicas: 1
    storage:
      deleteClaim: false
      size: 10Gi
      type: persistent-claim

spec:
  authentication:
    type: scram-sha-512
  authorization:
    acls:
      - host: '*'
        operations:
          - Describe
          - Read
        resource:
          name: '*'
          patternType: literal
          type: topic
      - host: '*'
        operations:
          - Read
        resource:
          name: '*'
          patternType: literal
          type: group
      - host: '*'
        operations:
          - Create
          - Describe
          - Write
          - Read
        resource:
          name: '*'
          patternType: literal
          type: topic
    type: simple

This is a singleNode cluster .
My client service is deployed on the same Kubernetes cluster but not in the same namespace
MyService namespace = tools
Kafka namespace = kafka

What would be the bootstrapserver URL to provide in such context ?

The operator created some services based on my configuration but i tried several options without any sucess.

client producer configuration

                                  saslConfigurator.SecurityProtocol = SecurityProtocol.SaslPlaintext;
                                    saslConfigurator.Mechanism = SaslMechanism.ScramSha512;
                                    saslConfigurator.Username = configuration.Username;  //testUser
                                    saslConfigurator.Password = configuration.Password;`   // password decoded 

Kafka logs error

%3|1694092255.194|FAIL|rdkafka#producer-3| [thrd:sasl_ssl://kafka-0:9094/bootstrap]: sasl_ssl://kafka-0:9094/bootstrap: Failed to resolve 'kafka-0:9094': Name does not resolve (after 5ms in state CONNECT, 16 identical error(s) suppressed)

I ve already tested by targetting gwp-strimzi-cluster-kafka-bootstrap.techno-tools-kafka.svc:9092 as bootstrapServer (client side) but not working

Thanks for your precious help or feedback

[scholzj]

You should check and fix the formatting of the information you shared because it is not readable.

[scholzj]

ANONYMOUS means you do not have authentication enabled on the listener. But without authorization set, you should not get any error. I guess you are likely connecting to some other cluster? Would that be possible?

[oesebus]

The client is deployed in the same cluster but not in same namespace .

[scholzj]

It is more about whether it connects to the right Kafka cluster or whether you got the YAML of the right Kafka cluster. Because you cannot get an authorization error without authorization enabled.

[oesebus]

Finally , i just restarted the kafka broker and then it works :-)
Thanks a lot @scholzj for your explanations and patience ^^. Really appreciate it
Have a nice week end

[scholzj]

Great, glad it works. Have a nice weekend.