unable to connect kafka broker from nginx controller ingress

[sagarshrestha24]

Please help me to configure kafka cluster where i have to use scram-sha-512 authentication and kafka endpoint using ingress

i have tested from this cluster.yaml

apiVersion: kafka.strimzi.io/v1beta2
kind: Kafka
metadata:
  name: strimzi-kafka-cluster
  namespace: kafka
spec:
  kafka:
    jvmOptions:
      -Xms: 2G
      -Xmx: 5G
    replicas: 1
    authorization:
     type: simple
    listeners:
      - name: plain
        port: 9092
        type: internal
        tls: false
        authentication:
          type: scram-sha-512
      - name: tls
        port: 9093
        type: internal
        tls: true
      - configuration:
          brokers:
          - broker: 0
            advertisedHost: kafka-broker-0.xxxx.com.np
            advertisedPort: 9097
        name: external
        port: 9094
        authentication:
          type: scram-sha-512
        tls: true
        type: cluster-ip
    storage:
      type: jbod
      volumes:
      - id: 0
        type: persistent-claim
        size: 100Gi
        deleteClaim: false
    config:
      sasl.enabled.mechanisms: scram-sha-512
      sasl.mechanism.inter.broker.protocol: scram-sha-512
      offsets.topic.replication.factor: 1
      transaction.state.log.replication.factor: 1
      transaction.state.log.min.isr: 1
      default.replication.factor: 1
      min.insync.replicas: 1
      inter.broker.protocol.version: "3.5.1"
      replica.fetch.max.bytes: 1048576
  zookeeper:
    jvmOptions:
      -Xms: 1G
      -Xmx: 2G
    replicas: 1
    storage:
      type: persistent-claim
      size: 20Gi
      deleteClaim: false
  entityOperator:
    topicOperator: {}
    userOperator: {}

but there is issue tls handshake while connecting from client

[scholzj]

You do not use type: ingress listener. So it is not clear what kind of issues you have with Ingress. You should either get more into details of what are you doing or check the docs and use the type: ingress listener.

[sagarshrestha24]

how to configure TLS in kafka client?
can't we use without TLS to connect kafka tp produce message and for consumer too

[sagarshrestha24]

i didnot understood what tls passthrough in first place

[scholzj]

You cannot use it without TLS with Ingress. You also have in your configuration of the Kafka resource tls: true -> what do you think that means if not that you have to configure TLS in the client? The docs how to configure TLS in the Kafka clients are in the Kafka docs. You will need to configure TLS and configure the Cluster CA as a trusted certificate.

[sagarshrestha24]

can't we make it tls:false because we are autheticating through scram-sha-512
here is the client.properties

security.protocol=SASL_PLAINTEXT
sasl.mechanism=SCRAM-SHA-512
sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="kafka-xxx" password="jYgcR5JTbRIQ5qIXXEM33P1zZB6X3nN0";

[scholzj]

You are mixing encryption and authentication. These are different things. But no, you cannot do it if you want to use Ingress. You can do it for example with load balancers or node ports.

[sagarshrestha24]

i have enable ssl passthrough also it is no working as expected.

You have to enable the TLs passthorugh in the Ingress configuration in the first place.