strimzi-kafka-operator: [Question] Cannot connect to Kafka deployed on Openshift

I am trying to set up a kafka cluster on the Openshift platform using this guide: https://developers.redhat.com/blog/2018/10/29/how-to-run-kafka-on-openshift-the-enterprise-kubernetes-with-amq-streams/

I have my zookeeper and kafka clusters up and running, my certificate downloaded and imported into a keystore but when I try to use the console-producer I get a message saying that the connection was terminated during authentication.

This is the command I’m running:

bin\windows\kafka-console-producer --broker-list https://my-cluster-kafka-bootstrap-kafka-test.domain.com:443 --topic tag-topic --producer.config config/producer.properties

and here is my producer.properties file:

compression.type=none
security.protocol=SSL
ssl.truststore.location=C:\\Tools\\kafka_2.12-2.2.0\\config\\store.jks
ssl.truststore.password=password
ssl.truststore.type=JKS
ssl.keystore.location=C:\\Tools\\kafka_2.12-2.2.0\\config\\store.jks
ssl.keystore.password=password
ssl.keystore.type=JKS
ssl.key.password=password

and the response I’m getting:

[2019-05-21 16:15:58,444] WARN [Producer clientId=console-producer] Connection to node 1 (my-cluster-kafka-1-kafka-test.domain.com/52.xxx.xx.40:443) terminated during authentication. This may happen due to any of the following reasons: (1) Authentication failed due to invalid credentials with brokers older than 1.0.0, (2) Firewall blocking Kafka TLS traffic (eg it may only allow HTTPS traffic), (3) Transient network issue. (org.apache.kafka.clients.NetworkClient)

Any tips on what this could be? The certificate is downloaded diretly from openshift and imported to the keystore as told in the bog post. There is no firewall. Is there a way to lower the log level to debug and see some more information about what is going on?

About this issue

  • Original URL
  • State: closed
  • Created 5 years ago
  • Comments: 23 (9 by maintainers)

Most upvoted comments

Did you enable the TLS client authentication for the external interface? If not, you should be able to leave out this part of your config file:

ssl.keystore.location=C:\\Tools\\kafka_2.12-2.2.0\\config\\store.jks
ssl.keystore.password=password
ssl.keystore.type=JKS
ssl.key.password=password

Would that help?