[Question]: Kafka External Connectivity using Strimzi Operator

[willyaako]

Hello,

I am currently setting up a Kafka cluster using the Strimzi Operator.
I have configured listeners on ports 9094 and 9095 and created a super user.
Here is my configuration:

listeners:
  - name: clusterip
    port: 9094
    type: cluster-ip
    tls: false
    authentication:
      type: scram-sha-512
  - name: external
    port: 9095
    type: loadbalancer
    tls: false
    authentication:
      type: scram-sha-512
    configuration:
      bootstrap:
       ...
      brokers:
       ...
authorization:
  type: simple
  superUsers:
  - super-user

The corresponding services have been generated and IPs assigned.
When I connect using the super user credentials to port 9094, I can successfully publish and subscribe.

However, when I try to use port 9095, I receive the following error:

Connection to node -1 ({IP}/{IP}:9095) terminated during authentication. This may happen due to any of the following reasons: (1) Authentication failed due to invalid credentials with brokers older than 1.0.0, (2) Firewall blocking Kafka TLS traffic (eg it may only allow HTTPS traffic), (3) Transient network issue. (org.apache.kafka.clients.NetworkClient)

Has anyone encountered a similar issue or have any suggestions for resolving this?

Thank you in advance for your help!

[scholzj]

That sounds like you have a misconfigured client or something on your network interferes with the connection.

[willyaako]

I have checked my configuration, and I can confirm that the client configuration for connecting to port 9094 is exactly the same as the one used for port 9095. However, the connection to port 9094 works perfectly, while the issue only occurs with port 9095.

Do you think it could be related to something specific to the LoadBalancer setup or network configuration for port 9095?
Any guidance would be greatly appreciated.

[scholzj]

Its not really clear what exactly you have here:

    configuration:
      bootstrap:
       ...
      brokers:
       ...

or what kind of infrastructure are you using. I think the error could for example mean you have the client configured to not use TLS (that corresponds to the listener configuration) but trying to connect through a load balancer that tries to do some TLS termination or something like that and expects the client to speak TLS. I think similar error might also happen for example with Amazon ALB load balancers that support HTTP traffic only and not TCP. But it is hard to say for sure without full understanding of the infrastructure etc.