strimzi kafka deployment using certs generated by cert manager, client connection not happening

[raju-lv]

Hi, I want to deploy strimzi kafka with certificates generated by cert manager, not the default secrets generated by cluster-operator for every kafka deployment. I had gone through one of the blog (https://strimzi.io/blog/2021/05/07/deploying-kafka-with-lets-encrypt-certificates/). Kafka deployment coming up but while connecting to kafka through client, getting following issue. Can you please suggest correct way of using certificates generated by cert manager in kafka deployment and disable the default secrets generated by cluster operator. Secret kafka1secret is having ca.crt, tls.crt and tls.key generated by cert manager.

kafka.yaml:

apiVersion: kafka.strimzi.io/v1beta2
kind: Kafka
metadata:
  name: my-cluster
spec:
  clusterCa:
    generateCertificateAuthority: false
  kafka:
    version: 2.8.0
    replicas: 3
    resources:
      requests:
        memory: 2Gi
        cpu: 200m
      limits:
        memory:  4Gi
        cpu: 400m
    listeners:
      - name: plain
        port: 9092
        type: internal
        tls: false
      - name: tls
        port: 9093
        type: internal
        tls: true
        authentication:
          type: tls
        configuration:
          brokerCertChainAndKey:
            secretName: kafka1secret
            certificate: tls.crt
            key: tls.key
    readinessProbe:
      initialDelaySeconds: 15
      timeoutSeconds: 5
    livenessProbe:
      initialDelaySeconds: 15
      timeoutSeconds: 5
    config:
      offsets.topic.replication.factor: 3
      transaction.state.log.replication.factor: 3
      transaction.state.log.min.isr: 2
      log.message.format.version: 2.8
      inter.broker.protocol.version: 2.8
    storage:
      type: persistent-claim
      class: xx
      size: xx
      deleteClaim: false
  zookeeper:
    replicas: 3
    resources:
      requests:
        memory: 1Gi
        cpu: 100m
      limits:
        memory: 2Gi
        cpu: 200m
    storage:
      type: persistent-claim
      class: xxx
      size: xx
      deleteClaim: false
  entityOperator:
    tlsSidecar:
      resources:
        requests:
          cpu: 100m
          memory: 2Gi
        limits:
          cpu: 200m
          memory: 4Gi
    topicOperator: {}
    userOperator: {}

---

Connecting through client.txt

bootstrap.servers=my-cluster-kafka-bootstrap:9093
security.protocol=SSL
ssl.truststore.location=/tmp/kafka-truststore.jks
ssl.truststore.password=xxxxxxxxx

Error:

./kafka-topics.sh --list --bootstrap-server my-cluster-kafka-bootstrap:9093 --command-config /tmp/client.txt
[2022-03-01 12:39:03,319] WARN Couldn't resolve server my-cluster-kafka-bootstrap:9093 from bootstrap.servers as DNS resolution failed for my-cluster-kafka-bootstrap (org.apache.kafka.clients.ClientUtils)
Exception in thread "main" org.apache.kafka.common.KafkaException: Failed to create new KafkaAdminClient
        at org.apache.kafka.clients.admin.KafkaAdminClient.createInternal(KafkaAdminClient.java:540)
        at org.apache.kafka.clients.admin.Admin.create(Admin.java:134)
        at kafka.admin.TopicCommand$AdminClientTopicService$.createAdminClient(TopicCommand.scala:229)
        at kafka.admin.TopicCommand$AdminClientTopicService$.apply(TopicCommand.scala:233)
        at kafka.admin.TopicCommand$.main(TopicCommand.scala:58)
        at kafka.admin.TopicCommand.main(TopicCommand.scala)
Caused by: org.apache.kafka.common.config.ConfigException: No resolvable bootstrap urls given in bootstrap.servers
        at org.apache.kafka.clients.ClientUtils.parseAndValidateAddresses(ClientUtils.java:89)
        at org.apache.kafka.clients.ClientUtils.parseAndValidateAddresses(ClientUtils.java:48)
        at org.apache.kafka.clients.admin.KafkaAdminClient.createInternal(KafkaAdminClient.java:494)
      

[scholzj]

Well, I think the error is quite obvious -> it says that your client cannot resolve the hostname you gave it. Second, you have configured TLS client authentication in the Kafka custom resource. So you will need to create a user and provide a keystore or you would need to disable the TLS client authentication.