Zookeeper pods fail with SSL handshake errors when run along with kuma service mesh

[Ravikanth-Mallappa]

Background:
We are running strimzi operator v 0.27.1 and trying to integrate it with Kuma service mesh. Kubernetes cluster where we are trying to bring Kafka cluster up, has a kuma sidecar injected at the namespace level same as where strimzi is being installed.

Issue:

After applying the CR file for the kafka cluster, it fails with the below SSL handshake exception while zookeeper cluster is trying to form the Quorum.

Options Tried:

Below options have been tried to mitigate the issue but with no success.

1. Tried to disable the SSL communication between zookeeper nodes, but found no option to do it
2. added an annotation as below, to zookeeper service as mentioned at the link https://kuma.io/docs/1.3.x/policies/protocol-support-in-kuma/#tls-support

Annotations: 3888.service.kuma.io/protocol: tcp

Ask:

1. Has anyone tried to integrate strimzi kafka with Kuma or other service mesh products and was it successful? What is the approach if it can be integrated?
2. Is there any work around to get over the above SSL issue while integrating with (Kuma) servicemesh?
3. If this feature is not available currently with Strimzi, are there any plans to release this capability in next releases?

[scholzj]

If you include only a weird hard to read screenshot of a single exception, it is quite hard to say what exactly the issue is. But there is no testing with Kuma and I'm not aware of anyone using Strimzi with Kuma, so it is quite possible it is causing the issue. In the past, there was a small (but steady) interest in integration with Istio, but there is currently no work going on on that.

[sreejesh123]

I have not tested with this specific mesh, But have tried the integration with Istio (ASM) in GKE.
Few things we did was bypass few port from
Istio , done by annotate mostly all ports which strimzi uses for communication, and the ISITO peerauth was set to permissive.
If you exposing bootstrap and broker using gateway then the tls setting should have passthrough such that envoy don’t terminate the connection

[Ravikanth-Mallappa]

Thanks sreejesh. I have tried with below options but it did not resolve the issue.
3888.service.kuma.io/protocol: tcp
traffic.sidecar.kuma.io/excludeInboundPorts: "2888,3888"
traffic.sidecar.kuma.io/excludeOutboundPorts: 2888,3888

I will see if TLS Passthrough can be set up in kuma

[sreejesh123]

Don’t think the way we did is this way . Each port should be in seperate line.

also we have to annotate this in operator too

[Ravikanth-Mallappa]

I have added the annotations correctly for outbound and inbound ports and it started working fine.

[sreejesh123]

Glad it worked