SSL connection towards Kafka when deploying with Helm

[neuwerld2]

Hello!

I am trying to understand how to use SSL certificates with my helm chart to be able to connect to Kafka. I am not sure how to get my certificates in to the application. Would appreciate some help if somebody could maybe point me in the right direction.

[neuwerld2]

Since my certificates exist in k8s as secrets I thought that would be an easy way to load them or to maybe use kafkaSecrets but I can't understand how to define the keystore/truststore. And after that I am not sure how to configure my connection to use these kafkaSecrets.

[tchiotludo]

An example configuration for ssl can be found here.
In order to mount secret on the pods and since the secrets already exist on your k8s, I would use this values configuration :

akhq/helm/akhq/values.yaml

Lines 67 to 70 in 82c5b94

	extraVolumes: []
	# Any extra volume mounts to define for the akhq container
	extraVolumeMounts: []

In order to mount existing secrets and bind it into

[neuwerld2]

I have transformed the keystores to base64 endoded strings now and configured it like this:

kafkaSecrets:
  kafka-dev-truststore.jks: |-
    {base64encodedString}
  kafka-dev-user-keystore.jks: |-
    {base64encodedString}

Is this correct? {base64encodedString} is actually the string that I got and dont want to paste :)
What is the next step after this if this looks ok?

[tchiotludo]

It's over the scope of this project, since it's only k8s stuff.

Mostly I think :

extraVolumeMounts:
  - name: truststore-volume
    mountPath: /app/ssl
extraVolumes:
  - name: truststore-volume
    projected:
      sources:
        - secret:
            name: aiven-kafka-secrets
            items:
              - key: kafka-dev-truststore.jks
                path: truststore.jks
              - key: kafka-dev-user-keystore.jks
                path: keystore.jks

Go to the pods and you must see the secrets on dir /app/ssl then you will have to configure akhq to use them.

PS: I have a doubt that the keystore can be in jks format

[neuwerld2]

I have managed to get the certificates in to the pod as wanted, thanks for your pointers, very much appreciated!
Now I get the following error trying to load topics page in AKHQ:

│ 2021-10-30 23:03:12,013 ERROR inclient-1 o.a.k.c.utils.KafkaThread Uncaught exception in thread 'kafka-admin-client-thread | adminclient-1': │
│ java.lang.OutOfMemoryError: Java heap space │
│ at java.base/java.nio.HeapByteBuffer.(Unknown Source) │
│ at java.base/java.nio.ByteBuffer.allocate(Unknown Source) │
│ at org.apache.kafka.common.memory.MemoryPool$1.tryAllocate(MemoryPool.java:30) │
│ at org.apache.kafka.common.network.NetworkReceive.readFrom(NetworkReceive.java:113) │
│ at org.apache.kafka.common.network.KafkaChannel.receive(KafkaChannel.java:452) │
│ at org.apache.kafka.common.network.KafkaChannel.read(KafkaChannel.java:402) │
│ at org.apache.kafka.common.network.Selector.attemptRead(Selector.java:674) │
│ at org.apache.kafka.common.network.Selector.pollSelectionKeys(Selector.java:576) │
│ at org.apache.kafka.common.network.Selector.poll(Selector.java:481) │
│ at org.apache.kafka.clients.NetworkClient.poll(NetworkClient.java:561) │
│ at org.apache.kafka.clients.admin.KafkaAdminClient$AdminClientRunnable.processRequests(KafkaAdminClient.java:1333) │
│ at org.apache.kafka.clients.admin.KafkaAdminClient$AdminClientRunnable.run(KafkaAdminClient.java:1264) │
│ at java.base/java.lang.Thread.run(Unknown Source) │
│ 2021-10-30 23:03:22,743 WARN r-thread-1 org.akhq.log.access [Date: 2021-10-30T23:03:22.742741Z] [Duration: 0 ms] [Url: GET /actuator/prometheus] [Status: 404] [Ip: /10.97.96.50] [User: -] │
│ 2021-10-30 23:03:37,742 WARN r-thread-3 org.akhq.log.access [Date: 2021-10-30T23:03:37.741933Z] [Duration: 0 ms] [Url: GET /actuator/prometheus] [Status: 404] [Ip: /10.97.96.50] [User: -] │
│ 2021-10-30 23:03:52,742 WARN r-thread-1 org.akhq.log.access [Date: 2021-10-30T23:03:52.7417Z] [Duration: 0 ms] [Url: GET /actuator/prometheus] [Status: 404] [Ip: /10.97.96.50] [User: -]

So I guess it works now but it seems that it needs more memory than I have given, right now I have given 2048MB?
Do I need to set Xms+Xmx in the configuration?

[neuwerld2]

I had no problems like this when using plain connection on 9092.
The following is shown on the page trying to load:
Call(callName=listNodes, deadlineMs=1635635637670, tries=1, nextAllowedTryMs=-9223372036854775709) timed out at 9223372036854775807 after 1 attempt(s)

[tchiotludo]

Never seen report where people need to raise memory.
For information, how many nodes, topics, partition, consumer group on your clusters ?

[neuwerld2]

Do not understand the logic here but I configured this section and now it works:
secrets: |
akhq:
connections:
dev-cluster:
properties: