last day (26 days later) » 

12:25 PM
0
A: Strimzi - Connecting external clients

ppatiernoI guess that the problem is that you are missing the right port 443 on the broker address so you have to use brokers: ['my-cluster-kafka-bootstrap-messaging-os.192.168.99.100.nip.io:443'] otherwise it is trying to connect to the default port 80 on the OpenShift route.

 
Ok, I was trying with 8443. With 443, I get this message, {"level":"ERROR","timestamp":"2019-10-05T05:21:44.986Z","log‌​ger":"kafkajs","mess‌​age":"[BrokerPool] Failed to connect to seed broker, trying another broker from the list: Closed connection","retryCount":0,"retryTime":325}
 
It seems to come from NodeJS and its configuration. I would try to disable host name verification to see if it works. Then just using a raw openssl client with same cert and route address to see that all is working from that point of view. If possible doing the same using the raw Kafka console client. Take also a look at this blog post strimzi.io/2019/04/30/accessing-kafka-part-3.html
I will be off for a little bit, se you later let me know ;)
 
To disable, host verification, I tried this checkServerIdentity: () => undefined as described here - stackoverflow.com/a/47957605/919480 No luck.
 
have you tried to test the certificate with openssl client or if a kafka console consumer is able to establish a connection. We need to check if it's a NodeJS problem or not, because imho the Strimzi configuration seems to be fine.
 
For the console clients, I set-up the client-ssl.properties file as described here (I didn't pass the key password though) - docs.cloudera.com/HDPDocuments/HDP3/HDP-3.1.0/…. I get this error - [2019-10-05 17:29:16,135] ERROR Error when sending message to topic my-topic with key: null, value: 5 bytes with error: (org.apache.kafka.clients.producer.internals.ErrorLoggingCal‌​lback) org.apache.kafka.common.errors.TimeoutException: Topic my-topic not present in metadata after 60000 ms.
openssl s_client -connect responds with a presence of a self-signed certificate - not more to look at; unless, you could suggest!
 
12:25 PM
what's the certificate you are getting? get you give me the output of commands oc get pods, oc get service, oc get route and oc get secret?
 
`oc get po`
`
my-cluster-entity-operator-68bf7bc996-qfrj9 3/3 Running 8 9h
my-cluster-kafka-0 2/2 Running 4 9h
my-cluster-zookeeper-0 2/2 Running 0 54m
strimzi-cluster-operator-5658b55c84-nrmpr 1/1 Running 4 9h
`
`oc get service`

my-cluster-kafka-0 ClusterIP 172.30.174.91 <none> 9094/TCP 9h
my-cluster-kafka-bootstrap ClusterIP 172.30.61.75 <none> 9091/TCP,9092/TCP,9093/TCP 9h
my-cluster-kafka-brokers ClusterIP None <none> 9091/TCP,9092/TCP,9093/TCP 9h
my-cluster-kafka-external-bootstrap ClusterIP 172.30.33.229 <none> 9094/TCP 9h
my-cluster-zookeeper-client ClusterIP 172.30.21.172 <none> 2181/TCP 9h
`oc get route`

NAME HOST/PORT PATH SERVICES PORT TERMINATION WILDCARD
my-cluster-kafka-0 my-cluster-kafka-0-messaging-os.192.168.99.100.nip.io my-cluster-kafka-0 9094 passthrough None
my-cluster-kafka-bootstrap my-cluster-kafka-bootstrap-messaging-os.192.168.99.100.nip.io my-cluster-kafka-external-bootstrap 9094 passthrough None
`oc get secret`

NAME TYPE DATA AGE
builder-dockercfg-l42zc kubernetes.io/dockercfg 1 10h
builder-token-7czvb kubernetes.io/service-account-token 4 10h
builder-token-w52xc kubernetes.io/service-account-token 4 10h
default-dockercfg-bxj4f kubernetes.io/dockercfg 1 10h
 
1:28 PM
Using the kafka-console-producer.sh what's the content of the properties file? did you create the truststore importing the CA certificate extracted? Did you extract the certificate from OpenShift from my-cluster-cluster-ca-cert or my-cluster-clients-ca-cert?
 
2:17 PM
The client-ssl.properties is as follows:
ssl.keystore.location = /home/user/mycluster/myTrustStore
ssl.keystore.password = 123456
Certificates were extracted from -cluster-ca-cert.
Trust store was created with keytool -import -file ca.cert -keystore myTrustStore
 
 
3 hours later…
5:12 PM
Does the my-topic exist if you have auto.create.topics.enable = false, or you have auto.create.topics.enable = true in the broker configuration?
 
I wouldn't know. How do we check? The console clients were able to publish and subscribe successfully on the plaintext port.
 

  last day (26 days later) »