Strimzi Kafka & Nginx ingress with Helm #4429

NathanAvx · 2021-02-17T06:11:34Z

NathanAvx
Feb 17, 2021

Trying to configure & install Strimzi Kafka & Nginx ingress controller using Helm chart.

Got the Received fatal alert: handshake_failure error while trying to produce message, attached javax.net.debug=all logs & configs for your reference.

./kafka-console-producer.sh --broker-list bootstrap.10.102.17.36.nip.io:443 --producer.config /tmp/kafka-client.properties --topic my-topic

javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.127 IST|Logger.java:765|System property jdk.tls.client.cipherSuites is set to 'null'
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.131 IST|Logger.java:765|System property jdk.tls.server.cipherSuites is set to 'null'
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.157 IST|Logger.java:765|jdk.tls.keyLimits:  entry = AES/GCM/NoPadding KeyUpdate 2^37. AES/GCM/NOPADDING:KEYUPDATE = 137438953472
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.176 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.176 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.176 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.177 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.177 IST|Logger.java:765|Ignore disabled cipher suite: SSL_RSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.177 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_RSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.177 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.178 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.178 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.178 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.179 IST|Logger.java:765|Ignore disabled cipher suite: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.179 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.179 IST|Logger.java:765|Ignore disabled cipher suite: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.179 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.180 IST|Logger.java:765|Ignore disabled cipher suite: TLS_DH_anon_WITH_AES_256_GCM_SHA384
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.180 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_DH_anon_WITH_AES_256_GCM_SHA384
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.180 IST|Logger.java:765|Ignore disabled cipher suite: TLS_DH_anon_WITH_AES_128_GCM_SHA256
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.181 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_DH_anon_WITH_AES_128_GCM_SHA256
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.181 IST|Logger.java:765|Ignore disabled cipher suite: TLS_DH_anon_WITH_AES_256_CBC_SHA256
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.181 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_DH_anon_WITH_AES_256_CBC_SHA256
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.181 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDH_anon_WITH_AES_256_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.181 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDH_anon_WITH_AES_256_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.182 IST|Logger.java:765|Ignore disabled cipher suite: TLS_DH_anon_WITH_AES_256_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.182 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_DH_anon_WITH_AES_256_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.182 IST|Logger.java:765|Ignore disabled cipher suite: TLS_DH_anon_WITH_AES_128_CBC_SHA256
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.182 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_DH_anon_WITH_AES_128_CBC_SHA256
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.183 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDH_anon_WITH_AES_128_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.183 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDH_anon_WITH_AES_128_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.183 IST|Logger.java:765|Ignore disabled cipher suite: TLS_DH_anon_WITH_AES_128_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.183 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_DH_anon_WITH_AES_128_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.184 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.184 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.184 IST|Logger.java:765|Ignore disabled cipher suite: SSL_DH_anon_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.184 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_DH_anon_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.185 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.185 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.185 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDHE_RSA_WITH_RC4_128_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.185 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDHE_RSA_WITH_RC4_128_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.185 IST|Logger.java:765|Ignore disabled cipher suite: SSL_RSA_WITH_RC4_128_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.186 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_RSA_WITH_RC4_128_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.186 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.186 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.186 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDH_RSA_WITH_RC4_128_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.187 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDH_RSA_WITH_RC4_128_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.187 IST|Logger.java:765|Ignore disabled cipher suite: SSL_RSA_WITH_RC4_128_MD5
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.187 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_RSA_WITH_RC4_128_MD5
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.187 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDH_anon_WITH_RC4_128_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.187 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDH_anon_WITH_RC4_128_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.188 IST|Logger.java:765|Ignore disabled cipher suite: SSL_DH_anon_WITH_RC4_128_MD5
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.188 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_DH_anon_WITH_RC4_128_MD5
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.188 IST|Logger.java:765|Ignore disabled cipher suite: SSL_RSA_WITH_DES_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.188 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_RSA_WITH_DES_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.189 IST|Logger.java:765|Ignore disabled cipher suite: SSL_DHE_RSA_WITH_DES_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.189 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_DHE_RSA_WITH_DES_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.189 IST|Logger.java:765|Ignore disabled cipher suite: SSL_DHE_DSS_WITH_DES_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.189 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_DHE_DSS_WITH_DES_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.189 IST|Logger.java:765|Ignore disabled cipher suite: SSL_DH_anon_WITH_DES_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.190 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_DH_anon_WITH_DES_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.190 IST|Logger.java:765|Ignore disabled cipher suite: SSL_RSA_EXPORT_WITH_DES40_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.190 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_RSA_EXPORT_WITH_DES40_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.190 IST|Logger.java:765|Ignore disabled cipher suite: SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.190 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.191 IST|Logger.java:765|Ignore disabled cipher suite: SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.191 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.191 IST|Logger.java:765|Ignore disabled cipher suite: SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.191 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.192 IST|Logger.java:765|Ignore disabled cipher suite: SSL_RSA_EXPORT_WITH_RC4_40_MD5
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.192 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_RSA_EXPORT_WITH_RC4_40_MD5
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.192 IST|Logger.java:765|Ignore disabled cipher suite: SSL_DH_anon_EXPORT_WITH_RC4_40_MD5
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.192 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_DH_anon_EXPORT_WITH_RC4_40_MD5
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.192 IST|Logger.java:765|Ignore disabled cipher suite: TLS_RSA_WITH_NULL_SHA256
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.193 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_RSA_WITH_NULL_SHA256
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.193 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDHE_ECDSA_WITH_NULL_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.193 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_NULL_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.193 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDHE_RSA_WITH_NULL_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.194 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDHE_RSA_WITH_NULL_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.194 IST|Logger.java:765|Ignore disabled cipher suite: SSL_RSA_WITH_NULL_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.194 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_RSA_WITH_NULL_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.194 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDH_ECDSA_WITH_NULL_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.195 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDH_ECDSA_WITH_NULL_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.195 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDH_RSA_WITH_NULL_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.195 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDH_RSA_WITH_NULL_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.196 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDH_anon_WITH_NULL_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.196 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDH_anon_WITH_NULL_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.196 IST|Logger.java:765|Ignore disabled cipher suite: SSL_RSA_WITH_NULL_MD5
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.196 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_RSA_WITH_NULL_MD5
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.197 IST|Logger.java:765|Ignore disabled cipher suite: TLS_KRB5_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.198 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_KRB5_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.199 IST|Logger.java:765|Ignore disabled cipher suite: TLS_KRB5_WITH_3DES_EDE_CBC_MD5
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.200 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_KRB5_WITH_3DES_EDE_CBC_MD5
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.201 IST|Logger.java:765|Ignore disabled cipher suite: TLS_KRB5_WITH_RC4_128_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.201 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_KRB5_WITH_RC4_128_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.201 IST|Logger.java:765|Ignore disabled cipher suite: TLS_KRB5_WITH_RC4_128_MD5
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.202 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_KRB5_WITH_RC4_128_MD5
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.202 IST|Logger.java:765|Ignore disabled cipher suite: TLS_KRB5_WITH_DES_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.202 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_KRB5_WITH_DES_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.204 IST|Logger.java:765|Ignore disabled cipher suite: TLS_KRB5_WITH_DES_CBC_MD5
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.205 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_KRB5_WITH_DES_CBC_MD5
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.205 IST|Logger.java:765|Ignore disabled cipher suite: TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.205 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.206 IST|Logger.java:765|Ignore disabled cipher suite: TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.206 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.206 IST|Logger.java:765|Ignore disabled cipher suite: TLS_KRB5_EXPORT_WITH_RC4_40_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.206 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_KRB5_EXPORT_WITH_RC4_40_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.206 IST|Logger.java:765|Ignore disabled cipher suite: TLS_KRB5_EXPORT_WITH_RC4_40_MD5
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.206 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_KRB5_EXPORT_WITH_RC4_40_MD5
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.214 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.214 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.214 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.214 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.215 IST|Logger.java:765|Ignore disabled cipher suite: SSL_RSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.215 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_RSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.215 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.215 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.215 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.215 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.215 IST|Logger.java:765|Ignore disabled cipher suite: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.216 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.216 IST|Logger.java:765|Ignore disabled cipher suite: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.216 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.216 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_AES_128_GCM_SHA256
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.216 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_AES_256_GCM_SHA384
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.219 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.219 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.219 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.220 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.220 IST|Logger.java:765|Ignore disabled cipher suite: SSL_RSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.220 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_RSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.220 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.221 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.221 IST|Logger.java:765|Ignore disabled cipher suite: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.221 IST|Logger.java:765|Ignore unsupported cipher suite: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.221 IST|Logger.java:765|Ignore disabled cipher suite: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.222 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.222 IST|Logger.java:765|Ignore disabled cipher suite: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.222 IST|Logger.java:765|Ignore unsupported cipher suite: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.231 IST|Logger.java:765|found key for : avx-kafka-tls-client-credentials (
  "certificate" : {
    "version"            : "v1",
    "serial number"      : "00 AE 6D E7 9E 2D 4F 06 FB",
    "signature algorithm": "SHA256withRSA",
    "issuer"             : "CN=clients-ca v0, O=io.strimzi",
    "not before"         : "2021-02-17 10:50:38.000 IST",
    "not  after"         : "2022-02-17 10:50:38.000 IST",
    "subject"            : "CN=avx-kafka-tls-client-credentials",
    "subject public key" : "RSA"}
)
javax.net.ssl|FINE|01|main|2021-02-17 11:20:32.237 IST|Logger.java:765|adding as trusted certificates (
  "certificate" : {
    "version"            : "v3",
    "serial number"      : "00 B4 27 88 2D AB C2 45 01",
    "signature algorithm": "SHA256withRSA",
    "issuer"             : "CN=cluster-ca v0, O=io.strimzi",
    "not before"         : "2021-02-17 10:47:20.000 IST",
    "not  after"         : "2022-02-17 10:47:20.000 IST",
    "subject"            : "CN=cluster-ca v0, O=io.strimzi",
    "subject public key" : "RSA",
    "extensions"         : [
      {
        ObjectId: 2.5.29.35 Criticality=false
        AuthorityKeyIdentifier [
        KeyIdentifier [
        0000: FB 37 AE 96 65 65 4B 89   C6 BA 8A F5 E7 AE 18 8D  .7..eeK.........
        0010: D5 62 87 A3                                        .b..
        ]
        ]
      },
      {
        ObjectId: 2.5.29.19 Criticality=false
        BasicConstraints:[
          CA:true
          PathLen:2147483647
        ]
      },
      {
        ObjectId: 2.5.29.14 Criticality=false
        SubjectKeyIdentifier [
        KeyIdentifier [
        0000: FB 37 AE 96 65 65 4B 89   C6 BA 8A F5 E7 AE 18 8D  .7..eeK.........
        0010: D5 62 87 A3                                        .b..
        ]
        ]
      }
    ]}
)
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.238 IST|Logger.java:765|trigger seeding of SecureRandom
javax.net.ssl|ALL|01|main|2021-02-17 11:20:32.238 IST|Logger.java:765|done seeding of SecureRandom
>javax.net.ssl|FINE|0C|kafka-producer-network-thread | console-producer|2021-02-17 11:20:32.453 IST|Logger.java:765|Ignore, context unavailable extension: status_request
javax.net.ssl|WARNING|0C|kafka-producer-network-thread | console-producer|2021-02-17 11:20:32.458 IST|Logger.java:765|Signature algorithm, ed25519, is not supported by the underlying providers
javax.net.ssl|WARNING|0C|kafka-producer-network-thread | console-producer|2021-02-17 11:20:32.458 IST|Logger.java:765|Signature algorithm, ed448, is not supported by the underlying providers
javax.net.ssl|ALL|0C|kafka-producer-network-thread | console-producer|2021-02-17 11:20:32.464 IST|Logger.java:765|Ignore disabled signature scheme: rsa_md5
javax.net.ssl|INFO|0C|kafka-producer-network-thread | console-producer|2021-02-17 11:20:32.465 IST|Logger.java:765|No available application protocols
javax.net.ssl|FINE|0C|kafka-producer-network-thread | console-producer|2021-02-17 11:20:32.465 IST|Logger.java:765|Ignore, context unavailable extension: application_layer_protocol_negotiation
javax.net.ssl|FINE|0C|kafka-producer-network-thread | console-producer|2021-02-17 11:20:32.467 IST|Logger.java:765|Ignore, context unavailable extension: status_request_v2
javax.net.ssl|FINE|0C|kafka-producer-network-thread | console-producer|2021-02-17 11:20:32.467 IST|Logger.java:765|Ignore, context unavailable extension: renegotiation_info
javax.net.ssl|FINE|0C|kafka-producer-network-thread | console-producer|2021-02-17 11:20:32.470 IST|Logger.java:765|Produced ClientHello handshake message (
"ClientHello": {
  "client version"      : "TLSv1.2",
  "random"              : "25 39 A4 B4 80 C3 A4 2C DE CA 48 5D B0 DE 9F D1 5F 97 F6 20 64 B2 B5 06 80 1B 94 50 24 28 35 6D",
  "session id"          : "",
  "cipher suites"       : "[TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384(0xC02C), TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256(0xC02B), TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384(0xC030), TLS_RSA_WITH_AES_256_GCM_SHA384(0x009D), TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384(0xC02E), TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384(0xC032), TLS_DHE_RSA_WITH_AES_256_GCM_SHA384(0x009F), TLS_DHE_DSS_WITH_AES_256_GCM_SHA384(0x00A3), TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256(0xC02F), TLS_RSA_WITH_AES_128_GCM_SHA256(0x009C), TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256(0xC02D), TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256(0xC031), TLS_DHE_RSA_WITH_AES_128_GCM_SHA256(0x009E), TLS_DHE_DSS_WITH_AES_128_GCM_SHA256(0x00A2), TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384(0xC024), TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384(0xC028), TLS_RSA_WITH_AES_256_CBC_SHA256(0x003D), TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384(0xC026), TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384(0xC02A), TLS_DHE_RSA_WITH_AES_256_CBC_SHA256(0x006B), TLS_DHE_DSS_WITH_AES_256_CBC_SHA256(0x006A), TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA(0xC00A), TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA(0xC014), TLS_RSA_WITH_AES_256_CBC_SHA(0x0035), TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA(0xC005), TLS_ECDH_RSA_WITH_AES_256_CBC_SHA(0xC00F), TLS_DHE_RSA_WITH_AES_256_CBC_SHA(0x0039), TLS_DHE_DSS_WITH_AES_256_CBC_SHA(0x0038), TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256(0xC023), TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256(0xC027), TLS_RSA_WITH_AES_128_CBC_SHA256(0x003C), TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256(0xC025), TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256(0xC029), TLS_DHE_RSA_WITH_AES_128_CBC_SHA256(0x0067), TLS_DHE_DSS_WITH_AES_128_CBC_SHA256(0x0040), TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA(0xC009), TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA(0xC013), TLS_RSA_WITH_AES_128_CBC_SHA(0x002F), TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA(0xC004), TLS_ECDH_RSA_WITH_AES_128_CBC_SHA(0xC00E), TLS_DHE_RSA_WITH_AES_128_CBC_SHA(0x0033), TLS_DHE_DSS_WITH_AES_128_CBC_SHA(0x0032), TLS_EMPTY_RENEGOTIATION_INFO_SCSV(0x00FF)]",
  "compression methods" : "00",
  "extensions"          : [
    "server_name (0)": {
      type=host_name (0), value=bootstrap.10.102.17.36.nip.io
    },
    "supported_groups (10)": {
      "versions": [secp256r1, secp384r1, secp521r1, ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192]
    },
    "ec_point_formats (11)": {
      "formats": [uncompressed]
    },
    "signature_algorithms (13)": {
      "signature schemes": [ecdsa_secp256r1_sha256, ecdsa_secp384r1_sha384, ecdsa_secp521r1_sha512, rsa_pss_rsae_sha256, rsa_pss_rsae_sha384, rsa_pss_rsae_sha512, rsa_pss_pss_sha256, rsa_pss_pss_sha384, rsa_pss_pss_sha512, rsa_pkcs1_sha256, rsa_pkcs1_sha384, rsa_pkcs1_sha512, dsa_sha256, ecdsa_sha224, rsa_sha224, dsa_sha224, ecdsa_sha1, rsa_pkcs1_sha1, dsa_sha1]
    },
    "signature_algorithms_cert (50)": {
      "signature schemes": [ecdsa_secp256r1_sha256, ecdsa_secp384r1_sha384, ecdsa_secp521r1_sha512, rsa_pss_rsae_sha256, rsa_pss_rsae_sha384, rsa_pss_rsae_sha512, rsa_pss_pss_sha256, rsa_pss_pss_sha384, rsa_pss_pss_sha512, rsa_pkcs1_sha256, rsa_pkcs1_sha384, rsa_pkcs1_sha512, dsa_sha256, ecdsa_sha224, rsa_sha224, dsa_sha224, ecdsa_sha1, rsa_pkcs1_sha1, dsa_sha1]
    },
    "extended_master_secret (23)": {
      <empty>
    },
    "supported_versions (43)": {
      "versions": [TLSv1.2]
    }
  ]
}
)
javax.net.ssl|FINE|0C|kafka-producer-network-thread | console-producer|2021-02-17 11:20:32.474 IST|Logger.java:765|WRITE: TLS12 handshake, length = 296
javax.net.ssl|FINE|0C|kafka-producer-network-thread | console-producer|2021-02-17 11:20:32.479 IST|Logger.java:765|Raw write (
  0000: 16 03 03 01 28 01 00 01   24 03 03 25 39 A4 B4 80  ....(...$..%9...
  0010: C3 A4 2C DE CA 48 5D B0   DE 9F D1 5F 97 F6 20 64  ..,..H]...._.. d
  0020: B2 B5 06 80 1B 94 50 24   28 35 6D 00 00 56 C0 2C  ......P$(5m..V.,
  0030: C0 2B C0 30 00 9D C0 2E   C0 32 00 9F 00 A3 C0 2F  .+.0.....2...../
  0040: 00 9C C0 2D C0 31 00 9E   00 A2 C0 24 C0 28 00 3D  ...-.1.....$.(.=
  0050: C0 26 C0 2A 00 6B 00 6A   C0 0A C0 14 00 35 C0 05  .&.*.k.j.....5..
  0060: C0 0F 00 39 00 38 C0 23   C0 27 00 3C C0 25 C0 29  ...9.8.#.'.<.%.)
  0070: 00 67 00 40 C0 09 C0 13   00 2F C0 04 C0 0E 00 33  .g.@...../.....3
  0080: 00 32 00 FF 01 00 00 A5   00 00 00 22 00 20 00 00  .2.........". ..
  0090: 1D 62 6F 6F 74 73 74 72   61 70 2E 31 30 2E 31 30  .bootstrap.10.10
  00A0: 32 2E 31 37 2E 33 36 2E   6E 69 70 2E 69 6F 00 0A  2.17.36.nip.io..
  00B0: 00 12 00 10 00 17 00 18   00 19 01 00 01 01 01 02  ................
  00C0: 01 03 01 04 00 0B 00 02   01 00 00 0D 00 28 00 26  .............(.&
  00D0: 04 03 05 03 06 03 08 04   08 05 08 06 08 09 08 0A  ................
  00E0: 08 0B 04 01 05 01 06 01   04 02 03 03 03 01 03 02  ................
  00F0: 02 03 02 01 02 02 00 32   00 28 00 26 04 03 05 03  .......2.(.&....
  0100: 06 03 08 04 08 05 08 06   08 09 08 0A 08 0B 04 01  ................
  0110: 05 01 06 01 04 02 03 03   03 01 03 02 02 03 02 01  ................
  0120: 02 02 00 17 00 00 00 2B   00 03 02 03 03           .......+.....
)
javax.net.ssl|FINE|0C|kafka-producer-network-thread | console-producer|2021-02-17 11:20:32.788 IST|Logger.java:765|Raw read (
  0000: 15 03 03 00 02 02 28                               ......(
)
javax.net.ssl|FINE|0C|kafka-producer-network-thread | console-producer|2021-02-17 11:20:32.788 IST|Logger.java:765|READ: TLSv1.2 alert, length = 2
javax.net.ssl|FINE|0C|kafka-producer-network-thread | console-producer|2021-02-17 11:20:32.789 IST|Logger.java:765|Received alert message (
"Alert": {
  "level"      : "fatal",
  "description": "handshake_failure"
}
)
javax.net.ssl|SEVERE|0C|kafka-producer-network-thread | console-producer|2021-02-17 11:20:32.790 IST|Logger.java:765|Fatal (HANDSHAKE_FAILURE): Received fatal alert: handshake_failure (
"throwable" : {
  javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
  	at sun.security.ssl.Alert.createSSLException(Alert.java:131)
  	at sun.security.ssl.Alert.createSSLException(Alert.java:117)
  	at sun.security.ssl.TransportContext.fatal(TransportContext.java:311)
  	at sun.security.ssl.Alert$AlertConsumer.consume(Alert.java:293)
  	at sun.security.ssl.TransportContext.dispatch(TransportContext.java:185)
  	at sun.security.ssl.SSLTransport.decode(SSLTransport.java:149)
  	at sun.security.ssl.SSLEngineImpl.decode(SSLEngineImpl.java:575)
  	at sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:531)
  	at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:398)
  	at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:377)
  	at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:626)
  	at org.apache.kafka.common.network.SslTransportLayer.handshakeUnwrap(SslTransportLayer.java:509)
  	at org.apache.kafka.common.network.SslTransportLayer.doHandshake(SslTransportLayer.java:368)
  	at org.apache.kafka.common.network.SslTransportLayer.handshake(SslTransportLayer.java:291)
  	at org.apache.kafka.common.network.KafkaChannel.prepare(KafkaChannel.java:173)
  	at org.apache.kafka.common.network.Selector.pollSelectionKeys(Selector.java:543)
  	at org.apache.kafka.common.network.Selector.poll(Selector.java:481)
  	at org.apache.kafka.clients.NetworkClient.poll(NetworkClient.java:561)
  	at org.apache.kafka.clients.producer.internals.Sender.runOnce(Sender.java:325)
  	at org.apache.kafka.clients.producer.internals.Sender.run(Sender.java:240)
  	at java.lang.Thread.run(Thread.java:748)}

)
javax.net.ssl|ALL|0C|kafka-producer-network-thread | console-producer|2021-02-17 11:20:32.791 IST|Logger.java:765|Invalidated session:  Session(1613541032362|SSL_NULL_WITH_NULL_NULL)
[2021-02-17 11:20:32,794] ERROR [Producer clientId=console-producer] Connection to node -1 (bootstrap.10.102.17.36.nip.io/10.102.17.36:443) failed authentication due to: SSL handshake failed (org.apache.kafka.clients.NetworkClient)
[2021-02-17 11:20:32,795] WARN [Producer clientId=console-producer] Bootstrap broker bootstrap.10.102.17.36.nip.io:443 (id: -1 rack: null) disconnected (org.apache.kafka.clients.NetworkClient)

Kafka-client.properties:

security.protocol=SSL
ssl.truststore.location=/tmp/truststore.jks
ssl.truststore.password=password
ssl.keystore.location=/tmp/kafka-user-keystore.jks
ssl.keystore.password=password
ssl.key.password=password

Nginx Ingress Deployment Config:

apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    deployment.kubernetes.io/revision: "1"
    meta.helm.sh/release-name: nginx-ingress
    meta.helm.sh/release-namespace: avx-kafka
  creationTimestamp: "2021-02-16T13:19:31Z"
  generation: 1
  labels:
    app.kubernetes.io/instance: nginx-ingress
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: nginx-ingress-nginx-ingress
    helm.sh/chart: nginx-ingress-0.8.0
  managedFields:
  - apiVersion: apps/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .: {}
          f:meta.helm.sh/release-name: {}
          f:meta.helm.sh/release-namespace: {}
        f:labels:
          .: {}
          f:app.kubernetes.io/instance: {}
          f:app.kubernetes.io/managed-by: {}
          f:app.kubernetes.io/name: {}
          f:helm.sh/chart: {}
      f:spec:
        f:progressDeadlineSeconds: {}
        f:replicas: {}
        f:revisionHistoryLimit: {}
        f:selector: {}
        f:strategy:
          f:rollingUpdate:
            .: {}
            f:maxSurge: {}
            f:maxUnavailable: {}
          f:type: {}
        f:template:
          f:metadata:
            f:annotations:
              .: {}
              f:prometheus.io/port: {}
              f:prometheus.io/scrape: {}
            f:labels:
              .: {}
              f:app: {}
          f:spec:
            f:containers:
              k:{"name":"nginx-ingress-nginx-ingress"}:
                .: {}
                f:args: {}
                f:env:
                  .: {}
                  k:{"name":"POD_NAME"}:
                    .: {}
                    f:name: {}
                    f:valueFrom:
                      .: {}
                      f:fieldRef:
                        .: {}
                        f:apiVersion: {}
                        f:fieldPath: {}
                  k:{"name":"POD_NAMESPACE"}:
                    .: {}
                    f:name: {}
                    f:valueFrom:
                      .: {}
                      f:fieldRef:
                        .: {}
                        f:apiVersion: {}
                        f:fieldPath: {}
                f:image: {}
                f:imagePullPolicy: {}
                f:name: {}
                f:ports:
                  .: {}
                  k:{"containerPort":80,"protocol":"TCP"}:
                    .: {}
                    f:containerPort: {}
                    f:name: {}
                    f:protocol: {}
                  k:{"containerPort":443,"protocol":"TCP"}:
                    .: {}
                    f:containerPort: {}
                    f:name: {}
                    f:protocol: {}
                  k:{"containerPort":9113,"protocol":"TCP"}:
                    .: {}
                    f:containerPort: {}
                    f:name: {}
                    f:protocol: {}
                  k:{"containerPort":31443,"protocol":"TCP"}:
                    .: {}
                    f:containerPort: {}
                    f:name: {}
                    f:protocol: {}
                f:readinessProbe:
                  .: {}
                  f:failureThreshold: {}
                  f:httpGet:
                    .: {}
                    f:path: {}
                    f:port: {}
                    f:scheme: {}
                  f:periodSeconds: {}
                  f:successThreshold: {}
                  f:timeoutSeconds: {}
                f:resources: {}
                f:securityContext:
                  .: {}
                  f:allowPrivilegeEscalation: {}
                  f:capabilities:
                    .: {}
                    f:add: {}
                    f:drop: {}
                  f:runAsUser: {}
                f:terminationMessagePath: {}
                f:terminationMessagePolicy: {}
            f:dnsPolicy: {}
            f:restartPolicy: {}
            f:schedulerName: {}
            f:securityContext: {}
            f:serviceAccount: {}
            f:serviceAccountName: {}
            f:terminationGracePeriodSeconds: {}
    manager: Go-http-client
    operation: Update
    time: "2021-02-16T13:19:31Z"
  - apiVersion: apps/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          f:deployment.kubernetes.io/revision: {}
      f:status:
        f:availableReplicas: {}
        f:conditions:
          .: {}
          k:{"type":"Available"}:
            .: {}
            f:lastTransitionTime: {}
            f:lastUpdateTime: {}
            f:message: {}
            f:reason: {}
            f:status: {}
            f:type: {}
          k:{"type":"Progressing"}:
            .: {}
            f:lastTransitionTime: {}
            f:lastUpdateTime: {}
            f:message: {}
            f:reason: {}
            f:status: {}
            f:type: {}
        f:observedGeneration: {}
        f:readyReplicas: {}
        f:replicas: {}
        f:updatedReplicas: {}
    manager: kube-controller-manager
    operation: Update
    time: "2021-02-16T13:19:36Z"
  name: nginx-ingress-nginx-ingress
  namespace: avx-kafka
  resourceVersion: "66367"
  uid: 692e9b53-c49a-4bfe-a950-976c8090171b
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: nginx-ingress-nginx-ingress
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      annotations:
        prometheus.io/port: "9113"
        prometheus.io/scrape: "true"
      creationTimestamp: null
      labels:
        app: nginx-ingress-nginx-ingress
    spec:
      containers:
      - args:
        - -nginx-plus=false
        - -nginx-reload-timeout=0
        - -enable-app-protect=false
        - -nginx-configmaps=$(POD_NAMESPACE)/nginx-ingress-nginx-ingress
        - -default-server-tls-secret=avx-kafka/nginx-tls
        - -ingress-class=nginx
        - -health-status=false
        - -health-status-uri=/nginx-health
        - -nginx-debug=false
        - -v=1
        - -nginx-status=true
        - -nginx-status-port=8080
        - -nginx-status-allow-cidrs=127.0.0.1
        - -report-ingress-status
        - -external-service=nginx-ingress-nginx-ingress
        - -enable-leader-election=true
        - -leader-election-lock-name=nginx-ingress-nginx-ingress-leader-election
        - -enable-prometheus-metrics=true
        - -prometheus-metrics-listen-port=9113
        - -enable-custom-resources=true
        - -enable-tls-passthrough=true
        - -enable-snippets=false
        - -enable-preview-policies=false
        - -ready-status=true
        - -ready-status-port=31443
        - -enable-latency-metrics=false
        env:
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        image: nginx/nginx-ingress:1.10.0
        imagePullPolicy: IfNotPresent
        name: nginx-ingress-nginx-ingress
        ports:
        - containerPort: 80
          name: http
          protocol: TCP
        - containerPort: 443
          name: https
          protocol: TCP
        - containerPort: 9113
          name: prometheus
          protocol: TCP
        - containerPort: 31443
          name: readiness-port
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /nginx-ready
            port: readiness-port
            scheme: HTTP
          periodSeconds: 1
          successThreshold: 1
          timeoutSeconds: 1
        resources: {}
        securityContext:
          allowPrivilegeEscalation: true
          capabilities:
            add:
            - NET_BIND_SERVICE
            drop:
            - ALL
          runAsUser: 101
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      serviceAccount: nginx-ingress-nginx-ingress
      serviceAccountName: nginx-ingress-nginx-ingress
      terminationGracePeriodSeconds: 30
status:
  availableReplicas: 1
  conditions:
  - lastTransitionTime: "2021-02-16T13:19:36Z"
    lastUpdateTime: "2021-02-16T13:19:36Z"
    message: Deployment has minimum availability.
    reason: MinimumReplicasAvailable
    status: "True"
    type: Available
  - lastTransitionTime: "2021-02-16T13:19:31Z"
    lastUpdateTime: "2021-02-16T13:19:36Z"
    message: ReplicaSet "nginx-ingress-nginx-ingress-5bd6744855" has successfully
      progressed.
    reason: NewReplicaSetAvailable
    status: "True"
    type: Progressing
  observedGeneration: 1
  readyReplicas: 1
  replicas: 1
  updatedReplicas: 1

Ingress Controller config :

apiVersion: v1
items:
- apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      ingress.kubernetes.io/ssl-passthrough: "true"
      kubernetes.io/ingress.class: nginx
      nginx.ingress.kubernetes.io/backend-protocol: HTTPS
      nginx.ingress.kubernetes.io/ssl-passthrough: "true"
    creationTimestamp: "2021-02-17T05:18:36Z"
    generation: 1
    labels:
      app.kubernetes.io/instance: avx-kafka-cluster
      app.kubernetes.io/managed-by: strimzi-cluster-operator
      app.kubernetes.io/name: kafka
      app.kubernetes.io/part-of: strimzi-avx-kafka-cluster
      helm.sh/chart: avx-kafka-0.1.0
      strimzi.io/cluster: avx-kafka-cluster
      strimzi.io/kind: Kafka
      strimzi.io/name: avx-kafka-cluster-kafka
    managedFields:
    - apiVersion: extensions/v1beta1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:ingress.kubernetes.io/ssl-passthrough: {}
            f:kubernetes.io/ingress.class: {}
            f:nginx.ingress.kubernetes.io/backend-protocol: {}
            f:nginx.ingress.kubernetes.io/ssl-passthrough: {}
          f:labels:
            .: {}
            f:app.kubernetes.io/instance: {}
            f:app.kubernetes.io/managed-by: {}
            f:app.kubernetes.io/name: {}
            f:app.kubernetes.io/part-of: {}
            f:helm.sh/chart: {}
            f:strimzi.io/cluster: {}
            f:strimzi.io/kind: {}
            f:strimzi.io/name: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"1da5f33f-9b17-4edc-89ca-8de18ff85af4"}:
              .: {}
              f:apiVersion: {}
              f:blockOwnerDeletion: {}
              f:controller: {}
              f:kind: {}
              f:name: {}
              f:uid: {}
        f:spec:
          f:rules: {}
          f:tls: {}
      manager: okhttp
      operation: Update
      time: "2021-02-17T05:18:36Z"
    name: avx-kafka-cluster-kafka-0
    namespace: avx-kafka
    ownerReferences:
    - apiVersion: kafka.strimzi.io/v1beta1
      blockOwnerDeletion: false
      controller: false
      kind: Kafka
      name: avx-kafka-cluster
      uid: 1da5f33f-9b17-4edc-89ca-8de18ff85af4
    resourceVersion: "90764"
    uid: 34f48bc8-7d2b-4033-95fc-e2bb7f61b4fb
  spec:
    rules:
    - host: broker-0.10.102.17.36.nip.io
      http:
        paths:
        - backend:
            service:
              name: avx-kafka-cluster-kafka-0
              port:
                number: 9094
          path: /
          pathType: ImplementationSpecific
    tls:
    - hosts:
      - broker-0.10.102.17.36.nip.io
  status:
    loadBalancer:
      ingress:
      - ip: 10.102.17.36
- apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      ingress.kubernetes.io/ssl-passthrough: "true"
      kubernetes.io/ingress.class: nginx
      nginx.ingress.kubernetes.io/backend-protocol: HTTPS
      nginx.ingress.kubernetes.io/ssl-passthrough: "true"
    creationTimestamp: "2021-02-17T05:18:36Z"
    generation: 1
    labels:
      app.kubernetes.io/instance: avx-kafka-cluster
      app.kubernetes.io/managed-by: strimzi-cluster-operator
      app.kubernetes.io/name: kafka
      app.kubernetes.io/part-of: strimzi-avx-kafka-cluster
      helm.sh/chart: avx-kafka-0.1.0
      strimzi.io/cluster: avx-kafka-cluster
      strimzi.io/kind: Kafka
      strimzi.io/name: avx-kafka-cluster-kafka
    managedFields:
    - apiVersion: extensions/v1beta1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:ingress.kubernetes.io/ssl-passthrough: {}
            f:kubernetes.io/ingress.class: {}
            f:nginx.ingress.kubernetes.io/backend-protocol: {}
            f:nginx.ingress.kubernetes.io/ssl-passthrough: {}
          f:labels:
            .: {}
            f:app.kubernetes.io/instance: {}
            f:app.kubernetes.io/managed-by: {}
            f:app.kubernetes.io/name: {}
            f:app.kubernetes.io/part-of: {}
            f:helm.sh/chart: {}
            f:strimzi.io/cluster: {}
            f:strimzi.io/kind: {}
            f:strimzi.io/name: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"1da5f33f-9b17-4edc-89ca-8de18ff85af4"}:
              .: {}
              f:apiVersion: {}
              f:blockOwnerDeletion: {}
              f:controller: {}
              f:kind: {}
              f:name: {}
              f:uid: {}
        f:spec:
          f:rules: {}
          f:tls: {}
      manager: okhttp
      operation: Update
      time: "2021-02-17T05:18:36Z"
    name: avx-kafka-cluster-kafka-bootstrap
    namespace: avx-kafka
    ownerReferences:
    - apiVersion: kafka.strimzi.io/v1beta1
      blockOwnerDeletion: false
      controller: false
      kind: Kafka
      name: avx-kafka-cluster
      uid: 1da5f33f-9b17-4edc-89ca-8de18ff85af4
    resourceVersion: "90765"
    uid: 87fffce3-d8d2-46ea-8a0b-3e9d5aabc061
  spec:
    rules:
    - host: bootstrap.10.102.17.36.nip.io
      http:
        paths:
        - backend:
            service:
              name: avx-kafka-cluster-kafka-external-bootstrap
              port:
                number: 9094
          path: /
          pathType: ImplementationSpecific
    tls:
    - hosts:
      - bootstrap.10.102.17.36.nip.io
  status:
    loadBalancer:
      ingress:
      - ip: 10.102.17.36
kind: List
metadata:
  resourceVersion: ""
  selfLink: ""

Please help me on fixing this.

scholzj · 2021-02-17T09:27:38Z

scholzj
Feb 17, 2021
Maintainer

No clue to be honest. I would try to connect with openssl c_client and see what that gives you. From the Kafka client log it looks to me as if the client and Nginx did not agreed on right from the beginning and the client did not even got any certificates from the server.

1 reply

NathanAvx Feb 17, 2021
Author

@scholzj output of openssl s_client -connect 10.104.198.45:443

CONNECTED(00000003)
depth=0 O = io.strimzi, CN = cluster-ca v0
verify error:num=18:self signed certificate
verify return:1
depth=0 O = io.strimzi, CN = cluster-ca v0
verify return:1
---
Certificate chain
 0 s:/O=io.strimzi/CN=cluster-ca v0
   i:/O=io.strimzi/CN=cluster-ca v0
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDLTCCAhWgAwIBAgIJALQniC2rwkUBMA0GCSqGSIb3DQEBCwUAMC0xEzARBgNV
BAoMCmlvLnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwHhcNMjEwMjE3
MDUxNzIwWhcNMjIwMjE3MDUxNzIwWjAtMRMwEQYDVQQKDAppby5zdHJpbXppMRYw
FAYDVQQDDA1jbHVzdGVyLWNhIHYwMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEAt53JCFuI1OsVskW7N09+4AeETg+/XfEgGfvE9U60n0dIzctMy1/i1qhf
iy6gdqMlLENfHWDo4uNGFaTRDa6rMZ4Yf5lBotWzmc+YHOMRNFHm6cH5itfN6Ssn
BuaYFv3RiIx5KNhuYRELX87qcdpTAXG7rsUszdACSMARMCl//4OflZBog5d869z2
D/VJlCpDxsD+WxKMcle2k1k83MEOXL/ISt3S9IN4tJPJbnv1eUlG7RRBo7ME0dx3
1aFgVo2alAciTirXgA1Ia7fcUai538dIuFsK9GBSE6WGxtotsWFfmEEWWGBL+Dkm
ukMWCjFz1egA8xSVk2ADt81tq0/O3wIDAQABo1AwTjAdBgNVHQ4EFgQU+zeulmVl
S4nGuor1564YjdVih6MwHwYDVR0jBBgwFoAU+zeulmVlS4nGuor1564YjdVih6Mw
DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAYPzBDldEe/I0MGWsNmzv
ldiQHBpPLpQ9AC3njC3qwSJUiVZQt2jFICpEQ2vV3gbVB292LHaTUJT0g+svbhjd
V3U+FKtw8aDjBoK+VjcXi6rQLxzjveKwffcuw1iox70ArZnhxEiPUPb9ZCT9rlT8
xcQjWiSML5K2uCn6CcTwiZvpAtM9+A9GK4C/iHhTdgydBBSJNGHPO0ImOp2sKWV3
9ODTtLKBCsQL05lwMREfS6lgvnuygt9ANEKmuRCB28te/WA80VljhS6Mbpx02TPL
/iWlPicXbJmgTnk41IVCZJ48nBSU86tj8/qr9soZy9u7s7i/2LL/QbpHsMD0J9Pu
pg==
-----END CERTIFICATE-----
subject=/O=io.strimzi/CN=cluster-ca v0
issuer=/O=io.strimzi/CN=cluster-ca v0
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 1487 bytes and written 391 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: 2D7CD81F4FAE43CCBAA5D145D913AA305C666809F1C69C0A6C23872322B7522D
    Session-ID-ctx: 
    Master-Key: B0A762BFBCDDB6B2378846D343045460C97C0E5423BF7372022A466A7789E5733DA913123485014DB489B9DFADC69A1A
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - e4 b9 33 52 f7 25 37 7f-a4 1e 7c d1 41 dd af db   ..3R.%7...|.A...
    0010 - 32 d7 b6 89 86 f0 bf bd-3f d7 e4 f8 09 eb 82 cf   2.......?.......
    0020 - 70 2f 9d e9 31 a5 32 4c-7a 24 08 8d ae 3a 8d 7a   p/..1.2Lz$...:.z
    0030 - 62 31 e6 d7 d6 6d 15 8c-4a a2 ea 47 9f be 71 b1   b1...m..J..G..q.
    0040 - 18 f8 49 0e 26 db 32 52-77 ab 7b 6d b6 b6 76 a1   ..I.&.2Rw.{m..v.
    0050 - 67 bd c3 7c 42 a7 15 ac-b0 75 3b 81 33 c1 c6 fc   g..|B....u;.3...
    0060 - 41 2b cd 13 e5 d3 41 97-49 37 77 58 d7 e5 cd 6a   A+....A.I7wX...j
    0070 - 40 f6 ea 25 cd d4 2c e7-87 53 d9 11 ca fb a2 64   @..%..,..S.....d
    0080 - 01 8e d0 33 e2 4c 13 ab-f1 12 e0 04 b2 f4 31 98   ...3.L........1.
    0090 - 32 74 4e 3b 34 cd 6d d1-f7 0f 52 97 9c 14 2d a0   2tN;4.m...R...-.
    00a0 - 3e b2 04 73 90 68 37 4c-b7 34 91 99 6b 41 d7 95   >..s.h7L.4..kA..

    Start Time: 1613554763
    Timeout   : 300 (sec)
    Verify return code: 18 (self signed certificate)
---
closed

scholzj · 2021-02-17T10:26:25Z

scholzj
Feb 17, 2021
Maintainer

Wait, what is 10.104.198.45:443? I think you should try to do something like this (since that corresponds to what the client does):

openssl s_client -connect bootstrap.10.102.17.36.nip.io:443 -servername bootstrap.10.102.17.36.nip.io

1 reply

NathanAvx Feb 17, 2021
Author

Sorry I missed to tell you that I reinstalled it with a older version which I had earlier so that the IP got changed.
Here is the output of the openssl with new IP & servername option.

openssl s_client -connect bootstrap.10.104.198.45.nip.io:443 -servername bootstrap.10.104.198.45.nip.io

CONNECTED(00000003)
140371818083992:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:s23_clnt.c:769:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 304 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1613558075
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---

NathanAvx · 2021-02-17T10:46:12Z

NathanAvx
Feb 17, 2021
Author

@scholzj , I found these in Nginx log, 'll it help ?



I0217 09:10:00.316698       1 event.go:282] Event(v1.ObjectReference{Kind:"Secret", Namespace:"avx-kafka", Name:"nginx-tls", UID:"f79496a2-af6d-4264-9e97-fd656d98d5b0", APIVersion:"v1", ResourceVersion:"10094", FieldPath:""}): type: 'Normal' reason: 'Updated' the special Secret avx-kafka/nginx-tls was updated

....

W0217 09:11:39.678029       1 controller.go:2866] Using the DEPRECATED annotation 'kubernetes.io/ingress.class'. The 'ingressClassName' field will be ignored.
W0217 09:11:39.678693       1 controller.go:1983] Error trying to get the secret  for Ingress avx-kafka-cluster-kafka-bootstrap: secret doesn't exist or of an unsupported type
W0217 09:11:39.678765       1 controller.go:2097] Error retrieving endpoints for the service avx-kafka-cluster-kafka-external-bootstrap: No endpoints for target port 9094 in service avx-kafka-cluster-kafka-external-bootstrap

....

I0217 09:11:39.969467       1 event.go:282] Event(v1.ObjectReference{Kind:"Ingress", Namespace:"avx-kafka", Name:"avx-kafka-cluster-kafka-bootstrap", UID:"56a19138-fae2-4dbb-b6d7-83cf68152ea8", APIVersion:"networking.k8s.io/v1beta1", ResourceVersion:"10307", FieldPath:""}): type: 'Warning' reason: 'AddedOrUpdatedWithWarning' Configuration for avx-kafka/avx-kafka-cluster-kafka-bootstrap was added or updated ; with warning(s): TLS termination for host 'bootstrap.10.104.198.45.nip.io' requires specifying a TLS secret or configuring a global wildcard TLS secret

....

W0217 09:11:40.005425       1 controller.go:2866] Using the DEPRECATED annotation 'kubernetes.io/ingress.class'. The 'ingressClassName' field will be ignored.
W0217 09:11:40.005652       1 controller.go:1983] Error trying to get the secret  for Ingress avx-kafka-cluster-kafka-0: secret doesn't exist or of an unsupported type
W0217 09:11:40.005744       1 controller.go:2097] Error retrieving endpoints for the service avx-kafka-cluster-kafka-0: No endpoints for target port 9094 in service avx-kafka-cluster-kafka-0

....

172.17.0.1 [17/Feb/2021:09:20:15 +0000] TCP 200 7 0 0.117 "bootstrap.10.104.198.45.nip.io"
172.17.0.1 [17/Feb/2021:09:20:16 +0000] TCP 200 7 0 0.032 "bootstrap.10.104.198.45.nip.io"
172.17.0.1 [17/Feb/2021:09:20:16 +0000] TCP 200 7 0 0.013 "bootstrap.10.104.198.45.nip.io"
172.17.0.1 [17/Feb/2021:09:20:16 +0000] TCP 200 7 0 0.027 "bootstrap.10.104.198.45.nip.io"
172.17.0.1 [17/Feb/2021:09:20:16 +0000] TCP 200 7 0 0.010 "bootstrap.10.104.198.45.nip.io"
172.17.0.1 [17/Feb/2021:09:20:16 +0000] TCP 200 7 0 0.027 "bootstrap.10.104.198.45.nip.io"
172.17.0.1 [17/Feb/2021:09:20:16 +0000] TCP 200 7 0 0.020 "bootstrap.10.104.198.45.nip.io"
172.17.0.1 [17/Feb/2021:09:20:16 +0000] TCP 200 7 0 0.036 "bootstrap.10.104.198.45.nip.io"
172.17.0.1 [17/Feb/2021:09:20:17 +0000] TCP 200 7 0 0.027 "bootstrap.10.104.198.45.nip.io"
172.17.0.1 [17/Feb/2021:09:20:17 +0000] TCP 200 7 0 0.017 "bootstrap.10.104.198.45.nip.io"
172.17.0.1 [17/Feb/2021:09:20:34 +0000] TCP 200 1284 16709 0.579 ""
172.17.0.1 [17/Feb/2021:09:20:34 +0000] TCP 200 1284 16709 0.052 ""
172.17.0.1 [17/Feb/2021:09:20:34 +0000] TCP 200 1284 16709 0.032 ""
172.17.0.1 [17/Feb/2021:09:20:35 +0000] TCP 200 1277 16716 0.059 ""
172.17.0.1 [17/Feb/2021:09:20:35 +0000] TCP 200 1284 16709 0.017 ""
172.17.0.1 [17/Feb/2021:09:20:35 +0000] TCP 200 1284 16709 0.050 ""
2021/02/17 09:20:35 [error] 67#67: *62 writev() failed (32: Broken pipe) while proxying and sending to upstream, client: 172.17.0.1, server: 0.0.0.0:443, upstream: "unix:/var/lib/nginx/passthrough-https.sock", bytes from/to client:16709/1277, bytes from/to upstream:1277/7547
172.17.0.1 [17/Feb/2021:09:20:35 +0000] TCP 200 1277 16709 0.085 ""
2021/02/17 09:20:35 [error] 67#67: *65 recv() failed (104: Connection reset by peer) while proxying and reading from upstream, client: 172.17.0.1, server: 0.0.0.0:443, upstream: "unix:/var/lib/nginx/passthrough-https.sock", bytes from/to client:16709/1284, bytes from/to upstream:1284/17015
172.17.0.1 [17/Feb/2021:09:20:35 +0000] TCP 200 1284 16709 0.026 ""
172.17.0.1 [17/Feb/2021:09:20:35 +0000] TCP 200 1284 16709 0.020 ""
172.17.0.1 [17/Feb/2021:09:20:36 +0000] TCP 200 1284 16709 0.051 ""
2021/02/17 09:20:36 [error] 67#67: *74 writev() failed (32: Broken pipe) while proxying and sending to upstream, client: 172.17.0.1, server: 0.0.0.0:443, upstream: "unix:/var/lib/nginx/passthrough-https.sock", bytes from/to client:16709/1277, bytes from/to upstream:1277/7547
172.17.0.1 [17/Feb/2021:09:20:36 +0000] TCP 200 1277 16709 0.020 ""
172.17.0.1 [17/Feb/2021:09:20:36 +0000] TCP 200 1277 16716 0.022 ""
2021/02/17 09:20:36 [error] 67#67: *80 writev() failed (32: Broken pipe) while proxying and sending to upstream, client: 172.17.0.1, server: 0.0.0.0:443, upstream: "unix:/var/lib/nginx/passthrough-https.sock", bytes from/to client:16709/1277, bytes from/to upstream:1277/14787
172.17.0.1 [17/Feb/2021:09:20:36 +0000] TCP 200 1277 16709 0.013 ""
172.17.0.1 [17/Feb/2021:09:20:36 +0000] TCP 200 1284 16709 0.049 ""
W0217 09:24:31.001987       1 warnings.go:70] networking.k8s.io/v1beta1 Ingress is deprecated in v1.19+, unavailable in v1.22+; use networking.k8s.io/v1 Ingress
W0217 09:33:15.998938       1 warnings.go:70] networking.k8s.io/v1beta1 Ingress is deprecated in v1.19+, unavailable in v1.22+; use networking.k8s.io/v1 Ingress
W0217 09:38:33.007378       1 warnings.go:70] networking.k8s.io/v1beta1 Ingress is deprecated in v1.19+, unavailable in v1.22+; use networking.k8s.io/v1 Ingress
172.17.0.1 [17/Feb/2021:09:40:23 +0000] TCP 200 1518 126 60.065 ""

1 reply

scholzj Feb 17, 2021
Maintainer

I guess this one is interesting:

W0217 09:11:39.678693       1 controller.go:1983] Error trying to get the secret  for Ingress avx-kafka-cluster-kafka-bootstrap: secret doesn't exist or of an unsupported type
W0217 09:11:39.678765       1 controller.go:2097] Error retrieving endpoints for the service avx-kafka-cluster-kafka-external-bootstrap: No endpoints for target port 9094 in service avx-kafka-cluster-kafka-external-bootstrap
...
I0217 09:11:39.969467       1 event.go:282] Event(v1.ObjectReference{Kind:"Ingress", Namespace:"avx-kafka", Name:"avx-kafka-cluster-kafka-bootstrap", UID:"56a19138-fae2-4dbb-b6d7-83cf68152ea8", APIVersion:"networking.k8s.io/v1beta1", ResourceVersion:"10307", FieldPath:""}): type: 'Warning' reason: 'AddedOrUpdatedWithWarning' Configuration for avx-kafka/avx-kafka-cluster-kafka-bootstrap was added or updated ; with warning(s): TLS termination for host 'bootstrap.10.104.198.45.nip.io' requires specifying a TLS secret or configuring a global wildcard TLS secret

if I read it right, it suggests it tries to terminate TLS with a custom certificate. But it needs to do TLS passthrough ... i.e. not load any certificates and just pass the TLS stream on. But I do not know why TBH. You seem to have -enable-tls-passthrough=true in your Ingress Controller config. That is all I ever needed.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Strimzi

Strimzi Kafka & Nginx ingress with Helm #4429

{{title}}

Replies: 3 comments 3 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

Select a reply

Strimzi

Strimzi Kafka & Nginx ingress with Helm #4429

NathanAvx Feb 17, 2021

Replies: 3 comments · 3 replies

scholzj Feb 17, 2021 Maintainer

NathanAvx Feb 17, 2021 Author

scholzj Feb 17, 2021 Maintainer

NathanAvx Feb 17, 2021 Author

NathanAvx Feb 17, 2021 Author

scholzj Feb 17, 2021 Maintainer

NathanAvx
Feb 17, 2021

Replies: 3 comments 3 replies

scholzj
Feb 17, 2021
Maintainer

NathanAvx Feb 17, 2021
Author

scholzj
Feb 17, 2021
Maintainer

NathanAvx Feb 17, 2021
Author

NathanAvx
Feb 17, 2021
Author

scholzj Feb 17, 2021
Maintainer