Error with Deploy Secure Confluent Platform on Kubernetes

Confluent Cloud
1

I am following the Quick Start steps (confluent-kubernetes-examples/security/secure-authn-encrypt-deploy at master · confluentinc/confluent-kubernetes-examples · GitHub) to deploy. secure confluent platform on Kubernetes.
After deploying Confluent Platform, when I run

**kubectl describe kafka**

I got following result:

Name:         kafka
Namespace:    confluent
Labels:       <none>
Annotations:  <none>
API Version:  platform.confluent.io/v1beta1
Kind:         Kafka
Metadata:
  Creation Timestamp:  2024-11-01T14:31:54Z
  Finalizers:
    kafka.finalizers.platform.confluent.io
  Generation:  1
  Managed Fields:
    API Version:  platform.confluent.io/v1beta1
    Fields Type:  FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .:
          f:kubectl.kubernetes.io/last-applied-configuration:
      f:spec:
        .:
        f:configOverrides:
          .:
          f:server:
        f:dataVolumeCapacity:
        f:dependencies:
          .:
          f:zookeeper:
            .:
            f:authentication:
              .:
              f:jaasConfig:
                .:
                f:secretRef:
              f:type:
            f:endpoint:
            f:tls:
              .:
              f:enabled:
        f:image:
          .:
          f:application:
          f:init:
        f:listeners:
          .:
          f:internal:
            .:
            f:authentication:
              .:
              f:jaasConfig:
                .:
                f:secretRef:
              f:type:
            f:tls:
              .:
              f:enabled:
        f:metricReporter:
          .:
          f:bootstrapEndpoint:
          f:enabled:
        f:replicas:
        f:tls:
          .:
          f:autoGeneratedCerts:
    Manager:      kubectl-client-side-apply
    Operation:    Update
    Time:         2024-11-01T14:31:54Z
    API Version:  platform.confluent.io/v1beta1
    Fields Type:  FieldsV1
    fieldsV1:
      f:metadata:
        f:finalizers:
          .:
          v:"kafka.finalizers.platform.confluent.io":
    Manager:      manager
    Operation:    Update
    Time:         2024-11-01T14:31:54Z
    API Version:  platform.confluent.io/v1beta1
    Fields Type:  FieldsV1
    fieldsV1:
      f:status:
        .:
        f:conditions:
        f:replicas:
    Manager:         manager
    Operation:       Update
    Subresource:     status
    Time:            2024-11-01T14:31:56Z
  Resource Version:  63025
  UID:               6a8b7dde-fa91-417d-8f12-2436d078e238
Spec:
  Config Overrides:
    Server:
      confluent.cluster.link.enable=true
  Data Volume Capacity:  10Gi
  Dependencies:
    Zookeeper:
      Authentication:
        Jaas Config:
          Secret Ref:  credential
        Type:          digest
      Endpoint:        zookeeper.confluent.svc.cluster.local:2182
      Tls:
        Enabled:  true
  Image:
    Application:  confluentinc/cp-server:7.7.0
    Init:         confluentinc/confluent-init-container:2.9.0
  Listeners:
    Internal:
      Authentication:
        Jaas Config:
          Secret Ref:  credential
        Type:          plain
      Tls:
        Enabled:  true
  Metric Reporter:
    Bootstrap Endpoint:  kafka:9092
    Enabled:             true
  Replicas:              3
  Tls:
    Auto Generated Certs:  true
Status:
  Conditions:
    Last Probe Time:       2024-11-01T14:31:56Z
    Last Transition Time:  2024-11-01T14:31:56Z
    Message:               spec.metricReporter.tls should be set when TLS is enabled on internal listener
    Reason:                ApplyFailed
    Status:                False
    Type:                  platform.confluent.io/cluster-ready
  Replicas:                0
Events:
  Type     Reason      Age              From   Message
  ----     ------      ----             ----   -------
  Warning  InputError  6s (x2 over 7s)  kafka  spec.metricReporter.tls should be set when TLS is enabled on internal listener

Some Pods are with CrashLoopBackOff status:

**kubectl get pods**
NAME                                  READY   STATUS             RESTARTS        AGE
confluent-operator-54879fdcdd-xvgdw   1/1     Running            0               16m
connect-0                             0/1     Running            5 (2m13s ago)   15m
connect-1                             0/1     Running            5 (2m59s ago)   15m
controlcenter-0                       0/1     CrashLoopBackOff   7 (2m8s ago)    15m
kafkarestproxy-0                      1/1     Running            0               15m
ksqldb-tls-0                          0/1     CrashLoopBackOff   7 (2m7s ago)    15m
ksqldb-tls-1                          0/1     CrashLoopBackOff   7 (3m22s ago)   15m
schemaregistry-0                      0/1     CrashLoopBackOff   7 (2m15s ago)   15m
zookeeper-0                           1/1     Running            0               15m
zookeeper-1                           1/1     Running            0               15m
zookeeper-2                           1/1     Running            0               15m

I checked the logs of some pod:

**kubectl logs controlcenter-0**

......

Caused by: org.apache.kafka.common.config.ConfigException: No resolvable bootstrap urls given in bootstrap.servers
        at org.apache.kafka.clients.ClientUtils.parseAndValidateAddresses(ClientUtils.java:119)
        at org.apache.kafka.clients.ClientUtils.parseAndValidateAddresses(ClientUtils.java:78)
        at org.apache.kafka.clients.ClientUtils.parseAndValidateAddresses(ClientUtils.java:74)
        at org.apache.kafka.clients.producer.KafkaProducer.<init>(KafkaProducer.java:449)

The Confluent Kubernete Yaml file can be found: confluent-kubernetes-examples/security/secure-authn-encrypt-deploy/confluent-platform-secure.yaml at cdd460dd90fbf3abfb348ed43acf97e3167399bd · confluentinc/confluent-kubernetes-examples · GitHub

Can someone help me find the rolution for the issue?

2

hey @ryan2002

as the kafka pod don’t start I would first focus on that.
did you check the operator logs?

kubectl logs  confluent-operator-54879fdcdd-xvgdw
3

Hi,

thanks for your message.
there are iterative error logs in confluent-operator-54879fdcdd-xvgdw:

{"level":"ERROR","time":"2024-11-03T06:53:53.489Z","name":"kafka","caller":"log/log.go:35","msg":"apply failed","name":"kafka","namespace":"confluent","error":"spec.metricReporter.tls should be set when TLS is enabled on internal listener"}

how can I set the spec.metricReporter.tls?

4

check this

best,
michael

5

Hi Michael,
thanks for your help.

After adding the authentication part in metricReporter in confluent-plartform-secure.yaml, it works now.

image
image1888×445 18.3 KB

1 Like
6

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.