# Error with Deploy Secure Confluent Platform on Kubernetes

**URL:** <https://forum.confluent.io/t/error-with-deploy-secure-confluent-platform-on-kubernetes/12467>\
**Category:** Confluent Cloud\
**Created:** [1 November 2024 14:51 UTC](https://forum.confluent.io/t/error-with-deploy-secure-confluent-platform-on-kubernetes/12467 "2024-11-01T14:51:28Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ryan2002](https://avatars.discourse-cdn.com/v4/letter/r/a4c791/32.png) [@ryan2002](https://forum.confluent.io/u/ryan2002)\
**Post date:** [1 November 2024 14:51 UTC](https://forum.confluent.io/t/error-with-deploy-secure-confluent-platform-on-kubernetes/12467/1 "2024-11-01T14:51:28Z")

</div>

I am following the Quick Start steps ([confluent-kubernetes-examples/security/secure-authn-encrypt-deploy at master · confluentinc/confluent-kubernetes-examples · GitHub](https://github.com/confluentinc/confluent-kubernetes-examples/tree/master/security/secure-authn-encrypt-deploy)) to deploy. secure confluent platform on Kubernetes.  
After deploying Confluent Platform, when I run

```auto
**kubectl describe kafka**

```

I got following result:

```auto
Name: kafka
Namespace: confluent
Labels: <none>
Annotations: <none>
API Version: platform.confluent.io/v1beta1
Kind: Kafka
Metadata:
  Creation Timestamp: 2024-11-01T14:31:54Z
  Finalizers:
    kafka.finalizers.platform.confluent.io
  Generation: 1
  Managed Fields:
    API Version: platform.confluent.io/v1beta1
    Fields Type: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .:
          f:kubectl.kubernetes.io/last-applied-configuration:
      f:spec:
        .:
        f:configOverrides:
          .:
          f:server:
        f:dataVolumeCapacity:
        f:dependencies:
          .:
          f:zookeeper:
            .:
            f:authentication:
              .:
              f:jaasConfig:
                .:
                f:secretRef:
              f:type:
            f:endpoint:
            f:tls:
              .:
              f:enabled:
        f:image:
          .:
          f:application:
          f:init:
        f:listeners:
          .:
          f:internal:
            .:
            f:authentication:
              .:
              f:jaasConfig:
                .:
                f:secretRef:
              f:type:
            f:tls:
              .:
              f:enabled:
        f:metricReporter:
          .:
          f:bootstrapEndpoint:
          f:enabled:
        f:replicas:
        f:tls:
          .:
          f:autoGeneratedCerts:
    Manager: kubectl-client-side-apply
    Operation: Update
    Time: 2024-11-01T14:31:54Z
    API Version: platform.confluent.io/v1beta1
    Fields Type: FieldsV1
    fieldsV1:
      f:metadata:
        f:finalizers:
          .:
          v:"kafka.finalizers.platform.confluent.io":
    Manager: manager
    Operation: Update
    Time: 2024-11-01T14:31:54Z
    API Version: platform.confluent.io/v1beta1
    Fields Type: FieldsV1
    fieldsV1:
      f:status:
        .:
        f:conditions:
        f:replicas:
    Manager: manager
    Operation: Update
    Subresource: status
    Time: 2024-11-01T14:31:56Z
  Resource Version: 63025
  UID: 6a8b7dde-fa91-417d-8f12-2436d078e238
Spec:
  Config Overrides:
    Server:
      confluent.cluster.link.enable=true
  Data Volume Capacity: 10Gi
  Dependencies:
    Zookeeper:
      Authentication:
        Jaas Config:
          Secret Ref: credential
        Type: digest
      Endpoint: zookeeper.confluent.svc.cluster.local:2182
      Tls:
        Enabled: true
  Image:
    Application: confluentinc/cp-server:7.7.0
    Init: confluentinc/confluent-init-container:2.9.0
  Listeners:
    Internal:
      Authentication:
        Jaas Config:
          Secret Ref: credential
        Type: plain
      Tls:
        Enabled: true
  Metric Reporter:
    Bootstrap Endpoint: kafka:9092
    Enabled: true
  Replicas: 3
  Tls:
    Auto Generated Certs: true
Status:
  Conditions:
    Last Probe Time: 2024-11-01T14:31:56Z
    Last Transition Time: 2024-11-01T14:31:56Z
    Message: spec.metricReporter.tls should be set when TLS is enabled on internal listener
    Reason: ApplyFailed
    Status: False
    Type: platform.confluent.io/cluster-ready
  Replicas: 0
Events:
  Type Reason Age From Message
  ---- ------ ---- ---- -------
  Warning InputError 6s (x2 over 7s) kafka spec.metricReporter.tls should be set when TLS is enabled on internal listener

```

Some Pods are with CrashLoopBackOff status:

```auto
**kubectl get pods**
NAME READY STATUS RESTARTS AGE
confluent-operator-54879fdcdd-xvgdw 1/1 Running 0 16m
connect-0 0/1 Running 5 (2m13s ago) 15m
connect-1 0/1 Running 5 (2m59s ago) 15m
controlcenter-0 0/1 CrashLoopBackOff 7 (2m8s ago) 15m
kafkarestproxy-0 1/1 Running 0 15m
ksqldb-tls-0 0/1 CrashLoopBackOff 7 (2m7s ago) 15m
ksqldb-tls-1 0/1 CrashLoopBackOff 7 (3m22s ago) 15m
schemaregistry-0 0/1 CrashLoopBackOff 7 (2m15s ago) 15m
zookeeper-0 1/1 Running 0 15m
zookeeper-1 1/1 Running 0 15m
zookeeper-2 1/1 Running 0 15m

```

I checked the logs of some pod:

```auto
**kubectl logs controlcenter-0**

......

Caused by: org.apache.kafka.common.config.ConfigException: No resolvable bootstrap urls given in bootstrap.servers
        at org.apache.kafka.clients.ClientUtils.parseAndValidateAddresses(ClientUtils.java:119)
        at org.apache.kafka.clients.ClientUtils.parseAndValidateAddresses(ClientUtils.java:78)
        at org.apache.kafka.clients.ClientUtils.parseAndValidateAddresses(ClientUtils.java:74)
        at org.apache.kafka.clients.producer.KafkaProducer.<init>(KafkaProducer.java:449)

```

The Confluent Kubernete Yaml file can be found: [confluent-kubernetes-examples/security/secure-authn-encrypt-deploy/confluent-platform-secure.yaml at cdd460dd90fbf3abfb348ed43acf97e3167399bd · confluentinc/confluent-kubernetes-examples · GitHub](https://github.com/confluentinc/confluent-kubernetes-examples/blob/cdd460dd90fbf3abfb348ed43acf97e3167399bd/security/secure-authn-encrypt-deploy/confluent-platform-secure.yaml)

Can someone help me find the rolution for the issue?

---

<div class="post-metadata">

**Author:** ![mmuehlbeyer](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/mmuehlbeyer/32/1088_2.png) [@mmuehlbeyer](https://forum.confluent.io/u/mmuehlbeyer)\
**Post date:** [2 November 2024 19:59 UTC](https://forum.confluent.io/t/error-with-deploy-secure-confluent-platform-on-kubernetes/12467/2 "2024-11-02T19:59:46Z")

</div>

hey @ryan2002

as the kafka pod don’t start I would first focus on that.  
did you check the operator logs?

```auto
kubectl logs confluent-operator-54879fdcdd-xvgdw

```

---

<div class="post-metadata">

**Author:** ![ryan2002](https://avatars.discourse-cdn.com/v4/letter/r/a4c791/32.png) [@ryan2002](https://forum.confluent.io/u/ryan2002)\
**Post date:** [3 November 2024 06:56 UTC](https://forum.confluent.io/t/error-with-deploy-secure-confluent-platform-on-kubernetes/12467/3 "2024-11-03T06:56:58Z")

</div>

Hi,

thanks for your message.  
there are iterative error logs in confluent-operator-54879fdcdd-xvgdw:

```auto
{"level":"ERROR","time":"2024-11-03T06:53:53.489Z","name":"kafka","caller":"log/log.go:35","msg":"apply failed","name":"kafka","namespace":"confluent","error":"spec.metricReporter.tls should be set when TLS is enabled on internal listener"}

```

how can I set the spec.metricReporter.tls?

---

<div class="post-metadata">

**Author:** ![mmuehlbeyer](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/mmuehlbeyer/32/1088_2.png) [@mmuehlbeyer](https://forum.confluent.io/u/mmuehlbeyer)\
**Post date:** [3 November 2024 13:59 UTC](https://forum.confluent.io/t/error-with-deploy-secure-confluent-platform-on-kubernetes/12467/4 "2024-11-03T13:59:55Z")

</div>

check this

> **[Monitor Confluent Platform in Confluent for Kubernetes | Confluent Documentation](https://docs.confluent.io/operator/current/co-monitor-cp.html#configure-c3-short-to-monitor-ak-clusters)**
>
> Learn how to monitor Confluent Platform in Confluent for Kubernetes.

best,  
michael

---

<div class="post-metadata">

**Author:** ![ryan2002](https://avatars.discourse-cdn.com/v4/letter/r/a4c791/32.png) [@ryan2002](https://forum.confluent.io/u/ryan2002)\
**Post date:** [4 November 2024 12:20 UTC](https://forum.confluent.io/t/error-with-deploy-secure-confluent-platform-on-kubernetes/12467/5 "2024-11-04T12:20:06Z")

</div>

> [@ryan2002](#):
>
> `metricReporter`

Hi Michael,  
thanks for your help.

After adding the authentication part in metricReporter in confluent-plartform-secure.yaml, it works now.

 ![image](https://us1.discourse-cdn.com/flex019/uploads/confluentcommunity/original/2X/d/da75f5e76ddf54b7e59548130bd44bf17c5c3722.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/confluentcommunity/original/1X/c49438c90c9df282e9996fdf6971be890c71b65a.svg) [@system](https://forum.confluent.io/u/system)\
**Post date:** [11 November 2024 12:20 UTC](https://forum.confluent.io/t/error-with-deploy-secure-confluent-platform-on-kubernetes/12467/6 "2024-11-11T12:20:29Z")

</div>

Closed on 11 November 2024 12:20 UTC

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.