通过Ingress暴露Strimzi Kafka时SSL握手失败求助

我用multipass创建了本地k3s集群，尝试通过Ingress方式部署Strimzi Kafka，让集群外的客户端能访问。操作步骤如下：

1. 获取集群IP #

执行以下命令拿到集群IP为192.168.205.5，后续配置文件会用到这个IP：

➜ kubectl get nodes
NAME          STATUS   ROLES                  AGE   VERSION
west-master   Ready    control-plane,master   15m   v1.26.3+k3s1

➜ kubectl get node west-master -o wide
NAME          STATUS   ROLES                  AGE   VERSION        INTERNAL-IP     EXTERNAL-IP   OS-IMAGE             KERNEL-VERSION      CONTAINER-RUNTIME
west-master   Ready    control-plane,master   16m   v1.26.3+k3s1   192.168.205.5   <none>        Ubuntu 22.04.2 LTS   5.15.0-67-generic   containerd://1.6.19-k3s1

➜ kubectl cluster-info
Kubernetes control plane is running at https://192.168.205.5:6443
CoreDNS is running at https://192.168.205.5:6443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy
Metrics-server is running at https://192.168.205.5:6443/api/v1/namespaces/kube-system/services/https:metrics-server:https/proxy

2. 部署Kafka集群 #

先创建命名空间，安装Strimzi Operator，再部署自定义的Kafka集群：

kubectl create namespace hm-kafka
kubectl apply --filename="https://strimzi.io/install/latest?namespace=hm-kafka" --namespace=hm-kafka
kubectl apply --filename=my-kafka-persistent.yaml --namespace=hm-kafka

my-kafka-persistent.yaml配置（基于官方kafka-persistent.yaml修改）：

---
apiVersion: kafka.strimzi.io/v1beta2
kind: Kafka
metadata:
  name: hm-kafka
spec:
  kafka:
    version: 3.4.0
    replicas: 3
    listeners:
      - name: plain
        port: 9092
        type: internal
        tls: false
      - name: tls
        port: 9093
        type: internal
        tls: true
      - name: external
        port: 9094
        type: ingress
        tls: true
        configuration:
          bootstrap:
            host: kafka-bootstrap.192.168.205.5.nip.io
          brokers:
          - broker: 0
            host: kafka-broker-0.192.168.205.5.nip.io
          - broker: 1
            host: kafka-broker-1.192.168.205.5.nip.io
          - broker: 2
            host: kafka-broker-2.192.168.205.5.nip.io
    config:
      offsets.topic.replication.factor: 3
      transaction.state.log.replication.factor: 3
      transaction.state.log.min.isr: 2
      default.replication.factor: 3
      min.insync.replicas: 2
      inter.broker.protocol.version: "3.4"
    storage:
      type: jbod
      volumes:
        - id: 0
          type: persistent-claim
          size: 100Gi
          deleteClaim: false
  zookeeper:
    replicas: 3
    storage:
      type: persistent-claim
      size: 100Gi
      deleteClaim: false
  entityOperator:
    topicOperator: {}
    userOperator: {}

部署完成后，Pods、Services、Ingresses均正常运行，且每个Ingress都配置了SSL passthrough注解。

3. 创建信任存储 #

从集群导出CA证书并导入到信任存储：

➜ kubectl get secret hm-kafka-cluster-ca-cert \
  --namespace=hm-kafka \
  --output=jsonpath="{.data.ca\.crt}" \
  | base64 -d \
  > ca.crt

➜ keytool -importcert \
  -trustcacerts \
  -alias root \
  -file ca.crt \
  -keystore kafka-truststore.jks \
  -storepass my_passw0rd \
  -noprompt
Certificate was added to keystore

问题：SSL握手失败 #

执行生产者命令向Kafka发送数据时，出现SSL握手失败错误：

➜ kafka-console-producer \
  --broker-list kafka-bootstrap.192.168.205.5.nip.io:443 \
  --producer-property security.protocol=SSL \
  --producer-property ssl.truststore.password=my_passw0rd \
  --producer-property ssl.truststore.location=kafka-truststore.jks \
  --topic my-topic
>[2023-04-14 15:57:06,047] ERROR [Producer clientId=console-producer] Connection to node -1 (kafka-bootstrap.192.168.205.5.nip.io/192.168.205.5:443) failed authentication due to: SSL handshake failed (org.apache.kafka.clients.NetworkClient)
[2023-04-14 15:57:06,047] WARN [Producer clientId=console-producer] Bootstrap broker kafka-bootstrap.192.168.205.5.nip.io:443 (id: -1 rack: null) disconnected (org.apache.kafka.clients.NetworkClient)
[2023-04-14 15:57:06,200] ERROR [Producer clientId=console-producer] Connection to node -1 (kafka-bootstrap.192.168.205.5.nip.io/192.168.205.5:443) failed authentication due to: SSL handshake failed (org.apache.kafka.clients.NetworkClient)
[2023-04-14 15:57:06,201] WARN [Producer clientId=console-producer] Bootstrap broker kafka-bootstrap.192.168.205.5.nip.io:443 (id: -1 rack: null) disconnected (org.apache.kafka.clients.NetworkClient)
[2023-04-14 15:57:06,691] ERROR [Producer clientId=console-producer] Connection to node -1 (kafka-bootstrap.192.168.205.5.nip.io/192.168.205.5:443) failed authentication due to: SSL handshake failed (org.apache.kafka.clients.NetworkClient)
[2023-04-14 15:57:06,691] WARN [Producer clientId=console-producer] Bootstrap broker kafka-bootstrap.192.168.205.5.nip.io:443 (id: -1 rack: null) disconnected (org.apache.kafka.clients.NetworkClient)

需要解决这个SSL握手失败的问题，求指引。

更新1 #

已按建议禁用k3s默认的Traefik，在macOS上用multipass创建集群时可以用以下命令：

multipass launch --name=west-master --cpus=4 --memory=16g --disk=128g
multipass exec west-master -- \
  bash -c 'curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="server --disable traefik" K3S_KUBECONFIG_MODE="644" sh -'

目前我已切换到Rancher Desktop（同样基于k3s），可以通过UI直接禁用Traefik。

更新2 #

关于部署ingress-nginx及解决"Ingress不包含有效IngressClass"的问题，我已发布相关提问，问题内容为：Strimzi Kafka无法创建broker，原因是"Ingress不包含有效IngressClass"

内容的提问来源于stack exchange，提问作者Hongbo Miao