unable to connect to Zookeeper SSL #1643

ramamanoj142000 · 2022-02-21T03:47:09Z

ramamanoj142000
Feb 21, 2022

Hi
I'm getting errors while connecting Kafka-ui on zookeeper-SSL, am i missing something ? . below are detail for docker-compose . Zookeeper host are reachable from this host .
Docker-compose file

version: '3.4'
services:
kafka-ui:
container_name: kafka-ui
image: docker.apple.com/isds-dataanalytics/isds-provectus-kafka-ui:latest
ports:
- 9096:8080
environment:
- KAFKA_CLUSTERS_0_NAME= kafkaservice-2
- KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL= SASL_SSL
- KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS=isds-kafkaservice-dev-west2-lkf01.cognizant.com:9094
- KAFKA_CLUSTERS_0_ZOOKEEPER=isds-kafkaservice-dev-west2-lzk01.cognizant.com:2185
- KAFKA_CLUSTERS_0_PROPERTIES_SSL_TRUSTSTORE_LOCATION= /kafka.truststore.jks
- KAFKA_CLUSTERS_0_PROPERTIES_SSL_TRUSTSTORE_PASSWORD= xxxxxx
- KAFKA_CLUSTERS_0_ZOOKEEPER_CLIENTCNXNSOCKETr= org.apache.zookeeper.ClientCnxnSocketNetty
- KAFKA_CLUSTERS_0_ZOOKEEPER_CLIENT_SECURE= 'true'
- KAFKA_CLUSTERS_0_ZOOKEEPER_SSL_KEYSTORE_LOCATION= /kafka.keystore.jks
- KAFKA_CLUSTERS_0_ZOOKEEPER_SSL_KEYSTORE_PASSWORD= xxxxxx
- KAFKA_CLUSTERS_0_ZOOKEEPER_SSL_TRUSTSTORE_LOCATION= /kafka.truststore.jks
- KAFKA_CLUSTERS_0_ZOOKEEPER_SSL_TRUSTSTORE_PASSWORD= xxxxxx
- KAFKA_CLUSTERS_0_PROPERTIES_SASL_MECHANISM=SCRAM-SHA-512
- KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG=org.apache.kafka.common.security.scram.ScramLoginModule required username="kafka_admin" password="O9csbZJJtGjURn2Akl";

volumes:
   - /ngs1/keystore/keystore.jks:/kafka.keystore.jks
   - /ngs1/keystore/truststore.jks:/kafka.truststore.jks

===============command to run --
docker-compose -f docker-compose.yml up

============================

Logs as below-

kafka-ui | 2022-02-21 03:35:18,972 INFO [kafka-admin-client-thread | adminclient-1-SendThread(isds-kafkaservice-dev-west2-lzk01.cognizant.com:2185)] o.a.z.ClientCnxn: SASL config status: Will not attempt to authenticate using SASL (unknown error)
kafka-ui | 2022-02-21 03:35:18,972 INFO [kafka-admin-client-thread | adminclient-1-SendThread(isds-kafkaservice-dev-west2-lzk01.cognizant.com:2185)] o.a.z.ClientCnxn: Socket connection established, initiating session, client: /172.18.0.2:41788, server: isds-kafkaservice-dev-west2-lzk01.cognizant.com/100.77.82.57:2185
kafka-ui | 2022-02-21 03:35:18,973 WARN [kafka-admin-client-thread | adminclient-1-SendThread(isds-kafkaservice-dev-west2-lzk01.cognizant.com:2185)] o.a.z.ClientCnxn: Session 0x0 for sever isds-kafkaservice-dev-west2-lzk01.cognizant.com/100.77.82.57:2185, Closing socket connection. Attempting reconnect except it is a SessionExpiredException.
kafka-ui | org.apache.zookeeper.ClientCnxn$EndOfStreamException: Unable to read additional data from server sessionid 0x0, likely server has closed socket
kafka-ui | at org.apache.zookeeper.ClientCnxnSocketNIO.doIO(ClientCnxnSocketNIO.java:77)
kafka-ui | at org.apache.zookeeper.ClientCnxnSocketNIO.doTransport(ClientCnxnSocketNIO.java:350)
kafka-ui | at org.apache.zookeeper.ClientCnxn$SendThread.run(ClientCnxn.java:1280)
kafka-ui | 2022-02-21 03:35:19,689 INFO [kafka-admin-client-thread | adminclient-1-SendThread(isds-kafkaservice-dev-west2-lzk01.cognizant.com:2185)] o.a.z.ClientCnxn: Opening socket connection to serverisds-kafkaservice-dev-west2-lzk01.cognizant.com/100.77.82.57:2185.
kafka-ui | 2022-02-21 03:35:19,689 INFO [kafka-admin-client-thread | adminclient-1-SendThread(isds-kafkaservice-dev-west2-lzk01.cognizant.com:2185)] o.a.z.ClientCnxn: SASL config status: Will not attempt to authenticate using SASL (unknown error)
kafka-ui | 2022-02-21 03:35:19,689 INFO [kafka-admin-client-thread | adminclient-1-SendThread(isds-kafkaservice-dev-west2-lzk01.cognizant.com:2185)] o.a.z.ClientCnxn: Socket connection established, initiating session, client: /172.18.0.2:41790, server: isds-kafkaservice-dev-west2-lzk01.cognizant.com/100.77.82.57:2185
kafka-ui | 2022-02-21 03:35:19,690 WARN [kafka-admin-client-thread | adminclient-1-SendThread(isds-kafkaservice-dev-west2-lzk01.cognizant.com:2185)] o.a.z.ClientCnxn: Session 0x0 for sever isds-kafkaservice-dev-west2-lzk01.cognizant.com/100.77.82.57:2185, Closing socket connection. Attempting reconnect except it is a SessionExpiredException.
kafka-ui | org.apache.zookeeper.ClientCnxn$EndOfStreamException: Unable to read additional data from server sessionid 0x0, likely server has closed socket
kafka-ui | at org.apache.zookeeper.ClientCnxnSocketNIO.doIO(ClientCnxnSocketNIO.java:77)
kafka-ui | at org.apache.zookeeper.ClientCnxnSocketNIO.doTransport(ClientCnxnSocketNIO.java:350)
kafka-ui | at org.apache.zookeeper.ClientCnxn$SendThread.run(ClientCnxn.java:1280)
kafka-ui | 2022-02-21 03:35:20,109 INFO [kafka-admin-client-thread | adminclient-1-SendThread(isds-kafkaservice-dev-west2-lzk01.cognizant.com:2185)] o.a.z.ClientCnxn: Opening socket connection to serverisds-kafkaservice-dev-west2-lzk01.cognizant.com/100.77.82.57:2185.
kafka-ui | 2022-02-21 03:35:20,110 INFO [kafka-admin-client-thread | adminclient-1-SendThread(isds-kafkaservice-dev-west2-lzk01.cognizant.com:2185)] o.a.z.ClientCnxn: SASL config status: Will not attempt to authenticate using SASL (unknown error)
kafka-ui | 2022-02-21 03:35:20,110 INFO [kafka-admin-client-thread | adminclient-1-SendThread(isds-kafkaservice-dev-west2-lzk01.cognizant.com:2185)] o.a.z.ClientCnxn: Socket connection established, initiating session, client: /172.18.0.2:41792, server: isds-kafkaservice-dev-west2-lzk01.cognizant.com/100.77.82.57:2185
kafka-ui | 2022-02-21 03:35:20,111 WARN [kafka-admin-client-thread | adminclient-1-SendThread(isds-kafkaservice-dev-west2-lzk01.cognizant.com:2185)] o.a.z.ClientCnxn: Session 0x0 for sever isds-kafkaservice-dev-west2-lzk01.cognizant.com/100.77.82.57:2185, Closing socket connection. Attempting reconnect except it is a SessionExpiredException.
kafka-ui | org.apache.zookeeper.ClientCnxn$EndOfStreamException: Unable to read additional data from server sessionid 0x0, likely server has closed socket
kafka-ui | at org.apache.zookeeper.ClientCnxnSocketNIO.doIO(ClientCnxnSocketNIO.java:77)
kafka-ui | at org.apache.zookeeper.ClientCnxnSocketNIO.doTransport(ClientCnxnSocketNIO.java:350)
kafka-ui | at org.apache.zookeeper.ClientCnxn$SendThread.run(ClientCnxn.java:1280)
kafka-ui | 2022-02-21 03:35:20,924 INFO [kafka-admin-client-thread | adminclient-1-SendThread(isds-kafkaservice-dev-west2-lzk01.cognizant.com:2185)] o.a.z.ClientCnxn: Opening socket connection to serverisds-kafkaservice-dev-west2-lzk01.cognizant.com/100.77.82.57:2185.
kafka-ui | 2022-02-21 03:35:20,924 INFO [kafka-admin-client-thread | adminclient-1-SendThread(isds-kafkaservice-dev-west2-lzk01.cognizant.com:2185)] o.a.z.ClientCnxn: SASL config status: Will not attempt to authenticate using SASL (unknown error)
kafka-ui | 2022-02-21 03:35:20,925 INFO [kafka-admin-client-thread | adminclient-1-SendThread(isds-kafkaservice-dev-west2-lzk01.cognizant.com:2185)] o.a.z.ClientCnxn: Socket connection established, initiating session, client: /172.18.0.2:41794, server: isds-kafkaservice-dev-west2-lzk01.cognizant.com/100.77.82.57:2185
kafka-ui | 2022-02-21 03:35:20,926 WARN [kafka-admin-client-thread | adminclient-1-SendThread(isds-kafkaservice-dev-west2-lzk01.cognizant.com:2185)] o.a.z.ClientCnxn: Session 0x0 for sever isds-kafkaservice-dev-west2-lzk01.cognizant.com/100.77.82.57:2185, Closing socket connection. Attempting reconnect except it is a SessionExpiredException.
kafka-ui | org.apache.zookeeper.ClientCnxn$EndOfStreamException: Unable to read additional data from server sessionid 0x0, likely server has closed socket
kafka-ui | at org.apache.zookeeper.ClientCnxnSocketNIO.doIO(ClientCnxnSocketNIO.java:77)
kafka-ui | at org.apache.zookeeper.ClientCnxnSocketNIO.doTransport(ClientCnxnSocketNIO.java:350)
kafka-ui | at org.apache.zookeeper.ClientCnxn$SendThread.run(ClientCnxn.java:1280)
kafka-ui | 2022-02-21 03:35:21,967 INFO [kafka-admin-client-thread | adminclient-1-SendThread(isds-kafkaservice-dev-west2-lzk01.cognizant.com:2185)] o.a.z.ClientCnxn: Opening socket connection to serverisds-kafkaservice-dev-west2-lzk01.cognizant.com/100.77.82.57:2185.
kafka-ui | 2022-02-21 03:35:21,967 INFO [kafka-admin-client-thread | adminclient-1-SendThread(isds-kafkaservice-dev-west2-lzk01.cognizant.com:2185)] o.a.z.ClientCnxn: SASL config status: Will not attempt to authenticate using SASL (unknown error)
kafka-ui | 2022-02-21 03:35:21,967 INFO [kafka-admin-client-thread | adminclient-1-SendThread(isds-kafkaservice-dev-west2-lzk01.cognizant.com:2185)] o.a.z.ClientCnxn: Socket connection established, initiating session, client: /172.18.0.2:41796, server: isds-kafkaservice-dev-west2-lzk01.cognizant.com/100.77.82.57:2185
kafka-ui | 2022-02-21 03:35:21,968 WARN [kafka-admin-client-thread | adminclient-1-SendThread(isds-kafkaservice-dev-west2-lzk01.cognizant.com:2185)] o.a.z.ClientCnxn: Session 0x0 for sever isds-kafkaservice-dev-west2-lzk01.cognizant.com/100.77.82.57:2185, Closing socket connection. Attempting reconnect except it is a SessionExpiredException.
kafka-ui | org.apache.zookeeper.ClientCnxn$EndOfStreamException: Unable to read additional data from server sessionid 0x0, likely server has closed socket
kafka-ui | at org.apache.zookeeper.ClientCnxnSocketNIO.doIO(ClientCnxnSocketNIO.java:77)
kafka-ui | at org.apache.zookeeper.ClientCnxnSocketNIO.doTransport(ClientCnxnSocketNIO.java:350)
kafka-ui | at org.apache.zookeeper.ClientCnxn$SendThread.run(ClientCnxn.java:1280)
kafka-ui | 2022-02-21 03:35:22,523 INFO [kafka-admin-client-thread | adminclient-1-SendThread(isds-kafkaservice-dev-west2-lzk01.cognizant.com:2185)] o.a.z.ClientCnxn: Opening socket connection to serverisds-kafkaservice-dev-west2-lzk01.cognizant.com/100.77.82.57:2185.
kafka-ui | 2022-02-21 03:35:22,524 INFO [kafka-admin-client-thread | adminclient-1-SendThread(isds-kafkaservice-dev-west2-lzk01.cognizant.com:2185)] o.a.z.ClientCnxn: SASL config status: Will not attempt to authenticate using SASL (unknown error)
kafka-ui | 2022-02-21 03:35:22,524 INFO [kafka-admin-client-thread | adminclient-1-SendThread(isds-kafkaservice-dev-west2-lzk01.cognizant.com:2185)] o.a.z.ClientCnxn: Socket connection established, initiating session, client: /172.18.0.2:41798, server: isds-kafkaservice-dev-west2-lzk01.cognizant.com/100.77.82.57:2185
kafka-ui | 2022-02-21 03:35:22,525 WARN [kafka-admin-client-thread | adminclient-1-SendThread(isds-kafkaservice-dev-west2-lzk01.cognizant.com:2185)] o.a.z.ClientCnxn: Session 0x0 for sever isds-kafkaservice-dev-west2-lzk01.cognizant.com/100.77.82.57:2185, Closing socket connection. Attempting reconnect except it is a SessionExpiredException.
kafka-ui | org.apache.zookeeper.ClientCnxn$EndOfStreamException: Unable to read additional data from server sessionid 0x0, likely server has closed socket
kafka-ui | at org.apache.zookeeper.ClientCnxnSocketNIO.doIO(ClientCnxnSocketNIO.java:77)
kafka-ui | at org.apache.zookeeper.ClientCnxnSocketNIO.doTransport(ClientCnxnSocketNIO.java:350)
kafka-ui | at org.apache.zookeeper.ClientCnxn$SendThread.run(ClientCnxn.java:1280)
^CGracefully stopping... (press Ctrl+C again to force)
Stopping kafka-ui ... done

I can nc or ping the zookeeper from this host ,

[kafka@isds-kafkaservice-dev-west2-lkf01 03:35:25 /ngs1]$ nc -v 100.77.82.57 2185
Ncat: Version 7.50 ( https://nmap.org/ncat )

Answered by Haarolean

Mar 24, 2022

Zookeeper was never required, moreover we've recently dropped support for zookeeper (#1663).

View full answer

Haarolean · 2022-02-21T10:27:51Z

Haarolean
Feb 21, 2022

Hi, I noticed a typo in this env. variable:
KAFKA_CLUSTERS_0_ZOOKEEPER_CLIENTCNXNSOCKETr
there's an extra 'r' at the end. Let's fix this and try again?

1 reply

ramamanoj142000 Feb 21, 2022
Author

even after correcting , i'm getting the same error

KAFKA_CLUSTERS_0_ZOOKEEPER_CLIENTCNXNSOCKET= org.apache.zookeeper.ClientCnxnSocketNetty
- KAFKA_CLUSTERS_0_ZOOKEEPER_CLIENT_SECURE= 'true'
- KAFKA_CLUSTERS_0_ZOOKEEPER_SSL_KEYSTORE_LOCATION= /kafka.keystore.jks
- KAFKA_CLUSTERS_0_ZOOKEEPER_SSL_KEYSTORE_PASSWORD= xxx
- KAFKA_CLUSTERS_0_ZOOKEEPER_SSL_TRUSTSTORE_LOCATION= /kafka.truststore.jks
- KAFKA_CLUSTERS_0_ZOOKEEPER_SSL_TRUSTSTORE_PASSWORD= xxxx
- KAFKA_CLUSTERS_0_PROPERTIES_SASL_MECHANISM=SCRAM-SHA-512

.ClientCnxn: Session 0x0 for sever isds-kafkaservice-dev-west2-lzk01. cognizant.com/100.77.82.57:2185, Closing socket connection. Attempting reconnect except it is a SessionExpiredException.
kafka-ui | org.apache.zookeeper.ClientCnxn$EndOfStreamException: Unable to read additional data from server sessionid 0x0, likely server has closed socket
kafka-ui | at org.apache.zookeeper.ClientCnxnSocketNIO.doIO(ClientCnxnSocketNIO.java:77)
kafka-ui | at org.apache.zookeeper.ClientCnxnSocketNIO.doTransport(ClientCnxnSocketNIO.java:350)
kafka-ui | at org.apache.zookeeper.ClientCnxn$SendThread.run(ClientCnxn.java:1280)

germanosin · 2022-02-21T12:53:50Z

germanosin
Feb 21, 2022

Hi, @ramamanoj142000
Thanks for sharing this issue.

Zookeeper connection is not mandatory this product, it will only provide you zookeeper status info.
Could you please try with only cluster configs like

KAFKA_CLUSTERS_0_NAME=kafkaservice-2
KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS=isds-kafkaservice-dev-west2-lkf01.cognizant.com:9094
KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL=SASL_SSL
KAFKA_CLUSTERS_0_PROPERTIES_SSL_TRUSTSTORE_LOCATION=/kafka.truststore.jks
KAFKA_CLUSTERS_0_PROPERTIES_SSL_TRUSTSTORE_PASSWORD=xxxx
KAFKA_CLUSTERS_0_PROPERTIES_SSL_KEYSTORE_LOCATION=/kafka.keystore.jks
KAFKA_CLUSTERS_0_PROPERTIES_SSL_KEYSTORE_PASSWORD=xxxx
KAFKA_CLUSTERS_0_PROPERTIES_SSL_KEY_PASSWORD=xxxx
KAFKA_CLUSTERS_0_PROPERTIES_SASL_MECHANISM=SCRAM-SHA-512
KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG='org.apache.kafka.common.security.scram.ScramLoginModule required username="kafka_admin" password="O9csbZJJtGjURn2Akl";'

If this will not work, please provide us logs again

3 replies

ramamanoj142000 Feb 21, 2022
Author

yes , this is working. but do you know why it is not connecting with the zookeeper? otherwise, i will mark this resolve.

germanosin Feb 21, 2022

Ok, great. I'll check your zookeeper configs, and will return to you.

germanosin Feb 22, 2022

@ramamanoj142000
There is an internal proposal to remove zookeeper configs & status from our product.
Currently, we use this config only for ZK status checking, and frankly, it is super basic.
What is your opinion on it? Is it important for you to see ZK connection status?

germanosin · 2022-02-21T12:58:37Z

germanosin
Feb 21, 2022

Btw I see that you are attaching kafka.keystore.jks, but you configure to use SCRAM auth. Do you have both SSL and SCRAM authentications?

1 reply

ramamanoj142000 Feb 21, 2022
Author

Yes , it is SSL and SCRAM .

Haarolean · 2022-03-24T18:08:19Z

Haarolean
Mar 24, 2022

Zookeeper was never required, moreover we've recently dropped support for zookeeper (#1663).

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

unable to connect to Zookeeper SSL #1643

{{title}}

Replies: 4 comments 5 replies

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

unable to connect to Zookeeper SSL #1643

ramamanoj142000 Feb 21, 2022

Hi I'm getting errors while connecting Kafka-ui on zookeeper-SSL, am i missing something ? . below are detail for docker-compose . Zookeeper host are reachable from this host . Docker-compose file

Replies: 4 comments · 5 replies

Haarolean Feb 21, 2022

ramamanoj142000 Feb 21, 2022 Author

germanosin Feb 21, 2022

ramamanoj142000 Feb 21, 2022 Author

germanosin Feb 21, 2022

germanosin Feb 22, 2022

germanosin Feb 21, 2022

ramamanoj142000 Feb 21, 2022 Author

Haarolean Mar 24, 2022

ramamanoj142000
Feb 21, 2022

Hi
I'm getting errors while connecting Kafka-ui on zookeeper-SSL, am i missing something ? . below are detail for docker-compose . Zookeeper host are reachable from this host .
Docker-compose file

Replies: 4 comments 5 replies

Haarolean
Feb 21, 2022

ramamanoj142000 Feb 21, 2022
Author

germanosin
Feb 21, 2022

ramamanoj142000 Feb 21, 2022
Author

germanosin
Feb 21, 2022

ramamanoj142000 Feb 21, 2022
Author

Haarolean
Mar 24, 2022