{"action":"created","issue":{"url":"https://api.github.com/repos/istio/istio/issues/4524","repository_url":"https://api.github.com/repos/istio/istio","labels_url":"https://api.github.com/repos/istio/istio/issues/4524/labels{/name}","comments_url":"https://api.github.com/repos/istio/istio/issues/4524/comments","events_url":"https://api.github.com/repos/istio/istio/issues/4524/events","html_url":"https://github.com/istio/istio/issues/4524","id":308570505,"number":4524,"title":"SSL Error Between Sidecar Service and Kafka","user":{"login":"tommyJimmy87","id":21197220,"avatar_url":"https://avatars1.githubusercontent.com/u/21197220?v=4","gravatar_id":"","url":"https://api.github.com/users/tommyJimmy87","html_url":"https://github.com/tommyJimmy87","followers_url":"https://api.github.com/users/tommyJimmy87/followers","following_url":"https://api.github.com/users/tommyJimmy87/following{/other_user}","gists_url":"https://api.github.com/users/tommyJimmy87/gists{/gist_id}","starred_url":"https://api.github.com/users/tommyJimmy87/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tommyJimmy87/subscriptions","organizations_url":"https://api.github.com/users/tommyJimmy87/orgs","repos_url":"https://api.github.com/users/tommyJimmy87/repos","events_url":"https://api.github.com/users/tommyJimmy87/events{/privacy}","received_events_url":"https://api.github.com/users/tommyJimmy87/received_events","type":"User","site_admin":false},"labels":[{"id":744786716,"url":"https://api.github.com/repos/istio/istio/labels/area/security","name":"area/security","color":"0e8a16","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-03-26T13:24:09Z","updated_at":"2018-04-13T09:16:32Z","closed_at":null,"author_association":"NONE","body":"This is my scenario : \r\n\r\nAws\r\nKubernetes 1.7.2\r\nIstio 0.6\r\nKafka Stream Application\r\nKafka Cluster (with SSL and SASL Enabled)\r\n\r\nI installed Istio Auth in istio-system namespace and so far is ok.\r\nI Deployed a Kafka Cluster (3 brokers) in another namespace (test) with the configuration for SSL and SASL without a sidecar.\r\nI Deployed a Kafka Stream Application with a Sidecar in the same kafka's namespace (test) with istio kube-inject, the installation is ok, the sidecar is attached correctly but when the kafka producer trying to connect with Kafka Cluster got this error : \r\n\r\n> [kafka-admin-client-thread | adminclient-1] WARN org.apache.kafka.clients.NetworkClient - [AdminClient clientId=adminclient-1] Connection to node 0 terminated during authentication. This may indicate that authentication failed due to invalid credentials.\r\n[kafka-admin-client-thread | adminclient-1] WARN org.apache.kafka.common.network.SslTransportLayer - Failed to send SSL Close message \r\njava.io.IOException: Broken pipe\r\n\tat sun.nio.ch.FileDispatcherImpl.write0(Native Method)\r\n\tat sun.nio.ch.SocketDispatcher.write(SocketDispatcher.java:47)\r\n\tat sun.nio.ch.IOUtil.writeFromNativeBuffer(IOUtil.java:93)\r\n\tat sun.nio.ch.IOUtil.write(IOUtil.java:65)\r\n\tat sun.nio.ch.SocketChannelImpl.write(SocketChannelImpl.java:471)\r\n\tat org.apache.kafka.common.network.SslTransportLayer.flush(SslTransportLayer.java:212)\r\n\tat org.apache.kafka.common.network.SslTransportLayer.close(SslTransportLayer.java:170)\r\n\tat org.apache.kafka.common.utils.Utils.closeAll(Utils.java:703)\r\n\tat org.apache.kafka.common.network.KafkaChannel.close(KafkaChannel.java:61)\r\n\tat org.apache.kafka.common.network.Selector.doClose(Selector.java:717)\r\n\tat org.apache.kafka.common.network.Selector.close(Selector.java:708)\r\n\tat org.apache.kafka.common.network.Selector.pollSelectionKeys(Selector.java:500)\r\n\tat org.apache.kafka.common.network.Selector.poll(Selector.java:398)\r\n\tat org.apache.kafka.clients.NetworkClient.poll(NetworkClient.java:460)\r\n\tat org.apache.kafka.clients.admin.KafkaAdminClient$AdminClientRunnable.run(KafkaAdminClient.java:1006)\r\n\r\n\r\nI tryed to exclude kafka service in the istio config-map : \r\n\r\n`# Edit this list to avoid using mTLS to connect to these services.\r\n    # Typically, these are control services (e.g kubernetes API server) that don't have Istio sidecar\r\n    # to transparently terminate mTLS authentication.\r\n    mtlsExcludedServices: [\"kubernetes.default.svc.cluster.local\",\"kafka-csvc.dev.svc.cluster.local\"]`\r\n\r\nWithout Sidecar it work well.\r\nI would like to exclude kafka cluster from the envoy proxy or something like that. \r\nAny help is appreciated.\r\nThanks\r\n"},"comment":{"url":"https://api.github.com/repos/istio/istio/issues/comments/381076450","html_url":"https://github.com/istio/istio/issues/4524#issuecomment-381076450","issue_url":"https://api.github.com/repos/istio/istio/issues/4524","id":381076450,"user":{"login":"tommyJimmy87","id":21197220,"avatar_url":"https://avatars1.githubusercontent.com/u/21197220?v=4","gravatar_id":"","url":"https://api.github.com/users/tommyJimmy87","html_url":"https://github.com/tommyJimmy87","followers_url":"https://api.github.com/users/tommyJimmy87/followers","following_url":"https://api.github.com/users/tommyJimmy87/following{/other_user}","gists_url":"https://api.github.com/users/tommyJimmy87/gists{/gist_id}","starred_url":"https://api.github.com/users/tommyJimmy87/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tommyJimmy87/subscriptions","organizations_url":"https://api.github.com/users/tommyJimmy87/orgs","repos_url":"https://api.github.com/users/tommyJimmy87/repos","events_url":"https://api.github.com/users/tommyJimmy87/events{/privacy}","received_events_url":"https://api.github.com/users/tommyJimmy87/received_events","type":"User","site_admin":false},"created_at":"2018-04-13T09:16:32Z","updated_at":"2018-04-13T09:16:32Z","author_association":"NONE","body":"UPDATE : I tried to annotate with \"auth.istio.io/9094: NONE\" my kafka borkers as well. But I still got the same problem. \r\nAny Idea ?\r\n"}}
{"actor":{"display_login":"tommyJimmy87"}}