title: SSL handshake failed in Kafka broker
body: <p>I have a Kafka cluster in Kubernetes created using Strimzi.</p>
  <pre><code>apiVersion: kafka.strimzi.io/v1beta1
  kind: Kafka
  metadata:
    name: {{ .Values.cluster.kafka.name }}
  spec:
    kafka:
      version: 2.7.0
      replicas: 3
      storage:
        deleteClaim: true
        size: {{ .Values.cluster.kafka.storagesize }}
        type: persistent-claim
      rack: 
        topologyKey: failure-domain.beta.kubernetes.io/zone
      template:
        pod:
          metadata:
            annotations:
              prometheus.io/scrape: 'true'
              prometheus.io/port: '9404'                                           
      listeners:
        - name: plain
          port: 9092
          type: internal
          tls: false
        - name: tls
          port: 9093
          type: internal
          tls: true
          authentication:
            type: tls
        - name: external
          port: 9094
          type: loadbalancer
          tls: true
          authentication:
            type: tls
          configuration:  
            bootstrap:
              loadBalancerIP: {{ .Values.cluster.kafka.bootstrapipaddress }}
            brokers:  
            {{- range  $key, $value := (split &quot;,&quot; .Values.cluster.kafka.brokersipaddress) }}  
              - broker: {{ (split &quot;=&quot; .)._0 }}
                loadBalancerIP: {{ (split &quot;=&quot; .)._1 | quote }}
            {{- end }}
      authorization:
        type: simple
  </code></pre>
  <p>Cluster is created and up, I am able to create topics and produce/consume to/from topic.
  The issue is that if I exec into one of Kafka brokers pods I see intermittent errors</p>
  <pre><code>INFO [SocketServer brokerId=0] Failed authentication with /10.240.0.35 (SSL handshake failed) (org.apache.kafka.common.network.Selector) [data-plane-kafka-network-thread-0-ListenerName(EXTERNAL-9094)-SSL-9]
  
  INFO [SocketServer brokerId=0] Failed authentication with /10.240.0.159 (SSL handshake failed) (org.apache.kafka.common.network.Selector) [data-plane-kafka-network-thread-0-ListenerName(EXTERNAL-9094)-SSL-11]
  
  INFO [SocketServer brokerId=0] Failed authentication with /10.240.0.4 (SSL handshake failed) (org.apache.kafka.common.network.Selector) [data-plane-kafka-network-thread-0-ListenerName(EXTERNAL-9094)-SSL-10]
  
  INFO [SocketServer brokerId=0] Failed authentication with /10.240.0.128 (SSL handshake failed) (org.apache.kafka.common.network.Selector) [data-plane-kafka-network-thread-0-ListenerName(EXTERNAL-9094)-SSL-1]
  
  </code></pre>
  <p>After inspecting these IPs [10.240.0.35, 10.240.0.159, 10.240.0.4,10.240.0.128] I figured out the all they are related to pods from kube-system namespace which are implicitly created as part of Kafka cluster deployment.</p>
  <p><a href="https://i.stack.imgur.com/8uS30.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/8uS30.png" alt="enter image description here" /></a></p>
  <p>Any idea what can be wrong?</p>