Problem with mTls configuration

[houas6]

strimzi.zip
Hello everyone,
I'm a student trying to implement mTLS for the Strimzi operator on AKS, but I’m facing several issues. My Kafka producer keeps disconnecting, and I’m unsure what the root cause is. I’ve attached my configuration files for reference. It would be great if someone could take a look and help me troubleshoot. I'm also encountering difficulties with certificate and secret management, and would appreciate any guidance on resolving these.
Thank you in advance for your time and support.

[scholzj]

Maybe a good start would be to explain what exactly you are trying to do. The ZIP you shared:

• Has for some reason a Cert Manager issuer without a clear meaning and to make it worse they seem to be trying to rewrite the Strimzi CA secrets which would be a mess
• Your Kafka CR:
  • Tries to use the Strimzi CA as a brokerCertChainAndKey which is completely wrong as that needs to be a server certificate and not a CA
  • You mount bunch of volumes that do not seem to make any sense
  • Your .spec.kafka.config section contains several non-sense options such as generateCertificateAuthority or configMap and options that are not allowed such as log.dirs

So you should probably:

• First start with the most simple configuration and make sure you can get that working before trying something more complicated
• Properly expúlain wat exactly are you trying to do
• End eventually also properly explain what exactly does not work -> although right now it is pretty obvious that the configuration is wrong

[houas6]

Thank you @scholzj for your reply and your time. for the cert manager i want to generate a certificate with letsencrypt for the client side and for the server side i want the default of strimzi ( as i saw in ones of your explanations its not correct to override certificate with a letsencrypt for the server it makes anyone with letencrypt cert accedes) for the configmap i want to override the server.properties. For generateCertificateAuthority i want to disable the operator default generated certs.

[scholzj]

• You cannot override the server.properties file. Operators like Strimzi do not allow that s they need to understand the Kafka configuration.
• If you want to use Let's Encrypt, you can try to follow this blog post: https://strimzi.io/blog/2021/05/07/deploying-kafka-with-lets-encrypt-certificates/ which is old but should be still mostly up to date and if nothing else it should give you at least the direction
• If you want to disable Stirmzi default CAs (with generateCertificateAuthority), you:
  • Need to use the correct API for that and have it placed in the correct place
  • Need to provide your own custom CA (it needs to be a CA, not a server certificate from Let's Encrypt)
  • The docs have more details on it. But it sounds like you do not really want to do this.

[houas6]

ok thank you @scholzj