Strimzi
[Bug]: #8320
PetruGarstea
started this conversation in
General
[Bug]:
#8320
Replies: 3 comments 16 replies
-
|
Well, the error message is quite clear => it looks like your certificate is expired. But without full logs, configs, etc., it is quite hard to understand the context. |
Beta Was this translation helpful? Give feedback.
9 replies
-
|
@scholzj I will continue the investigation on my own. Cheers |
Beta Was this translation helpful? Give feedback.
-
|
Well, without the logs, it is not even clear if it is some Strimzi component doing this. Is this just an error in logs? Or you see any actual issues? |
Beta Was this translation helpful? Give feedback.
-
|
ATM the telemetry does not report any impact. |
Beta Was this translation helpful? Give feedback.
-
|
@PetruGarstea hi, have you ever fixed the issue? |
Beta Was this translation helpful? Give feedback.
-
|
we have the same problem |
Beta Was this translation helpful? Give feedback.
-
|
i have the same problem ,here is the full log i kubectl exec -it in zk pod and openssl x509 -noout -dates -in kafka-bio-zookeeper-0.crt,kafka-bio-zookeeper-1.crt,kafka-bio-zookeeper-2.crt . And the date is right . |
Beta Was this translation helpful? Give feedback.
7 replies
-
|
I use strimzi CA and follow the https://strimzi.io/docs/operators/in-development/full/deploying.html#proc-recovering-expired-ca-certs-str step. It is the same problem. zk secret seems right ,but it also the same log as before @scholzj do you have any idea |
Beta Was this translation helpful? Give feedback.
-
|
I guess you will have to find out who is connecting there with expired certificate. |
Beta Was this translation helpful? Give feedback.
-
|
thanks very mush !!! its zoo-entrance , i restart zoo-entrance ,it fixed. |
Beta Was this translation helpful? Give feedback.
-
|
Yeah, zoo-entrance has no logic to reload the certificate. You need to manually roll it anytime renewal happens. Sorry, maybe I mislead you and the CA was not expired at all - normally we do not expect any other connections to ZooKeeper then from the Strimzi components. |
Beta Was this translation helpful? Give feedback.
-
|
first my CA has expired, i try as https://strimzi.io/docs/operators/in-development/full/deploying.html#proc-recovering-expired-ca-certs-str . But zk still log certificate_expired. Then you tell me 'who is connecting there with expired certificate'. Then i guess maybe zoo-entrance.that is right. i know you do not expert zk to be connected, but i use kafka ui (know streaming) , this kafka ui need connect zk. |
Beta Was this translation helpful? Give feedback.
-
|
Somewhat related to this but for other reasons I have SSL problems talking to the k8s API and I have to specify the TLS version for the operator to use TLSv1.3 |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Bug Description
Greetings,
In one of the DC we start noticing the following zookeeper exceptions in the log
2023-03-29 19:59:10,906 ERROR Unsuccessful handshake with session 0x0 (org.apache.zookeeper.server.NettyServerCnxnFactory) [nioEventLoopGroup-7-4]I need your help to identify the root cause of this behaviour and fix it.
The snippet of the log is attached.
Please advise.
Regards.
Steps to reproduce
N/A
Expected behavior
All other DC dont have the above mentioned exceptions.
Strimzi version
0.28.0
Kubernetes version
Server Version: v1.23.7
Installation method
Helm chart
Infrastructure
Bare metal/Rancher
Configuration files and logs
Additional context
No response
Beta Was this translation helpful? Give feedback.
All reactions