How to set securityProtocol: SSL for mirrormaker2?

[iftachbyaf]

Hey,

Trying to mirror 2 MSK clusters. They are configured with just TLS access. From producer / consumer I need to add securityProtocol: SSL to communicate with the clusters, but I don't specify a key/certificate.

Trying to launch MM2 with strimzi I'm getting these messages on the pods

2024-04-08 12:23:02,340 INFO [AdminClient clientId=adminclient-1] Cancelled in-flight API_VERSIONS request with correlation id 919 due to node -3 being disconnected (elapsed time since creation: 59ms, elapsed time since send: 59ms, request timeout: 3600000ms) (org.apache.kafka.clients.NetworkClient) [kafka-admin-client-thread | adminclient-1]
2024-04-08 12:23:02,405 INFO [AdminClient clientId=adminclient-1] Node -2 disconnected. (org.apache.kafka.clients.NetworkClient) [kafka-admin-client-thread | adminclient-1]

I've so far not been able to understand how exactly to setup the securityProtocol: SSL for mm2 using strimzi. I see on pod startup these messages;

security.protocol=PLAINTEXT
producer.security.protocol=PLAINTEXT
consumer.security.protocol=PLAINTEXT
admin.security.protocol=PLAINTEXT

Tried adding authentication on the clusters spec

  clusters:
    - alias: "source"
      authentication:
        type: "tls"

and also in the source connector config

  mirrors:
    - sourceCluster: "source"
      targetCluster: "target"
      sourceConnector:
        tasksMax: 1
        config:
          security.protocol: "SSL"

Can anyone help me understand what I'm doing wrong?
Thanks!

[scholzj]

TLS Encryption is configured through the tls section of the cluster. The authentication section you have configures mTLS authentication, not TLS encryption and the security protocol.

[iftachbyaf]

@scholzj Thanks for the super quick response. :)

I tried what you wrote, but wasn't sure what cert/key to supply. tried setting it like this now and it seems to work;

  clusters:
    - alias: "source"
      tls:
        trustedCertificates: []

Thanks again for the quick help!

[scholzj]

Yeah, this shhould work when the Kafka cluster is using a certificates signed by a public CA which MSK normally does.