Kubernetes setup with SASL or SSL configuration is not allowing container to be in ready state.

[ss85705]

I am trying to connect SASL enabled cluster through KLAW and for that i added the below config in kubernetes deployment file.
.......
app: klaw-cluster-api
spec:
containers:
- name: klaw-cluster-api
image: aivenoy/klaw-cluster-api:latest
env:
- name: KLAW_CLUSTERAPI_ACCESS_BASE64_SECRET
value: "ifwoirfwjnfjwknfjkwnfkwjenkwnflnlnflkenfoiewnfoiwenfoewnf==fcfwcds"
- name: DEVSASL1_KAFKASASL_JAASCONFIG_PLAIN
value: org.apache.kafka.common.security.plain.PlainLoginModule required username='xxxxx' password='xxxxxx'
volumeMounts:
- name: klaw-data
mountPath: /klaw
volumes:
.......

Do you think if this config looks OK.
Can you please help me with kubernetes file reference for the same.

[aindriu-aiven]

Hey @ss85705 I didnt see this last week apologies.

I added some details to your other question #2133

But I am just wondering what events are you actually getting from your k8s cluster?

What do you get when you run kubectl get events ? And if the pod is running what do you get from the logs?
@muralibasani and I are both looking at this issue at the moment so any additional detail would be great!

Thanks,
Aindriú

[muralibasani]

@ss85705 config looks correct. I was able to test it.

Just would like to clarify if DEVSASL1 is the clusteridentification at your side, DEVSASL must be your clustername ?

In my situation below is my cluster config, TSTSASL is the clustername without any spaces or _ or any. Pls make sure, the clustername in UI has no spaces or _

and TSTSASL5_KAFKASASL_JAASCONFIG_PLAIN="org.apache.kafka.common.security.plain.PlainLoginModule required username='xxx' password='xxx';" has been configured. The clusteridentification has been copied from UI.

[aindriu-aiven]

I would also like to add the following deployment.yaml example

This I tested using minikube so I had to create a persistence volume locally and also mount that volume to minikube.

to mount the local volume to minikube use the following command
minikube mount /tmp/data:/tmp/data

Add your klaw-application.properties and cluster-application.properties to /tmp/data as well as any certificates and key & trust stores you have,

Then apply your deployment

 apiVersion: v1

kind: Service
metadata:
  name: klaw-core
spec:
  selector:
    app: klaw-core
  ports:
    - name: http
      port: 9097
      targetPort: 9097
  type: LoadBalancer
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: klaw-core
spec:
  replicas: 1
  selector:
    matchLabels:
      app: klaw-core
  template:
    metadata:
      labels:
        app: klaw-core
    spec:
      containers:
        - name: klaw-core
          image: aivenoy/klaw-core:latest
          env:
            - name: KLAW_CLUSTERAPI_ACCESS_BASE64_SECRET
              value: "dGhpcyBpcyBhIHNlY3JldCB0byBhY2Nlc3MgY2x1c3RlcmFwaQ=="
            - name: SPRING_CONFIG_LOCATION
              value: "/klaw/klaw-application.properties"
          volumeMounts:
            - name: klaw-data-storage
              mountPath: "/klaw"
      volumes:
        - name: klaw-data-storage
          persistentVolumeClaim:
            claimName: klaw-data-claim
---
apiVersion: v1
kind: Service
metadata:
  name: klaw-cluster-api
spec:
  selector:
    app: klaw-cluster-api
  ports:
    - name: http
      port: 9343
      targetPort: 9343
  type: NodePort
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: klaw-cluster-api
spec:
  replicas: 1
  selector:
    matchLabels:
      app: klaw-cluster-api
  template:
    metadata:
      labels:
        app: klaw-cluster-api
    spec:
      containers:
        - name: klaw-cluster-api
          image: aivenoy/klaw-cluster-api:latest
          env:
            - name: KLAW_CLUSTERAPI_ACCESS_BASE64_SECRET
              value: "dGhpcyBpcyBhIHNlY3JldCB0byBhY2Nlc3MgY2x1c3RlcmFwaQ=="
            - name: SPRING_CONFIG_LOCATION
              value: "/klaw/cluster-application.properties"
          volumeMounts:
            - name: klaw-data
              mountPath: "/klaw"
      volumes:
        - name: klaw-data
          persistentVolumeClaim:
            claimName: klaw-data-claim
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: klaw-data-volume
  labels:
    type: local
spec:
  storageClassName: manual
  capacity:
    storage: 1Gi
  accessModes:
    - ReadWriteOnce
  hostPath:
    path: "/tmp/klaw-data"
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: klaw-data-claim
spec:
  storageClassName: manual
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi

with minikube you can find the url to access klaw with one command
minikube service klaw-core --url

And to get your cluster api url so you can update the settings for communication
minikube service klaw-cluster-api --url