Search code examples
sslapache-kafkatls1.2aws-msk

Unable to create kafka topics or connect to TLS enabled AWS MSK kafka broker endpoint: Timed out waiting for a node assignment

I want to have aws msk kafka cluster to be TLS enabled and want to connect to broker from my local windows machine.

I created MSK cluster using following TLS config in cloudformation:

  EncryptionInfo:
    EncryptionInTransit:
      ClientBroker: TLS
      InCluster: True

I followed this aws blog to enable TLS at server and client machine. https://docs.aws.amazon.com/msk/latest/developerguide/msk-working-with-encryption.html

I did copied my local window's java's truststore cacerts to E:\kafka_2.13-3.2.1\tmp\ (executed following command)

copy "C:\Program Files (x86)\Java\jre-1.8\lib\security\cacerts" "E:\kafka_2.13-3.2.1\tmp\kafka.client.truststore.jks"

And created config.properties with content

security.protocol=SSL
ssl.truststore.location=C:\\Program Files (x86)\\Java\\jre-1.8\\lib\\security\\cacerts
ssl.endpoint.identification.algorithm=https
ssl.truststore.password=changeit

I executed following command to create a topic on secured kafka broker

kafka-topics.bat --create --bootstrap-server  b-2.xxx.amazonaws.com:9094,b-1.xxx.amazonaws.com:9094 --command-config client.properties --replication-factor 2 --partitions 1 --topic TLSTestTopic

but getting following error

E:\kafka_2.13-3.2.1\bin\windows>kafka-topics.bat --create --bootstrap-server  b-2.xxx.amazonaws.com:9094,b-1.xxx.amazonaws.com:9094 --command-config client.properties --replication-factor 2 --partitions 1 --topic TLSTestTopic
SLF4J: Class path contains multiple SLF4J bindings.
SLF4J: Found binding in [jar:file:/E:/kafka_2.13-3.2.1/libs/slf4j-reload4j-1.7.36.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: Found binding in [jar:file:/E:/Edifecs/TM/sdk/lib/log4j-slf4j-impl-2.17.2.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation.
SLF4J: Actual binding is of type [org.slf4j.impl.Reload4jLoggerFactory]
[2023-07-18 00:03:52,275] WARN [AdminClient clientId=adminclient-1] Connection to node -1 (b-2.kafkatlsmskcluster.1lyy3o.c14.kafka.us-west-2.amazonaws.com/10.151.46.36:9094) could not be established. Broker may not be available. (org.apache.kafka.clients.NetworkClient)
Error while executing topic command : Timed out waiting for a node assignment. Call: createTopics
[2023-07-18 00:04:14,090] ERROR org.apache.kafka.common.errors.TimeoutException: Timed out waiting for a node assignment. Call: createTopics
 (kafka.admin.TopicCommand$)

I have also allowed TLS port 9094 in relavant security group in inbound rule. What I am missing? It should work with Java's trust store, right?

Solution

  • I was able to resolve it by allowing correct IP with port=9094 in inbound rule of security group associated with AWS MSK Cluster