SSL is not configured when Internal and external listener is defined

[David-hod]

looking at the code :
https://github.com/confluentinc/kafka-images/blob/master/kafka/include/etc/confluent/docker/configure

if [[ $KAFKA_ADVERTISED_LISTENERS == *"SSL://"* ]]

will always be false in case you define multiple listeners like this :

docker run --name kafka --rm -it -p 2181:2181 -p 9092:9092 -p 29092:29092 \
    -e KAFKA_LISTENERS=INTERNAL://:29092,EXTERNAL://:9092 \
    -e KAFKA_ADVERTISED_LISTENERS=INTERNAL://kafka:29092,EXTERNAL://localhost:9092 \
    -e KAFKA_LISTENER_SECURITY_PROTOCOL_MAP=INTERNAL:PLAINTEXT,EXTERNAL:PLAINTEXT \
    -e KAFKA_INTER_BROKER_LISTENER_NAME=INTERNAL \
    confluentinc/cp-kafka:latest

like the documentation specify to do :
https://www.confluent.io/blog/kafka-listeners-explained/

[rgo]

@David-hod I think, in your example, you'd mean defining EXTERNAL listener as SSL.

Like this:

    -e KAFKA_LISTENER_SECURITY_PROTOCOL_MAP=INTERNAL:PLAINTEXT,EXTERNAL:SSL \

Anyway, the issue is there.

[JKollien]

FYI: in this case SSL environment variables could always be set explicitly, e.g., KAFKA_SSL_KEY_PASSWORD, KAFKA_SSL_KEYSTORE_LOCATION, KAFKA_SSL_KEYSTORE_PASSWORD, KAFKA_SSL_TRUSTSTORE_LOCATION, KAFKA_SSL_TRUSTSTORE_PASSWORD that are exported in the referenced block