NatsToKafka bridge cannot connect to Nats with tls

[rpuppo]

Hi, I am trying to configure natstokafka bridge following the documentation in Setting up tls for nats connectivity, however I am not having much success on it. I tried with following values.yaml:

natskafka:
    monitoring:
      httpPort: 8222
      tls:  
        secret: "nats-server-tls-cert"
     nats:
      servers:
        - "nats://server-nats:4222"
      tls:
        root: "/etc/nats-kafka/tls/ca.crt"
        cert: "/etc/nats-kafka/tls/tls.crt"
        key: "/etc/nats-kafka/tls/tls.key"

If I enable the monitoring tls I can see the tls volume mounted with specified tls secret, but cannot connect to nats with tls, which is required.
I'm getting this logs:

2023/09/01 16:47:43.195487 [INF] loading configuration from "/etc/nats-kafka/nats-kafka.conf"                                                                                                                                                                                   
2023/09/01 16:47:43.195727 [INF] starting NATS-Kafka Bridge, version                                                                                                                                                                                                         
2023/09/01 16:47:43.195737 [INF] server time is Fri Sep  1 16:47:43 UTC 2023                                                                                                                                                                                                 
2023/09/01 16:47:43.195740 [INF] connecting to NATS core                                                                                                                                                                                                                    
2023/09/01 16:47:43.212594 [ERR] error starting bridge, x509: certificate is valid for server-nats.nats.svc,server-nats.nats.svc.cluster.local, *.server-nats.nats.svc.cluster.local, not server-nats                             │
2023/09/01 16:47:43.212616 [INF] stopping bridge                                                                                                                                                                                                                            
2023/09/01 16:47:43.212619 [INF] http monitoring stopped 

Could you please help me understanding what I'm missing? Is it possible to activate tls in bridge when connecting to nats? Is it possible via helm values.yaml(it seems to me there is only tls for monitoring configurable)?

BR,
Riccardo

[caleblloyd]

Try connecting to one of the domain names that those certificates are valid for in the natskafka.nats.servers section

[rpuppo]

Thanks for quick answer.
In case I try to connect to one of the domain names for which the cert is valid is replying me:

2023/09/04 07:15:11.018287 [INF] loading configuration from "/etc/nats-kafka/nats-kafka.conf"
2023/09/04 07:15:11.018400 [INF] starting NATS-Kafka Bridge, version
2023/09/04 07:15:11.018405 [INF] server time is Mon Sep 4 07:15:11 UTC 2023
2023/09/04 07:15:11.018407 [INF] connecting to NATS core
2023/09/04 07:15:11.032735 [ERR] error starting bridge, x509: certificate signed by unknown authority
2023/09/04 07:15:11.032747 [INF] stopping bridge
2023/09/04 07:15:11.032749 [INF] http monitoring stopped

I'm not sure tls is well configured for nats while it is for monitoring.
If I print out the config map gathering the config file for the natsKafka bridge I have this:
│ nats-kafka.conf:
│ ----
│ reconnectinterval: 5000
│ connecttimeout: 5000
│ logging: {
│ time: true,
│ debug: false,
│ trace: false,
│ colors: true,
│ pid: true,
│ } │
│ nats: {
│ Servers: [
│ "nats://server-nats.nats.svc.cluster.local:4222",
│ ], │
│ ConnectTimeout: 5000,
│ MaxReconnects: 120,
│ ReconnectWait: 5000,
│ }
│ monitoring: {
│ httpPort: 8222
| tls: { │ root: /etc/nats-kafka/tls//etc/nats-kafka/tls/ca.crt │ cert: /etc/nats-kafka/tls//etc/nats-kafka/tls/tls.crt │ key: /etc/nats-kafka/tls//etc/nats-kafka/tls/tls.key │ }
│ } │
│ connect: []

I mnaged to make it works by adding manually tls config on nats section of the bridge, but no way to configure it via helm values.yaml.
If you confirm I'm gonna propose the PR to let tls be configurable at bridge level for nats connection, via helm values .