tls: failed to parse password protected private key about terraform-provider-kafka

[azhurbilo]

Today get the same error: Error: tls: failed to parse private key

with latest provider version: "= v0.2.9"

My "client_key" also encrypted with password but "client_key_passphrase" doesn't help

My certificate private key in this format

-----BEGIN ENCRYPTED PRIVATE KEY-----
XXXXXXX==
-----END ENCRYPTED PRIVATE KEY-----

@Mongey may be such format not covered in test? I see https://github.com/Mongey/terraform-provider-kafka/blob/9fc87abc86c42b96041dfb6271808c2d62e637a5/secrets/kafkacat.client.key looks they are in different format

[yohei1126]

sorry I was using encrypted private key.
Then I got different error.

$ openssl rsa -in private_key.txt -out decrypted_key.pem
$ terraform plan
Error: kafka: client has run out of available brokers to talk to (Is your cluster reachable?)

  on kafka.tf line 1, in provider "kafka":
   1: provider "kafka" {

[Mongey]

Can you post with TF_LOG=debug with the decrypted key ? or, can it still not parse ?
I need to invest some time into adding TLS tests 😅

[yohei1126]

Confirmed that this plugin does not support encrypted private key.

[yohei1126]

I am trying to connect from simple program with sarama but it failed to connect to kafka broker.

2019/07/24 13:26:19 unable to create kafka client: "kafka: client has run out of available
brokers to talk to (Is your cluster reachable?)"

package main

import (
	"crypto/tls"
	"crypto/x509"
	"io/ioutil"
	"log"
	"os"
	"os/signal"
	"sync"

	"github.com/Shopify/sarama"
)

func main() {
	tlsConfig, err := NewTLSConfig(
		"./certs/Certificate.txt",
		"./certs/decrypted_key.pem",
		"./certs/CACertificate.pem")
	if err != nil {
		log.Fatal(err)
	}
	// This can be used on test server if domain does not match cert:
	// tlsConfig.InsecureSkipVerify = true

	consumerConfig := sarama.NewConfig()
	consumerConfig.Net.TLS.Enable = true
	consumerConfig.Net.TLS.Config = tlsConfig

	client, err := sarama.NewClient([]string{"my.kafka.io:19092"}, consumerConfig)
	if err != nil {
		log.Fatalf("unable to create kafka client: %q", err)
	}
	log.Println("created kafka client")

	consumer, err := sarama.NewConsumerFromClient(client)
	if err != nil {
		log.Fatal(err)
	}
	log.Println("created consumer")
	defer consumer.Close()

	consumerLoop(consumer, "mytopic")
}

// NewTLSConfig generates a TLS configuration used to authenticate on server with
// certificates.
// Parameters are the three pem files path we need to authenticate: client cert, client key and CA cert.
func NewTLSConfig(clientCertFile, clientKeyFile, caCertFile string) (*tls.Config, error) {
	tlsConfig := tls.Config{}

	// Load client cert
	cert, err := tls.LoadX509KeyPair(clientCertFile, clientKeyFile)
	if err != nil {
		return &tlsConfig, err
	}
	tlsConfig.Certificates = []tls.Certificate{cert}

	// Load CA cert
	caCert, err := ioutil.ReadFile(caCertFile)
	if err != nil {
		return &tlsConfig, err
	}
	caCertPool := x509.NewCertPool()
	caCertPool.AppendCertsFromPEM(caCert)
	tlsConfig.RootCAs = caCertPool

	tlsConfig.BuildNameToCertificate()
	return &tlsConfig, err
}

func consumerLoop(consumer sarama.Consumer, topic string) {
	partitions, err := consumer.Partitions(topic)
	if err != nil {
		log.Println("unable to fetch partition IDs for the topic", topic, err)
		return
	}

	// Trap SIGINT to trigger a shutdown.
	signals := make(chan os.Signal, 1)
	signal.Notify(signals, os.Interrupt)

	var wg sync.WaitGroup
	for partition := range partitions {
		wg.Add(1)
		go func() {
			consumePartition(consumer, int32(partition), signals)
			wg.Done()
		}()
	}
	wg.Wait()
}

func consumePartition(consumer sarama.Consumer, partition int32, signals chan os.Signal) {
	log.Println("Receving on partition", partition)
	partitionConsumer, err := consumer.ConsumePartition("test", partition, sarama.OffsetNewest)
	if err != nil {
		log.Println(err)
		return
	}
	defer func() {
		if err := partitionConsumer.Close(); err != nil {
			log.Println(err)
		}
	}()

	consumed := 0
ConsumerLoop:
	for {
		select {
		case msg := <-partitionConsumer.Messages():
			log.Printf("Consumed message offset %d\nData: %s\n", msg.Offset, msg.Value)
			consumed++
		case <-signals:
			break ConsumerLoop
		}
	}
	log.Printf("Consumed: %d\n", consumed)
}