Versions

Configuration

Really the important part is TLS Enabled, i.e.

config.Net.TLS.Enable = true
config.Net.TLS.Config = tlsConfig

Logs

Again, the relevant part is this log.

[SARAMA] 2020/06/11 10:24:59 Error while closing connection to broker localhost:9092: write tcp [::1]:37390->[::1]:9092: i/o timeout

Problem Description

After enabling TLS, the above error happens on client Close() call. Without TLS, everything works fine.
I went down to it and figured that the culprit is https://github.com/Shopify/sarama/blob/0189d59e5253ee7aa2a9eb50bffd18a69460630d/broker.go#L309
but that's probably because it's the first write executed on the connection?

Going further, I found out that removing deadline from https://github.com/Shopify/sarama/blob/0189d59e5253ee7aa2a9eb50bffd18a69460630d/broker.go#L708
(or setting it to time.Time{}) removes the problem.
Then I found this report golang/go#13828 stating that SetWriteDeadline does not seem to work properly on TLS Clients. Which appears to be (still) true.

Honestly, not sure what can realistically be done about it in sarama, removing deadlines does not sound like viable solution. Still thought I will share my findings.