Consumer and producer lose connection after upgrading from kafka-0.38-kafka3.6 to kafka-0.41-kafka3.7.

[ledoc]

Hello,

We recently updated kafka via Helm and the strimzi operator.
All went well on the kafka / zookeeper side, but a problem I don't understand occurred on the client, consumer and producer side, which lost the connection to the Kafka cluster.
They had to be restarted to re-establish the connection.
The clients are developed in DotNet with the Confluent.Kafka library.
The developers told me that the connection was initialized when the client was started up, but nothing has changed and soon there will be clients over which we have no control, so we won't be able to restart.

Here's the Kafka resource configuration (it's a template):

apiVersion: kafka.strimzi.io/v1beta2
kind: Kafka
metadata:
  labels:
    app: "$KAFKA_CLUSTER_NAME"
  name: "$KAFKA_CLUSTER_NAME"
  namespace: "$KAFKA_NAMESPACE"
spec:
  kafkaExporter:
    topicRegex: ".*"
    groupRegex: ".*"
  kafka:
    template:
      pod:
        affinity:
          podAntiAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchExpressions:
                - key: strimzi.io/name
                  operator: In
                  values:
                  - "$KAFKA_CLUSTER_NAME-kafka"
              topologyKey: kubernetes.io/hostname  
    image: $HARBOR_URL/$HARBOR_FOLDER/$KAFKA_IMAGE_PREFIX:$KAFKA_CHART_VERSION-kafka-$KAFKA_VERSION
    version: "$KAFKA_VERSION"
    replicas: 3
    resources:
      requests:
        memory: "$KAFKA_MEMORY_REQUEST"
        cpu: "$KAFKA_CPU_REQUEST"
      limits:
        memory: "$KAFKA_MEMORY_LIMIT"         
    listeners:
      - name: plain
        port: 9092
        type: internal
        tls: false
      - name: tls
        port: 9093
        type: internal
        tls: false
        authentication:
          type: scram-sha-512
      - name: external
        port: 9094
        type: ingress
        tls: true
        authentication:
          type: scram-sha-512
        configuration:
          bootstrap:
            host: bootstrap-kafka-$ENVIRONNEMENT.xxx.priv
          brokers:
          - broker: 0
            host: broker-kafka-$ENVIRONNEMENT-0.xxx.priv
            advertisedPort: 31443
          - broker: 1
            host: broker-kafka-$ENVIRONNEMENT-1.xxx.priv
            advertisedPort: 31443
          - broker: 2
            host: broker-kafka-$ENVIRONNEMENT-2.xxx.priv
            advertisedPort: 31443
          brokerCertChainAndKey:
            secretName: xxx-certif
            certificate: xxx.cer
            key: xxx.key
          class: nginx
    authorization:
      type: simple
    config:
      auto.create.topics.enable: false
      offsets.topic.replication.factor: 2
      transaction.state.log.replication.factor: 2  
      transaction.state.log.min.isr: 2 
      default.replication.factor: 2            
      min.insync.replicas: 2         
      inter.broker.protocol.version: "$KAFKA_INTER_BROKER_PROTOCOL"
    storage:
      type: jbod
      volumes:
      - id: 0
        type: persistent-claim
        size: 130Gi
        deleteClaim: false
    metricsConfig:
      type: jmxPrometheusExporter
      valueFrom:
        configMapKeyRef:
          name: kafka-metrics
          key: kafka-metrics-config.yml        
  zookeeper:
    resources:
      requests:
        memory: "$ZOOKEEPER_MEMORY_REQUEST"
        cpu: "$ZOOKEEPER_CPU_REQUEST"
    replicas: 1
    storage:
      type: persistent-claim
      size: 10Gi
      deleteClaim: false
    metricsConfig:
      type: jmxPrometheusExporter
      valueFrom:
        configMapKeyRef:
          name: kafka-metrics
          key: zookeeper-metrics-config.yml      
  entityOperator:
    topicOperator: {}
    userOperator: {}

I don't understand why the clients had to be restarted. The certificates and passwords were not modified during the update, so what was the problem that caused the clients to lose their connection ?

thank you in advance for your help.