KafkaConnect TLS property, error while connect to Bitnami Kafka cluster

[alekseytivonchik]

Hello

Environment

Kubernetes: v1.30.4
Strimzi Cluster Operator (Helm chart): 0.46.0
KafkaConnect: 4.0.0
Bitnami Kafka Cluster: 4.0.0

I need to connect KafkaConnect to the Bitnami Kafka cluster with one-way TLS.

KafkaConnect Manifest:

apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaConnect
metadata:
  name: debezium-connect
  namespace: kafka
  annotations:
    strimzi.io/use-connector-resources: "true"
spec:
  replicas: 1
  image: quay.io/strimzi/kafka:latest-kafka-4.0.0
  bootstrapServers: kafka.kafka.svc.cluster.local:9092
  version: 4.0.0
  tls:
    trustedCertificates:
      - secretName: kafka-pem-crt
        pattern: "*.crt"
  authentication:
    type: scram-sha-512
    username: user1
    passwordSecret:
      secretName: kafka-user-passwords
      password: client-passwords
  config:
    group.id: connect-cluster
    offset.storage.topic: connect-offsets
    config.storage.topic: connect-configs
    status.storage.topic: connect-status
    key.converter: org.apache.kafka.connect.json.JsonConverter
    value.converter: org.apache.kafka.connect.json.JsonConverter

Bitnami Kafka Cluster Parameters:

listeners:
  client:
    containerPort: 9092
    protocol: SASL_SSL
    name: CLIENT
    sslClientAuth: ""
  controller:
    name: CONTROLLER
    containerPort: 9093
    protocol: SASL_SSL
    sslClientAuth: ""
  interbroker:
    containerPort: 9094
    protocol: SASL_SSL
    name: INTERNAL
    sslClientAuth: ""

Kubernetes Secret:

$ k get secret -n kafka kafka-pem-crt -o jsonpath="{.data.ca\.crt}" | base64 -d
-----BEGIN CERTIFICATE-----
MIIGCDCCBPCgAwIBAgIUQ5Ee6u2CBFfs7avG/lp/L35rA2owDQYJKoZIhvcNAQEL
BQAwgZAxCzAJBgNVBAYTAlVTMRIwEAYDVQQIDAlZb3VyU3RhdGUxETAPBgNVBAcM
CFlvdXJDaXR5MRkwFwYDVQQKDBBZb3VyT3JnYW5pemF0aW9uMRcwFQYDVQQLDA5Z
b3VyRGVwYXJ0bWVudDEmMCQGA1UEAwwda2Fma2Eua2Fma2Euc3ZjLmNsdXN0ZXIu
bG9jYWwwHhcNMjUwNjEyMTE0MDIxWhcNMzUwNjEwMTE0MDIxWjCBkDELMAkGA1UE
BhMCVVMxEjAQBgNVBAgMCVlvdXJTdGF0ZTERMA8GA1UEBwwIWW91ckNpdHkxGTAX
BgNVBAoMEFlvdXJPcmdhbml6YXRpb24xFzAVBgNVBAsMDllvdXJEZXBhcnRtZW50
MSYwJAYDVQQDDB1rYWZrYS5rYWZrYS5zdmMuY2x1c3Rlci5sb2NhbDCCASIwDQYJ
KoZIhvcNAQEBBQADggEPADCCAQoCggEBAKxmxiNZQvPMQaUIau+Tn9BksLEah+Y0
lGlsqhB3apZGJ1cZ1K6+U8OiK8MnihSvRb5sdDFxRczkuKIl9G/QIUdyGA4sJIMi
71T2KZ43yjndKWojH1UoEVH56dNmljK0lIerQFKKcCmOKBvv/2heFHXekbiJg4tt
g3+x8EGHh3yVZXPZNodr89HIAngm42tcwpseWp9EEF8nEELBt7ZN/YDlPt7BUXqu
hK52sOet8jApm6xqfQecciCtpYA2yATqc3hsRAItmGQl8d6yIUpbTWYiGjxcc1M9
f3pdbEdKYZbrsAOBDJEnzIlQ91Q6QWQE6OV6DKqUIG/+FgETUCR0OTMCAwEAAaOC
AlYwggJSMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUH
AwIwggIiBgNVHREEggIZMIICFYIda2Fma2Eua2Fma2Euc3ZjLmNsdXN0ZXIubG9j
YWyCC2thZmthLmthZmthggVrYWZrYYJEa2Fma2EtY29udHJvbGxlci0wLmthZmth
LWNvbnRyb2xsZXItaGVhZGxlc3Mua2Fma2Euc3ZjLmNsdXN0ZXIubG9jYWyCMmth
ZmthLWNvbnRyb2xsZXItMC5rYWZrYS1jb250cm9sbGVyLWhlYWRsZXNzLmthZmth
gixrYWZrYS1jb250cm9sbGVyLTAua2Fma2EtY29udHJvbGxlci1oZWFkbGVzc4JE
a2Fma2EtY29udHJvbGxlci0xLmthZmthLWNvbnRyb2xsZXItaGVhZGxlc3Mua2Fm
a2Euc3ZjLmNsdXN0ZXIubG9jYWyCMmthZmthLWNvbnRyb2xsZXItMS5rYWZrYS1j
b250cm9sbGVyLWhlYWRsZXNzLmthZmthgixrYWZrYS1jb250cm9sbGVyLTEua2Fm
a2EtY29udHJvbGxlci1oZWFkbGVzc4JEa2Fma2EtY29udHJvbGxlci0yLmthZmth
LWNvbnRyb2xsZXItaGVhZGxlc3Mua2Fma2Euc3ZjLmNsdXN0ZXIubG9jYWyCMmth
ZmthLWNvbnRyb2xsZXItMi5rYWZrYS1jb250cm9sbGVyLWhlYWRsZXNzLmthZmth
hwR/AAABhwQKIBwohwQKIBwphwQKIBwqMA0GCSqGSIb3DQEBCwUAA4IBAQBalLd/
yFNhYXRa+IH6wtWFxD1ioYe6AWOwz4/kt5VRf/FFSA7VmvFeILEXdiJFeUO5LjFw
wuDi3nM5bIXXpN2iB74cZMzbPMbmMAQBExMQRu9/HbWuYtBMBr25qkb/UU8G3YYH
+4Jk7GNYbx4Qs8a50yy/Jzi/jUvsGN90QdSymFZfvwnEEgLABqKlWrv8TnUUXnLe
/g6g0KQVeFtY+Ae3gsNaU7dSEWM1YLFFMPRuin+QX23CS3L5h52sOY4ADNqiWyxK
ekdD+jtmYVNzQ6rBQxRVFZyA8hBwiW+EQLTG6gIUvPw85N1UiHtaaYJPFuKb95Rb
XeTUoJaejaWyYVMQ
-----END CERTIFICATE-----

The certificate for the Bitnami Kafka cluster is correctly configured, as I can successfully connect to it using other Java clients.

However, when starting Kafka Connect, I encounter the following error:

Caused by: java.nio.file.NoSuchFileException: /tmp/kafka/cluster.truststore.p12

Full log:
https://gist.github.com/alekseytivonchik/31040ec9d442bf18c2a9addbf11b7bbb

Could there be an error in the Kafka Connect configuration? Any ideas on how to resolve this issue?

[scholzj]

You are using the wrong container image - quay.io/strimzi/kafka:latest-kafka-4.0.0. If you use Strimzi 0.46.0 as you suggest, the image you should use should be quay.io/strimzi/kafka:0.46.0-kafka-4.0.0 (or you can actually not set the .spec.image at all and Strimzi will use this image automatically). This should also be the base image once you need to build a custom image with some connector plugins.

When using the quay.io/strimzi/kafka:latest-kafka-4.0.0 image, you use the current in-development features from the main branch, which might not be compatible with Strimzi 0.46.0 (in this case, the incompatibility is likely the cause of your error).

[alekseytivonchik]

@scholzj thanks, worked for me