Trust store password difference between 0.45 and 0.46.1, how do i read values with ${strimzienv:CERTS_STORE_PASSWORD}

[rao2100]

In my source connector I create my own kafka consumer using the config provided to poll a topic. It was working fine in 0.45 and throws error in 0.46.1 with keystore password was incorrect, complete error below. I see that in 0.45 we can see the password compared to 0.46.1 where the password has ${strimzienv:CERTS_STORE_PASSWORD}. I probably have to update my kafka consumer config to read this value, may I know how do i do this? Let me know if more info is required. Thanks.

Basically I need a way to get the password to the truststore in my kafka consumer client.

I noticed the following difference in the properties.

0.45 /tmp/strimzi-connect.properties

#TLS / SSL
ssl.truststore.location=/tmp/kafka/cluster.truststore.p12
ssl.truststore.password=wm5wtenQNIGFQsyL01F6Br9PrCx0cAAT
ssl.truststore.type=PKCS12

producer.ssl.truststore.location=/tmp/kafka/cluster.truststore.p12
producer.ssl.truststore.password=wm5wtenQNIGFQsyL01F6Br9PrCx0cAAT

consumer.ssl.truststore.location=/tmp/kafka/cluster.truststore.p12
consumer.ssl.truststore.password=wm5wtenQNIGFQsyL01F6Br9PrCx0cAAT

admin.ssl.truststore.location=/tmp/kafka/cluster.truststore.p12
admin.ssl.truststore.password=wm5wtenQNIGFQsyL01F6Br9PrCx0cAAT

0.46.1 /tmp/strimzi-connect.properties

##########
# TLS / SSL
##########
ssl.truststore.location=/tmp/kafka/cluster.truststore.p12
ssl.truststore.password=${strimzienv:CERTS_STORE_PASSWORD}
ssl.truststore.type=PKCS12
producer.ssl.truststore.location=/tmp/kafka/cluster.truststore.p12
producer.ssl.truststore.password=${strimzienv:CERTS_STORE_PASSWORD}
consumer.ssl.truststore.location=/tmp/kafka/cluster.truststore.p12
consumer.ssl.truststore.password=${strimzienv:CERTS_STORE_PASSWORD}
admin.ssl.truststore.location=/tmp/kafka/cluster.truststore.p12
admin.ssl.truststore.password=${strimzienv:CERTS_STORE_PASSWORD}

Error

Caused by: org.apache.kafka.common.KafkaException: Failed to load SSL keystore /tmp/kafka/cluster.truststore.p12 of type JKS
        at org.apache.kafka.common.security.ssl.DefaultSslEngineFactory$FileBasedStore.load(DefaultSslEngineFactory.java:380)
        at org.apache.kafka.common.security.ssl.DefaultSslEngineFactory$FileBasedStore.<init>(DefaultSslEngineFactory.java:352)
        at org.apache.kafka.common.security.ssl.DefaultSslEngineFactory.createTruststore(DefaultSslEngineFactory.java:325)
        at org.apache.kafka.common.security.ssl.DefaultSslEngineFactory.configure(DefaultSslEngineFactory.java:169)
        at org.apache.kafka.common.security.ssl.SslFactory.instantiateSslEngineFactory(SslFactory.java:147)
        at org.apache.kafka.common.security.ssl.SslFactory.configure(SslFactory.java:100)
        at org.apache.kafka.common.network.SslChannelBuilder.configure(SslChannelBuilder.java:70)
        at org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilders.java:193)
        at org.apache.kafka.common.network.ChannelBuilders.clientChannelBuilder(ChannelBuilders.java:82)
        at org.apache.kafka.clients.ClientUtils.createChannelBuilder(ClientUtils.java:120)
        at org.apache.kafka.clients.ClientUtils.createNetworkClient(ClientUtils.java:224)
        ... 24 more
Caused by: java.io.IOException: keystore password was incorrect
        at java.base/sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:2159)
        at java.base/sun.security.util.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:242)
        at java.base/java.security.KeyStore.load(KeyStore.java:1473)
        at org.apache.kafka.common.security.ssl.DefaultSslEngineFactory$FileBasedStore.load(DefaultSslEngineFactory.java:377)

[im-konge]

${strimzienv:CERTS_STORE_PASSWORD} should be env variable passed to the container using the config provider.
But I think that there should be secret like CLUSTER_NAME-connect-tls-trusted-certs where the info should be present.

[scholzj]

Why do you need the password? I think you should in the first place expert what are you trying to do. Then you might get some suggestion how to best address it.