SSL issues when moving from 0.5.0 to 0.6.1

[vascoferraz]

Hi everyone,

When using the helm chart version 0.5.4 to deploy the Kafka-UI version 0.5.0 with the following template everything works fine.

When using the helm chart version 0.6.1 to deploy the Kafka-UI version 0.6.1 with the same exact template I get this SSL error message when trying to enter Kafka Connect, Schema Registry, or kSQL.

PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

yamlApplicationConfig:
  kafka:
    clusters:
      - name: my-kafka-cluster
        bootstrapServers: "kafka.confluent.svc.cluster.local:9092"
        properties:
          sasl.mechanism: PLAIN
          security.protocol: SASL_SSL
          sasl.jaas.config: org.apache.kafka.common.security.plain.PlainLoginModule required username="kafka" password="kafka-secret";
          ssl.keystore.location: /mnt/sslcerts/keystore.p12
          ssl.keystore.password: mystorepassword
          ssl.truststore.location: /mnt/sslcerts/truststore.p12
          ssl.truststore.password: mystorepassword
        kafkaConnect:
          - name: connect-cluster
            address: https://connect.confluent.svc.cluster.local:8083
            username: connect
            password: connect-secret
            keystorelocation: /mnt/sslcerts/keystore.p12
            keystorepassword: mystorepassword
            truststorelocation: /mnt/sslcerts/truststore.p12
            truststorepassword: mystorepassword
        schemaRegistry: https://schemaregistry.confluent.svc.cluster.local:8081
        schemaRegistryAuth:
            username: sr
            password: sr-secret
        schemaRegistrySSL:
            keystorelocation: /mnt/sslcerts/keystore.p12
            keystorepassword: mystorepassword
            truststorelocation: /mnt/sslcerts/truststore.p12
            truststorepassword: mystorepassword
        ksqlDBServer: https://ksqldb.confluent.svc.cluster.local:8088
        ksqlDBServerAuth:
            username: ksql
            password: ksql-secret
        ksqlDBServerSSL:
            keystorelocation: /mnt/sslcerts/keystore.p12
            keystorepassword: mystorepassword
            truststorelocation: /mnt/sslcerts/truststore.p12
            truststorepassword: mystorepassword
  auth:
    type: LOGIN_FORM
  spring:
    security:
      user:
        name: admin
        password: admin

env:
  - name: "SERVER_SSL_ENABLED"
    value: "true"
  - name: "SERVER_SSL_KEY_STORE"
    value: "/mnt/sslcerts/keystore.p12"
  - name: "SERVER_SSL_KEY_STORE_PASSWORD"
    value: "mystorepassword"

probes:
  useHttpsScheme: true

service:
  type: NodePort
  nodePort: 30901

volumeMounts:
  - mountPath: /mnt/sslcerts
    name: kafka-ui

volumes:
  - name: kafka-ui
    secret:
      secretName: kafkaui-pkcs12

[vascoferraz]

Got the explanation in the 0.6.0 release notes :)

BREAKING CHANGES

If you've been using SSL for any component (Clusters, SR, KSQL, KC, etc.), you have to migrate your properties a bit;
Now we supply just one truststore per cluster, keystore stays the same way, one per component:

      KAFKA_CLUSTERS_0_SSL_TRUSTSTORELOCATION: /kafka.truststore.jks
      KAFKA_CLUSTERS_0_SSL_TRUSTSTOREPASSWORD: "secret"

All other truststore-related properties have been deprecated.