Trust store password difference between 0.45 and 0.46.1, how do i read values with ${strimzienv:CERTS_STORE_PASSWORD}

[rao2100]

In my source connector I create my own kafka consumer using the config provided to poll a topic. It was working fine in 0.45 and throws error in 0.46.1 with keystore password was incorrect, complete error below. I see that in 0.45 we can see the password compared to 0.46.1 where the password has ${strimzienv:CERTS_STORE_PASSWORD}. I probably have to update my kafka consumer config to read this value, may I know how do i do this? Let me know if more info is required. Thanks.

Basically I need a way to get the password to the truststore in my kafka consumer client.

I noticed the following difference in the properties.

0.45 /tmp/strimzi-connect.properties

#TLS / SSL
ssl.truststore.location=/tmp/kafka/cluster.truststore.p12
ssl.truststore.password=wm5wtenQNIGFQsyL01F6Br9PrCx0cAAT
ssl.truststore.type=PKCS12

producer.ssl.truststore.location=/tmp/kafka/cluster.truststore.p12
producer.ssl.truststore.password=wm5wtenQNIGFQsyL01F6Br9PrCx0cAAT

consumer.ssl.truststore.location=/tmp/kafka/cluster.truststore.p12
consumer.ssl.truststore.password=wm5wtenQNIGFQsyL01F6Br9PrCx0cAAT

admin.ssl.truststore.location=/tmp/kafka/cluster.truststore.p12
admin.ssl.truststore.password=wm5wtenQNIGFQsyL01F6Br9PrCx0cAAT

0.46.1 /tmp/strimzi-connect.properties

##########
# TLS / SSL
##########
ssl.truststore.location=/tmp/kafka/cluster.truststore.p12
ssl.truststore.password=${strimzienv:CERTS_STORE_PASSWORD}
ssl.truststore.type=PKCS12
producer.ssl.truststore.location=/tmp/kafka/cluster.truststore.p12
producer.ssl.truststore.password=${strimzienv:CERTS_STORE_PASSWORD}
consumer.ssl.truststore.location=/tmp/kafka/cluster.truststore.p12
consumer.ssl.truststore.password=${strimzienv:CERTS_STORE_PASSWORD}
admin.ssl.truststore.location=/tmp/kafka/cluster.truststore.p12
admin.ssl.truststore.password=${strimzienv:CERTS_STORE_PASSWORD}

Error

Caused by: org.apache.kafka.common.KafkaException: Failed to load SSL keystore /tmp/kafka/cluster.truststore.p12 of type JKS
        at org.apache.kafka.common.security.ssl.DefaultSslEngineFactory$FileBasedStore.load(DefaultSslEngineFactory.java:380)
        at org.apache.kafka.common.security.ssl.DefaultSslEngineFactory$FileBasedStore.<init>(DefaultSslEngineFactory.java:352)
        at org.apache.kafka.common.security.ssl.DefaultSslEngineFactory.createTruststore(DefaultSslEngineFactory.java:325)
        at org.apache.kafka.common.security.ssl.DefaultSslEngineFactory.configure(DefaultSslEngineFactory.java:169)
        at org.apache.kafka.common.security.ssl.SslFactory.instantiateSslEngineFactory(SslFactory.java:147)
        at org.apache.kafka.common.security.ssl.SslFactory.configure(SslFactory.java:100)
        at org.apache.kafka.common.network.SslChannelBuilder.configure(SslChannelBuilder.java:70)
        at org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilders.java:193)
        at org.apache.kafka.common.network.ChannelBuilders.clientChannelBuilder(ChannelBuilders.java:82)
        at org.apache.kafka.clients.ClientUtils.createChannelBuilder(ClientUtils.java:120)
        at org.apache.kafka.clients.ClientUtils.createNetworkClient(ClientUtils.java:224)
        ... 24 more
Caused by: java.io.IOException: keystore password was incorrect
        at java.base/sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:2159)
        at java.base/sun.security.util.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:242)
        at java.base/java.security.KeyStore.load(KeyStore.java:1473)
        at org.apache.kafka.common.security.ssl.DefaultSslEngineFactory$FileBasedStore.load(DefaultSslEngineFactory.java:377)

[im-konge]

${strimzienv:CERTS_STORE_PASSWORD} should be env variable passed to the container using the config provider.
But I think that there should be secret like CLUSTER_NAME-connect-tls-trusted-certs where the info should be present.

[scholzj]

Why do you need the password? I think you should in the first place expert what are you trying to do. Then you might get some suggestion how to best address it.

[rao2100]

Hi @scholzj @im-konge

In our source connector we also have a consumer that we create to monitor a command topic. And we create the kafka consumer using the properties as below:

Properties props = new Properties();
// load default properties
loadProperties(props, "consumer.", "/tmp/strimzi-connect.properties");
props.putAll(filterByKey(config.originals(), "consumer.override."));

[scholzj]

That is super hacky. You are hooking into Strimzi's internal structures, which might change from release to release. So you will need to adjust this, possibly with every single release, to make it work with the latest Strimzi changes. That is the nature of relying on internal things.

I guess you should consider several things:

• Is your connector really a connector? It seems to be doing something special, which suggests that maybe you are not using the right solution.
• If you wanna stick with your solution, you can probably create your own Kafka user and configure your command consumer to use it in your connector configuration instead of trying to hack the configuration from the Strimzi internals.