InitContainer, run custom command ?

[Ycallaer]

Hi all,
I am currently running Strimzi Connect with a custom image to run our different connectors.
However, I would like to add an InitContainer that accepts a custom command, and from the documentation this does not seem possible ?
So the use case: The init container should poll a custom endpoint (Confluent Schema Registry) and wait until the command returns a 200 return code. (so simple curl command).

I can see in https://github.com/strimzi/strimzi-kafka-operator/blob/main/install/cluster-operator/041-Crd-kafkaconnect.yaml that there is an "initContainer" option but it only accepts environment variables. But from the java code (https://github.com/strimzi/strimzi-kafka-operator/blob/9850f22e169fd19572ecefe7d5bde393e452fefd/cluster-operator/src/main/java/io/strimzi/operator/cluster/model/KafkaConnectCluster.java) I can't see how to pass a command ?

Anybody that can give me some pointers ? Many thanks

[scholzj]

Strimzi currently doesn't support custom init containers. The option in the CRD is to pass the environment variable to Strimzi's own init container used for rack awareness. TBH, I'm not sure I understand why do you need an init container to check if Schema Registry is running.

[rafis]

Many Helm Charts has extraManifests and extraInitContainers, it gives product extensibility and thus more appealing to use.

[dvaldivia]

@scholzj I think the use case for init containers is to do things like crafting a custom truststore, we have a use case where we need the KafkaConnect cluster to trust another service that is using kubernetes signed certificates thus we need the kafka connect cluster to trust anything signed by the kubernetes root CA which every pod has available at /var/run/secrets/kubernetes.io/serviceaccount/ca.crt, an easy solution is would be to include an init container to do this:

      initContainers:
        - name: init-truststore
          image: private.registry.com/openjdk:11-jre-slim
          command:
            - /bin/sh
            - -c
          args:
            - |
              mkdir -p /truststore/certs && \
              cp $JAVA_HOME/lib/security/cacerts /truststore/certs/truststore.jks && \
              keytool -importcert -noprompt -trustcacerts -file /var/run/secrets/kubernetes.io/serviceaccount/ca.crt -alias "kubernetes.ca" -keystore /truststore/certs/truststore.jks -storepass ${TRUSTSTORE_PASSWORD} && \
              echo "Truststore created successfully"
          env:
            - name: TRUSTSTORE_PASSWORD
              value: "YourTruststorePassword"
          volumeMounts:
            - name: truststore-volume
              mountPath: /truststore

[scholzj]

Strimzi uses PEM files. Kafka can use PEM files directly as well. So this would not help you with anything as you do not need the conversion and would not have a way to specify the path anyway.

[codrutpanea]

@scholzj when using the elasticsearch sink connector: https://docs.confluent.io/kafka-connectors/elasticsearch/15.0/security.html
it only accepts JKS truststore format. An initContainer is needed to convert the PEM format that elasticsearch is generating into a JKS format to run this connector

[scholzj]

I think you have options available today. For example preparing the JKS store on your own and mounting it as a volume.

You can also add support for PEM certificates to the ElasticSearch connector (this is pretty much the standard in the Kubernetes world, and more and more even in the Java world, so I think sooner or later they should add it).

While there might be one day support for custom init containers, it is a non-trivial improvement and as far as I know, nobody is working on any proposal to add such a feature. So you should probably not wait for it. It is obviously also a bit more complicated because to do what you want to do, you have to also have some shared volumes between the containers etc.