KafkaConnector SqlServerConnector - unable to find valid certification path to requested target

[Migueljfs]

Hello, I'm trying to setup a kafka connector to connect to a SQL Server database.
I'm trying to make it as simple as possible, so I'm not using TLS anywhere in Kafka, it's all plaintext, here is my configuration:

cluster.yaml:

apiVersion: kafka.strimzi.io/v1beta2
kind: Kafka
metadata:
  name: cluster
  namespace: kafka
spec:
  kafka:
    version: 3.2.3
    replicas: 6
    listeners:
      - name: inside
        port: 9092
        type: internal
        tls: false
      - name: outside
        port: 9094
        type: nodeport
        tls: false
        configuration:
          bootstrap:
            nodePort: 30002
          brokers:
          - broker: 0
            advertisedHost: ************
            advertisedPort: 31000
            nodePort: 31000
          - broker: 1
            advertisedHost: ************
            advertisedPort: 31001
            nodePort: 31001
          - broker: 2
            advertisedHost: ************
            advertisedPort: 31002
            nodePort: 31002
          - broker: 3
            advertisedHost: ************
            advertisedPort: 31003
            nodePort: 31003
          - broker: 4
            advertisedHost: ************
            advertisedPort: 31004
            nodePort: 31004
          - broker: 5
            advertisedHost: ************
            advertisedPort: 31005
            nodePort: 31005
    config:
      auto.create.topics.enable: true
      default.replication.factor: 3
      log.cleaner.threads: 1
      log.segment.bytes: 104857600
      log.retention.hours: 72
      log.retention.check.interval.ms: 60000
      log.flush.interval.ms: 5000
      socket.request.max.bytes: 1048576000
      min.insync.replicas: 2
      num.io.threads: 12
      num.network.threads: 3
      num.replica.fetchers: 64
      replica.fetch.min.bytes: 1
      replica.fetch.wait.max.ms: 500
      offsets.retention.minutes: 10080
      offsets.topic.replication.factor: 3
      num.recovery.threads.per.data.dir: 8
      socket.receive.buffer.bytes: 16777216
      socket.send.buffer.bytes: 16777216
      replica.socket.receive.buffer.bytes: 16777216
      max.incremental.fetch.session.cache.slots: 5000
      leader.imbalance.check.interval.seconds: 60
      transactional.id.expiration.ms: 2147483647
      transaction.state.log.replication.factor: 3
      log.roll.hours: 24
      transaction.state.log.min.isr: 2
      zookeeper.session.timeout.ms: 18000
      replica.lag.time.max.ms: 30000
      cruise.control.metrics.reporter.kubernetes.mode: true
      inter.broker.protocol.version: "3.2"

    logging:
      type: inline
      loggers:
        kafka.root.logger.level: "DEBUG"
    storage:
      type: jbod
      volumes:
      - id: 0
        type: persistent-claim
        size: 100Gi
        deleteClaim: false
    metricsConfig:
      type: jmxPrometheusExporter
      valueFrom:
        configMapKeyRef:
          name: kafka-metrics
          key: kafka-metrics-config.yml
  zookeeper:
    replicas: 3
    storage:
      type: persistent-claim
      size: 64Gi
      deleteClaim: false
    metricsConfig:
      type: jmxPrometheusExporter
      valueFrom:
        configMapKeyRef:
          name: kafka-metrics
          key: zookeeper-metrics-config.yml
  entityOperator:
    topicOperator: {}
    userOperator: {}
  kafkaExporter:
    topicRegex: ".*"
    groupRegex: ".*"
  cruiseControl:
    metricsConfig:
      type: jmxPrometheusExporter
      valueFrom:
        configMapKeyRef:
          name: cruise-control-metrics
          key: metrics-config.yml

connect.yaml:
apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaConnect
metadata:
  name: kafka
  namespace: kafka
  annotations:
    strimzi.io/use-connector-resources: "true"
spec:
  version: 3.2.3
  replicas: 1
  bootstrapServers: cluster-kafka-bootstrap.kafka:9092
  config:
    group.id: connect-cluster
    offset.storage.topic: connect-cluster-offsets
    config.storage.topic: connect-cluster-configs
    status.storage.topic: connect-cluster-status
    # -1 means it will use the default replication factor configured in the broker
    config.storage.replication.factor: -1
    offset.storage.replication.factor: -1
    status.storage.replication.factor: -1

    config.providers: secrets,configmaps
    config.providers.secrets.class: io.strimzi.kafka.KubernetesSecretConfigProvider
    config.providers.configmaps.class: io.strimzi.kafka.KubernetesConfigMapConfigProvider

    key.converter: io.confluent.connect.avro.AvroConverter
    key.converter.schema.registry.url: http://cluster-schema-registry.kafka:8081

    value.converter: io.confluent.connect.avro.AvroConverter
    value.converter.schema.registry.url: http://cluster-schema-registry.kafka:8081
  build:
    output:
      type: docker
      # This image will last only for 24 hours and might be overwritten by other users
      # Strimzi will use this tag to push the image. But it will use the digest to pull
      # the container image to make sure it pulls exactly the image we just built. So
      # it should not happen that you pull someone else's container image. However, we
      # recommend changing this to your own container registry or using a different
      # image name for any other than demo purposes.
      image: ttl.sh/strimzi-my-my-connect-example-3.2.3:24h
    plugins:
      - name: avro
        artifacts:
          - type: jar
            url: https://packages.confluent.io/maven/io/confluent/kafka-connect-avro-converter/7.2.2/kafka-connect-avro-converter-7.2.2.jar
            sha512sum: bbf2486fe22844e37d6efee0288dc24bd82bbeaa4d5a42e883b74e7d2ff02dcd19d4945c732207e42f4108a4e6bb5d4229c1966568cdc4fa983055d03ff44413
          - type: jar
            url: https://packages.confluent.io/maven/io/confluent/kafka-connect-avro-data/7.2.2/kafka-connect-avro-data-7.2.2.jar
            sha512sum: 5d304ff1c16f4969c804f8ed27834241490f854673c8738a0b2f3bee6499d8159d236deb8bc8eb58b2e84cc6b76270ab30b0f13f04fa71e9f51dd36bc498f9c4
          - type: jar
            url: https://packages.confluent.io/maven/io/confluent/kafka-avro-serializer/7.2.2/kafka-avro-serializer-7.2.2.jar
            sha512sum: f8f2066381573a54932bdcb9872669fcbde912e0b41e3f40b0a778a3d32058552d1c34e5887cce1b2a4175376114c57d7caeab52597488ca2298a0b583ae9fc0
          - type: jar
            url: https://packages.confluent.io/maven/io/confluent/kafka-schema-registry-client/7.2.2/kafka-schema-registry-client-7.2.2.jar
            sha512sum: e034df9dc16d1eb917085a4aa4bbb78cf1340cb88322c2d7eebf6acad9bb8964fcdc941dfa641829e6cec3a52c14f819c9ccf64f46b3e2ed3dc587805b4d6d30
          - type: jar
            url: https://packages.confluent.io/maven/io/confluent/kafka-schema-serializer/7.2.2/kafka-schema-serializer-7.2.2.jar
            sha512sum: 976e89acb2d7a30ee090245bce7474ec85995818fad35a8208220007dfc17db6674905c101d563f851656f214c73bf9e49ef0d8276b2846cf630fd311cf03bab
      - name: debezium
        artifacts:
          - type: tgz
            url: https://repo1.maven.org/maven2/io/debezium/debezium-connector-postgres/1.3.1.Final/debezium-connector-postgres-1.3.1.Final-plugin.tar.gz
            sha512sum: 962a12151bdf9a5a30627eebac739955a4fd95a08d373b86bdcea2b4d0c27dd6e1edd5cb548045e115e33a9e69b1b2a352bee24df035a0447cb820077af00c03
          - type: tgz
            url: https://repo1.maven.org/maven2/io/debezium/debezium-connector-sqlserver/2.0.0.CR1/debezium-connector-sqlserver-2.0.0.CR1-plugin.tar.gz
            sha512sum: e06be047e87e0c1ce11d39c5c51d0cfe119c9b4891e7d5e9639a6914c7e5a19bf09b50b6a196ef488036661f28b9c9b9ff8fcd5046ba0c5eae9549695f44bd25
  metricsConfig:
    type: jmxPrometheusExporter
    valueFrom:
      configMapKeyRef:
        name: connect-metrics
        key: metrics-config.yml
  resources:
    requests:
      cpu: "1"
      memory: 1Gi
    limits:
      cpu: "2"
      memory: 1Gi

connector.yaml:

apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaConnector
metadata:
  name: sqlserver-connector
  namespace: kafka
  labels:
    strimzi.io/cluster: kafka
spec:
  class: io.debezium.connector.sqlserver.SqlServerConnector
  tasksMax: 1
  config:
    database.history.kafka.bootstrap.servers: cluster-kafka-bootstrap.kafka:9092
    database.history.kafka.topic: ${secrets:kafka/kafka-connect-vault-sqlserver:db-history-kafka-topic}
    database.hostname: ${secrets:kafka/kafka-connect-vault-sqlserver:db-hostname}
    database.port: ${secrets:kafka/kafka-connect-vault-sqlserver:db-port}
    database.server.name: ${secrets:kafka/kafka-connect-vault-sqlserver:db-server-name}
    database.names: ${secrets:kafka/kafka-connect-vault-sqlserver:db-name}
    database.user: ${secrets:kafka/kafka-connect-vault-sqlserver:db-user}
    database.password: ${secrets:kafka/kafka-connect-vault-sqlserver:db-password}

    topic.prefix: "connect-sqlserver"

And this is the logs I see:

2022-10-13 10:40:57,525 INFO Retrieving configuration from Secret kafka-connect-vault-sqlserver in namespace kafka (io.strimzi.kafka.AbstractKubernetesConfigProvider) [pool-20-thread-7]
2022-10-13 10:40:57,654 ERROR Failed testing connection for {connector.class=io.debezium.connector.sqlserver.SqlServerConnector, database.user=*******, database.names=**********, tasks.max=1, database.history.kafka.topic=*********, database.history.kafka.bootstrap.servers=cluster-kafka-bootstrap.kafka:9092, database.server.name==********, database.port===********, topic.prefix=connect-sqlserver, database.hostname==********, database.password=********, name==********} with user '[database.user,null,[],[],true]' (io.debezium.connector.sqlserver.SqlServerConnector) [pool-20-thread-7]
com.microsoft.sqlserver.jdbc.SQLServerException: The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: "PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target". ClientConnectionId:957ff5c0-22b0-4ada-a94d-dec1a44fae3e
	at com.microsoft.sqlserver.jdbc.SQLServerConnection.terminate(SQLServerConnection.java:3680)
	at com.microsoft.sqlserver.jdbc.TDSChannel.enableSSL(IOBuffer.java:2113)
	at com.microsoft.sqlserver.jdbc.SQLServerConnection.connectHelper(SQLServerConnection.java:3204)
	at com.microsoft.sqlserver.jdbc.SQLServerConnection.login(SQLServerConnection.java:2833)
	at com.microsoft.sqlserver.jdbc.SQLServerConnection.connectInternal(SQLServerConnection.java:2671)
	at com.microsoft.sqlserver.jdbc.SQLServerConnection.connect(SQLServerConnection.java:1640)
	at com.microsoft.sqlserver.jdbc.SQLServerDriver.connect(SQLServerDriver.java:936)
	at io.debezium.jdbc.JdbcConnection.lambda$patternBasedFactory$1(JdbcConnection.java:240)
	at io.debezium.jdbc.JdbcConnection$ConnectionFactoryDecorator.connect(JdbcConnection.java:126)
	at io.debezium.jdbc.JdbcConnection.connection(JdbcConnection.java:872)
	at io.debezium.connector.sqlserver.SqlServerConnection.connection(SqlServerConnection.java:227)
	at io.debezium.jdbc.JdbcConnection.connection(JdbcConnection.java:867)
	at io.debezium.jdbc.JdbcConnection.execute(JdbcConnection.java:429)
	at io.debezium.jdbc.JdbcConnection.execute(JdbcConnection.java:408)
	at io.debezium.connector.sqlserver.SqlServerConnector.validateConnection(SqlServerConnector.java:121)
	at io.debezium.connector.common.RelationalBaseSourceConnector.validate(RelationalBaseSourceConnector.java:55)
	at org.apache.kafka.connect.runtime.AbstractHerder.validateConnectorConfig(AbstractHerder.java:471)
	at org.apache.kafka.connect.runtime.AbstractHerder.lambda$validateConnectorConfig$2(AbstractHerder.java:367)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:353)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:296)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:291)
	at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:654)
	at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:473)
	at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:369)
	at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392)
	at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:443)
	at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:421)
	at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:183)
	at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
	at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1506)
	at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1416)
	at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:456)
	at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:427)
	at com.microsoft.sqlserver.jdbc.TDSChannel.enableSSL(IOBuffer.java:2021)
	... 21 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)
	at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)
	at java.base/sun.security.validator.Validator.validate(Validator.java:264)
	at java.base/sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:313)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:233)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:110)
	at com.microsoft.sqlserver.jdbc.TDSChannel$HostNameOverrideX509TrustManager.checkServerTrusted(IOBuffer.java:1702)
	at java.base/sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(SSLContextImpl.java:1549)
	at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:638)
	... 33 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
	at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
	at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)
	at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434)
... 41 more

How can I fix this?

[scholzj]

Well, you have your Kafka without TLS. But it looks like your SQL Server uses TLS. So you will need to configure TLS for that or disable it in the connector and your SQL Server. That said, I do not know Debezium or SQL Server well enough to tell you where or how.

[Migueljfs]

Right that makes sense, so what I would want is to use plaintext connection inside my kafka clusters between everything and only do TLS between Connect -> SQL Server. How would I go about doing this?

Changing kafka connect to this:

apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaConnect
metadata:
  name: kafka
  namespace: kafka
  annotations:
    strimzi.io/use-connector-resources: "true"
spec:
  version: 3.2.3
  replicas: 1
  bootstrapServers: cluster-kafka-bootstrap.kafka:9092
  tls:
    trustedCertificates:
      - secretName: cluster-cluster-ca-cert
        certificate: ca.crt
  config:
    group.id: connect-cluster
    offset.storage.topic: connect-cluster-offsets
    config.storage.topic: connect-cluster-configs
    status.storage.topic: connect-cluster-status
    # -1 means it will use the default replication factor configured in the broker
    config.storage.replication.factor: -1
    offset.storage.replication.factor: -1
    status.storage.replication.factor: -1

    config.providers: secrets,configmaps
    config.providers.secrets.class: io.strimzi.kafka.KubernetesSecretConfigProvider
    config.providers.configmaps.class: io.strimzi.kafka.KubernetesConfigMapConfigProvider

    key.converter: io.confluent.connect.avro.AvroConverter
    key.converter.schema.registry.url: http://cluster-schema-registry.kafka:8081

    value.converter: io.confluent.connect.avro.AvroConverter
    value.converter.schema.registry.url: http://cluster-schema-registry.kafka:8081
  build:
    output:
      type: docker
      # This image will last only for 24 hours and might be overwritten by other users
      # Strimzi will use this tag to push the image. But it will use the digest to pull
      # the container image to make sure it pulls exactly the image we just built. So
      # it should not happen that you pull someone else's container image. However, we
      # recommend changing this to your own container registry or using a different
      # image name for any other than demo purposes.
      image: ttl.sh/strimzi-my-my-connect-example-3.2.3:24h
    plugins:
      - name: avro
        artifacts:
          - type: jar
            url: https://packages.confluent.io/maven/io/confluent/kafka-connect-avro-converter/7.2.2/kafka-connect-avro-converter-7.2.2.jar
            sha512sum: bbf2486fe22844e37d6efee0288dc24bd82bbeaa4d5a42e883b74e7d2ff02dcd19d4945c732207e42f4108a4e6bb5d4229c1966568cdc4fa983055d03ff44413
          - type: jar
            url: https://packages.confluent.io/maven/io/confluent/kafka-connect-avro-data/7.2.2/kafka-connect-avro-data-7.2.2.jar
            sha512sum: 5d304ff1c16f4969c804f8ed27834241490f854673c8738a0b2f3bee6499d8159d236deb8bc8eb58b2e84cc6b76270ab30b0f13f04fa71e9f51dd36bc498f9c4
          - type: jar
            url: https://packages.confluent.io/maven/io/confluent/kafka-avro-serializer/7.2.2/kafka-avro-serializer-7.2.2.jar
            sha512sum: f8f2066381573a54932bdcb9872669fcbde912e0b41e3f40b0a778a3d32058552d1c34e5887cce1b2a4175376114c57d7caeab52597488ca2298a0b583ae9fc0
          - type: jar
            url: https://packages.confluent.io/maven/io/confluent/kafka-schema-registry-client/7.2.2/kafka-schema-registry-client-7.2.2.jar
            sha512sum: e034df9dc16d1eb917085a4aa4bbb78cf1340cb88322c2d7eebf6acad9bb8964fcdc941dfa641829e6cec3a52c14f819c9ccf64f46b3e2ed3dc587805b4d6d30
          - type: jar
            url: https://packages.confluent.io/maven/io/confluent/kafka-schema-serializer/7.2.2/kafka-schema-serializer-7.2.2.jar
            sha512sum: 976e89acb2d7a30ee090245bce7474ec85995818fad35a8208220007dfc17db6674905c101d563f851656f214c73bf9e49ef0d8276b2846cf630fd311cf03bab
      - name: debezium
        artifacts:
          - type: tgz
            url: https://repo1.maven.org/maven2/io/debezium/debezium-connector-postgres/1.3.1.Final/debezium-connector-postgres-1.3.1.Final-plugin.tar.gz
            sha512sum: 962a12151bdf9a5a30627eebac739955a4fd95a08d373b86bdcea2b4d0c27dd6e1edd5cb548045e115e33a9e69b1b2a352bee24df035a0447cb820077af00c03
          - type: tgz
            url: https://repo1.maven.org/maven2/io/debezium/debezium-connector-sqlserver/2.0.0.CR1/debezium-connector-sqlserver-2.0.0.CR1-plugin.tar.gz
            sha512sum: e06be047e87e0c1ce11d39c5c51d0cfe119c9b4891e7d5e9639a6914c7e5a19bf09b50b6a196ef488036661f28b9c9b9ff8fcd5046ba0c5eae9549695f44bd25
  metricsConfig:
    type: jmxPrometheusExporter
    valueFrom:
      configMapKeyRef:
        name: connect-metrics
        key: metrics-config.yml
  resources:
    requests:
      cpu: "1"
      memory: 1Gi
    limits:
      cpu: "2"
      memory: 1Gi

Does not seem to work as it timeouts when reaching the brokers:

2022-10-13 14:35:03,729 WARN The configuration 'producer.ssl.truststore.password' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,729 WARN The configuration 'group.id' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,729 WARN The configuration 'rest.advertised.port' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,729 WARN The configuration 'plugin.path' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,729 WARN The configuration 'config.providers.configmaps.class' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,729 WARN The configuration 'config.providers' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,730 WARN The configuration 'admin.security.protocol' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,730 WARN The configuration 'consumer.ssl.truststore.location' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,730 WARN The configuration 'producer.ssl.truststore.location' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,730 WARN The configuration 'config.providers.secrets.class' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,730 WARN The configuration 'status.storage.replication.factor' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,730 WARN The configuration 'offset.storage.topic' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,730 WARN The configuration 'consumer.security.protocol' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,730 WARN The configuration 'value.converter' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,730 WARN The configuration 'key.converter' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,730 WARN The configuration 'admin.ssl.truststore.password' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,730 WARN The configuration 'consumer.ssl.truststore.password' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,730 WARN The configuration 'consumer.client.rack' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,730 WARN The configuration 'config.storage.topic' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,730 WARN The configuration 'producer.security.protocol' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,730 WARN The configuration 'rest.advertised.host.name' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,730 WARN The configuration 'status.storage.topic' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,730 WARN The configuration 'rest.port' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,730 WARN The configuration 'config.storage.replication.factor' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,730 WARN The configuration 'value.converter.schema.registry.url' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,730 WARN The configuration 'offset.storage.replication.factor' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,730 WARN The configuration 'key.converter.schema.registry.url' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,730 WARN The configuration 'admin.ssl.truststore.location' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig) [main]
2022-10-13 14:35:03,731 INFO Kafka version: 3.2.3 (org.apache.kafka.common.utils.AppInfoParser) [main]
2022-10-13 14:35:03,731 INFO Kafka commitId: 50029d3ed8ba576f (org.apache.kafka.common.utils.AppInfoParser) [main]
2022-10-13 14:35:03,731 INFO Kafka startTimeMs: 1665671703730 (org.apache.kafka.common.utils.AppInfoParser) [main]
2022-10-13 14:35:12,324 INFO [AdminClient clientId=adminclient-1] Disconnecting from node -1 due to socket connection setup timeout. The timeout value is 8526 ms. (org.apache.kafka.clients.NetworkClient) [kafka-admin-client-thread | adminclient-1
2022-10-13 14:35:31,448 INFO [AdminClient clientId=adminclient-1] Disconnecting from node -1 due to socket connection setup timeout. The timeout value is 18990 ms. (org.apache.kafka.clients.NetworkClient) [kafka-admin-client-thread | adminclient-1]
2022-10-13 14:35:33,735 INFO [AdminClient clientId=adminclient-1] Metadata update failed (org.apache.kafka.clients.admin.internals.AdminMetadataManager) [kafka-admin-client-thread | adminclient-1]
org.apache.kafka.common.errors.TimeoutException: Timed out waiting to send the call. Call: fetchMetadata

[scholzj]

Different applications have different connections and they have different configurations. So no, your Kafka Connect configuration was fine. You will need to fix the connector configuration since it is the connector what connects to the database. Not Strimzi. Strimzi lets you mount secrets with certificates etc. => look for externalConfiguration in the docs. But it needs to be configured in the connector.

[Migueljfs]

To be clear, the externalConfiguration is part of KafkaConnect or KafkaConnector (or both)? Reading the docs I only see examples of it used in KafkaConnect

[scholzj]

Right, correct, sorry if I confused you. The externalConfiguration is in the KafkaConnect resource. But that just basically mounts the secret with your certificate into the Connect pods. You then have to go and configure it inside the KafkaConnector so that the connector instance uses the certificate properly.

[Migueljfs]

Thank you, I finally figured out the issue, I thought maybe it was something related to strimzi because I have a non strimzi kafka connect running and working. I will post the solution below for others that run into the same issue. But tl;dr the plugin I'm installing for debezium sql is on a new version that introduced a breaking change by enabling encryption by default. Before it was set to false

[Migueljfs]

I finally figure the issue, I will post the answer for others:

This not in any way related to strimzi, it's solely on the plugin you are installing. In my case, I was installing the debezium-sql server on a version that uses JDBC driver 10.2 or newer, which introduced a breaking change of enabling encryption by default.

This is generally problematic because, by default, SQL Server is installed with a self-signed X.509 certificate so it doesn't appear in any trust stores.

To solve this, you can either change your KafkaConnector config:

• set database.encrypt: false
• set database.trustServerCertificate: true

Depending on whether or not you want encryption .

@scholzj We can close this, thanks for the help!