How to use a keystore password which is in a file

[vascoferraz]

Hi everyone.

I have the following yaml

yamlApplicationConfig:
  kafka:
    clusters:
      - name: my-kafka-cluster
        bootstrapServers: "kafka.confluent.svc.cluster.local:9092"
        properties:
          sasl.mechanism: PLAIN
          security.protocol: SASL_SSL
          sasl.jaas.config: org.apache.kafka.common.security.plain.PlainLoginModule required username="kafka" password="kafka-secret";
          ssl.keystore.location: /mnt/sslcerts/keystore.p12
          ssl.keystore.password: ${file:/mnt/sslcerts/jksPassword.txt:jksPassword}
          ssl.truststore.location: /mnt/sslcerts/truststore.p12
          ssl.truststore.password: ${file:/mnt/sslcerts/jksPassword.txt:jksPassword}

service:
  type: NodePort
  nodePort: 30902

volumeMounts:
  - mountPath: /mnt/sslcerts
    name: kafka-ui

volumes:
  - name: kafka-ui
    secret:
      secretName: controlcenter-pkcs12

Also, inside the container I have this file /mnt/sslcerts/jksPassword.txt with the following content: jksPassword=mystorepassword

But if I try to read the file like this: ${file:/mnt/sslcerts/jksPassword.txt:jksPassword} the following exception is thrown:

Caused by: java.security.UnrecoverableKeyException: failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.

If I pass the password in a literal form, like this, ssl.keystore.password: mystorepassword, it works perfectly.

Any guidance is appreciated :)

Thanks

Vasco Ferraz

[Haarolean]

Hi, unfortunately, that's unsupported, neither by the app nor by kafka or adminclient.

I see you're using helm, I can suggest using secrets for this purpose.

[vascoferraz]

Thank you so much for the clarification.