Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Truststore.jks and keystore.jks are not refreshed after certificate rotation #524

Open
bhavyaravilla opened this issue Aug 26, 2024 · 1 comment

Comments

@bhavyaravilla
Copy link

Describe the bug
After the cert-manager refreshes the certificates for bookie, broker. The file where the secrets are loaded gets updated but the truststore.jks and keystore.jks do not get refreshed with the new certificates. Therefore the communication with zookeeper fails. We have to restart the pods so that the truststore.jks and keystore.jks are recreated and the communication is restored.

To Reproduce
Once the cert-manager updates the certificates for Bookie and broker below error comes up
60:2281, Closing socket connection. Attempting reconnect except it is a SessionExpiredException.org.apache.zookeeper.ClientCnxn$EndOfStreamException: channel for sessionid 0x303844ec7980001 is lost at org.apache.zookeeper.ClientCnxnSocketNetty.doTransport(ClientCnxnSocketNetty.java:286) ~[org.apache.zookeeper-zookeeper-3.8.3.jar:3.8.3] at org.apache.zookeeper.ClientCnxn$SendThread.run(ClientCnxn.java:1289) ~[org.apache.zookeeper-zookeeper-3.8.3.jar:3.8.3] 2024-08-13T10:45:36,645+0000 [epollEventLoopGroup-164-1] ERROR org.apache.zookeeper.ClientCnxnSocketNetty - Unexpected throwableio.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate_unknown at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:499) ~[io.netty-netty-codec-4.1.100.Final.jar:4.1.100.Final] at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290) ~[io.netty-netty-codec-4.1.100.Final.jar:4.1.100.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444) ~[io.netty-netty-transport-4.1.100.Final.jar:4.1.100.Final]

Expected behavior
The truststore.jks and keystore.jks should also be recreated or refreshed with the new certificates

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants
@bhavyaravilla and others