Kubernetes config provider in schema registry

[opsocomusr]

Can we use kubernetes configuration provider in schema registry(confluent image)? The required libraries are added to the classpath and we could see the below logs when the container starts up (without using the ${secrets:namespace/secret:name}) for the truststore and password configurations.

===> Launching schema-registry ...
[2021-09-02 14:15:37,427] INFO Configuring Kubernetes Secret config provider (io.strimzi.kafka.AbstractKubernetesConfigProvider)
[2021-09-02 14:15:38,199] INFO Closing Kubernetes Secret config provider (io.strimzi.kafka.AbstractKubernetesConfigProvider)

But after changing the truststore location to ${secrets:namespace/secret:name} in the configuration, it throws the below error.

[main] ERROR org.apache.kafka.common.security.ssl.DefaultSslEngineFactory - Modification time of key store could not be obtained: ${secrets:ocdp/strimzi-cluster-ca-cert:ca.p12}
java.nio.file.NoSuchFileException: ${secrets:ocdp/strimzi-cluster-ca-cert:ca.p12}
	at java.base/sun.nio.fs.UnixException.translateToIOException(UnixException.java:92)
	at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:111)
	at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:116)
	at java.base/sun.nio.fs.UnixFileAttributeViews$Basic.readAttributes(UnixFileAttributeViews.java:55)
	at java.base/sun.nio.fs.UnixFileSystemProvider.readAttributes(UnixFileSystemProvider.java:149)
	at java.base/sun.nio.fs.LinuxFileSystemProvider.readAttributes(LinuxFileSystemProvider.java:99)
	at java.base/java.nio.file.Files.readAttributes(Files.java:1764)
	at java.base/java.nio.file.Files.getLastModifiedTime(Files.java:2315)
	at org.apache.kafka.common.security.ssl.DefaultSslEngineFactory$FileBasedStore.lastModifiedMs(DefaultSslEngineFactory.java:383)
	at org.apache.kafka.common.security.ssl.DefaultSslEngineFactory$FileBasedStore.<init>(DefaultSslEngineFactory.java:348)
	at org.apache.kafka.common.security.ssl.DefaultSslEngineFactory.createTruststore(DefaultSslEngineFactory.java:322)
	at org.apache.kafka.common.security.ssl.DefaultSslEngineFactory.configure(DefaultSslEngineFactory.java:168)
	at org.apache.kafka.common.security.ssl.SslFactory.instantiateSslEngineFactory(SslFactory.java:136)
	at org.apache.kafka.common.security.ssl.SslFactory.configure(SslFactory.java:93)
	at org.apache.kafka.common.network.SslChannelBuilder.configure(SslChannelBuilder.java:72)
	at org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilders.java:157)
	at org.apache.kafka.common.network.ChannelBuilders.clientChannelBuilder(ChannelBuilders.java:73)
	at org.apache.kafka.clients.ClientUtils.createChannelBuilder(ClientUtils.java:105)
	at org.apache.kafka.clients.admin.KafkaAdminClient.createInternal(KafkaAdminClient.java:508)
	at org.apache.kafka.clients.admin.Admin.create(Admin.java:75)
	at org.apache.kafka.clients.admin.AdminClient.create(AdminClient.java:49)
	at io.confluent.admin.utils.ClusterStatus.isKafkaReady(ClusterStatus.java:138)
	at io.confluent.admin.utils.cli.KafkaReadyCommand.main(KafkaReadyCommand.java:150)

[scholzj]

Did you initialized the provider? The error suggests that the value is not replaced by the client. TBH, I do not know if the Schema Registry supports the configuration providers or not. I would expect it to work in any place where Kafka client is configured.

[opsocomusr]

Yes. I initialized the provider in the configuration and below are the logs for the provider initialization.

[2021-09-02 14:15:37,427] INFO Configuring Kubernetes Secret config provider (io.strimzi.kafka.AbstractKubernetesConfigProvider)
[2021-09-02 14:15:38,199] INFO Closing Kubernetes Secret config provider (io.strimzi.kafka.AbstractKubernetesConfigProvider)

[scholzj]

It is also closing it which is weird. As I said, I never tried it with Confluent Schema Registry, so maybe they have something there what makes it not work.