Docker运行带TLS的Bitnami/Kafka遇证书挂载错误求助

问题场景 #

启动启用TLS的Bitnami/Kafka容器时，触发证书挂载错误，提示需将证书挂载到/bitnami/kafka/config/certs目录，但实际配置的挂载路径和证书路径使用了conf而非config。

执行的Docker命令：

docker run --name kafka_ssl \
  -p 9092:9092 \
  -p 9093:9093 \
  -v ${HOME}/.localdev/ssl/tmp/keystore/localdev_keystore.jks:/bitnami/kafka/conf/certs/kafka.keystore.jks \
  -v ${HOME}/.localdev/ssl/tmp/truststore/localdev_truststore.jks:/bitnami/kafka/conf/certs/kafka.truststore.jks \
  -e ALLOW_PLAINTEXT_LISTENER=yes \
  -e KAFKA_CFG_ZOOKEEPER_CONNECT=${DOCKER_VM_HOST}:2181 \
  -e KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP=PLAINTEXT:PLAINTEXT,SSL:SSL \
  -e KAFKA_CFG_ADVERTISED_LISTENERS=PLAINTEXT://localhost:9092,SSL://localhost:9093 \
  -e KAFKA_CFG_SSL_KEYSTORE_LOCATION=/bitnami/kafka/conf/certs/kafka.keystore.jks \
  -e KAFKA_CFG_SSL_KEYSTORE_PASSWORD=password \
  -e KAFKA_CFG_SSL_TRUSTSTORE_LOCATION=/bitnami/kafka/conf/certs/kafka.truststore.jks \
  -e KAFKA_CFG_SSL_TRUSTSTORE_PASSWORD=password \
  -e KAFKA_CFG_LISTENERS=PLAINTEXT://:9092,SSL://:9093 \
  -e KAFKA_CFG_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM= \
  ${DOCKER_BASE_REGISTRY}/bitnami/kafka:2.8.1

错误提示：

kafka 11:01:30.08 ERROR ==> In order to configure the TLS encryption for Kafka with JKS certs you must mount your kafka.keystore.jks and kafka.truststore.jks certs to the /bitnami/kafka/config/certs directory.

解决步骤 #

错误核心是路径拼写不一致：容器要求证书挂载到/bitnami/kafka/config/certs，但命令中误用了/bitnami/kafka/conf/certs（conf和config的差异）。需同步修改两处配置：

1. 修正卷挂载路径：将挂载目标路径中的conf替换为config
2. 修正环境变量中的证书路径：同步更新KAFKA_CFG_SSL_KEYSTORE_LOCATION和KAFKA_CFG_SSL_TRUSTSTORE_LOCATION的值为正确路径

修正后的完整Docker命令：

docker run --name kafka_ssl \
  -p 9092:9092 \
  -p 9093:9093 \
  -v ${HOME}/.localdev/ssl/tmp/keystore/localdev_keystore.jks:/bitnami/kafka/config/certs/kafka.keystore.jks \
  -v ${HOME}/.localdev/ssl/tmp/truststore/localdev_truststore.jks:/bitnami/kafka/config/certs/kafka.truststore.jks \
  -e ALLOW_PLAINTEXT_LISTENER=yes \
  -e KAFKA_CFG_ZOOKEEPER_CONNECT=${DOCKER_VM_HOST}:2181 \
  -e KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP=PLAINTEXT:PLAINTEXT,SSL:SSL \
  -e KAFKA_CFG_ADVERTISED_LISTENERS=PLAINTEXT://localhost:9092,SSL://localhost:9093 \
  -e KAFKA_CFG_SSL_KEYSTORE_LOCATION=/bitnami/kafka/config/certs/kafka.keystore.jks \
  -e KAFKA_CFG_SSL_KEYSTORE_PASSWORD=password \
  -e KAFKA_CFG_SSL_TRUSTSTORE_LOCATION=/bitnami/kafka/config/certs/kafka.truststore.jks \
  -e KAFKA_CFG_SSL_TRUSTSTORE_PASSWORD=password \
  -e KAFKA_CFG_LISTENERS=PLAINTEXT://:9092,SSL://:9093 \
  -e KAFKA_CFG_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM= \
  ${DOCKER_BASE_REGISTRY}/bitnami/kafka:2.8.1

额外检查项：确保本地证书文件路径${HOME}/.localdev/ssl/tmp/keystore/localdev_keystore.jks和${HOME}/.localdev/ssl/tmp/truststore/localdev_truststore.jks真实存在，且文件权限允许容器读取（可通过chmod 644调整权限）。

内容的提问来源于stack exchange，提问作者Seda Saakyan