迁移SpringBoot至ROSA时Kafka连接遇SSL异常求助

问题描述 #

将OpenShift V3上的SpringBoot项目迁移至OpenShift V4（ROSA）后，Kafka集成功能异常，抛出java.io.EOFException: SSL peer shut down incorrectly错误，已核对V3与ROSA环境的证书，未发现差异。

错误栈信息 #

logger_name: org.springframework.aop.interceptor.SimpleAsyncUncaughtExceptionHandler
   message: Unexpected exception occurred invoking async method: public void KafkaProducerService.send(java.lang.String,java.lang.String,java.lang.String)
   stack_trace: org.apache.kafka.common.errors.SerializationException: Error serializing Avro message
    at io.confluent.kafka.serializers.AbstractKafkaAvroSerializer.serializeImpl(AbstractKafkaAvroSerializer.java:144)

Caused by: javax.net.ssl.SSLHandshakeException: Remote host terminated the handshake
    at java.base/sun.security.ssl.SSLSocketImpl.handleEOF(SSLSocketImpl.java:1701)
    at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1519)
    at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1421)
    at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:456)
    at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:427)
    at java.base/sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:572)
    at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:201)
    at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1592)
    at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1520)
    at java.base/java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:527)
    at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:334)
    at io.confluent.kafka.schemaregistry.client.rest.RestService.sendHttpRequest(RestService.java:275)
    at io.confluent.kafka.schemaregistry.client.rest.RestService.httpRequest(RestService.java:365)
    at io.confluent.kafka.schemaregistry.client.rest.RestService.getLatestVersion(RestService.java:774)
    at io.confluent.kafka.schemaregistry.client.rest.RestService.getLatestVersion(RestService.java:765)
    at io.confluent.kafka.schemaregistry.client.CachedSchemaRegistryClient.getLatestSchemaMetadata(CachedSchemaRegistryClient.java:360)
    at io.confluent.kafka.serializers.AbstractKafkaSchemaSerDe.lookupLatestVersion(AbstractKafkaSchemaSerDe.java:175)
    at io.confluent.kafka.serializers.AbstractKafkaSchemaSerDe.lookupLatestVersion(AbstractKafkaSchemaSerDe.java:159)
    at io.confluent.kafka.serializers.AbstractKafkaAvroSerializer.serializeImpl(AbstractKafkaAvroSerializer.java:106)
    ... 20 common frames omitted
Caused by: java.io.EOFException: SSL peer shut down incorrectly
    at java.base/sun.security.ssl.SSLSocketInputRecord.read(SSLSocketInputRecord.java:489)
    at java.base/sun.security.ssl.SSLSocketInputRecord.readHeader(SSLSocketInputRecord.java:478)
    at java.base/sun.security.ssl.SSLSocketInputRecord.decode(SSLSocketInputRecord.java:160)
    at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:111)
    at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1511)
    ... 37 common frames omitted

当前Kafka配置 #

kafka:
    bootstrap-servers: <name1>-kafka-broker-n1-test:9093,<name2>-kafka-broker-n2-test:9093,<name3>-kafka-broker-n3-test:9093
    properties:
      schema.registry.url: https://<name>-schema-registry-n1-test:8081
      auto.register.schemas: false
      use.latest.version: true
      basic.auth.credentials.source: USER_INFO
      basic.auth.user.info: ${username}:${password}
      security.protocol: SASL_SSL
      sasl:
        mechanism: PLAIN
        jaas.config: org.apache.kafka.common.security.plain.PlainLoginModule required username="${username}" password="${password}";

排查思路 #

• 聚焦Schema Registry的SSL连接：从错误栈可见，异常触发于连接Schema Registry时的SSL握手，而非Kafka Broker。需确认：

  • ROSA网络策略是否允许SpringBoot Pod访问Schema Registry的8081端口
  • Schema Registry的证书是否被应用Pod信任：可通过挂载证书到Pod的信任目录，或指定JVM信任存储路径解决
  • 双方TLS协议版本匹配：高版本JVM默认禁用旧TLS协议，需确认Schema Registry是否开启TLS1.2及以上版本

• 验证SASL认证配置：

  • 确认ROSA环境中Kafka和Schema Registry的SASL PLAIN用户名密码有效且权限正确
  • 检查jaas.config格式是否正确，环境变量${username}、${password}是否被正确注入

• 排查JVM版本差异：

  • 对比V3与ROSA环境的JVM版本，高版本JVM的SSL规则更严格，可添加-Djavax.net.debug=ssl:handshake开启调试日志，定位握手过程中的具体协议/算法不兼容问题

• 网络连通性验证：

  • 在SpringBoot Pod内执行curl -v https://<name>-schema-registry-n1-test:8081，测试SSL连接和响应
  • 确认Schema Registry域名解析正常，无DNS故障
  • 检查ROSA安全组、网络策略是否拦截了Pod与Schema Registry之间的流量

内容的提问来源于stack exchange，提问作者ljs