Docker Compose中带SASL认证的Schema Registry启动失败问题排查

问题场景 #

通过Docker Compose部署包含Kafka、Zookeeper和Schema Registry的集群并配置SASL认证后，Zookeeper和Kafka Broker运行正常，但Schema Registry启动后立即退出，容器状态显示为exited (1)。

容器状态输出：

NAME                COMMAND                  SERVICE             STATUS              PORTS
broker              "/etc/confluent/dock…"   broker              running             9092/tcp, 0.0.0.0:9093->9093/tcp, :::9093->9093/tcp
schema-registry     "/etc/confluent/dock…"   schema-registry     exited (1)           
zookeeper           "/bin/bash -c 'echo …"   zookeeper           running             0.0.0.0:2181->2181/tcp, :::2181->2181/tcp, 2888/tcp, 3888/tcp

核心报错信息：

===> Running preflight checks ... 
===> Check if Kafka is healthy ...
[2023-05-23 08:07:14,063] ERROR Error while running kafka-ready. (io.confluent.admin.utils.cli.KafkaReadyCommand)
org.apache.kafka.common.KafkaException: Failed to create new KafkaAdminClient
...
Caused by: java.lang.IllegalArgumentException: Could not find a 'KafkaClient' entry in the JAAS configuration. System property 'java.security.auth.login.config' is not set

已配置的kafka_client_jaas.conf内容：

KafkaClient {
  org.apache.kafka.common.security.plain.PlainLoginModule required 
  username="kafka" 
  password="kafka-secret";
};

报错原因分析 #

Schema Registry启动时会先执行预检查脚本kafka-ready，该脚本会创建KafkaAdminClient连接Broker验证健康状态。当前仅通过SCHEMA_REGISTRY_OPTS给Schema Registry主进程设置了JAAS配置路径，但预检查脚本不会读取这个变量，而是读取通用的KAFKA_OPTS环境变量，导致脚本无法找到JAAS配置，进而启动失败。

解决方案 #

在Schema Registry的环境变量中添加KAFKA_OPTS，值与SCHEMA_REGISTRY_OPTS一致，确保预检查脚本和主进程都能加载到JAAS配置。

修改后的Schema Registry服务Docker Compose配置片段：

schema-registry:
  image: confluentinc/cp-schema-registry
  volumes:
    - ./data/kafka_client_jaas.conf:/opt/kafka_client_jaas.conf
  hostname: schema-registry
  container_name: schema-registry
  depends_on:
    - broker
  ports:
    - "8081:8081"
  networks:
    - network
  environment:
    SCHEMA_REGISTRY_HOST_NAME: schema-registry
    SCHEMA_REGISTRY_KAFKASTORE_BOOTSTRAP_SERVERS: 'broker:9093'
    SCHEMA_REGISTRY_LOG4J_ROOT_LOGLEVEL: WARN
    SCHEMA_REGISTRY_KAFKASTORE_SECURITY_PROTOCOL: SASL_PLAINTEXT
    SCHEMA_REGISTRY_KAFKASTORE_SASL_MECHANISM: PLAIN
    SCHEMA_REGISTRY_OPTS: "-Djava.security.auth.login.config=/opt/kafka_client_jaas.conf"
    KAFKA_OPTS: "-Djava.security.auth.login.config=/opt/kafka_client_jaas.conf" # 新增此环境变量

执行以下命令重新部署：

docker-compose down
docker-compose up -d

验证容器状态，Schema Registry应正常运行：

docker-compose ps

内容的提问来源于stack exchange，提问作者A. Vasyukhin