求助：Strimzi KafkaConnector无法从Secrets读取数据库凭证

问题 #

在Docker Desktop环境中，按照Debezium官方文档部署Debezium集群，仅替换了自定义Kafka Connect镜像的输出仓库和插件URL，其余步骤完全遵循文档。创建KafkaConnector后，连接器始终未运行。

执行以下命令排查：

kubectl describe kafkaconnector debezium-connector-mysql -n debezium-example
kubectl describe kafkaconnect debezium-connect-cluster -n debezium-example

Kafka Connector输出关键信息 #

Spec:
  Class:  io.debezium.connector.mysql.MySqlConnector
  Config:
    database.hostname:                                mysql
    database.include.list:                            inventory
    database.password:                                <nil>
    database.port:                                    3306
    database.server.id:                               184054
    database.user:                                    <nil>
    # 其余配置省略
Events:                                               <none>

Kafka Connect输出关键错误 #

Status:
  Conditions:
    Last Transition Time:  2023-03-24T07:42:01.787955422Z
    Message:               database.password: A null value is not allowed for this key
    Reason:                InvalidConfigParameterException
    Status:                True
    Type:                  NotReady

可以看到连接器无法从debezium-secret中读取数据库用户名和密码，无法定位问题。

解决方法 #

1. 验证Secret的正确性 #

确认debezium-secret已在debezium-example命名空间中创建，且包含database.user和database.password两个键：

kubectl get secret debezium-secret -n debezium-example -o yaml

输出中应包含类似以下的data字段：

data:
  database.user: <base64编码的用户名>
  database.password: <base64编码的密码>

2. 修正KafkaConnector的配置引用 #

KafkaConnector需要使用Strimzi的配置提供者语法来引用Secret中的值，而不是直接留空。修改连接器配置文件中的对应字段：

spec:
  config:
    database.user: "${secrets:debezium-secret:database.user}"
    database.password: "${secrets:debezium-secret:database.password}"
    # 其余配置保持不变

3. 确认KafkaConnect的权限配置 #

Strimzi的KubernetesSecretConfigProvider需要KafkaConnect的ServiceAccount具备读取debezium-secret的权限。检查是否存在对应的Role和RoleBinding：

• 查看ServiceAccount：

kubectl get serviceaccount -n debezium-example | grep debezium-connect-cluster

• 确认Role是否允许读取secrets资源：

kubectl get role -n debezium-example
kubectl describe role <role-name> -n debezium-example

• 确认RoleBinding已关联ServiceAccount和Role：

kubectl get rolebinding -n debezium-example
kubectl describe rolebinding <rolebinding-name> -n debezium-example

如果缺失权限，需要创建对应的Role和RoleBinding：

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: debezium-connect-secret-reader
  namespace: debezium-example
rules:
- apiGroups: [""]
  resources: ["secrets"]
  resourceNames: ["debezium-secret"]
  verbs: ["get", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: debezium-connect-secret-reader-binding
  namespace: debezium-example
subjects:
- kind: ServiceAccount
  name: debezium-connect-cluster-connect
  namespace: debezium-example
roleRef:
  kind: Role
  name: debezium-connect-secret-reader
  apiGroup: rbac.authorization.k8s.io

4. 重新应用配置并验证 #

修正配置后，重新部署KafkaConnector：

kubectl apply -f <your-connector-config.yaml> -n debezium-example

等待片刻后，查看KafkaConnect的状态：

kubectl describe kafkaconnect debezium-connect-cluster -n debezium-example

确认NotReady状态消失，再检查KafkaConnector的运行状态：

kubectl get kafkaconnector debezium-connector-mysql -n debezium-example -o wide

内容的提问来源于stack exchange，提问作者Tom Liang