Kubernetes集群Kafka与Zookeeper Pod反复重启CrashLoopBackOff问题求助

你的配置存在5个核心问题，直接导致Zookeeper启动失败/连接不通，触发Kafka CrashLoopBackOff：

• Bitnami系列镜像默认以UID=1001的非root用户运行，未配置存储目录权限时，Zookeeper进程无权写入工作目录，会直接启动失败，2181端口始终未监听，Kafka发起连接时自然抛出Connection refused。
• Zookeeper Service未显式指定targetPort，虽然默认规则下会转发到同名数值端口，但存在配置歧义，部分网络插件场景下会出现转发目标错误。
• 3.7.0及以上版本的Bitnami Kafka默认启用KRaft（无Zookeeper）模式，未显式关闭该模式时，Zookeeper连接逻辑不会正常生效。
• Kafka配置中直接在环境变量值内引用$(KAFKA_POD_IP)依赖镜像内部脚本做变量展开，不同版本镜像逻辑不一致，容易出现监听器配置失效。
• 未配置服务就绪检查和启动顺序控制，Kafka可能在Zookeeper完全启动前就发起连接，放大重启问题。

zookeeper-deploy.yaml #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: zookeeper
spec:
  selector:
    matchLabels:
      app: zookeeper
  template:
    metadata:
      labels:
        app: zookeeper
    spec:
      securityContext:
        fsGroup: 1001 # 给非root用户分配目录写入权限
      containers:
        - name: zookeeper
          image: bitnami/zookeeper:3.8
          ports:
            - name: client
              containerPort: 2181
          env:
            - name: ALLOW_ANONYMOUS_LOGIN
              value: "yes"
          # 就绪探针，确认端口真的监听后才接入Service流量
          readinessProbe:
            tcpSocket:
              port: 2181
            initialDelaySeconds: 10
            periodSeconds: 5
          livenessProbe:
            tcpSocket:
              port: 2181
            initialDelaySeconds: 15
            periodSeconds: 10
---
apiVersion: v1
kind: Service
metadata:
  name: zookeeper
spec:
  selector:
    app: zookeeper
  ports:
    - protocol: TCP
      port: 2181
      targetPort: 2181 # 显式指定转发目标端口，消除歧义

kafka-deploy.yaml #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: kafka
spec:
  selector:
    matchLabels:
      app: kafka
  template:
    metadata:
      labels:
        app: kafka
    spec:
      securityContext:
        fsGroup: 1001
      initContainers:
        # 初始化容器，等待Zookeeper完全就绪后再启动Kafka
        - name: wait-for-zookeeper
          image: busybox:1.36
          command: ['sh', '-c', 'until nc -zv zookeeper 2181; do echo "waiting for zookeeper"; sleep 2; done']
      containers:
        - name: kafka
          image: bitnami/kafka:3.6 # 选3.x稳定版，默认兼容Zookeeper模式
          ports:
            - name: client
              containerPort: 9092
          env:
            - name: KAFKA_BROKER_ID
              value: "1"
            - name: ALLOW_PLAINTEXT_LISTENER
              value: "yes"
            - name: KAFKA_ENABLE_KRAFT
              value: "no" # 显式关闭KRaft模式，启用Zookeeper协调模式
            - name: KAFKA_CFG_LISTENERS
              value: PLAINTEXT://:9092
            - name: KAFKA_CFG_ADVERTISED_LISTENERS
              value: PLAINTEXT://kafka:9092 # 集群内访问用Service域名，避免Pod IP漂移问题
            - name: KAFKA_LISTENER_SECURITY_PROTOCOL_MAP
              value: PLAINTEXT:PLAINTEXT
            - name: KAFKA_CFG_ZOOKEEPER_CONNECT
              value: zookeeper:2181
          readinessProbe:
            tcpSocket:
              port: 9092
            initialDelaySeconds: 15
            periodSeconds: 5
---
apiVersion: v1
kind: Service
metadata:
  name: kafka
spec:
  selector:
    app: kafka
  ports:
    - protocol: TCP
      port: 9092
      targetPort: 9092
  type: LoadBalancer

1. 先部署Zookeeper资源：kubectl apply -f zookeeper-deploy.yaml
2. 等待30秒左右执行kubectl get pods，确认Zookeeper Pod状态为Running，重启次数为0
3. 执行kubectl logs <zookeeper-pod名称>，确认日志无Permission denied、端口绑定失败类报错，出现Zookeeper启动成功的提示
4. 部署Kafka资源：kubectl apply -f kafka-deploy.yaml
5. 等待1分钟左右执行kubectl get pods，确认Kafka Pod状态为Running，无重启
6. 进入Kafka Pod执行测试命令创建topic、生产消费消息，验证功能正常

注：如果需要从minikube集群外部访问Kafka，再调整advertised.listeners配置为minikube可访问的地址即可，集群内部通信直接用Service域名:9092没有问题。

内容的提问来源于stack exchange，提问作者Sora69