I have a kafka cluster running in FIPS mode with below configuration.
Brokers: 3, Zookeeper Nodes: 3
Kafka: 2.0.0, Scala: 2.12
Zookeeper: 3.4.14
Java - 8
bc-fips - 1.0.1
This cluster is running fine and is in a healthy state.
Currently we have upgraded Kafka(2.4.0) and Java(11) versions, after which FIPS cluster is unable to load bc-fips library and start kafka. New cluster configuration:
Brokers: 3, Zookeeper Nodes: 3
Kafka: 2.4.0, Scala: 2.12
Zookeeper: 3.4.14
Java - 11
bc-fips - 1.0.2
With the analysis so far, the problem seems to be with loading bc-fips jar with new JAVA version(11), as java doc says:
So when I am starting the kafka service its failing with below error:
org.apache.kafka.common.KafkaException: org.apache.kafka.common.KafkaException: java.security.NoSuchAlgorithmException: DEFAULT SecureRandom not available
at org.apache.kafka.common.network.SaslChannelBuilder.configure(SaslChannelBuilder.java:158)
at org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilders.java:146)
at org.apache.kafka.common.network.ChannelBuilders.serverChannelBuilder(ChannelBuilders.java:85)
at kafka.network.Processor.<init>(SocketServer.scala:753)
at kafka.network.SocketServer.newProcessor(SocketServer.scala:394)
at kafka.network.SocketServer.$anonfun$addDataPlaneProcessors$1(SocketServer.scala:279)
at scala.collection.immutable.Range.foreach$mVc$sp(Range.scala:158)
at kafka.network.SocketServer.addDataPlaneProcessors(SocketServer.scala:278)
at kafka.network.SocketServer.$anonfun$createDataPlaneAcceptorsAndProcessors$1(SocketServer.scala:241)
at kafka.network.SocketServer.$anonfun$createDataPlaneAcceptorsAndProcessors$1$adapted(SocketServer.scala:238)
at scala.collection.mutable.ResizableArray.foreach(ResizableArray.scala:62)
at scala.collection.mutable.ResizableArray.foreach$(ResizableArray.scala:55)
at scala.collection.mutable.ArrayBuffer.foreach(ArrayBuffer.scala:49)
at kafka.network.SocketServer.createDataPlaneAcceptorsAndProcessors(SocketServer.scala:238)
at kafka.network.SocketServer.startup(SocketServer.scala:121)
at kafka.server.KafkaServer.startup(KafkaServer.scala:263)
at kafka.server.KafkaServerStartable.startup(KafkaServerStartable.scala:44)
at kafka.Kafka$.main(Kafka.scala:84)
at kafka.Kafka.main(Kafka.scala)
Caused by: org.apache.kafka.common.KafkaException: java.security.NoSuchAlgorithmException: DEFAULT SecureRandom not available
at org.apache.kafka.common.security.ssl.SslEngineBuilder.createSecureRandom(SslEngineBuilder.java:126)
at org.apache.kafka.common.security.ssl.SslEngineBuilder.<init>(SslEngineBuilder.java:86)
at org.apache.kafka.common.security.ssl.SslFactory.configure(SslFactory.java:95)
at org.apache.kafka.common.network.SaslChannelBuilder.configure(SaslChannelBuilder.java:154)
... 18 more
Caused by: java.security.NoSuchAlgorithmException: DEFAULT SecureRandom not available
at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:159)
at java.base/java.security.SecureRandom.getInstance(SecureRandom.java:364)
at org.apache.kafka.common.security.ssl.SslEngineBuilder.createSecureRandom(SslEngineBuilder.java:124)
... 21 more
[2020-05-18 11:59:39,646] INFO [KafkaServer id=48] shutting down (kafka.server.KafkaServer)
Note: As said above the same configuration works with java-8.
Any help would be really appreciated.
OK, I got this working with below setup
Java: 11.0.7
BCFIPS: bc-fips-1.0.2.jar
Add the bcfips jar in kafka lib directory: <-kafka-root-directory->/libs/bc-fips-1.0.2.jar
And start the kafka server, it will load bcfips jar.