search

zncdatadev / zookeeper-operator

A tool that can be used to deploy and manager Apache ZooKeeper clusters/ensembles
Apache License 2.0
2 stars 2 forks source link

[Bug]: zk cluster deploy error with enable tls #101

Closed whg517 closed 1 month ago

whg517 commented 1 month ago

Describe the bug

zk cluster:

apiVersion: zookeeper.zncdata.dev/v1alpha1
kind: ZookeeperCluster
metadata:
  labels:
    app.kubernetes.io/name: zookeepercluster
    app.kubernetes.io/instance: zookeepercluster-sample
    app.kubernetes.io/part-of: zookeeper-operator
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/created-by: zookeeper-operator
  name: zookeepercluster-sample
spec:
  clusterOperation:
    stopped: false
  clusterConfig:
    listenerClass: external-unstable
    tls:
      quorumSecretClass: tls
      serverSecretClass: tls
  server:
    roleGroups:
      default:
        replicas: 2
        config:
          resources:
            cpu:
              min: "400m"
              max: "800m"
            memory:
              limit: "2Gi"
          logging:
            zookeeperCluster:
              loggers:
                test:
                  level: DEBUG
              console:
                level: INFO
              file:
                level: INFO

zk operator log is fine.

zk log:

Defaulted container "server" out of: server, prepare (init)
+ LOG_CONFIG_DIR_MOUNT=/kubedoop/mount/log/
+ CONFIG_DIR_MOUNT=/kubedoop/mount/config/
+ CONFIG_DIR=/kubedoop/config/
+ mkdir --parents /kubedoop/config/
+ echo copying /kubedoop/mount/log/ to /kubedoop/config/, /kubedoop/mount/config/ to /kubedoop/config/
+ cp -RL /kubedoop/mount/log/logback.xml /kubedoop/mount/log/security.properties /kubedoop/mount/log/zoo.cfg /kubedoop/config/
copying /kubedoop/mount/log/ to /kubedoop/config/, /kubedoop/mount/config/ to /kubedoop/config/
+ cp -RL /kubedoop/mount/config/logback.xml /kubedoop/mount/config/security.properties /kubedoop/mount/config/zoo.cfg /kubedoop/config/
+ rm -f /kubedoop/log/_vector/shutdown
+ prepare_signal_handlers
+ unset term_child_pid
+ unset term_kill_needed
+ trap handle_term_signal TERM
+ wait_for_termination 14
+ set +e
+ term_child_pid=14
+ [[ -v term_kill_needed ]]
+ wait 14
+ bin/zkServer.sh start-foreground /kubedoop/config/zoo.cfg
ZooKeeper JMX enabled by default
Using config: /kubedoop/config/zoo.cfg
2024-09-10 03:43:22,955 [myid:] - INFO  [main:o.a.z.s.q.QuorumPeerConfig@177] - Reading configuration from: /kubedoop/config/zoo.cfg
2024-09-10 03:43:22,957 [myid:] - INFO  [main:o.a.z.s.q.QuorumPeerConfig@440] - clientPortAddress is 0.0.0.0:2282
2024-09-10 03:43:22,958 [myid:] - INFO  [main:o.a.z.s.q.QuorumPeerConfig@444] - secureClientPort is not set
2024-09-10 03:43:22,958 [myid:] - INFO  [main:o.a.z.s.q.QuorumPeerConfig@460] - observerMasterPort is not set
2024-09-10 03:43:22,958 [myid:] - INFO  [main:o.a.z.s.q.QuorumPeerConfig@477] - metricsProvider.className is org.apache.zookeeper.metrics.impl.DefaultMetricsProvider
2024-09-10 03:43:22,962 [myid:] - WARN  [main:o.a.z.s.q.QuorumPeerConfig@709] - No server failure will be tolerated. You need at least 3 servers.
2024-09-10 03:43:22,963 [myid:1] - INFO  [main:o.a.z.s.DatadirCleanupManager@78] - autopurge.snapRetainCount set to 3
2024-09-10 03:43:22,963 [myid:1] - INFO  [main:o.a.z.s.DatadirCleanupManager@79] - autopurge.purgeInterval set to 0
2024-09-10 03:43:22,964 [myid:1] - INFO  [main:o.a.z.s.DatadirCleanupManager@101] - Purge task is not scheduled.
2024-09-10 03:43:22,964 [myid:1] - INFO  [main:o.a.z.j.ManagedUtil@46] - Log4j 1.2 jmx support not found; jmx disabled.
2024-09-10 03:43:22,964 [myid:1] - INFO  [main:o.a.z.s.q.QuorumPeerMain@152] - Starting quorum peer, myid=1
2024-09-10 03:43:22,968 [myid:1] - INFO  [main:o.a.z.s.ServerMetrics@64] - ServerMetrics initialized with provider org.apache.zookeeper.metrics.impl.DefaultMetricsProvider@15a04efb
2024-09-10 03:43:22,969 [myid:1] - INFO  [main:o.a.z.s.a.DigestAuthenticationProvider@51] - ACL digest algorithm is: SHA1
2024-09-10 03:43:22,969 [myid:1] - INFO  [main:o.a.z.s.a.DigestAuthenticationProvider@65] - zookeeper.DigestAuthenticationProvider.enabled = true
2024-09-10 03:43:22,973 [myid:1] - INFO  [main:o.a.z.c.X509Util@88] - Setting -D jdk.tls.rejectClientInitiatedRenegotiation=true to disable client-initiated TLS renegotiation
2024-09-10 03:43:23,161 [myid:1] - INFO  [main:o.a.z.c.X509Util@110] - Default TLS protocol is TLSv1.3, supported TLS protocols are [TLSv1.3, TLSv1.2, TLSv1.1, TLSv1, SSLv3, SSLv2Hello]
2024-09-10 03:43:23,340 [myid:1] - INFO  [main:o.a.z.s.NettyServerCnxnFactory@516] - zookeeper.client.certReload=false
2024-09-10 03:43:23,341 [myid:1] - INFO  [main:o.a.z.s.NettyServerCnxnFactory@528] - zookeeper.client.portUnification=true
2024-09-10 03:43:23,341 [myid:1] - INFO  [main:o.a.z.s.NettyServerCnxnFactory@540] - zookeeper.netty.advancedFlowControl.enabled = false
2024-09-10 03:43:23,341 [myid:1] - INFO  [main:o.a.z.s.NettyServerCnxnFactory@103] - handshakeThrottlingEnabled = false, zookeeper.netty.server.outstandingHandshake.limit = -1
2024-09-10 03:43:23,356 [myid:1] - INFO  [main:o.a.z.s.ServerCnxnFactory@169] - Using org.apache.zookeeper.server.NettyServerCnxnFactory as server connection factory
2024-09-10 03:43:23,357 [myid:1] - WARN  [main:o.a.z.s.ServerCnxnFactory@309] - maxCnxns is not configured, using default value 0.
2024-09-10 03:43:23,357 [myid:1] - INFO  [main:o.a.z.s.NettyServerCnxnFactory@626] - configure org.apache.zookeeper.server.NettyServerCnxnFactory@e98770d secure: false on addr /0.0.0.0:2282
2024-09-10 03:43:23,358 [myid:1] - INFO  [main:o.a.z.s.q.QuorumPeer@801] - zookeeper.quorumCnxnTimeoutMs=-1
2024-09-10 03:43:23,367 [myid:1] - INFO  [main:o.e.j.u.l.Log@170] - Logging initialized @1435ms to org.eclipse.jetty.util.log.Slf4jLog
2024-09-10 03:43:23,454 [myid:1] - WARN  [main:o.e.j.s.h.ContextHandler@1662] - o.e.j.s.ServletContextHandler@132ddbab{/,null,STOPPED} contextPath ends with /*
2024-09-10 03:43:23,454 [myid:1] - WARN  [main:o.e.j.s.h.ContextHandler@1673] - Empty contextPath
2024-09-10 03:43:23,462 [myid:1] - INFO  [main:o.a.z.s.p.FileTxnSnapLog@124] - zookeeper.snapshot.trust.empty : false
2024-09-10 03:43:23,464 [myid:1] - INFO  [main:o.a.z.s.q.QuorumPeer@1781] - Local sessions disabled
2024-09-10 03:43:23,464 [myid:1] - INFO  [main:o.a.z.s.q.QuorumPeer@1792] - Local session upgrading disabled
2024-09-10 03:43:23,464 [myid:1] - INFO  [main:o.a.z.s.q.QuorumPeer@1759] - tickTime set to 3000
2024-09-10 03:43:23,464 [myid:1] - INFO  [main:o.a.z.s.q.QuorumPeer@1803] - minSessionTimeout set to 6000
2024-09-10 03:43:23,464 [myid:1] - INFO  [main:o.a.z.s.q.QuorumPeer@1814] - maxSessionTimeout set to 60000
2024-09-10 03:43:23,464 [myid:1] - INFO  [main:o.a.z.s.q.QuorumPeer@1839] - initLimit set to 5
2024-09-10 03:43:23,464 [myid:1] - INFO  [main:o.a.z.s.q.QuorumPeer@2026] - syncLimit set to 2
2024-09-10 03:43:23,464 [myid:1] - INFO  [main:o.a.z.s.q.QuorumPeer@2041] - connectToLearnerMasterLimit set to 0
2024-09-10 03:43:23,469 [myid:1] - INFO  [main:o.a.z.ZookeeperBanner@42] - 
2024-09-10 03:43:23,470 [myid:1] - INFO  [main:o.a.z.ZookeeperBanner@42] -   ______                  _                                          
2024-09-10 03:43:23,470 [myid:1] - INFO  [main:o.a.z.ZookeeperBanner@42] -  |___  /                 | |                                         
2024-09-10 03:43:23,470 [myid:1] - INFO  [main:o.a.z.ZookeeperBanner@42] -     / /    ___     ___   | | __   ___    ___   _ __     ___   _ __   
2024-09-10 03:43:23,470 [myid:1] - INFO  [main:o.a.z.ZookeeperBanner@42] -    / /    / _ \   / _ \  | |/ /  / _ \  / _ \ | '_ \   / _ \ | '__|
2024-09-10 03:43:23,470 [myid:1] - INFO  [main:o.a.z.ZookeeperBanner@42] -   / /__  | (_) | | (_) | |   <  |  __/ |  __/ | |_) | |  __/ | |    
2024-09-10 03:43:23,470 [myid:1] - INFO  [main:o.a.z.ZookeeperBanner@42] -  /_____|  \___/   \___/  |_|\_\  \___|  \___| | .__/   \___| |_|
2024-09-10 03:43:23,470 [myid:1] - INFO  [main:o.a.z.ZookeeperBanner@42] -                                               | |                     
2024-09-10 03:43:23,470 [myid:1] - INFO  [main:o.a.z.ZookeeperBanner@42] -                                               |_|                     
2024-09-10 03:43:23,470 [myid:1] - INFO  [main:o.a.z.ZookeeperBanner@42] - 
2024-09-10 03:43:23,471 [myid:1] - INFO  [main:o.a.z.Environment@98] - Server environment:zookeeper.version=3.9.2-${mvngit.commit.id}, built on 2024-09-08 11:07 UTC
2024-09-10 03:43:23,471 [myid:1] - INFO  [main:o.a.z.Environment@98] - Server environment:host.name=zookeepercluster-sample-server-default-0.zookeepercluster-sample-server-default.chainsaw-tender-pony.svc.cluster.local
2024-09-10 03:43:23,471 [myid:1] - INFO  [main:o.a.z.Environment@98] - Server environment:java.version=11.0.24
2024-09-10 03:43:23,471 [myid:1] - INFO  [main:o.a.z.Environment@98] - Server environment:java.vendor=Red Hat, Inc.
2024-09-10 03:43:23,471 [myid:1] - INFO  [main:o.a.z.Environment@98] - Server environment:java.home=/usr/lib/jvm/java-11-openjdk-11.0.24.0.8-2.el9.aarch64
2024-09-10 03:43:23,471 [myid:1] - INFO  [main:o.a.z.Environment@98] - Server environment:java.class.path=/kubedoop/apache-zookeeper-3.9.2/bin/../zookeeper-metrics-providers/zookeeper-prometheus-metrics/target/classes:/kubedoop/apache-zookeeper-3.9.2/bin/../zookeeper-server/target/classes:/kubedoop/apache-zookeeper-3.9.2/bin/../build/classes:/kubedoop/apache-zookeeper-3.9.2/bin/../zookeeper-metrics-providers/zookeeper-prometheus-metrics/target/lib/*.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../zookeeper-server/target/lib/*.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../build/lib/*.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/zookeeper-prometheus-metrics-3.9.2.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/zookeeper-jute-3.9.2.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/zookeeper-3.9.2.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/snappy-java-1.1.10.5.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/slf4j-api-1.7.30.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/simpleclient_servlet-0.9.0.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/simpleclient_hotspot-0.9.0.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/simpleclient_common-0.9.0.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/simpleclient-0.9.0.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/netty-transport-native-unix-common-4.1.105.Final.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/netty-transport-native-epoll-4.1.105.Final-linux-x86_64.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/netty-transport-classes-epoll-4.1.105.Final.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/netty-transport-4.1.105.Final.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/netty-tcnative-classes-2.0.61.Final.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/netty-tcnative-boringssl-static-2.0.61.Final.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/netty-tcnative-boringssl-static-2.0.61.Final-windows-x86_64.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/netty-tcnative-boringssl-static-2.0.61.Final-osx-x86_64.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/netty-tcnative-boringssl-static-2.0.61.Final-osx-aarch_64.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/netty-tcnative-boringssl-static-2.0.61.Final-linux-x86_64.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/netty-tcnative-boringssl-static-2.0.61.Final-linux-aarch_64.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/netty-resolver-4.1.105.Final.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/netty-handler-4.1.105.Final.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/netty-common-4.1.105.Final.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/netty-codec-4.1.105.Final.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/netty-buffer-4.1.105.Final.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/metrics-core-4.1.12.1.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/logback-core-1.2.13.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/logback-classic-1.2.13.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/jline-2.14.6.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/jetty-util-ajax-9.4.53.v20231009.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/jetty-util-9.4.53.v20231009.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/jetty-servlet-9.4.53.v20231009.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/jetty-server-9.4.53.v20231009.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/jetty-security-9.4.53.v20231009.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/jetty-io-9.4.53.v20231009.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/jetty-http-9.4.53.v20231009.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/javax.servlet-api-3.1.0.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/jackson-databind-2.15.2.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/jackson-core-2.15.2.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/jackson-annotations-2.15.2.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/commons-io-2.11.0.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/commons-cli-1.5.0.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../lib/audience-annotations-0.12.0.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../zookeeper-*.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../zookeeper-server/src/main/resources/lib/*.jar:/kubedoop/apache-zookeeper-3.9.2/bin/../conf:
2024-09-10 03:43:23,471 [myid:1] - INFO  [main:o.a.z.Environment@98] - Server environment:java.library.path=/usr/java/packages/lib:/lib:/usr/lib:/usr/lib64:/lib64
2024-09-10 03:43:23,471 [myid:1] - INFO  [main:o.a.z.Environment@98] - Server environment:java.io.tmpdir=/tmp
2024-09-10 03:43:23,471 [myid:1] - INFO  [main:o.a.z.Environment@98] - Server environment:java.compiler=<NA>
2024-09-10 03:43:23,471 [myid:1] - INFO  [main:o.a.z.Environment@98] - Server environment:os.name=Linux
2024-09-10 03:43:23,471 [myid:1] - INFO  [main:o.a.z.Environment@98] - Server environment:os.arch=aarch64
2024-09-10 03:43:23,471 [myid:1] - INFO  [main:o.a.z.Environment@98] - Server environment:os.version=6.10.4-linuxkit
2024-09-10 03:43:23,471 [myid:1] - INFO  [main:o.a.z.Environment@98] - Server environment:user.name=kubedoop
2024-09-10 03:43:23,471 [myid:1] - INFO  [main:o.a.z.Environment@98] - Server environment:user.home=/kubedoop
2024-09-10 03:43:23,471 [myid:1] - INFO  [main:o.a.z.Environment@98] - Server environment:user.dir=/kubedoop/apache-zookeeper-3.9.2
2024-09-10 03:43:23,471 [myid:1] - INFO  [main:o.a.z.Environment@98] - Server environment:os.memory.free=19MB
2024-09-10 03:43:23,471 [myid:1] - INFO  [main:o.a.z.Environment@98] - Server environment:os.memory.max=1583MB
2024-09-10 03:43:23,471 [myid:1] - INFO  [main:o.a.z.Environment@98] - Server environment:os.memory.total=30MB
2024-09-10 03:43:23,471 [myid:1] - INFO  [main:o.a.z.s.ZooKeeperServer@149] - zookeeper.enableEagerACLCheck = false
2024-09-10 03:43:23,472 [myid:1] - INFO  [main:o.a.z.s.ZooKeeperServer@162] - zookeeper.digest.enabled = true
2024-09-10 03:43:23,472 [myid:1] - INFO  [main:o.a.z.s.ZooKeeperServer@166] - zookeeper.closeSessionTxn.enabled = true
2024-09-10 03:43:23,472 [myid:1] - INFO  [main:o.a.z.s.ZooKeeperServer@2253] - zookeeper.serializeLastProcessedZxid.enabled = true
2024-09-10 03:43:23,472 [myid:1] - INFO  [main:o.a.z.s.ZooKeeperServer@1596] - zookeeper.flushDelay = 0 ms
2024-09-10 03:43:23,472 [myid:1] - INFO  [main:o.a.z.s.ZooKeeperServer@1605] - zookeeper.maxWriteQueuePollTime = 0 ms
2024-09-10 03:43:23,472 [myid:1] - INFO  [main:o.a.z.s.ZooKeeperServer@1614] - zookeeper.maxBatchSize=1000
2024-09-10 03:43:23,472 [myid:1] - INFO  [main:o.a.z.s.ZooKeeperServer@287] - zookeeper.intBufferStartingSizeBytes = 1024
2024-09-10 03:43:23,537 [myid:1] - INFO  [main:o.a.z.s.w.WatchManagerFactory@42] - Using org.apache.zookeeper.server.watch.WatchManager as watch manager
2024-09-10 03:43:23,537 [myid:1] - INFO  [main:o.a.z.s.w.WatchManagerFactory@42] - Using org.apache.zookeeper.server.watch.WatchManager as watch manager
2024-09-10 03:43:23,538 [myid:1] - INFO  [main:o.a.z.s.ZKDatabase@134] - zookeeper.snapshotSizeFactor = 0.33
2024-09-10 03:43:23,538 [myid:1] - INFO  [main:o.a.z.s.ZKDatabase@154] - zookeeper.commitLogCount=500
2024-09-10 03:43:23,543 [myid:1] - INFO  [main:o.a.z.s.q.QuorumPeer@2103] - Using TLS encrypted quorum communication
2024-09-10 03:43:23,543 [myid:1] - INFO  [main:o.a.z.s.q.QuorumPeer@2111] - Port unification disabled
2024-09-10 03:43:23,543 [myid:1] - INFO  [main:o.a.z.s.q.QuorumPeer@184] - multiAddress.enabled set to false
2024-09-10 03:43:23,543 [myid:1] - INFO  [main:o.a.z.s.q.QuorumPeer@209] - multiAddress.reachabilityCheckEnabled set to true
2024-09-10 03:43:23,543 [myid:1] - INFO  [main:o.a.z.s.q.QuorumPeer@196] - multiAddress.reachabilityCheckTimeoutMs set to 1000
2024-09-10 03:43:23,543 [myid:1] - INFO  [main:o.a.z.s.q.QuorumPeer@2573] - QuorumPeer communication is not secured! (SASL auth disabled)
2024-09-10 03:43:23,544 [myid:1] - INFO  [main:o.a.z.s.q.QuorumPeer@2598] - quorum.cnxn.threads.size set to 20
2024-09-10 03:43:23,546 [myid:1] - INFO  [main:o.a.z.s.p.SnapStream@61] - zookeeper.snapshot.compression.method = CHECKED
2024-09-10 03:43:23,546 [myid:1] - INFO  [main:o.a.z.s.p.FileTxnSnapLog@480] - Snapshotting: 0x0 to /kubedoop/data/version-2/snapshot.0
2024-09-10 03:43:23,548 [myid:1] - INFO  [main:o.a.z.s.ZKDatabase@291] - Snapshot loaded in 4 ms, highest zxid is 0x0, digest is 1371985504
2024-09-10 03:43:23,548 [myid:1] - INFO  [main:o.a.z.s.q.QuorumPeer@1161] - currentEpoch not found! Creating with a reasonable default of 0. This should only happen when you are upgrading your installation
2024-09-10 03:43:23,550 [myid:1] - INFO  [main:o.a.z.s.q.QuorumPeer@1189] - acceptedEpoch not found! Creating with a reasonable default of 0. This should only happen when you are upgrading your installation
2024-09-10 03:43:23,551 [myid:1] - INFO  [main:o.a.z.s.NettyServerCnxnFactory@715] - binding to port /0.0.0.0:2282
2024-09-10 03:43:23,643 [myid:1] - INFO  [main:o.a.z.s.NettyServerCnxnFactory@720] - bound to port 2282
2024-09-10 03:43:23,645 [myid:1] - INFO  [main:o.e.j.s.Server@375] - jetty-9.4.53.v20231009; built: 2023-10-09T12:29:09.265Z; git: 27bde00a0b95a1d5bbee0eae7984f891d2d0f8c9; jvm 11.0.24+8-LTS
2024-09-10 03:43:23,673 [myid:1] - INFO  [main:o.e.j.s.s.DefaultSessionIdManager@334] - DefaultSessionIdManager workerName=node0
2024-09-10 03:43:23,673 [myid:1] - INFO  [main:o.e.j.s.s.DefaultSessionIdManager@339] - No SessionScavenger set, using defaults
2024-09-10 03:43:23,674 [myid:1] - INFO  [main:o.e.j.s.s.HouseKeeper@132] - node0 Scavenging every 600000ms
2024-09-10 03:43:23,675 [myid:1] - WARN  [main:o.e.j.s.ConstraintSecurityHandler@759] - ServletContext@o.e.j.s.ServletContextHandler@132ddbab{/,null,STARTING} has uncovered http methods for path: /*
2024-09-10 03:43:23,680 [myid:1] - INFO  [main:o.e.j.s.h.ContextHandler@921] - Started o.e.j.s.ServletContextHandler@132ddbab{/,null,AVAILABLE}
2024-09-10 03:43:23,741 [myid:1] - INFO  [main:o.e.j.s.AbstractConnector@333] - Started ServerConnector@40e10ff8{HTTP/1.1, (http/1.1)}{0.0.0.0:8080}
2024-09-10 03:43:23,741 [myid:1] - INFO  [main:o.e.j.s.Server@415] - Started @1810ms
2024-09-10 03:43:23,741 [myid:1] - INFO  [main:o.a.z.s.a.JettyAdminServer@201] - Started AdminServer on address 0.0.0.0, port 8080 and command URL /commands
2024-09-10 03:43:23,742 [myid:1] - INFO  [main:o.a.z.s.q.QuorumPeer@2615] - Using 6000ms as the quorum cnxn socket timeout
2024-09-10 03:43:23,744 [myid:1] - INFO  [main:o.a.z.s.q.QuorumCnxManager$Listener@924] - Election port bind maximum retries is 3
2024-09-10 03:43:23,745 [myid:1] - INFO  [main:o.a.z.s.q.FastLeaderElection@90] - zookeeper.fastleader.minNotificationInterval = 200 ms
2024-09-10 03:43:23,745 [myid:1] - INFO  [main:o.a.z.s.q.FastLeaderElection@92] - zookeeper.fastleader.maxNotificationInterval = 60000 ms
2024-09-10 03:43:23,746 [myid:] - INFO  [ListenerHandler-zookeepercluster-sample-server-default-0.zookeepercluster-sample-server-default.chainsaw-tender-pony.svc.cluster.local/10.244.0.23:3888:o.a.z.s.q.QuorumCnxManager$Listener$ListenerHandler@1133] - Creating TLS-only quorum server socket
2024-09-10 03:43:23,748 [myid:1] - INFO  [main:o.a.z.a.ZKAuditProvider@42] - ZooKeeper audit is disabled.
2024-09-10 03:43:23,749 [myid:] - INFO  [ListenerHandler-zookeepercluster-sample-server-default-0.zookeepercluster-sample-server-default.chainsaw-tender-pony.svc.cluster.local/10.244.0.23:3888:o.a.z.s.q.QuorumCnxManager$Listener$ListenerHandler@1071] - 1 is accepting connections now, my election bind port: zookeepercluster-sample-server-default-0.zookeepercluster-sample-server-default.chainsaw-tender-pony.svc.cluster.local/10.244.0.23:3888
2024-09-10 03:43:23,751 [myid:] - INFO  [QuorumPeer[myid=1](plain=[0:0:0:0:0:0:0:0]:2282)(secure=disabled):o.a.z.s.q.QuorumPeer@1471] - LOOKING
2024-09-10 03:43:23,752 [myid:] - INFO  [QuorumPeer[myid=1](plain=[0:0:0:0:0:0:0:0]:2282)(secure=disabled):o.a.z.s.q.FastLeaderElection@947] - New election. My id = 1, proposed zxid=0x0
2024-09-10 03:43:23,757 [myid:] - INFO  [WorkerReceiver[myid=1]:o.a.z.s.q.FastLeaderElection$Messenger$WorkerReceiver@391] - Notification: my state:LOOKING; n.sid:1, n.state:LOOKING, n.leader:1, n.round:0x1, n.peerEpoch:0x0, n.zxid:0x0, message format version:0x2, n.config version:0x0
2024-09-10 03:43:23,840 [myid:] - WARN  [QuorumConnectionThread-[myid=1]-1:o.a.z.s.q.QuorumCnxManager@401] - Cannot open channel to 2 at election address zookeepercluster-sample-server-default-1.zookeepercluster-sample-server-default.chainsaw-tender-pony.svc.cluster.local/10.244.0.22:3888
java.net.ConnectException: Connection refused (Connection refused)
        at java.base/java.net.PlainSocketImpl.socketConnect(Native Method)
        at java.base/java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:412)
        at java.base/java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:255)
        at java.base/java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:237)
        at java.base/java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)
        at java.base/java.net.Socket.connect(Socket.java:609)
        at java.base/sun.security.ssl.SSLSocketImpl.connect(SSLSocketImpl.java:305)
        at org.apache.zookeeper.server.quorum.QuorumCnxManager.initiateConnection(QuorumCnxManager.java:384)
        at org.apache.zookeeper.server.quorum.QuorumCnxManager$QuorumConnectionReqThread.run(QuorumCnxManager.java:458)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
        at java.base/java.lang.Thread.run(Thread.java:829)
2024-09-10 03:43:23,854 [myid:] - INFO  [nioEventLoopGroup-4-1:o.a.z.s.c.FourLetterCommands@223] - The list of known four letter word commands is : [{1936881266=srvr, 1937006964=stat, 2003003491=wchc, 1685417328=dump, 1668445044=crst, 1936880500=srst, 1701738089=envi, 1668247142=conf, -720899=telnet close, 1751217000=hash, 2003003507=wchs, 2003003504=wchp, 1684632179=dirs, 1668247155=cons, 1835955314=mntr, 1769173615=isro, 1920298859=ruok, 1735683435=gtmk, 1937010027=stmk}]
2024-09-10 03:43:23,854 [myid:] - INFO  [nioEventLoopGroup-4-1:o.a.z.s.c.FourLetterCommands@224] - The list of enabled four letter word commands is : [[conf, ruok, mntr, srvr]]
2024-09-10 03:43:23,854 [myid:] - INFO  [nioEventLoopGroup-4-1:o.a.z.s.NettyServerCnxn@311] - Processing srvr command from /127.0.0.1:53990
2024-09-10 03:43:23,942 [myid:] - INFO  [ListenerHandler-zookeepercluster-sample-server-default-0.zookeepercluster-sample-server-default.chainsaw-tender-pony.svc.cluster.local/10.244.0.23:3888:o.a.z.s.q.QuorumCnxManager$Listener$ListenerHandler@1076] - Received connection request from /10.244.0.22:54912
2024-09-10 03:43:23,944 [myid:] - INFO  [nioEventLoopGroup-4-2:o.a.z.s.NettyServerCnxn@311] - Processing srvr command from /127.0.0.1:54006
2024-09-10 03:43:23,960 [myid:] - INFO  [QuorumPeer[myid=1](plain=[0:0:0:0:0:0:0:0]:2282)(secure=disabled):o.a.z.s.q.FastLeaderElection@997] - Notification time out: 400 ms
2024-09-10 03:43:24,252 [myid:] - INFO  [ListenerHandler-zookeepercluster-sample-server-default-0.zookeepercluster-sample-server-default.chainsaw-tender-pony.svc.cluster.local/10.244.0.23:3888:o.a.z.s.q.UnifiedServerSocket$UnifiedSocket@266] - Accepted TLS connection from /10.244.0.22:54912 - NONE - SSL_NULL_WITH_NULL_NULL
2024-09-10 03:43:24,252 [myid:] - WARN  [ListenerHandler-zookeepercluster-sample-server-default-0.zookeepercluster-sample-server-default.chainsaw-tender-pony.svc.cluster.local/10.244.0.23:3888:o.a.z.s.q.QuorumCnxManager@630] - Exception reading or writing challenge
java.net.SocketException: Socket is closed
        at java.base/sun.security.ssl.SSLSocketImpl.getInputStream(SSLSocketImpl.java:894)
        at org.apache.zookeeper.server.quorum.UnifiedServerSocket$UnifiedInputStream.getRealInputStream(UnifiedServerSocket.java:699)
        at org.apache.zookeeper.server.quorum.UnifiedServerSocket$UnifiedInputStream.read(UnifiedServerSocket.java:693)
        at java.base/java.io.BufferedInputStream.fill(BufferedInputStream.java:252)
        at java.base/java.io.BufferedInputStream.read1(BufferedInputStream.java:292)
        at java.base/java.io.BufferedInputStream.read(BufferedInputStream.java:351)
        at java.base/java.io.DataInputStream.readFully(DataInputStream.java:200)
        at java.base/java.io.DataInputStream.readLong(DataInputStream.java:421)
        at org.apache.zookeeper.server.quorum.QuorumCnxManager.handleConnection(QuorumCnxManager.java:602)
        at org.apache.zookeeper.server.quorum.QuorumCnxManager.receiveConnection(QuorumCnxManager.java:555)
        at org.apache.zookeeper.server.quorum.QuorumCnxManager$Listener$ListenerHandler.acceptConnections(QuorumCnxManager.java:1085)
        at org.apache.zookeeper.server.quorum.QuorumCnxManager$Listener$ListenerHandler.run(QuorumCnxManager.java:1039)
        at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
        at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
        at java.base/java.lang.Thread.run(Thread.java:829)
2024-09-10 03:43:24,361 [myid:] - INFO  [QuorumPeer[myid=1](plain=[0:0:0:0:0:0:0:0]:2282)(secure=disabled):o.a.z.s.q.FastLeaderElection@997] - Notification time out: 800 ms
2024-09-10 03:43:24,463 [myid:] - WARN  [QuorumConnectionThread-[myid=1]-2:o.a.z.s.q.QuorumCnxManager@401] - Cannot open channel to 2 at election address zookeepercluster-sample-server-default-1.zookeepercluster-sample-server-default.chainsaw-tender-pony.svc.cluster.local/10.244.0.22:3888
javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
        at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:360)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:303)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:298)
        at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1357)
        at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1232)
        at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1175)
        at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392)
        at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:443)
        at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:421)
        at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:183)
        at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
        at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1511)
        at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1421)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:456)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:427)
        at org.apache.zookeeper.server.quorum.QuorumCnxManager.initiateConnection(QuorumCnxManager.java:387)
        at org.apache.zookeeper.server.quorum.QuorumCnxManager$QuorumConnectionReqThread.run(QuorumCnxManager.java:458)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
        at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
        at java.base/sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:369)
        at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:275)
        at java.base/sun.security.validator.Validator.validate(Validator.java:264)
        at java.base/sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:313)
        at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:222)
        at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:129)
        at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1341)
        ... 16 common frames omitted
Caused by: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
        at java.base/sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:157)
        at java.base/sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(PKIXCertPathValidator.java:83)
        at java.base/java.security.cert.CertPathValidator.validate(CertPathValidator.java:309)
        at java.base/sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:364)
        ... 22 common frames omitted
2024-09-10 03:43:24,535 [myid:] - INFO  [ListenerHandler-zookeepercluster-sample-server-default-0.zookeepercluster-sample-server-default.chainsaw-tender-pony.svc.cluster.local/10.244.0.23:3888:o.a.z.s.q.QuorumCnxManager$Listener$ListenerHandler@1076] - Received connection request from /10.244.0.22:54920
2024-09-10 03:43:24,568 [myid:] - INFO  [ListenerHandler-zookeepercluster-sample-server-default-0.zookeepercluster-sample-server-default.chainsaw-tender-pony.svc.cluster.local/10.244.0.23:3888:o.a.z.s.q.UnifiedServerSocket$UnifiedSocket@266] - Accepted TLS connection from /10.244.0.22:54920 - NONE - SSL_NULL_WITH_NULL_NULL
2024-09-10 03:43:24,569 [myid:] - WARN  [ListenerHandler-zookeepercluster-sample-server-default-0.zookeepercluster-sample-server-default.chainsaw-tender-pony.svc.cluster.local/10.244.0.23:3888:o.a.z.s.q.QuorumCnxManager@630] - Exception reading or writing challenge
java.net.SocketException: Socket is closed
        at java.base/sun.security.ssl.SSLSocketImpl.getInputStream(SSLSocketImpl.java:894)
        at org.apache.zookeeper.server.quorum.UnifiedServerSocket$UnifiedInputStream.getRealInputStream(UnifiedServerSocket.java:699)
        at org.apache.zookeeper.server.quorum.UnifiedServerSocket$UnifiedInputStream.read(UnifiedServerSocket.java:693)
        at java.base/java.io.BufferedInputStream.fill(BufferedInputStream.java:252)
        at java.base/java.io.BufferedInputStream.read1(BufferedInputStream.java:292)
        at java.base/java.io.BufferedInputStream.read(BufferedInputStream.java:351)
        at java.base/java.io.DataInputStream.readFully(DataInputStream.java:200)
        at java.base/java.io.DataInputStream.readLong(DataInputStream.java:421)
        at org.apache.zookeeper.server.quorum.QuorumCnxManager.handleConnection(QuorumCnxManager.java:602)
        at org.apache.zookeeper.server.quorum.QuorumCnxManager.receiveConnection(QuorumCnxManager.java:555)
        at org.apache.zookeeper.server.quorum.QuorumCnxManager$Listener$ListenerHandler.acceptConnections(QuorumCnxManager.java:1085)
        at org.apache.zookeeper.server.quorum.QuorumCnxManager$Listener$ListenerHandler.run(QuorumCnxManager.java:1039)
        at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
        at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
        at java.base/java.lang.Thread.run(Thread.java:829)
2024-09-10 03:43:24,701 [myid:] - INFO  [nioEventLoopGroup-4-1:o.a.z.s.NettyServerCnxn@311] - Processing srvr command from /127.0.0.1:54024
2024-09-10 03:43:24,869 [myid:] - INFO  [nioEventLoopGroup-4-2:o.a.z.s.NettyServerCnxn@311] - Processing srvr command from /127.0.0.1:54050
2024-09-10 03:43:25,163 [myid:] - INFO  [QuorumPeer[myid=1](plain=[0:0:0:0:0:0:0:0]:2282)(secure=disabled):o.a.z.s.q.FastLeaderElection@997] - Notification time out: 1600 ms
2024-09-10 03:43:25,171 [myid:] - WARN  [QuorumConnectionThread-[myid=1]-3:o.a.z.s.q.QuorumCnxManager@401] - Cannot open channel to 2 at election address zookeepercluster-sample-server-default-1.zookeepercluster-sample-server-default.chainsaw-tender-pony.svc.cluster.local/10.244.0.22:3888
javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
        at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:360)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:303)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:298)
        at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1357)
        at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1232)
        at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1175)
        at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392)
        at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:443)
        at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:421)
        at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:183)
        at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
        at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1511)
        at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1421)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:456)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:427)
        at org.apache.zookeeper.server.quorum.QuorumCnxManager.initiateConnection(QuorumCnxManager.java:387)
        at org.apache.zookeeper.server.quorum.QuorumCnxManager$QuorumConnectionReqThread.run(QuorumCnxManager.java:458)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
        at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
        at java.base/sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:369)
        at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:275)
        at java.base/sun.security.validator.Validator.validate(Validator.java:264)
        at java.base/sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:313)
        at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:222)
        at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:129)
        at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1341)
        ... 16 common frames omitted
Caused by: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
        at java.base/sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:157)
        at java.base/sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(PKIXCertPathValidator.java:83)
        at java.base/java.security.cert.CertPathValidator.validate(CertPathValidator.java:309)
        at java.base/sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:364)
        ... 22 common frames omitted
2024-09-10 03:43:25,336 [myid:] - INFO  [ListenerHandler-zookeepercluster-sample-server-default-0.zookeepercluster-sample-server-default.chainsaw-tender-pony.svc.cluster.local/10.244.0.23:3888:o.a.z.s.q.QuorumCnxManager$Listener$ListenerHandler@1076] - Received connection request from /10.244.0.22:54924
2024-09-10 03:43:25,353 [myid:] - INFO  [ListenerHandler-zookeepercluster-sample-server-default-0.zookeepercluster-sample-server-default.chainsaw-tender-pony.svc.cluster.local/10.244.0.23:3888:o.a.z.s.q.UnifiedServerSocket$UnifiedSocket@266] - Accepted TLS connection from /10.244.0.22:54924 - NONE - SSL_NULL_WITH_NULL_NULL

System Info

- zk: 3.9.2
- platform: 0.0.0-dev

Severity

Blocking usage of operator

whg517 commented 1 month ago

about SAN:

whg517 commented 1 month ago

Certificate abstract:

keystore.p12 with keytool

 keytool -v -list -storetype pkcs12 -keystore keystore.p12 
Enter keystore password:  
Keystore type: PKCS12
Keystore provider: SUN

Your keystore contains 1 entry

Alias name: 1
Creation date: Sep 10, 2024
Entry type: PrivateKeyEntry
Certificate chain length: 2
Certificate[1]:
Owner: 
Issuer: CN=secret-operator self-signed CA
Serial number: 83405e84b11c10b2
Valid from: Tue Sep 10 03:58:02 GMT 2024 until: Tue Sep 10 13:58:02 GMT 2024
Certificate fingerprints:
         SHA1: 6A:D0:EE:97:D8:D6:A1:B7:50:11:07:C2:63:9F:6B:70:CF:96:EE:D3
         SHA256: 18:DB:A5:A5:B6:FC:2C:54:B9:52:AD:0B:DB:03:EA:6F:7E:94:72:C2:CC:C0:DD:E5:77:28:F2:2D:B4:02:22:41
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 2048-bit RSA key
Version: 3

Extensions: 

#1: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 10 C0 0F 30 DA 5C CD 08   DD 96 D7 14 43 3F 17 FA  ...0.\......C?..
0010: 49 DB ED 04 FF 3F 56 6A   45 37 86 75 ED E0 40 92  I....?VjE7.u..@.
]
]

#2: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:false
  PathLen: undefined
]

#3: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
  clientAuth
  serverAuth
]

#4: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
  DigitalSignature
  Key_Encipherment
]

#5: ObjectId: 2.5.29.17 Criticality=true
SubjectAlternativeName [
  DNSName: zookeeper-operator-1.27.11-control-plane
  DNSName: zookeepercluster-sample-server-default.chainsaw-wise-shark.svc.cluster.local
  DNSName: zookeepercluster-sample-server-default-0.zookeepercluster-sample-server-default.chainsaw-wise-shark.svc.cluster.local
  IPAddress: 172.18.0.2
]

#6: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: BA 80 EE 18 E4 65 E1 F2   A1 E1 C7 B0 AB 01 57 C0  .....e........W.
0010: 5A CA 2A 80 10 62 D0 BE   16 0F 0C 5B C5 08 11 2C  Z.*..b.....[...,
]
]

Certificate[2]:
Owner: CN=secret-operator self-signed CA
Issuer: CN=secret-operator self-signed CA
Serial number: ba8b0d6effedf6b1
Valid from: Tue Sep 10 03:58:02 GMT 2024 until: Fri Sep 08 03:58:01 GMT 2034
Certificate fingerprints:
         SHA1: 16:A9:51:78:F5:4B:E3:33:53:87:C3:94:D1:65:E3:80:91:68:9A:60
         SHA256: A4:10:D3:F2:92:0E:D9:7A:B3:E8:C4:65:B3:07:B6:8D:D1:29:6B:C8:E2:10:B4:76:E0:A7:B1:68:4F:B1:89:C6
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 2048-bit RSA key
Version: 3

Extensions: 

#1: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 10 C0 0F 30 DA 5C CD 08   DD 96 D7 14 43 3F 17 FA  ...0.\......C?..
0010: 49 DB ED 04 FF 3F 56 6A   45 37 86 75 ED E0 40 92  I....?VjE7.u..@.
]
]

#2: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:true
  PathLen:2147483647
]

#3: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
  DigitalSignature
  Key_Encipherment
  Key_CertSign
  Crl_Sign
]

#4: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 10 C0 0F 30 DA 5C CD 08   DD 96 D7 14 43 3F 17 FA  ...0.\......C?..
0010: 49 DB ED 04 FF 3F 56 6A   45 37 86 75 ED E0 40 92  I....?VjE7.u..@.
]
]

*******************************************
*******************************************

truststore.p12 with keytool

[kubedoop@zookeepercluster-sample-server-default-0 quorum_tls]$ keytool -v -list -storetype pkcs12 -keystore truststore.p12 
Enter keystore password:  
Keystore type: PKCS12
Keystore provider: SUN

Your keystore contains 1 entry

Alias name: cn=secret-operator self-signed ca
Creation date: Sep 10, 2024
Entry type: trustedCertEntry

Owner: CN=secret-operator self-signed CA
Issuer: CN=secret-operator self-signed CA
Serial number: ba8b0d6effedf6b1
Valid from: Tue Sep 10 03:58:02 GMT 2024 until: Fri Sep 08 03:58:01 GMT 2034
Certificate fingerprints:
         SHA1: 16:A9:51:78:F5:4B:E3:33:53:87:C3:94:D1:65:E3:80:91:68:9A:60
         SHA256: A4:10:D3:F2:92:0E:D9:7A:B3:E8:C4:65:B3:07:B6:8D:D1:29:6B:C8:E2:10:B4:76:E0:A7:B1:68:4F:B1:89:C6
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 2048-bit RSA key
Version: 3

Extensions: 

#1: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 10 C0 0F 30 DA 5C CD 08   DD 96 D7 14 43 3F 17 FA  ...0.\......C?..
0010: 49 DB ED 04 FF 3F 56 6A   45 37 86 75 ED E0 40 92  I....?VjE7.u..@.
]
]

#2: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:true
  PathLen:2147483647
]

#3: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
  DigitalSignature
  Key_Encipherment
  Key_CertSign
  Crl_Sign
]

#4: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 10 C0 0F 30 DA 5C CD 08   DD 96 D7 14 43 3F 17 FA  ...0.\......C?..
0010: 49 DB ED 04 FF 3F 56 6A   45 37 86 75 ED E0 40 92  I....?VjE7.u..@.
]
]

*******************************************
*******************************************

by openssl

keystore.p12 with openssl

openssl pkcs12 -in keystore.p12 -nodes | openssl x509 -text -noout
Enter Import Password:
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            83:40:5e:84:b1:1c:10:b2
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = secret-operator self-signed CA
        Validity
            Not Before: Sep 10 03:58:02 2024 GMT
            Not After : Sep 10 13:58:02 2024 GMT
        Subject: 
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:da:f6:93:77:35:be:3a:41:08:a0:e3:e6:c6:a8:
                    b9:60:36:36:ff:87:6e:09:6d:b0:ab:7b:b5:16:cb:
                    1b:bd:f3:48:f4:89:40:6d:80:d2:83:93:54:2e:31:
                    03:2f:94:67:b1:2a:19:9a:00:4c:fe:21:ea:ec:0f:
                    d4:ca:66:12:68:c1:2b:a9:3b:0f:ce:ac:43:80:1b:
                    7a:b2:3d:50:e3:1b:e8:ff:a4:02:00:cb:d3:38:4c:
                    b4:64:74:ff:be:42:ee:3f:1c:e6:17:e5:20:3d:b8:
                    2f:5c:31:64:8b:d3:b3:e1:41:8d:e2:8f:e0:e1:46:
                    53:de:1c:b3:8e:08:66:9a:af:96:ea:d1:48:4c:c0:
                    99:9f:fa:ad:86:48:4d:1d:63:4a:87:0b:23:5a:98:
                    34:76:62:0a:51:0c:84:9e:83:f4:fa:80:ee:62:3e:
                    33:5f:3e:f0:d9:4a:f9:5a:ed:be:65:2f:9e:8e:56:
                    bb:56:aa:14:f9:17:e8:d3:5c:ff:6f:7d:b9:75:5a:
                    51:75:8e:15:42:ca:e3:ab:3a:2b:04:e0:53:eb:de:
                    ac:81:2d:22:84:31:92:e0:c2:39:0f:85:02:ea:bd:
                    8e:22:32:13:25:f7:26:c9:03:e4:45:4b:79:0e:92:
                    78:f5:0d:4b:c6:8e:1f:57:b0:fb:f6:9c:36:9e:7b:
                    ce:9f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Key Identifier: 
                BA:80:EE:18:E4:65:E1:F2:A1:E1:C7:B0:AB:01:57:C0:5A:CA:2A:80:10:62:D0:BE:16:0F:0C:5B:C5:08:11:2C
            X509v3 Authority Key Identifier: 
                10:C0:0F:30:DA:5C:CD:08:DD:96:D7:14:43:3F:17:FA:49:DB:ED:04:FF:3F:56:6A:45:37:86:75:ED:E0:40:92
            X509v3 Subject Alternative Name: critical
                DNS:zookeeper-operator-1.27.11-control-plane, DNS:zookeepercluster-sample-server-default.chainsaw-wise-shark.svc.cluster.local, DNS:zookeepercluster-sample-server-default-0.zookeepercluster-sample-server-default.chainsaw-wise-shark.svc.cluster.local, IP Address:172.18.0.2
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        6f:3c:43:bf:cb:f9:b2:80:2c:80:91:cc:c3:69:b1:ea:8b:11:
        32:29:b2:d4:25:67:ee:91:d9:c7:8a:dd:f9:eb:45:22:de:ef:
        e0:84:8c:36:43:b6:d8:d1:60:39:bc:16:67:52:c5:06:6d:75:
        fb:05:51:81:1e:6f:b4:d1:1a:d0:35:24:3d:6b:12:c9:64:04:
        c1:87:cd:ac:53:32:32:b8:9d:3b:1d:6c:08:ea:d2:4f:70:99:
        d9:bf:c3:d8:5c:21:7f:5c:ba:d0:4b:a0:3d:6b:c6:8c:f1:82:
        d6:32:63:7d:38:50:81:e2:1d:05:89:27:52:af:67:3e:33:cb:
        5d:b1:8c:13:26:3c:b5:9c:ec:64:17:2e:9e:f3:05:6e:b8:35:
        08:e9:a0:2c:6e:fb:7f:fc:89:e1:7b:31:ff:5f:3f:1a:7c:0c:
        92:2e:11:fe:f1:8b:14:75:ad:05:3a:66:55:2f:bd:e3:c7:dd:
        54:06:93:24:60:20:66:3b:a3:6b:48:9b:79:99:08:08:ae:c2:
        12:aa:63:13:13:b5:23:bc:fe:c2:13:f9:de:87:0b:45:9e:12:
        f6:00:99:3a:36:3e:cd:fa:51:e8:e9:92:e3:f2:6e:fc:ac:1c:
        33:f7:d5:59:f3:20:e2:49:fe:5c:c2:c0:4d:cc:94:65:93:4a:
        34:69:9c:a6

truststore.p12 with openssl

$ openssl pkcs12 -in truststore.p12 -nodes | openssl x509 -text -noout
Enter Import Password:
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ba:8b:0d:6e:ff:ed:f6:b1
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = secret-operator self-signed CA
        Validity
            Not Before: Sep 10 03:58:02 2024 GMT
            Not After : Sep  8 03:58:01 2034 GMT
        Subject: CN = secret-operator self-signed CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b8:99:39:cc:68:b2:dd:28:53:41:44:69:f9:4c:
                    76:10:35:d6:08:38:49:a8:8e:cf:03:01:ba:0d:4e:
                    57:f3:e4:eb:bc:2b:a5:c8:e4:d7:41:7c:f7:4e:3b:
                    d4:53:24:82:78:6a:15:86:82:31:6f:3f:ae:7e:f0:
                    18:b8:b3:c5:3b:13:2d:0c:2b:6d:de:eb:a9:6d:77:
                    4d:29:91:26:f9:e2:f7:a2:0c:61:50:ad:c4:fc:8f:
                    62:49:d6:ee:f2:08:cb:b1:f0:6a:1a:70:fc:8b:6b:
                    18:d4:67:c6:46:02:0e:0c:1e:9a:01:04:20:ec:af:
                    8d:ef:6e:b6:26:df:86:d6:aa:3c:03:3c:e6:5f:d7:
                    7a:7c:4d:8a:2d:b2:0d:85:27:bf:d7:de:57:93:79:
                    0a:ea:e9:79:f1:fe:79:0f:51:c8:c1:9f:b2:a8:0d:
                    9b:cd:b5:9b:a8:6f:a9:ae:b2:a5:38:0d:e2:34:26:
                    37:e4:87:ef:23:d0:e9:1a:14:40:d0:8f:99:91:4c:
                    89:d1:99:49:ab:fa:3a:b3:39:ef:b5:19:49:e2:78:
                    ac:69:b1:63:b0:f1:80:16:bb:36:f0:75:d7:8a:cd:
                    e5:ef:57:4a:7c:79:06:77:bb:af:f4:75:75:aa:91:
                    4f:b3:0a:55:20:16:65:8e:39:b0:d4:53:91:94:be:
                    7d:2d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier: 
                10:C0:0F:30:DA:5C:CD:08:DD:96:D7:14:43:3F:17:FA:49:DB:ED:04:FF:3F:56:6A:45:37:86:75:ED:E0:40:92
            X509v3 Authority Key Identifier: 
                10:C0:0F:30:DA:5C:CD:08:DD:96:D7:14:43:3F:17:FA:49:DB:ED:04:FF:3F:56:6A:45:37:86:75:ED:E0:40:92
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        70:3e:ac:27:a2:98:3d:ef:88:e9:8c:15:31:3e:d0:64:7c:3d:
        33:ff:ba:9a:47:fe:4e:bb:6d:95:89:4f:96:9a:a7:b6:08:73:
        b9:88:dd:c0:be:9a:e1:1c:7b:21:86:47:75:e6:1c:70:c1:f1:
        07:df:71:86:59:76:e4:61:ba:aa:7d:75:1f:e6:88:ef:ff:a9:
        8a:ce:35:a0:d1:54:cb:db:c7:a9:32:50:0a:c6:4a:c5:32:95:
        8f:d9:78:b3:bc:30:c3:83:53:9f:d0:88:cd:01:03:67:fd:e0:
        8e:73:18:13:bd:a4:e8:e8:9f:28:e7:af:04:b9:70:6c:ba:22:
        22:b4:dd:0c:9d:df:99:ec:9d:bf:3c:7f:f0:82:c0:c6:d4:a3:
        ad:70:32:09:0b:a8:77:8c:48:61:02:94:39:20:a7:0b:43:e4:
        82:a4:a8:d3:1a:70:ba:90:6a:ad:b2:2c:b3:c9:7c:d7:90:c3:
        ea:19:3f:37:51:43:ec:f8:cb:28:b2:35:4d:5e:04:2e:3a:fc:
        24:30:ac:c9:30:14:bb:88:de:bb:84:a8:dd:d8:e2:20:19:1c:
        f4:07:b6:e6:e1:70:6e:c0:0b:5d:27:75:c2:43:44:a9:9f:53:
        bc:74:66:0f:77:e8:4d:3a:4e:b9:92:40:2d:5c:f2:72:dc:d9:
        17:6a:c5:4a