KafkaConnect not starting, crashing without logging any error while retrieving secrets from the tls-trusted-certs

[shash137]

Hi team,
I am updating from quay.io/strimzi/kafka:0.40.0-kafka-3.7.0 to quay.io/strimzi/kafka:0.47.0-kafka-3.9.1 have updated the operator also to version 0.47.0 When I deploy with the newer version pods are going in continuously crashing CrashLoopBackOff and restarting.
adding logs:

2025-11-18 08:34:51,848 INFO Configuring Kubernetes Secret config provider with configuration {} (io.strimzi.kafka.AbstractKubernetesConfigProvider:68) [main] TrackingId:-  OrgId:-  offerType:- 
2025-11-18 08:34:52,094 INFO Configuring Kubernetes Secret config provider with configuration {secret.key=trusted_ca_cert, secret.name=aws-ca-cert-secret} (io.strimzi.kafka.AbstractKubernetesConfigProvider:68) [main] TrackingId:-  OrgId:-  offerType:- 
2025-11-18 08:34:52,106 INFO Retrieving configuration from Secret custom-connect-tls-trusted-certs in namespace (io.strimzi.kafka.AbstractKubernetesConfigProvider:123) [main] TrackingId:-  OrgId:-  offerType:- 

These are few last lines of the logs i.e. EOF, and there are no error logs from starting till end.

my CR: kafkaconnect.txt

My doubt is this: the secret with the name having connect-tls-trusted-certs is auto generated ? If yes then can I overwrite it by some config changes or like I tried using aws-ca-cert-secret but no progress. Operator gets stuck in retrieving the configuration and throws TOE(TimeOutException). Also, if you can please point me to the tls trusted certificates doc, will be glad. In older version I was using Truststore in external-configuration like this:

  externalConfiguration:
    volumes:
      - name: truststore
        secret:
          secretName: kafkaconnect-truststore
      - name: keystore
        secret:
          secretName: kafkaconnect-keystore
      - name: password
        secret:
          secretName: kafkaconnect-password

In the newer version of strimzi is it still valid ? Because I didn't see in the doc and still not getting the way to configure the tls-trustedcertificates.

Thanks!!
I appreciate any inputs!

[scholzj]

You would need to share the full logs, full custom resource (ideally including the status section - kubectl get kafkaconnect -o yaml and not just some templaze), etc.

Also, make sure your custom container image corresponds to the Strimzi and Kafka version you use. So if you now use Strimzi 0.47.0 and Kafka 3.9.1, it has to be based on quay.io/strimzi/kafka:0.47.0-kafka-3.9.1.

As for the externalConfiguration, the YAML itself is valid. But those Secrets are not used for anything by Strimzi and the configurations you set should be ignored. Trusted certificates are configured in .spec.tls section.

[shash137]

Thanks @scholzj for the prompt response. Was able to deploy with version: 0.45.1
Will try incrementally upgrading the version and try resolving the errors. Will share here in the thread.