{"record":{"id":"0357f67e0aefaf84","repo":"xai-org/x-algorithm","slug":"kafka-mtls-requires-ca-at-ca-file-r-mount-inter","errorCode":null,"errorMessage":"Kafka mTLS requires CA at {ca_file!r} (mount internal-ca ConfigMap or set SSL_CA_FILE)","messagePattern":"Kafka mTLS requires CA at (.+?) \\(mount internal-ca ConfigMap or set SSL_CA_FILE\\)","errorType":"exception","errorClass":"FileNotFoundError","httpStatus":null,"severity":"critical","filePath":"grox/libs/kafka_cli/mtls.py","lineNumber":11,"sourceCode":"import logging\nimport os\nimport ssl\n\nlogger = logging.getLogger(__name__)\n\n\ndef create_mtls_ssl_context() -> ssl.SSLContext:\n    ca_file = os.getenv(\"SSL_CA_FILE\", \"/etc/ssl/internal-ca/ca-bundle.crt\")\n    if not ca_file or not os.path.exists(ca_file):\n        raise FileNotFoundError(\n            f\"Kafka mTLS requires CA at {ca_file!r} (mount internal-ca ConfigMap or set SSL_CA_FILE)\"\n        )\n\n    ssl_ctx = ssl.create_default_context(cafile=ca_file)\n    ssl_ctx.verify_mode = ssl.CERT_REQUIRED\n    ssl_ctx.check_hostname = False\n    logger.info(f\"Kafka mTLS: CERT_REQUIRED ca={ca_file} check_hostname=False\")\n\n    cert_file = os.getenv(\"SSL_CERT_FILE\", \"/etc/ssl/s2s/client/tls.crt\")\n    key_file = os.getenv(\"SSL_KEY_FILE\", \"/etc/ssl/s2s/client/tls.key\")\n    if not os.path.exists(cert_file) and os.path.exists(\"/certs/client.fullchain\"):\n        cert_file = \"/certs/client.fullchain\"\n    if not os.path.exists(key_file) and os.path.exists(\"/certs/client.key\"):\n        key_file = \"/certs/client.key\"\n\n    if os.path.exists(cert_file) and os.path.exists(key_file):\n        ssl_ctx.load_cert_chain(certfile=cert_file, keyfile=key_file)\n        logger.info(f\"mTLS client certificate loaded: CERT={cert_file} KEY={key_file}\")","sourceCodeStart":1,"sourceCodeEnd":29,"githubUrl":"https://github.com/xai-org/x-algorithm/blob/24c60942c5c5fdad3a6addffb4c6e6d2f228f04f/grox/libs/kafka_cli/mtls.py#L1-L29","documentation":"create_mtls_ssl_context builds the SSL context Kafka clients use for mutual TLS. It reads SSL_CA_FILE (default /etc/ssl/internal-ca/ca-bundle.crt) and raises FileNotFoundError when the CA bundle is absent, because mTLS cannot verify brokers without a trusted CA. The message points at the internal-ca ConfigMap mount, indicating a k8s deployment expectation.","triggerScenarios":"Starting a Kafka consumer/producer region with security protocol SSL/mTLS where SSL_CA_FILE is unset and /etc/ssl/internal-ca/ca-bundle.crt does not exist in the container filesystem (ConfigMap not mounted, wrong path, or bare-metal run without the file).","commonSituations":"Running the service locally or in CI without the internal CA mount; deploying to k8s with the volumes/volumeMounts block missing or mounted at a different path; SSL_CA_FILE pointing to a path that exists in one image but not another.","solutions":["Mount the internal-ca ConfigMap at /etc/ssl/internal-ca in the pod spec (volumes + volumeMounts).","Or set SSL_CA_FILE to an existing CA bundle path in the container: export SSL_CA_FILE=/path/to/ca-bundle.crt.","Verify with kubectl exec -- ls -l /etc/ssl/internal-ca/ that the file is actually present after deployment."],"exampleFix":"# before\n# pod started without the ConfigMap -> FileNotFoundError on consumer start\n\n# after (deployment.yaml)\ncontainers:\n- name: app\n  volumeMounts:\n  - name: internal-ca\n    mountPath: /etc/ssl/internal-ca\nvolumes:\n- name: internal-ca\n  configMap:\n    name: internal-ca","handlingStrategy":"validation","validationCode":"ca = os.getenv('SSL_CA_FILE', '/etc/ssl/internal-ca/ca-bundle.crt')\nif not os.path.isfile(ca):\n    raise SystemExit(f'CA bundle missing at {ca}; mount internal-ca ConfigMap')","typeGuard":null,"tryCatchPattern":"try:\n    await consumer.start()\nexcept FileNotFoundError as e:\n    if 'internal-ca' in str(e):\n        logger.error('mTLS CA not mounted; check ConfigMap volumes')\n    raise","preventionTips":["Add a container startup probe that checks the CA path","Keep SSL_CA_FILE explicit in non-k8s environments","Assert the ConfigMap exists in deploy-time checks"],"tags":["kafka","mtls","ssl","certificates","kubernetes","configmap"],"backgroundTag":"missing-ca-certificate","analyzedSha":"24c60942c5c5fdad3a6addffb4c6e6d2f228f04f","analyzedAt":"2026-08-28T11:40:14.686Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}