Make Zookeeper TLS Properties Available via nifi.properties

[#1]

Hi,

We have recently made our external ZooKeeper's implement SSL, Now Nifi is failing to startup.

2021-09-23 15:46:01,711 ERROR [Curator-Framework-0] o.a.c.f.imps.CuratorFrameworkImpl Background retry gave up
org.apache.curator.CuratorConnectionLossException: KeeperErrorCode = ConnectionLoss
	at org.apache.curator.framework.imps.CuratorFrameworkImpl.performBackgroundOperation(CuratorFrameworkImpl.java:972)
	at org.apache.curator.framework.imps.CuratorFrameworkImpl.backgroundOperationsLoop(CuratorFrameworkImpl.java:943)
	at org.apache.curator.framework.imps.CuratorFrameworkImpl.access$300(CuratorFrameworkImpl.java:66)
	at org.apache.curator.framework.imps.CuratorFrameworkImpl$4.call(CuratorFrameworkImpl.java:346)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:304)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at java.base/java.lang.Thread.run(Thread.java:834)

Nifi version we are using is 1.10.0

using TLS properties via nifi.properties  as below

nifi.zookeeper.client.secure=true
nifi.zookeeper.security.keystore=./conf/keystore
nifi.zookeeper.security.keystoreType=jks
nifi.zookeeper.security.keystorePasswd=password
nifi.zookeeper.security.truststore=./conf/truststore
nifi.zookeeper.security.truststoreType=jks
nifi.zookeeper.security.truststorePasswd=password
nifi.zookeeper.connect.string=host1:2185,host2:2186,host3:2187
nifi.zookeeper.connect.timeout=10 secs
nifi.zookeeper.session.timeout=10 secs
nifi.zookeeper.root.node=/nifi

However i see that TLS support for nifi.properties is available only in 1.13.0 ? as per this jira

https://issues.apache.org/jira/browse/NIFI-7357

can you please let me know how to use TLS properties via nifi.properties in Nifi version : 1.10.0

[#2 · Accepted solution]

@samarsimha 

The zookeeper client version used in Apache NiFi versions prior to 1.13 do not support TLS.  You'll need to upgrade your NiFi 1.13 from 1.10 to take advantage of the new TLS connectivity to Zookeeper.

If you found this response assisted with your query, please take a moment to login and click on "Accept as Solution" below this post.

Thank you,

Matt