K8s External secret Class secrets with Kafka Connect

[fuadayodeji]

Hi,
Please could someone help with how I can go about this issue. So I have deployed the strimzi operator in our eks cluster and a strimzi namespace. I now want to deploy the kafkaconnect in a kafka connect namespace ; I have introduced a secret provider class in conjuction with aws csi to read the password /api key from our aws registry. The issue is that when I mount the volume on the kafkaconnect pod , I think the operator fails with the error secret isnt found. To by pass I have managed to create another pod that creates the secret first and that works ; however I dont want to use this approach ; any other approach will be highly appreciated. Thanks

[mg1986jp]

The issue is probably that the Strimzi operator expects the secret to exist in the same namespace as the KafkaConnect resource, but the CSI driver creates the secret after the pod starts up (or in a different namespace).

The flow is: Strimzi operator reads the KafkaConnect CR → tries to mount/reference the secret → secret doesn't exist yet because the CSI driver hasn't synced it → error.

A few approaches:

1. Use ExternalSecrets operator to sync the AWS secret into a regular K8s Secret in the Kafka Connect namespace before deploying the KafkaConnect CR. ExternalSecrets creates a standard Secret that Strimzi can find.

2. If you want to stick with CSI, you might need to create a separate pod/init container that triggers the CSI volume mount first, then reference the resulting K8s Secret in Strimzi. The CSI secrets store can create K8s secrets via secretObjects in the SecretProviderClass.

3. The simplest workaround is to just create a regular K8s Secret (synced from AWS via ExternalSecrets or sealed-secrets) and reference it directly in the KafkaConnect spec under authentication or tls.

What's the actual error message you're getting?