Strimzi-kafka-operator: Specify security.protocol for Kafka Connect

[abhirockzz]

While trying to use Kafka Connect with SASL PLAIN auth (as per https://strimzi.io/docs/latest/#sasl_based_plain_authentication). In the Kafka Connect logs, I saw this error:

WARN [AdminClient clientId=adminclient-1] Connection to node -1 (foo.servicebus.windows.net/42.42.42.42:9093) terminated during authentication. This may happen due to any of the following reasons: (1) Authentication failed due to invalid credentials with brokers older than 1.0.0, (2) Firewall blocking Kafka TLS traffic (eg it may only allow HTTPS traffic), (3) Transient network issue. (org.apache.kafka.clients.NetworkClient) [kafka-admin-client-thread | adminclient-1]

In the logs, I noticed security.protocol = SASL_PLAINTEXT. I am using this with Azure Event Hubs where the security.protocol needs to be set to SASL_SSL (see https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-for-kafka-ecosystem-overview#shared-access-signature-sas). I have a local Kafka Connect instance which works fine (since I configured the security.protocol as documented). I see that config does not accept security parameters (https://strimzi.io/docs/latest/#type-KafkaConnectSpec-reference). Is there a way to get this working?

[scholzj]

If you want the security.protocol to be SASL_SSL you have to configure not just the authentication but also encryption: https://strimzi.io/docs/latest/full.html#assembly-kafka-connect-tls-deployment-configuration-kafka-connect

If the KAfka broker where you want to connect uses certificates signed by a public CA already tusted by the JVM, you should be able to do something like this:

  tls:
    trustedCertificates: []

[abhirockzz]

Thank you! Should have thought of that earlier ;-)