Strimzi-kafka-operator: [Question] How to get SASL_SSL with SCRAM on Kafka Connect

[pcasaes]

I've followed the documentation on how to setup from SCRAM but the security protocol get's set to SASL_PLAINTEXT

security.protocol = SASL_PLAINTEXT

Is there anyway to get it to be SASL_SSL?

For some context I'm trying to integrate with MSK using SASL SCRAM.
https://docs.aws.amazon.com/msk/latest/developerguide/msk-password.html

security.protocol=SASL_SSL
sasl.mechanism=SCRAM-SHA-512
sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="username" password="password";

[scholzj]

Yeah. You just configure TLS in .spec.tls and SASL auth in .spec.auth ...
and when they are both set, it enables SASL_SSL. Not at my desk right now,
but I can provide docs links and examples tomorrow.

On Thu 1. 10. 2020 at 1:13, Paulo Casaes [e-mail] wrote:

>
>

I've followed the documentation on how to setup from SCRAM but the
security protocol get's set to SASL_PLAINTEXT

security.protocol = SASL_PLAINTEXT

Is there anyway to get it to be SASL_SSL?

For some context I'm trying to integrate with MSK using SASL SCRAM.

https://docs.aws.amazon.com/msk/latest/developerguide/msk-password.html

security.protocol=SASL_SSL

sasl.mechanism=SCRAM-SHA-512

sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="username" password="password";

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/strimzi/strimzi-kafka-operator/issues/3730, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/ABLFOR2OS4WIQ35NRSWRDYLSIO3THANCNFSM4R7V664A
.

[scholzj]

To add from tomorrow ... this example is using SASL_SSL: https://github.com/strimzi/strimzi-kafka-operator/blob/02edfdd9b0b78c1e5ffbc4c052da24c8c1bbf3f4/examples/security/scram-sha-512-auth/connect.yaml#L102

But MSK normally uses signed certificates so you do not need to provide the trusted certificate and can do just something like this:

  tls:
    trustedCertificates: []
  authentication:
    type: scram-sha-512
    username: my-connect
    passwordSecret:
      secretName: my-connect
      password: password

[pcasaes]

Thank you! that did it.

Follow up question. Hot about for confluent cloud that uses PLAIN SASL with a signed certificate.

Would it be this?

  tls:
    trustedCertificates: []
  authentication:
    type: plain
    username: my-connect
    passwordSecret:
      secretName: my-connect
      password: password

[scholzj]

Yes, this should work for PLAIN

[Coqueiro]

Thanks, @scholzj !

[pcasaes]

Thanks! I'll go ahead and close this.