Configure SASL auth in Kubernetes

[ginwakeup]

Hi there,

we have a Kafka cluster setup using SASL and SCRAM 512 auth. How can I configure kafka-ui to connect to it by using the sasl.jaas.config from kubernetes secrets? I would like to avoid having to put the password in clear in the deployment file.

I found this page:
https://github.com/provectus/kafka-ui/blob/master/documentation/guides/SASL_SCRAM.md

but it seems you have to set the password in clear.
Isn't there a way to mount the sasl.jaas.config secret and use it for the environment variable KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG
?

[ginwakeup]

Ok so I could make this "work" with the following deployment code:

          - name: SUPER_USER_SECRET
            valueFrom:
              secretKeyRef:
                name: super
                key: password
                optional: false
          - name: KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL
            value: SASL_SSL
          - name: KAFKA_CLUSTERS_0_PROPERTIES_SASL_MECHANISM
            value: SCRAM-SHA-512
          - name: KAFKA_CLUSTERS_0_PROPERTIES_PROTOCOL
            value: SASL
          - name: KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG
            value: 'org.apache.kafka.common.security.scram.ScramLoginModule required username="super" password="$(SUPER_SECRET)";'
        

But now I am getting the following error on the brokers:

2023-02-06 21:12:53,808 INFO [SocketServer listenerType=ZK_BROKER, nodeId=0] Failed authentication with /192.168.188.43 (channelId=192.168.188.34:9092-192.168.188.43:42412-125611) (Failing SASL authentication due to invalid receive size) (org.apache.kafka.common.network.Selector) [data-plane-kafka-network-thread-0-ListenerName(PLAIN-9092)-SASL_PLAINTEXT-5]

It seems to be related to zookeeper.

Does the authentication has to be enabled on it as well?
I am using Strimzi.

[Haarolean]

sasl_ssl also requires a truststore if you have a self-signed certificated

[Haarolean]

https://github.com/provectus/kafka-ui/blob/master/documentation/compose/kafka-ssl.yml

[Haarolean]

also #3362 #1698