SASL_SSL / SCRAM support

[krisek]

Hi,

as far as I understand SASL_SSL is not supported (and consequently SCRAM-SHA-512 is not supported too) any plans for this or eventually a hint where should I start to hack?

[krisek]

Finally I managed to inject the functionality by

• using python-kafka from https://github.com/aiven/kafka-python:aiven-20212201:1b95333: appearantly this commit contains the _send_request_to_least_loaded_node function which is referred in kafka_rest_apis/admin.py
• removing the self.kafka_client parameters from the _init function in kafka_rest_apis/init.py and somewhere else

Is this OK? Can you include this in upstream if I raise a PR? Maybe the self.kafka_client parameters have something to do with the different python-kafka versions.

[hnousiainen]

Hello @krisek,

We would most certainly welcome PRs on that topic. Our own operation uses SSL authentication, so we didn't yet have our own plans for extending support to SASL_SSL.

Since Karapace uses kafka-python, supporting SASL should be a matter of propagating the suitable config to the consumer/producer instances (grep for e.g. bootstrap_servers). We have some SASL examples for kafka-python listed in this help article: https://help.aiven.io/en/articles/489572-getting-started-with-aiven-kafka

[krisek]

Hi Heikki @hnousiainen,

actually the functionality is implemented, what about the dependency on _send_request_to_least_loaded_node from aiven-kafka and the self.kafka_client params in the init.py?

Should I raise the PR with or without them?

[hackaugusto]

Hey @krisek , _send_request_to_least_loaded_node is an important bugfix, It is currently waiting on upstream for code review. bugfix: fix infinite loop on KafkaAdminClient #2194. Until the changes are merged I'd recommend using our fork

For SASL_SSL support, it only needs validation of the configuration and then pass it to the class constructors in a few places:

• KafkaProducer
• KafkaConsumer , and for the rest api
• KafkaAdminClient
• AIOKafkaProducer

I hope this helps :)