Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

KIP-554 — broker-side SCRAM credential admin API

Status: partial — see the KIP index.

What's missing

  • SCRAM-SHA-256 — kaas authenticates with SCRAM-SHA-512 only, so SHA-256 upsertions answer UNSUPPORTED_SASL_MECHANISM rather than storing a credential no listener could verify.
  • Wire-side credential deletion — deletions answer UNSUPPORTED_VERSION with a message pointing at the KafkaUser CR. The credential's lifecycle belongs to the CR: the operator would re-materialise anything the broker removed on its next reconcile, and a deletion that silently comes back is worse than a refusal. Delete the CR (or change its authentication.type) to remove a credential.

What the KIP changes in Apache Kafka

KIP-554 moved SCRAM credential management from ZooKeeper writes to a proper broker API: admins upsert and inspect salted SCRAM credentials via the AdminClient, with the broker storing the derived keys (never the password).

What kaas has

Credential management is operator-side, via the KafkaUser CR — the Kubernetes-native equivalent of what the KIP provides over the wire:

  • The KafkaUser reconciler (crates/kaas-operator-controllers/src/kafkauser_controller.rs) derives salted SCRAM entries into /data/__cluster/credentials.json, which brokers hot-reload.
  • The rotation path: a KafkaUser can reference pre-derived SCRAM credentials, which pass through to credentials.json verbatim — enabling zero-downtime rotation without the operator ever seeing the plaintext password.
  • Auto-generated passwords land in a <user>-kafka-credentials Secret owned by the CR (Kubernetes GC cleans it up with the user).

And since v0.2.45 the wire path is served too: DescribeUserScramCredentials (key 50) answers mechanism + iteration counts from the same hot-reloaded credential store the SCRAM authenticator verifies against, and AlterUserScramCredentials (key 51) derives the RFC 5802 stored/server keys from the wire's salted material and patches them into KafkaUser.spec.authentication.scram — the same CR-write pattern CreateAcls uses, so the operator remains the only writer of credentials.json and kafka-configs.sh --alter --add-config 'SCRAM-SHA-512=…' rotates a credential cluster-wide within one reconcile + reload cycle.

See Listeners, authentication, authorization for how credentials are consumed.

How the partial state is verified

KafkaUser reconcile tests cover derivation, passthrough rotation, and Secret ownership (crates/kaas-operator-controllers/src/kafkauser_controller.rs); bins/kaas/tests/auth_smoke.rs proves the derived credentials authenticate over the wire. The wire keys are pinned by the registry test in crates/kaas-codec/src/api/registry.rs; the alter handler's key-derivation and rejection semantics by crates/kaas-broker/src/handlers/alter_user_scram_credentials.rs.