Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

KIP-554 — broker-side SCRAM credential admin API

Status: partial — see the KIP index.

What's missing

Wire keys 50 (DescribeUserScramCredentials) and 51 (AlterUserScramCredentials) entirely — no codec modules, no dispatch; both appear in the matrix's gap table. kafka-configs.sh --alter --add-config 'SCRAM-SHA-512=…' against kaas fails with an unsupported-API error rather than rotating a credential.

What the KIP changes in Apache Kafka

KIP-554 moved SCRAM credential management from ZooKeeper writes to a proper broker API: admins upsert and inspect salted SCRAM credentials via the AdminClient, with the broker storing the derived keys (never the password).

What kaas has

Credential management is operator-side, via the KafkaUser CR — the Kubernetes-native equivalent of what the KIP provides over the wire:

  • The KafkaUser reconciler (crates/kaas-operator-controllers/src/kafkauser_controller.rs) derives salted SCRAM entries into /data/__cluster/credentials.json, which brokers hot-reload.
  • The gh #104 rotation path: a KafkaUser can reference pre-derived SCRAM credentials, which pass through to credentials.json verbatim — enabling zero-downtime rotation without the operator ever seeing the plaintext password.
  • Auto-generated passwords land in a <user>-kafka-credentials Secret owned by the CR (Kubernetes GC cleans it up with the user).

So the KIP's capability — rotate SCRAM credentials without restarts, never persist plaintext — exists, but through CRs rather than the Kafka admin protocol. Serving keys 50/51 (mapping wire writes onto KafkaUser CRs, the same pattern CreateAcls uses) is the tracked follow-up.

See Listeners, authentication, authorization for how credentials are consumed.

How the partial state is verified

KafkaUser reconcile tests cover derivation, passthrough rotation, and Secret ownership (crates/kaas-operator-controllers/src/kafkauser_controller.rs); bins/kaas/tests/auth_smoke.rs proves the derived credentials authenticate over the wire. The absent keys are pinned by the registry count test in crates/kaas-codec/src/api/registry.rs.