<p><strong>Goal:</strong></p>
<p>I want to use bitnami/kafka helm chart with SASL enabled with the PLAIN mechanism for only the external client. (client-broker, broker-broker, broker-zookeeper connection can be in PLAINTEXT mechanism)</p>
<p><strong>What I have Done:</strong></p>
<p>I've set configured parameters in values.yaml file:</p>
<pre><code>superUsers: User:adminuser
auth.externalClientProtocol: sasl
auth.sasl.jaas.clientUsers:
  - adminuser
  - otheruser
auth.sasl.jaas.clientPasswords:
  - adminuserpass
  - otheruserpass
auth.sasl.jaas.interBrokerUser: adminuser
</code></pre>
<p>And left other parameters as it is. But it doesn't seem to be enough. The broker container is going to backOff state when I try to install the chart.</p>
<p><strong>Question#1:</strong> Aren't these configuration parameters enough for setting up what I'm trying to achieve? Won't these create a JAAS config file for me?</p>
<p>From Kafka documentation <a href="https://kafka.apache.org/documentation/#security_sasl" rel="nofollow noreferrer">Kafka_SASL</a>, I have to pass a JAAS config file for the broker. It can be done by <code>sasl.jaas.config</code> configuration parameter. For me it should be something like this:</p>
<pre><code>listener.name.EXTERNAL.plain.sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required \
username=&quot;adminuser&quot; \
password=&quot;adminuserpass&quot; \
user_adminuser=&quot;adminuserpass&quot; \
user_otheruser=&quot;otheruserpass&quot;;
</code></pre>
<p>But it doesn't seem there is any <code>sasl.jaas.config</code> available in bitnami/kafka.values.yaml.</p>
<p><strong>Question#2:</strong> How can I pass this JAAS config file values if the answer for question#1 is <strong>NO</strong>? Should I use <code>config</code> or <code>extraEnvVars</code> for this?</p>
<p><strong>Thanks!</strong></p>

<p>This is work for me:</p>
<pre><code>...
authorizerClassName: &quot;kafka.security.authorizer.AclAuthorizer&quot;

auth:
  clientProtocol: sasl
  externalClientProtocol: sasl
  interBrokerProtocol: plaintext
  sasl:
    mechanisms: plain,scram-sha-256,scram-sha-512
    interBrokerMechanism: plain
    jaas:
      clientUsers:
        - yourusername
      clientPasswords:
        - yourpassword
....
</code></pre>
<p>I don't know why but I have to set <code>clientProtocol: sasl</code>
otherwise, I get <code>java.io.IOException: /opt/bitnami/kafka/conf/kafka_jaas.conf (No such file or directory)</code>
also, I didn't see the error till I set <code>image.debug: true</code></p>
<p>Note: as u you probably see this will force authentication also between the clients inside the cluster</p>
