<p>I'm using this helm chart: <a href="https://github.com/helm/charts/tree/master/incubator/kafka" rel="nofollow noreferrer">https://github.com/helm/charts/tree/master/incubator/kafka</a> </p>

<p>and these overrides in values.yaml</p>

<pre><code>configurationOverrides:
  advertised.listeners: |-
    EXTERNAL://kafka-${KAFKA_BROKER_ID}.host-removed:$((31090 + ${KAFKA_BROKER_ID}))
  listener.security.protocol.map: |-
    PLAINTEXT:SASL_PLAINTEXT,EXTERNAL:SASL_PLAINTEXT
  sasl.enabled.mechanisms: SCRAM-SHA-256
  auto.create.topics.enable: false
  inter.broker.listener.name: PLAINTEXT
  sasl.mechanism.inter.broker.protocol: SCRAM-SHA-256
  listener.name.EXTERNAL.scram-sha-256.sasl.jaas.config: org.apache.kafka.common.security.scram.ScramLoginModule required username="user" password="password";
</code></pre>

<p>based on this documentation: <a href="https://kafka.apache.org/documentation/#security_jaas_broker" rel="nofollow noreferrer">https://kafka.apache.org/documentation/#security_jaas_broker</a> </p>

<p>(quick summary)</p>

<pre><code>Brokers may also configure JAAS using the broker configuration property sasl.jaas.config. The property name must be prefixed with the listener prefix including the SASL mechanism, i.e. listener.name.{listenerName}.{saslMechanism}.sasl.jaas.config. Only one login module may be specified in the config value. If multiple mechanisms are configured on a listener, configs must be provided for each mechanism using the listener and mechanism prefix

listener.name.sasl_ssl.scram-sha-256.sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required \
    username="admin" \
    password="admin-secret";
</code></pre>

<p>The problem is that when I start Kafka I get the following error: </p>

<pre><code>java.lang.IllegalArgumentException: Could not find a 'KafkaServer' or 'plaintext.KafkaServer' entry in the JAAS configuration. System property 'java.security.auth.login.config' is not set
</code></pre>

<p>According to the order of precedence, it should use the static jass file if the above config is NOT set. </p>

<pre><code>If JAAS configuration is defined at different levels, the order of precedence used is:
</code></pre>

<ul>
<li>Broker configuration property listener.name.{listenerName}.{saslMechanism}.sasl.jaas.config</li>
<li>{listenerName}.KafkaServer section of static JAAS configuration</li>
<li>KafkaServer section of static JAAS configuration</li>
</ul>

<p>The helm chart doesn't support a way to configure this jaas file so using this property seems to be the desired way, I'm just confused as to what is configured incorrectly.</p>

<p>Note: The cluster works fine if I disable all SASL and just use plain text but that's not much good in a real environment.</p>

<p>We've defined 2 listeners: <code>PLAINTEXT</code> and <code>EXTERNAL</code>. You've mapped both to <code>SASL_PLAINTEXT</code>.</p>

<p>Is this really what you wanted to do? or did you want <code>PLAINTEXT</code> to not require SASL but just be Plaintext?</p>

<ul>
<li><p>If you really want both to be SASL, then both of them need a JAAS configuration. In your question, I only see a JAAS configuration for EXTERNAL:</p>

<pre><code>listener.name.EXTERNAL.scram-sha-256.sasl.jaas.config: org.apache.kafka.common.security.scram.ScramLoginModule required username="user" password="password";
</code></pre>

<p>As you've mapped <code>PLAINTEXT</code> to SASL_PLAINTEXT, it also requires a JAAS configuration. You can specify it using for example:</p>

<pre><code> listener.name.PLAINTEXT.scram-sha-256.sasl.jaas.config: org.apache.kafka.common.security.scram.ScramLoginModule required username="user" password="password";
</code></pre></li>
<li><p>If you wanted your <code>PLAINTEXT</code> listener to actually be Plaintext without SASL, then you need to update the listener mapping:</p>

<pre><code>listener.security.protocol.map: |-
  PLAINTEXT:PLAINTEXT,EXTERNAL:SASL_PLAINTEXT
</code></pre></li>
</ul>
