[dmetzler]

Fixes #4759

Summary

When sasl.mechanism=OAUTHBEARER, KafkaClientsAuth.java currently returns early without setting sasl.jaas.config or sasl.login.callback.handler.class. The Kafka client is left with the default OAuthBearerLoginModule, which has no way to obtain a token — so the only working OAUTHBEARER path today is AWS MSK IAM, whose IAMLoginModule is bundled on the classpath.

This PR adds a vendor-neutral passthrough: when those two keys are present in the auth secret, they are propagated verbatim to the Kafka client. This unblocks standard OAUTHBEARER providers (Azure Event Hubs via Entra ID / Workload Identity, Keycloak, etc.) without adding any vendor dependency to the project. When the keys are absent, behaviour is unchanged.

Changes

Data plane (Java)

• Credentials: add default methods SASLJaasConfig() and SASLLoginCallbackHandlerClass() (both return null by default — no behaviour change for existing implementations).
  KubernetesCredentials: resolve the two new optional secret keys (sasl.jaas.config, sasl.login.callback.handler.class), base64-decoded and lazily cached.
• KafkaClientsAuth: in the OAUTHBEARER branch, set SASL_JAAS_CONFIG / SASL_LOGIN_CALLBACK_HANDLER_CLASS only when provided. Also logs a warning if a callback handler class is set on a non-OAUTHBEARER mechanism (likely misconfiguration).

Control plane (Go)

secret.go: tolerate OAUTHBEARER secrets without tokenProvider. The new keys are consumed by the Java data plane only; the Go side ignores them without error.

Docs

New "Azure Event Hubs with Managed Identity" guide (derived data-plane image, secret format, Workload Identity setup) plus secret-based auth notes.

What this does NOT do

No vendor code or dependencies added — the callback handler jar (e.g. the Conduktor Azure handler) must be supplied by the operator on the data-plane classpath via a derived image.
The Go control plane cannot use a Java callback handler; when tokenProvider is absent it enables SASL/OAUTHBEARER without a Go-native token provider. This is acceptable — the control plane only manages configuration; the data plane handles all Kafka traffic.

Testing

Added KafkaClientsAuthTest cases covering:
both keys set → both propagated;
neither key set → identical to prior behaviour (MSK IAM regression guard);
only handler class set → only handler propagated;
handler class on a SCRAM mechanism → ignored (+ warning), normal SCRAM config intact.

Java + Go tests pass on the branch.

Backward compatibility

Fully backward compatible. The new secret keys are optional; absent them, both planes behave exactly as before (verified by the MSK IAM regression test).

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: dmetzler / name: Damien Metzler (1ccbad4, d20e5d8, f2a44f3)

[knative-prow]

Welcome @dmetzler! It looks like this is your first PR to knative-extensions/eventing-kafka-broker 🎉

[knative-prow]

Hi @dmetzler. Thanks for your PR.

I'm waiting for a knative-extensions member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[jijo-OO7]

/ok-to-test

[codecov]

Codecov Report

❌ Patch coverage is 91.11111% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 36.49%. Comparing base (2872f04) to head (d20e5d8).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
...ka/broker/core/security/KubernetesCredentials.java	76.47%	0 Missing and 4 partials ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #4789      +/-   ##
============================================
+ Coverage     29.19%   36.49%   +7.30%     
- Complexity        0      919     +919     
============================================
  Files           294      406     +112     
  Lines         16241    20154    +3913     
  Branches          0      352     +352     
============================================
+ Hits           4741     7355    +2614     
- Misses        11036    12141    +1105     
- Partials        464      658     +194     

Flag	Coverage Δ
java-unittests	66.95% <85.71%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[dmetzler]

/test channel-integration-tests-ssl

[Cali0707]

/cc @creydr @dsimansk

[Cali0707]

@dmetzler mind filling out the CLA?

[dmetzler]

@dmetzler mind filling out the CLA?

I already did a couple of times with my 2 different Github bound adresses.... but it doesn't seem to update the status

[dmetzler]

/test reconciler-tests_eventing-kafka-broker_main

[jijo-OO7]

/test reconciler-tests_eventing-kafka-broker_main

[dmetzler]

@creydr @Cali0707 are you waiting for something from me on this PR ?

[jijo-OO7]

LGTM Waiting on a maintainer approval

[creydr]

Thanks a lot @dmetzler for this PR (and sorry for my late review - I was out the last days). Looks good IMO 💪

/lgtm

[knative-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: creydr, dmetzler

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [creydr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment