KAFKA-20419 : Add SASL_PLAINTEXT docker compose examples and sanity test by muralibasani · Pull Request #22023 · apache/kafka

muralibasani · 2026-04-10T23:06:25Z

Ref : https://issues.apache.org/jira/browse/KAFKA-20419

Note : these examples work only with jvm image and not with native
image. (Open issue https://issues.apache.org/jira/browse/KAFKA-19584)

Changes :

Adding sasl_plain docker compose examples
Updated readme
Added sasl_flow tests (only combined and isolated modes)

Testing the changes locally :

Start single node cluster :

IMAGE=apache/kafka:latest docker compose -f docker/examples/docker-compose-files/single-node/sasl_plaintext/docker-compose.yml up -d

Create a topic :

./bin/kafka-topics.sh --bootstrap-server localhost:9094 --create --topic test --command-config docker/examples/fixtures/client-secrets/client-sasl.properties

Produce :

./bin/kafka-console-producer.sh --bootstrap-server localhost:9094 --topic test --producer.config docker/examples/fixtures/client-secrets/client-sasl.properties

Consume :

./bin/kafka-console-consumer.sh --bootstrap-server localhost:9094 --topic test --from-beginning --max-messages 1 --consumer.config docker/examples/fixtures/client-secrets/client-sasl.properties

Results :

Topic test is created
Producer sends and consumer receives a message over SASL_PLAINTEXT

muralibasani · 2026-04-10T23:18:44Z

+    - `KAFKA_OPTS` is set to point to the JAAS config file.
+    - Similar to the plaintext example, two listeners are configured: one for inter-broker communication and one for client-to-broker communication. Both use the `SASL_PLAINTEXT` security protocol.
+    - Two users are configured in the JAAS file: `admin` (for inter-broker) and `alice` (for clients).
+    - Note: SASL is currently not supported with the GraalVM based native image (`apache/kafka-native`) due to missing reflection configuration for `java.security.AccessController`. See [KAFKA-19584](https://issues.apache.org/jira/browse/KAFKA-19584) for details.


This is an open issue.

muralibasani · 2026-04-10T23:20:15Z

            print(constants.FILE_INPUT_ERROR_PREFIX, str(e))
            total_errors.append(str(e))
+        # SASL is not supported on native image due to missing reflection config (KAFKA-19584)
+        if self.MODE == "jvm":


since this sasl config doesn't work on native image, adding this condition to run only on jvm based image

muralibasani · 2026-04-21T18:42:16Z

@chia7712 updated the pr with test instructions. Pls take a look. Thank you.

Copilot

Pull request overview

Adds SASL/PLAIN (SASL_PLAINTEXT) Docker Compose examples and extends the Docker sanity test suite to validate SASL client connectivity against the Docker image, complementing the existing plaintext/SSL examples and flows.

Changes:

Added new SASL_PLAINTEXT Docker Compose examples (single-node and multi-node: combined + isolated) plus supporting JAAS/client config fixtures.
Updated Docker examples README with SASL mode guidance and run instructions.
Extended docker sanity tests and fixture compose files to exercise a SASL client flow (JVM image only).

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
docker/test/fixtures/sasl/client-sasl.properties	Adds SASL client properties fixture for docker sanity tests.
docker/test/fixtures/sasl/broker_jaas.conf	Adds broker JAAS fixture for SASL/PLAIN in docker sanity tests.
docker/test/fixtures/mode/isolated/docker-compose.yml	Exposes a SASL_PLAINTEXT listener (9095) for isolated-mode docker sanity tests.
docker/test/fixtures/mode/combined/docker-compose.yml	Exposes a SASL_PLAINTEXT listener (9095) for combined-mode docker sanity tests.
docker/test/docker_sanity_test.py	Adds a SASL flow test and gates it to JVM image mode.
docker/test/constants.py	Introduces constants for SASL flow naming/config paths/topic/error prefix.
docker/examples/README.md	Documents SASL mode and adds SASL_PLAINTEXT run instructions for examples.
docker/examples/fixtures/sasl/broker_jaas.conf	Adds example JAAS config for SASL/PLAIN brokers.
docker/examples/fixtures/client-secrets/client-sasl.properties	Adds example client SASL properties.
docker/examples/docker-compose-files/single-node/sasl_plaintext/docker-compose.yml	Adds single-node SASL_PLAINTEXT compose example.
docker/examples/docker-compose-files/cluster/isolated/sasl_plaintext/docker-compose.yml	Adds isolated multi-node SASL_PLAINTEXT compose example.
docker/examples/docker-compose-files/cluster/combined/sasl_plaintext/docker-compose.yml	Adds combined multi-node SASL_PLAINTEXT compose example.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+- Set `KAFKA_OPTS` to `-Djava.security.auth.login.config=/etc/kafka/secrets/<jaas_config_filename>`.
+- Set `KAFKA_SASL_ENABLED_MECHANISMS` to the desired SASL mechanism (e.g. `GSSAPI` , `PLAIN`, `SCRAM-SHA-256`, `SCRAM-SHA-512`).
+- Ensure `KAFKA_ADVERTISED_LISTENERS` contains a `SASL_PLAINTEXT://` or `SASL_SSL://` listener.
+- For inter-broker SASL communication, set `KAFKA_SASL_MECHANISM_INTER_BROKER_PROTOCOL` to the desired mechanism (SASL_PLAINTEXT (or SASL_SSL)).


viktorsomogyi · 2026-05-10T14:36:21Z

+- Set `KAFKA_SASL_ENABLED_MECHANISMS` to the desired SASL mechanism (e.g. `GSSAPI` , `PLAIN`, `SCRAM-SHA-256`, `SCRAM-SHA-512`).
+- Ensure `KAFKA_ADVERTISED_LISTENERS` contains a `SASL_PLAINTEXT://` or `SASL_SSL://` listener.
+- For inter-broker SASL communication, set `KAFKA_SASL_MECHANISM_INTER_BROKER_PROTOCOL` to the desired mechanism (SASL_PLAINTEXT (or SASL_SSL)).
+- The Docker image `configure` script will validate that `KAFKA_OPTS` contains the `java.security.auth.login.config` property when SASL listeners are detected.


@muralibasani as I see the configure script will only warn if KAFKA_OPTS doesn't contain -Djava.security.auth.login.config=..., so we should correct the readme here.

@viktorsomogyi good point, indeed. Updated.

muralibasani · 2026-05-10T18:30:02Z

+    def sasl_flow(self, sasl_broker_port, test_name, test_error_prefix, topic):
+        print(f"Running {test_name}")
+        errors = []
+        try:
+            self.assertTrue(self.create_topic(topic, ["--bootstrap-server", sasl_broker_port, "--command-config", f"{self.FIXTURES_DIR}/{constants.SASL_CLIENT_CONFIG}"]))
+        except AssertionError as e:
+            errors.append(test_error_prefix + str(e))
+            return errors
+
+        producer_config = ["--bootstrap-server", sasl_broker_port,
+                           "--command-config", f"{self.FIXTURES_DIR}/{constants.SASL_CLIENT_CONFIG}"]
+        self.produce_message(topic, producer_config, "key", "message")
+
+        consumer_config = [
+            "--bootstrap-server", sasl_broker_port,
+            "--command-property", "auto.offset.reset=earliest",
+            "--command-config", f"{self.FIXTURES_DIR}/{constants.SASL_CLIENT_CONFIG}",
+        ]
+        message = self.consume_message(topic, consumer_config)


Updated to remove the duplicate blocks.

viktorsomogyi

@muralibasani would you please address the copilot reviews? I see that there are some valid comments from it. Also, would you please create a ticket and reformat your PR title to fit the conventions?

muralibasani · 2026-05-11T05:30:40Z

@muralibasani would you please address the copilot reviews? I see that there are some valid comments from it. Also, would you please create a ticket and reformat your PR title to fit the conventions?

@viktorsomogyi thanks for the review. Updated PR based on the suggestions.

viktorsomogyi · 2026-05-15T15:20:12Z

@muralibasani merged it, thanks for your contribution!

…est (apache#22023) Note : these examples work only with jvm image and not with native image. (Open issue https://issues.apache.org/jira/browse/KAFKA-19584) Changes : - Adding sasl_plain docker compose examples - Updated readme - Added sasl_flow tests (only combined and isolated modes) Reviewers: Viktor Somogyi-Vass <viktorsomogyi@gmail.com>

chia7712 · 2026-08-24T20:26:58Z

      KAFKA_NODE_ID: 4
-      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: 'CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT,SSL:SSL,PLAINTEXT_HOST:PLAINTEXT'
-      KAFKA_ADVERTISED_LISTENERS: 'PLAINTEXT_HOST://localhost:9092,SSL://localhost:19093,PLAINTEXT://broker1:29092'
+      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: 'CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT,SSL:SSL,PLAINTEXT_HOST:PLAINTEXT,SASL_PLAINTEXT:SASL_PLAINTEXT'


It seems we only set the SASL_PLAINTEXT listener for broker1, but the partition created by the test could be hosted by broker2 or broker3, so the client wouldn't be able to connect to the leader.

Am I missing something?

opened https://issues.apache.org/jira/browse/KAFKA-20982 as blocker

Adding sasl_plain docker compose example

8c67c9a

github-actions Bot added the triage PRs from the community label Apr 10, 2026

muralibasani changed the title ~~Adding sasl_plain docker compose examples~~ KAFKA-20419 : Adding sasl_plain docker compose examples Apr 10, 2026

github-actions Bot added the docker Official Docker image label Apr 10, 2026

muralibasani changed the title ~~KAFKA-20419 : Adding sasl_plain docker compose examples~~ KAFKA-20419 : docker - Adding sasl_plain docker compose examples Apr 10, 2026

muralibasani commented Apr 10, 2026

View reviewed changes

github-actions Bot removed the triage PRs from the community label Apr 11, 2026

chia7712 added the ci-approved label Apr 20, 2026

viktorsomogyi requested a review from Copilot May 10, 2026 14:20

Copilot started reviewing on behalf of viktorsomogyi May 10, 2026 14:21 View session

Copilot AI reviewed May 10, 2026

View reviewed changes

viktorsomogyi reviewed May 10, 2026

View reviewed changes

based on review comments

7ce4860

muralibasani changed the title ~~KAFKA-20419 : docker - Adding sasl_plain docker compose examples~~ KAFKA-20419 : Add SASL_PLAINTEXT docker compose examples and sanity test May 10, 2026

viktorsomogyi approved these changes May 15, 2026

View reviewed changes

viktorsomogyi merged commit 1695e95 into apache:trunk May 15, 2026
25 checks passed

chia7712 reviewed Aug 24, 2026

View reviewed changes

mingyen066 mentioned this pull request Aug 25, 2026

KAFKA-20982: Enable SASL_PLAINTEXT listener on all brokers in docker sanity test fixtures #23263

Open

Navigation Menu

Uh oh!

KAFKA-20419 : Add SASL_PLAINTEXT docker compose examples and sanity test - #22023

KAFKA-20419 : Add SASL_PLAINTEXT docker compose examples and sanity test#22023
viktorsomogyi merged 2 commits into
apache:trunkfrom
muralibasani:KAFKA-20419

muralibasani commented Apr 10, 2026 •

edited by github-actions Bot

Loading

Uh oh!

muralibasani Apr 10, 2026

Uh oh!

muralibasani Apr 10, 2026

Uh oh!

muralibasani commented Apr 21, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

viktorsomogyi May 10, 2026

Uh oh!

muralibasani May 10, 2026

Uh oh!

muralibasani May 10, 2026

Uh oh!

viktorsomogyi left a comment •

edited

Loading

Uh oh!

muralibasani commented May 11, 2026 •

edited

Loading

Uh oh!

Uh oh!

viktorsomogyi commented May 15, 2026

Uh oh!

chia7712 Aug 24, 2026

Uh oh!

chia7712 Aug 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

muralibasani commented Apr 10, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

muralibasani Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

muralibasani Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

muralibasani commented Apr 21, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

viktorsomogyi May 10, 2026

Choose a reason for hiding this comment

Uh oh!

muralibasani May 10, 2026

Choose a reason for hiding this comment

Uh oh!

muralibasani May 10, 2026

Choose a reason for hiding this comment

Uh oh!

viktorsomogyi left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

muralibasani commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

viktorsomogyi commented May 15, 2026

Uh oh!

chia7712 Aug 24, 2026

Choose a reason for hiding this comment

Uh oh!

chia7712 Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

muralibasani commented Apr 10, 2026 •

edited by github-actions Bot

Loading

viktorsomogyi left a comment •

edited

Loading

muralibasani commented May 11, 2026 •

edited

Loading