[Bug]: KafkaUser secret decoding improperly

[stefannmih]

Bug Description

I am trying to create a KafkaUser with scram-sha-512 authentication, using my own password. However, when the operator creates the KafkaUser secret based on my own password, referenced through a secret, it adds to the sasl.jaas.config, an extra new line at the end and I am not able to authenticate to the kafka brokers.

If I create a KafkaUser resource without specifying my own password, it creates it as it should and I am able to connect to the brokers using that user. The custom one does not work.

The dummy-kafka-secret-user is made from a custom password, and the kafka-user-scram is made with the default password

This is the custom KafkaUser I'm using:

kind: KafkaUser
metadata:
  name: dummy-kafka-secret-user
  labels:
    strimzi.io/cluster: my-cluster
spec:
  authentication:
    type: scram-sha-512
    password:
      valueFrom:
        secretKeyRef:
          name: dummy-kafka-secret
          key: password

And this is the secret:

apiVersion: v1
kind: Secret
metadata:
  name: dummy-kafka-secret
  namespace: kafkapoc-op1
data:
  password: RFVNTVlQQVNTV09SRDc3RFVNTVlQQVNTV09SRAo=

Looking for an answer, I've found this commit: #9912

However, I am not sure if that change is going to solve this issue or if there's anything else that I'm missing.

Steps to reproduce

No response

Expected behavior

No response

Strimzi version

0.40.0

Kubernetes version

1.25

Installation method

Helm Chart

Infrastructure

No response

Configuration files and logs

[2024-04-16 11:30:34,157] ERROR [AdminClient clientId=adminclient-1] Connection to node -1 failed authentication due to: Authentication failtion due to invalid credentials with SASL mechanism SCRAM-SHA-512 (org.apache.kafka.clients.NetworkClient)
[2024-04-16 11:30:34,158] WARN [AdminClient clientId=adminclient-1] Metadata update failed due to authentication error (org.apache.kafka.clients.admin.internals.AdminMetadataManager)
org.apache.kafka.common.errors.SaslAuthenticationException: Authentication failed during authentication due to invalid credentials with SASL mechanism SCRAM-SHA-512
Error while executing topic command : Authentication failed during authentication due to invalid credentials with SASL mechanism SCRAM-SHA-512
[2024-04-16 11:30:34,161] ERROR org.apache.kafka.common.errors.SaslAuthenticationException: Authentication failed during authentication due to invalid credentials with SASL mechanism SCRAM-SHA-512
(org.apache.kafka.tools.TopicCommand)

Additional context

No response

[khartld]

I think your encoded string contains a newline. Try to encode it with echo -n DUMMYPASSWORD77DUMMYPASSWORD | base64 or use stringData in the secret instead

[stefannmih]

Thank you, it seems like I was really missing something.

[scholzj]

Yeah, as suggested by @khartld, you have a new line there:

$ echo "DUMMYPASSWORD77DUMMYPASSWORD" | tr -d '\n' | base64
RFVNTVlQQVNTV09SRDc3RFVNTVlQQVNTV09SRA==
$ echo "DUMMYPASSWORD77DUMMYPASSWORD" | base64
RFVNTVlQQVNTV09SRDc3RFVNTVlQQVNTV09SRAo=