feat(kafka source, kafka sink): support AWS MSK IAM auth via SASL/OAUTHBEARER#25751

Open

gecube wants to merge 10 commits into

vectordotdev:masterfrom

gecube:feat/kafka-msk-iam-auth

Commits on Jul 6, 2026

feat(kafka source, kafka sink): support AWS MSK IAM auth via SASL/OAUTHBEARER

gecube
authored and
Gaál György
committed
fix(kafka): honor MSK IAM on source context and enable-by-flag; add auth matrix tests

gecube
authored and
Gaál György
committed
fix(kafka): make MSK IAM token callback sync, require TLS, poll healthcheck

gecube
authored and
Gaál György
committed
fix(kafka): reject bare OAUTHBEARER mechanism outside MSK IAM

gecube
authored and
Gaál György
committed
fix(kafka): honor MSK IAM load timeout, gate OAUTHBEARER guard on sasl, reject conflicting librdkafka_options

gecube
authored and
Gaál György
committed
fix(kafka): clamp MSK IAM token to credential expiry, partition-aware signing host, reject librdkafka OAUTHBEARER; add cue docs

gecube
authored and
Gaál György
committed
fix(kafka): also reject the plural sasl.mechanisms alias in librdkafka_options

gecube
authored and
Gaál György
committed
fix(kafka): strip endpoint path, validate before credential load, reject MSK IAM without aws-core

gecube
authored and
Gaál György
committed
fix(kafka): stop rejecting non-MSK OAUTHBEARER (preserve librdkafka OIDC)

gecube
authored and
Gaál György
committed

Commits on Jul 7, 2026

fix(kafka): reserve sasl.oauthbearer.* for MSK IAM in librdkafka_options
gecube
committed