lh0156 opened a new pull request, #22941: URL: https://github.com/apache/kafka/pull/22941
## Summary - Detect SSL and SASL_SSL listeners from `KAFKA_LISTENER_SECURITY_PROTOCOL_MAP` and `KAFKA_LISTENERS` in addition to advertised listeners. - Add a Docker regression test for a dedicated KRaft controller using `CONTROLLER:SSL` without advertised listeners. ## Motivation Fixes [KAFKA-20325](https://issues.apache.org/jira/browse/KAFKA-20325). Dedicated KRaft controllers must not set `KAFKA_ADVERTISED_LISTENERS`, but they can still use an SSL controller listener through `KAFKA_LISTENER_SECURITY_PROTOCOL_MAP`. The Docker image previously detected SSL only from advertised listener names, so it skipped keystore and truststore initialization and the controller could not start with SSL. The detection keeps the existing advertised-listener behavior and also respects the configured security protocol, including custom listener names such as `CONTROLLER:SSL` and `EXTERNAL:SASL_SSL`. ## Validation - Added a regression test that fails against the previous script and passes after the change. - Built an image containing the updated Docker script and ran the regression test successfully. - Started a dedicated KRaft controller with `CONTROLLER:SSL`; the Kafka server reached the started state. - `bash -n docker/resources/common-scripts/configure` - `python3 -m py_compile docker/test/docker_sanity_test.py` - `git diff --check` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
