# SASL/PLAIN — Kafka credentials.
#
# TLS behaviour is driven by ca_cert and the explicit tls: signal:
#   - ca_cert present        → SASL_SSL       (TLS; the supplied CA is trusted)
#   - tls: true (no ca_cert) → SASL_SSL       (TLS; system/public trust store)
#   - neither                → SASL_PLAINTEXT (no TLS — test/lab listeners only)
#
# Usable in any Kafka slot (source, clusterLink.source, clusterLink.destination).
sasl_plain:
  username: admin
  password: secret
  ca_cert: ./ca.pem   # present ⇒ SASL_SSL over a private/internal CA.
                      # Remove it for a plaintext (non-TLS) test listener.
  # tls: true         # SASL_SSL over a PUBLIC/system-CA listener (e.g. Confluent
                      # Cloud) with no custom CA — omit ca_cert and set this.