# SASL/SCRAM — Kafka credentials. Always connects over TLS (SASL_SSL).
#
# Usable in any Kafka slot:
#   - spec.source.credentials
#   - spec.clusterLink.source.credentials       (destination-initiated mode)
#   - spec.clusterLink.destination.credentials  (source-initiated mode)
sasl_scram:
  username: admin
  password: secret
  mechanism: SHA512     # required: SHA256 or SHA512 (MSK requires SHA512)
  # ca_cert: ./ca.pem   # optional — PEM path to verify a private/internal CA.
                        # Omit for public-CA brokers (MSK, Confluent Cloud): they
                        # validate against the system trust store.