feat(kafka): support TLS and SASL authentication for external Kafka brokers

[shiv-shi]

Problem

When KAFKA_BROKERS is configured, OpenPanel creates its KafkaJS client without passing ssl or sasl options. This prevents connections to common managed or secured Kafka deployments that require TLS and SASL authentication.

Affected code

packages/queue/src/kafka.ts, in getKafka().

Expected behavior

Preserve the current unauthenticated connection behavior when no security-related environment variables are configured. When configured, support these common modes:

• TLS only
• SASL/PLAIN over TLS
• SASL/SCRAM-SHA-256 over TLS
• SASL/SCRAM-SHA-512 over TLS

Suggested configuration

KAFKA_SASL_USERNAME=...
KAFKA_SASL_PASSWORD=...
KAFKA_SASL_MECHANISM=scram-sha-512

Suggested behavior:

• If neither username nor password is configured, preserve the existing behavior.
• If only one is configured, fail fast with a clear configuration error.
• Default the mechanism to scram-sha-512 when SASL credentials are present.
• Reject unsupported mechanisms before creating the Kafka client.
• Do not log credential values.

Why this matters

TLS/SASL is a common requirement for managed Kafka and production Kafka installations. Supporting it through environment configuration would make the Kafka integration usable without requiring source changes or a custom image.

[junoyoon]

Dear @lindesvard,
Since this feature was requested by supporter plan, we would appreciate it being considered a high-priority item.

[lindesvard]

Hey @junoyoon

Sorry for the long wait and hard for me to know who is supporter here tbh. Requesting features or linking them in the supporter discord is a better channel to get things in faster.

I don't see a reason for this to not be added so will make sure you have this tomorrow or Monday.

🫶