How to use a JWT to authenticate against the broker?

[PeterTranHuynh]

Hello, I was wondering if I was approaching this configuration properly?
I noticed that Dekaf supports JWT or Oauth for authentication through the pulsar broker, but haven't been able to properly configure my deployment to work with an existing pulsar instance.

I'm deployed using Apache's Pulsar helm charts, version 4.4.0, and wanted to try out the dekaf component that was recently added to those charts.

So far I'm using this reference markdown page for configuration of certs and some reverse proxy content: https://github.com/visortelle/dekaf/blob/main/docs/configuration-reference.md

However, I can't seem to get the UI to auth properly. Anytime it hits the broker service, I get a 401 auth error
I'm passing in a few DEKAF_ style environment variables, and was trying to pass a JWT from a secret into DEKAF_DEFAULT_PULSAR_AUTH

An example of the configuration value snippet related to this:

dekaf:
  deployment:
    extraEnv:
    - name: DEKAF_DEFAULT_PULSAR_AUTH
      valueFrom:
        secretKeyRef:
          name: pulsar-tokens
          value: asym-token

How do I go about passing in a JWT for the container to use? Is there some other configuration to specify an authentication provider/parameter/plugin/etc? I couldn't find any specifics about JWT or token authentication in the repo besides 2 closed feature issues mentioning JWTs are supported, and some spare source referencing it on a typescript/ui level.

[visortelle]

I added a section which describes the defaultPulsarAuth field to configuration reference: https://github.com/visortelle/dekaf/blob/main/docs/configuration-reference.md#default-pulsar-auth

Automatically injecting auth from k8s secret isn't handled by the pulsar-helm-chart, but there is a workaround.

We can use variable interpolation:

https://kubernetes.io/docs/tasks/inject-data-application/define-interdependent-environment-variables/

dekaf:
  deployment:
    extraEnv:
    - name: JWT_TOKEN
      valueFrom:
        secretKeyRef:
          name: pulsar-tokens
          key: asym-token
    - name: DEKAF_DEFAULT_PULSAR_AUTH
      value: '{"type":"jwt","token":"$(JWT_TOKEN)"}'

Pay attention that secretKeyRef.value field has been changed to secretKeyRef.key.

I didn't check it, but suppose it should work.

[PeterTranHuynh]

I just updated my DEKAF_DEFAULT_PULSAR_AUTH environment variable. Works splendidly! Thank you for just a quick doc update and response.

[yleizour-splio]

thx