[SamuelAdigos]

Fixes #10035

When a listener is registered via withListener(...), KafkaHelper always appended TC-<n>:PLAINTEXT to
KAFKA_LISTENER_SECURITY_PROTOCOL_MAP, even if the user had already mapped that listener (e.g. TC-0:SASL_PLAINTEXT).
The map then contained the listener twice and Kafka used PLAINTEXT, so additional listeners could not be secured
without overriding configure().

The default TC-<n>:PLAINTEXT mapping is now only added when the user has not configured one for that listener
(matched case-insensitively, as Kafka normalises listener names). Default behaviour is unchanged.
This applies to both org.testcontainers.kafka.KafkaContainer and ConfluentKafkaContainer; the deprecated
org.testcontainers.containers.KafkaContainer is left untouched.

Tests

• Added ConfluentKafkaContainerTest.shouldKeepSecurityProtocolConfiguredForListener: maps TC-0 to SASL_PLAINTEXT
  and produces/consumes through that listener with SASL/PLAIN (fails before the fix).
• ./gradlew :testcontainers-kafka:check plus spotless/checkstyle/japicmp.
• Ran the full CI testMatrix locally; remaining failures are environment-related (arm64 host, Rancher Desktop)
  and reproduce on main.

Summary by CodeRabbit

• Bug Fixes
  • Kafka containers now retain an explicitly configured security protocol for a listener instead of adding a conflicting plaintext mapping. Custom authenticated listener configurations, such as SASL/PLAIN, therefore remain effective when connecting through a proxy. Protocol entries with different casing or surrounding whitespace are also recognized as existing configurations, helping prevent unexpected connection behavior.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: e97e9ab6-d713-4dc9-a280-e0f446b93f82

Commits

Reviewing files that changed from the base of the PR and between 3de32b4 and 034990c.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review.

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1b38975c-6e79-4b60-90b1-4d62b59d0ab7

📥 Commits

Reviewing files that changed from the base of the PR and between 9bb3c2d and 3de32b4.

📒 Files selected for processing (2)

• modules/kafka/src/main/java/org/testcontainers/kafka/KafkaHelper.java
• modules/kafka/src/test/java/org/testcontainers/kafka/ConfluentKafkaContainerTest.java

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

Listener resolution now retains an existing security protocol mapping for a generated listener instead of always adding a PLAINTEXT mapping. An integration test configures SASL_PLAINTEXT with PLAIN authentication and checks access through a proxy.

Changes: Kafka listener protocol map

Layer / File(s)	Summary
Preserve configured listener protocol modules/kafka/src/main/java/org/testcontainers/kafka/KafkaHelper.java, modules/kafka/src/test/java/org/testcontainers/kafka/ConfluentKafkaContainerTest.java	resolveListeners checks for a trimmed, case-insensitive mapping for the generated protocol before adding a PLAINTEXT entry. The integration test configures TC-0 as SASL_PLAINTEXT with PLAIN authentication and checks functionality through the proxy.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: eddumelendez

Merge Risk: Minimal · previous review 3de32

Additional Kafka listeners now keep the security protocol the user configured, and the default is unchanged when none is set. No merge-blocking risk was found.

Pre-merge checks | 4 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: preserving user-defined security protocols for additional Kafka listeners.
Description check		The description identifies issue #10035, explains the broken behavior, describes the fix and its scope, documents the added regression test, and reports validation commands and environment-related CI …
Linked Issues check		Issue [#10035] requires an additional listener to retain a user-defined security protocol. KafkaHelper.resolveListeners now checks KAFKA_LISTENER_SECURITY_PROTOCOL_MAP case-insensitively before ad…
Out of Scope Changes check		The changes are limited to the shared listener-resolution logic and an integration test for the linked issue. The test directly verifies the required Confluent Kafka behavior. No unrelated implementat…

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}