changefeedccl: support kerberos auth for changefeed kafka sink

[chriscasano]

Customer request to have Kerberos auth for Kafka sink in Changefeed. They have multiple scenarios for using changefeeds for audit events, table replication and other triggering events. All production Kafka clusters us Kerberos and they can not migrate current app to production without this. We would have to consider how we add Kerberos service name, credentials service, principal and key tab as part to the Create Changeed statement. I haven’t tested but looks like Sarama supports Kerberos: IBM/sarama#1366

gz#4609

gz#7784

Jira issue: CRDB-5216

[knz]

cc @nstewart for triage

[RoachietheSupportRoach]

Zendesk ticket #4609 has been linked to this issue.

[BramGruneir]

@mwang1026 or @thtruo, any movement on this?

[knz]

Wasn't this achieved already?
@stevendanna @dt ?

[shermanCRL]

See IBM/sarama#1366

[knz]

@shermanCRL thanks, but how does this answer the question? Was the outcome from crdb's perspective achieved or not? In which version? Our CEAs would like to know.

[stevendanna]

No, we do not currently support this. We added support for SCRAM as a new SASL authentication method but not GSSAPI.