Respect user-defined security protocol for additional Kafka listeners

[SamuelAdigos]

Fixes #10035

When a listener is registered via withListener(...), KafkaHelper always appended TC-<n>:PLAINTEXT to
KAFKA_LISTENER_SECURITY_PROTOCOL_MAP, even if the user had already mapped that listener (e.g. TC-0:SASL_PLAINTEXT).
The map then contained the listener twice and Kafka used PLAINTEXT, so additional listeners could not be secured
without overriding configure().

The default TC-<n>:PLAINTEXT mapping is now only added when the user has not configured one for that listener
(matched case-insensitively, as Kafka normalises listener names). Default behaviour is unchanged.
This applies to both org.testcontainers.kafka.KafkaContainer and ConfluentKafkaContainer; the deprecated
org.testcontainers.containers.KafkaContainer is left untouched.

Tests

• Added ConfluentKafkaContainerTest.shouldKeepSecurityProtocolConfiguredForListener: maps TC-0 to SASL_PLAINTEXT
  and produces/consumes through that listener with SASL/PLAIN (fails before the fix).
• ./gradlew :testcontainers-kafka:check plus spotless/checkstyle/japicmp.
• Ran the full CI testMatrix locally; remaining failures are environment-related (arm64 host, Rancher Desktop)
  and reproduce on main.

Summary by CodeRabbit

• Bug Fixes
  • Kafka containers now retain an explicitly configured security protocol for a listener instead of adding a conflicting plaintext mapping. Custom authenticated listener configurations, such as SASL/PLAIN, therefore remain effective when connecting through a proxy. Protocol entries with different casing or surrounding whitespace are also recognized as existing configurations, helping prevent unexpected connection behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1b38975c-6e79-4b60-90b1-4d62b59d0ab7

---

📥 Commits

Reviewing files that changed from the base of the PR and between 9bb3c2d and 3de32b4.

---

📒 Files selected for processing (2)

• modules/kafka/src/main/java/org/testcontainers/kafka/KafkaHelper.java
• modules/kafka/src/test/java/org/testcontainers/kafka/ConfluentKafkaContainerTest.java

---

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

---

📝 Walkthrough

Walkthrough

Listener resolution now retains an existing security protocol mapping for a generated listener instead of always adding a PLAINTEXT mapping. An integration test configures SASL_PLAINTEXT with PLAIN authentication and checks access through a proxy.

Changes

Kafka listener protocol map

Layer / File(s)	Summary
Preserve configured listener protocol modules/kafka/src/main/java/org/testcontainers/kafka/KafkaHelper.java, modules/kafka/src/test/java/org/testcontainers/kafka/ConfluentKafkaContainerTest.java	resolveListeners checks for a trimmed, case-insensitive mapping for the generated protocol before adding a PLAINTEXT entry. The integration test configures TC-0 as SASL_PLAINTEXT with PLAIN authentication and checks functionality through the proxy.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: eddumelendez

---

Merge Risk: ⚪ Minimal · up to 3de32

Additional Kafka listeners now keep the security protocol the user configured, and the default is unchanged when none is set. No merge-blocking risk was found.

Pre-merge checks | 4 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: preserving user-defined security protocols for additional Kafka listeners.
Description check		The description identifies issue #10035, explains the broken behavior, describes the fix and its scope, documents the added regression test, and reports validation commands and environment-related CI …
Linked Issues check		Issue [#10035] requires an additional listener to retain a user-defined security protocol. KafkaHelper.resolveListeners now checks KAFKA_LISTENER_SECURITY_PROTOCOL_MAP case-insensitively before ad…
Out of Scope Changes check		The changes are limited to the shared listener-resolution logic and an integration test for the linked issue. The test directly verifies the required Confluent Kafka behavior. No unrelated implementat…

---

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}