🔒 fix(sink): redact kafka SASL construction errors

[SebTardif]

Summary

Stop Kafka SCRAM setup errors from carrying secret material into CR status and Events.

Problem

dialTransport wraps scram.Mechanism errors with %w. The SASL library can interpolate the configured password into Error(). NewBackend and TestConnection return that string. Family-sink and ConnectionTest reconcilers copy it into conditions and Warning events.

Anyone who can get a KollectEventSink status (or Events) but not the referenced Secret can then read the password.

This is the same class as the postgres SEC-01 redaction work: never fold third-party connect/auth text into operator-visible errors.

Change

• Return a static kafka SASL: authentication configuration failed when SCRAM construction fails.
• Add a unit test that uses a SASLprep-prohibited password rune and asserts the returned error does not contain the secret.

Validation

• Red: go test ./internal/sink/kafka/ -run TestDialTransport_SASLPrepErrorOmitsPassword failed because the wrapped error included the password.
• Green: go test ./internal/sink/kafka/ and golangci-lint run (project custom binary) passed.

Origin

Introduced in fa8aeb5 (2026-06-05) when the Kafka backend landed.

Related in-repo redaction:

• 🔒 fix(sink/postgres): redact DSN/host from pgx ParseConfig error (SEC-01) #174
• 🔒 fix(sink/postgres): harden DSN/host redaction (SEC-01-FUP1/FUP2) #182
• 🔒 fix(sink/postgres): redact ConnectError on export path (SEC-01-FUP3/FUP4) #184

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[konih]

Hey @SebTardif — thank you, genuinely.

I want to say that plainly before anything else. #303 and #304 are the kind of contribution maintainers hope for and rarely get: real bugs, tight diffs, a test that fails before the fix, and a PR body that explains the reasoning instead of making me reconstruct it. Reviewing them was easy, which is about the highest compliment I can pay a patch.

And I'll be honest — I was surprised you actually did this after I reached out on Reddit. That kind of message usually goes nowhere. This one didn't.

Reviewing #304 sent me looking for the same class of gap elsewhere, and I've put the results up as separate PRs rather than pushing to your branch:

• 📝 docs(controller): document cluster-scope GVK backstop and upgrade impact #305 — documents the ScopeGVKDenied backstop and the upgrade impact
• 🐛 fix(controller): make KollectClusterScope enforceable at runtime (RBAC + watch) #306 — the operator never had RBAC to read KollectClusterScope at all, so the cluster-scope ceiling could not be enforced in a cluster with RBAC on; adds the grant, plus a watch so scope edits re-reconcile their targets
• 🐛 fix(webhook): keep KollectScope checks when the profile is missing #307 — the namespaced KollectTarget webhook had the identical hole you fixed for the cluster kind

#306 is the one I would never have gone looking for without your PR. Your fix made cluster-scope enforcement correct; it then turned out the subsystem could not run at all in an RBAC-enforcing cluster. So thanks for that one twice over.

Merging this one now — #304 is queued next with its follow-ups behind it.

Last thing: I went looking through Attune for something I could pick up in return and couldn't find open engineering work — the open issues read as community and launch chores. If any of those would genuinely help, I'm happy to take them off your plate (the awesome-list submissions, or one of the write-ups). And if there's something else you're working on where a hand would be useful, just say so — I'd rather return the favour than bank it.