fix: emit SCRAM-SHA512 sasl_mechanism the kafka-backup binary accepts

The kafka-backup binary's config parser only accepts SCRAM-SHA512 (no
hyphen before the digits), but both config adapters wrote the CRD-style
SCRAM-SHA-512 into generated ConfigMaps, so every backup or restore job
using authentication.type: scram-sha-512 failed on startup with
"unknown variant `SCRAM-SHA-512`".

The mechanism string now lives in a single shared constant used by both
the backup and restore adapters.

Verified end-to-end in kind: Strimzi 0.46.1 with a SCRAM-SHA-512
listener, MinIO S3 storage, backup and restore jobs both complete and
round-trip 100 records.

Fixes #35

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: sionsmith

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file.
 
+## 0.2.11 - 2026-07-03
+
+### Fixed
+
+- Write `sasl_mechanism: SCRAM-SHA512` (no hyphen before the digits) into generated backup and restore ConfigMaps. The kafka-backup binary's config parser only accepts `SCRAM-SHA512`, so jobs for resources using `authentication.type: scram-sha-512` failed on startup with `unknown variant 'SCRAM-SHA-512'`. Fixes [#35](https://github.com/osodevops/strimzi-backup-operator/issues/35).
+
 ## 0.2.10 - 2026-06-12
 
 ### Added

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "kafka-backup-operator"
-version = "0.2.10"
+version = "0.2.11"
 edition = "2021"
 rust-version = "1.88"
 license = "Apache-2.0"

Cargo.toml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: strimzi-backup-operator
 description: Kubernetes operator for Kafka backup and restore, integrated with Strimzi
 type: application
-version: 0.2.10
-appVersion: "0.2.10"
+version: 0.2.11
+appVersion: "0.2.11"
 home: https://github.com/osodevops/strimzi-backup-operator
 sources:
   - https://github.com/osodevops/strimzi-backup-operator

deploy/helm/strimzi-backup-operator/Chart.yaml

@@ -150,7 +150,7 @@ fn build_kafka_config(
         } => {
             security.insert(
                 Value::String("sasl_mechanism".to_string()),
-                Value::String("SCRAM-SHA-512".to_string()),
+                Value::String(super::SASL_MECHANISM_SCRAM_SHA512.to_string()),
             );
             security.insert(
                 Value::String("sasl_username".to_string()),
@@ -560,6 +560,25 @@ mod tests {
         assert!(yaml.contains("rdkafka: info"));
     }
 
+    /// Issue #35: the kafka-backup binary's config parser only accepts
+    /// `SCRAM-SHA512` (no hyphen before the digits); `SCRAM-SHA-512` is
+    /// rejected with "unknown variant".
+    #[test]
+    fn test_scram_auth_emits_binary_compatible_sasl_mechanism() {
+        let backup = test_backup();
+        let auth = ResolvedAuth::ScramSha512 {
+            username: "kafka-backup".to_string(),
+            secret_name: "kafka-backup".to_string(),
+            password_key: "password".to_string(),
+        };
+        let yaml = build_backup_config_yaml(&backup, &test_cluster(), &None, &auth).unwrap();
+        let config: Value = serde_yaml::from_str(&yaml).unwrap();
+        assert_eq!(
+            config["source"]["security"]["sasl_mechanism"].as_str(),
+            Some("SCRAM-SHA512")
+        );
+    }
+
     #[test]
     fn test_default_backup_id_uses_env_var() {
         let backup = test_backup();

src/adapters/backup_config.rs

@@ -3,3 +3,9 @@ pub mod logging_config;
 pub mod restore_config;
 pub mod secrets;
 pub mod storage_config;
+
+/// SASL mechanism value for SCRAM-SHA-512 as the kafka-backup binary's config
+/// parser expects it: `SCRAM-SHA512`, with no hyphen before the digits. The
+/// binary rejects the IANA spelling `SCRAM-SHA-512` with "unknown variant"
+/// (issue #35).
+pub(crate) const SASL_MECHANISM_SCRAM_SHA512: &str = "SCRAM-SHA512";

src/adapters/mod.rs

@@ -126,7 +126,7 @@ fn build_kafka_config(
         ResolvedAuth::ScramSha512 { username, .. } => {
             security.insert(
                 Value::String("sasl_mechanism".to_string()),
-                Value::String("SCRAM-SHA-512".to_string()),
+                Value::String(super::SASL_MECHANISM_SCRAM_SHA512.to_string()),
             );
             security.insert(
                 Value::String("sasl_username".to_string()),

src/adapters/restore_config.rs

@@ -351,6 +351,33 @@ fn test_restore_config_topic_selection() {
     assert_eq!(topics["exclude"][0].as_str(), Some("*-internal"));
 }
 
+/// Issue #35: the kafka-backup binary's config parser only accepts
+/// `SCRAM-SHA512` (no hyphen before the digits); `SCRAM-SHA-512` is
+/// rejected with "unknown variant".
+#[test]
+fn test_restore_scram_auth_emits_binary_compatible_sasl_mechanism() {
+    let restore = sample_restore();
+    let backup = sample_backup();
+    let cluster = sample_cluster();
+    let auth = ResolvedAuth::ScramSha512 {
+        username: "kafka-backup".to_string(),
+        secret_name: "kafka-backup".to_string(),
+        password_key: "password".to_string(),
+    };
+
+    let yaml = build_restore_config_yaml(&restore, &backup, &cluster, &None, &auth).unwrap();
+
+    let config: serde_yaml::Value = serde_yaml::from_str(&yaml).unwrap();
+    assert_eq!(
+        config["target"]["security"]["sasl_mechanism"].as_str(),
+        Some("SCRAM-SHA512")
+    );
+    assert_eq!(
+        config["target"]["security"]["security_protocol"].as_str(),
+        Some("SASL_SSL")
+    );
+}
+
 #[test]
 fn test_restore_config_omits_topic_selection_by_default() {
     let restore = sample_restore();