xai-org/x-algorithm · error · ValueError

ScramKafkaProducer requires an ssl config

Error message

ScramKafkaProducer requires an ssl config

What it means

ScramKafkaProducer._build_client (invoked from get()) builds the aiokafka client from KafkaProducerConfig; when config.ssl is None it raises ValueError because the SCRAM producer is designed to run only over TLS — plaintext SCRAM would leak credentials. Other producers in this codebase use SSL/mTLS config, so ssl=None is treated as misconfiguration.

Source

Thrown at grox/libs/kafka_cli/producer.py:146

            raise


class _ScramKafkaProducerClient:
    _cached_clients: dict[str, AIOKafkaProducer] = {}

    @classmethod
    async def _build_client(cls, config: KafkaProducerConfig) -> AIOKafkaProducer:
        if isinstance(config.brokers, WilyConfig):
            wily = WilyNs(config.brokers)
            instances = await wily.resolve(config.dest)
            brokers = ",".join(
                f"{instance.address}:{instance.port}" for instance in instances
            )
        else:
            brokers = ",".join(config.brokers)
        ssl_conf = config.ssl
        if ssl_conf is None:
            raise ValueError("ScramKafkaProducer requires an ssl config")

        proto = (ssl_conf.security_protocol or "").upper()
        if proto == "SSL":
            ssl_context = _create_mtls_ssl_context()
            producer = AIOKafkaProducer(
                bootstrap_servers=brokers,
                security_protocol="SSL",
                ssl_context=ssl_context,
                request_timeout_ms=config.timeout_sec * 1000,
            )
        else:
            ssl_context = ssl.create_default_context()
            ssl_context.check_hostname = False
            ssl_context.verify_mode = ssl.CERT_NONE
            producer = AIOKafkaProducer(
                bootstrap_servers=brokers,
                sasl_mechanism=ssl_conf.sasl_mechanism,
                security_protocol=ssl_conf.security_protocol,

View on GitHub (pinned to 24c60942c5)

Solutions

1. Add an ssl (SSLConfig) block to the producer config with security_protocol SASL_SSL and the appropriate context/mechanism settings.
2. If you do not need SCRAM, use the non-SCRAM producer class that permits plaintext.
3. Validate the config source includes the ssl section before building the client.

Example fix

# before
cfg = KafkaProducerConfig(brokers=['b:9092'])
producer = ScramKafkaProducer.get(cfg)  # ValueError: requires an ssl config

# after
cfg = KafkaProducerConfig(
    brokers=['b:9092'],
    ssl=SSLConfig(security_protocol='SASL_SSL'),
)
producer = ScramKafkaProducer.get(cfg)

if config.ssl is None:
    raise SystemExit('SCRAM producer requires ssl config; add SASL_SSL block')
producer = ScramKafkaProducer.get(config)

try:
    p = ScramKafkaProducer.get(cfg)
except ValueError as e:
    if 'ssl config' in str(e):
        cfg = cfg.model_copy(update={'ssl': SSLConfig(security_protocol='SASL_SSL')})
        p = ScramKafkaProducer.get(cfg)
    else:
        raise

When it happens

Trigger: Constructing/getting a ScramKafkaProducer with a KafkaProducerConfig that omits the ssl field (defaults to None), e.g. config built from a source lacking the ssl block.

Common situations: Config template that only sets brokers and group but no ssl section; migrating a local plaintext producer config to the SCRAM class without adding TLS; YAML indentation putting ssl under the wrong parent key so it parses as absent.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Kafka mTLS requires CA at {ca_file!r} (mount internal-ca Con
• XAI_USER environment variable is required
• XAI_JOB_NAME environment variable is required
• XAI_CLUSTER environment variable is required
• {cls.__name__} must set TASK_GENERATOR_TYPE to be registered

AI-assisted analysis of xai-org/x-algorithm@24c60942c5 (2026-08-28). Data as JSON: /api/errors/174936b570723ea9. Report an issue: GitHub.