KIP-1061 — Allow exporting SCRAM credentials

Discussion SecurityAdmin

KIP-1061 proposes adding a `--describe` export mode to `kafka-configs.sh` that outputs SCRAM credential fields (`salt`, `stored_key`, `server_key`) needed to replicate credentials to another cluster. KIP-554 stored SCRAM credentials in KRaft metadata but intentionally withheld these fields from the describe output; without them, migrating a cluster requires all users to reset their passwords in the new cluster.

Protocol Impact

DescribeUserScramCredentials

Details