[bryansan-local]

Motivation

The emulator now serves SASL_SSL on the Event Hubs Kafka endpoint (localstack/localstack-pro#9645), so the Kafka producer can use the settings Azure requires instead of describing them in a comment.

Changes

• producer_kafka.py always sets security.protocol=SASL_SSL, sasl.mechanism=PLAIN, sasl.username=$ConnectionString and the connection string as sasl.password, so the same config works against LocalStack and Azure.
• The README no longer says the emulator serves Kafka in plaintext.

Tests

• Real Azure: producer_kafka.py published 15 of 15 events to the namespace created by each deployment (Azure CLI, Bicep, Terraform). The version on main fails there with Disconnected while requesting ApiVersion, since Azure only accepts SASL_SSL.
• Emulator (image with localstack-pro#9645): deploy.sh and validate.sh pass, and run-pipeline.sh ingests all 75 payments, 15 of them over Kafka.
• The rest of the sample doesn't deploy on real Azure yet, for reasons unrelated to this change. That goes in a separate PR.

Part of SMF-955

[Copilot]

🟢 Approval recommended

The focused configuration change matches Azure’s requirements, with no identified blocking issues and reported validation against Azure and the updated emulator.

No open issues 🎉

What changed in this PR

Aligns the Event Hubs Kafka producer with Azure’s authentication requirements, using the same configuration for Azure and the updated LocalStack emulator.

Changes:

• Enables SASL_SSL with PLAIN authentication and connection-string credentials.
• Removes the README’s outdated plaintext Kafka limitation.

File	Description
samples/​eventhubs/​python/​src/​producers/​producer_kafka.py	Configures Azure-compatible TLS and SASL authentication.
samples/​eventhubs/​python/​README.md	Removes the obsolete emulator plaintext note.

_{Review effort: Balanced}