My project currently uses Smallrye Kafka (via quarkus-smallrye-reactive-messaging-kafka) for various messaging duties, with the username and password set in application.yaml.

Username/password in plaintext has been flagged by security, who want us to move it into AWS Secrets Manager.

We currently use Secrets Manager to store credentials for downstream webservices, and access them via a Service that has SecretsManagerClient injected (from quarkus-amazon-secretsmanager).

Smallrye-Kafka is configured in the application.yaml;

kafka.sasl.jaas.config: org.apache.kafka.common.security.plain.PlainLoginModule required username="${kafka.user}" password="${kafka.pswd}";

So is it possible to load secrets (kafka.user and kafka.pswd) from Secrets Manager in the application config?
Is another option to change the Smallrye-Kafka default instantiation behaviour to use my service to grab the username and password?