What's the difference between Kafka's SSL/TLS (encryption) and SASL (authentication), and why do production clusters typically need both?

TLS encrypts the data in transit so it can't be read or tampered with on the wire, but by itself doesn't verify WHO is connecting. SASL (e.g. SCRAM or Kerberos) handles authenticating the client's identity to the broker. Production clusters typically run both together — TLS for confidentiality/integrity, SASL for verifying the connecting client is who it claims to be — since either alone leaves a real gap.