...

As stated previously, clients never see protocol labels and will make metadata requests exactly as before. The difference is that the list of endpoints they get back is restricted to the protocol label of the endpoint where they made the request. In the example above, if let's assume that all brokers are configured similarly and that a client makes sends a metadata request to cluster1.foo.com:9092 , it will be mapped to the and it reaches broker1's 192.1.1.8:9092 interface via a load balancer. The broker will return security protocol would be SASL_PLAINTEXT:// and the metadata response would contain host=cluster1.foo.com:9092 in the metadata response. It returned the entry in advertised.listeners with the same protocol label, but it translated the protocol label to the associated security protocol before returning it to the client,port=9092 for each broker returned.

Compatibility, Deprecation, and Migration Plan

...