Merge pull request ClickHouse#1348 from ClickHouse/clickpipes3

Added authentication note to ClickPipes FAQ

docs/en/integrations/data-ingestion/clickpipes/index.md

@@ -158,6 +158,12 @@ Nullable versions of the above are also supported with these exceptions:
 
   ClickPipes uses a dedicated architecture running the Kafka Consumer API to read data from a specified topic and then inserts the data into a ClickHouse table on a specific ClickHouse Cloud service.
 
+- **What's the difference between ClickPipes and the ClickHouse Kafka Table Engine?**
+
+  The Kafka Table engine is a ClickHouse core capability that implements a “pull model” where the ClickHouse server itself connects to Kafka, pulls events then writes them locally. 
+
+  ClickPipes is a separate cloud service that runs independently from the ClickHouse Service, it connects to Kafka (or other data sources) and pushes events to an associated ClickHouse Cloud service. This decoupled architecture allows for superior operational flexibility, clear separation of concerns, scalable ingestion, graceful failure management, extensibility and more.
+
 - **What are the requirements for using ClickPipes for Kafka ?**
 
   In order to use ClickPipes for Kafka, you will need a running Kafka broker and a ClickHouse Cloud service with ClickPipes enabled. You will also need to ensure that ClickHouse Cloud can access your Kafka broker. This can be achieved by allowing remote connection on the Kafka side, whitelisting [ClickHouse Cloud Egress IP addresses](https://clickhouse.com/docs/en/manage/security/cloud-endpoints-api) in your Kafka setup. Support for AWS Private Link is coming soon.
@@ -184,4 +190,8 @@ Nullable versions of the above are also supported with these exceptions:
 
 - **Does using ClickPipes incur an additional cost ?**
 
-  ClickPipes is not billed separately. Running ClickPipes might generate an indirect compute and storage cost on the destination ClickHouse Cloud service like any ingest workload.
+  ClickPipes is not billed separately. Running ClickPipes might generate an indirect compute and storage cost on the destination ClickHouse Cloud service like any ingest workload.
+
+- **What authentication mechanisms are supported for ClickPipes for Kafka?**
+
+  ClickPipes for Kafka supports [SASL/PLAIN](https://docs.confluent.io/platform/current/kafka/authentication_sasl/authentication_sasl_plain.html) authentication with TLS encryption.