kafka-proxy proxy
kafka-proxy proxy
The kafka-proxy proxy binding for adapting kafka topic streams to kafka topic streams.
kafka_proxy:
type: kafka-proxy
kind: proxy
options:
external:
host: kafka-#.external.net
port: 9093
internal:
host: b-#.kafka.internal.net
port: 9094
exit: tls_clientConfiguration (* required)
options*
object
The kafka-proxy specific options.
options:
cluster-id: development
external:
host: kafka-#.external.net
port: 9093
internal:
host: b-#.kafka.internal.net
port: 9094options.cluster-id
string
Specifies the cluster id for virtual cluster configuration.
options.external*
object
Kafka proxy endpoint used by external clients.
external:
host: kafka-#.external.net
port: 9093
authorization:
cognito0:
mechanism: oauthbearerexternal.host*
string| Pattern:^[^:]+(?:-({[^}]+}|[^.]+))?(?::(\\d+)\\+)?$
Hostname pattern for external Kafka broker names, where # is an integer.
external.port*
integer
Port number for external Kafka broker.
external.default
string| Pattern:^[^:]+$
Default external hostname.
external.radix
enum[10,16,36] | Default:16
Radix used to encode the broker number in the external hostname pattern.
external.authorization
objectas map of namedobjectproperties
Authorization configuration for external connections, keyed by guard name. Each named entry authenticates the external SASL handshake against that guard.
authorization.mechanism
enum[plain,oauthbearer]
Authorization mechanism.
plain: extractsauthzid/authcid/passwdfrom a SASL/PLAIN initial response and substitutes them into thecredentialstemplate before authorizing with the guard.oauthbearer: parses an RFC 7628 SASL/OAUTHBEARER initial response and extracts the bearer token, substituting it into thecredentialstemplate before authorizing with the guard. On rejection, the client receives an RFC 7628 §3.7 error response instead of an immediate SASL failure.
authorization.credentials
string| Default:"Bearer {credentials}"whenmechanismisoauthbearer
Template used to build the credentials string passed to the guard.
- For
plain,{username}and{password}are substituted from the SASL/PLAIN initial response'sauthcid/passwd. Required. - For
oauthbearer,{credentials}is substituted from the extracted bearer token. Optional.
external:
authorization:
test0:
mechanism: plain
credentials: "{username}:{password}"
cognito0:
mechanism: oauthbeareroptions.internal*
object
Internal Kafka broker endpoint.
internal:
host: b-#.kafka.internal.net
port: 9094internal.host*
string| Pattern:^[^:]+$
Hostname pattern for internal Kafka broker names, where # is an integer.
internal.port*
integer
Port number for internal Kafka broker.
internal.default
string| Pattern:^[^:]+$
Default internal hostname.
internal.radix
enum[10,16,36] | Default:16
Radix used to encode the broker number in the internal hostname pattern.
internal.authorization
object
Authorization configuration for internal connections.
credentials.mechanism
enum[plain,scram-sha-256,scram-sha-512,oauthbearer]
Authentication mechanism.
plain,scram-sha-256,scram-sha-512: authenticates to the internal broker with the staticusername/passwordbelow.oauthbearer: authenticates to the internal broker with a token built from thecredentialstemplate below, evaluated against the session an external guard already authorized. Lets Zilla present the external client's own credentials to the internal broker instead of a static service-account secret.
credentials.username
string
Username for authentication. Required when mechanism is plain, scram-sha-256, or scram-sha-512.
credentials.password
string
Password for authentication. Required when mechanism is plain, scram-sha-256, or scram-sha-512.
internal:
authorization:
credentials:
mechanism: plain
username: ${{env.SASL_USERNAME}}
password: ${{env.SASL_PASSWORD}}credentials.credentials
string
Template used to build the bearer token presented to the internal broker. Required when mechanism is oauthbearer. Supports ${guarded['my_guard'].credentials} to reference the raw credential string an external guard authorized the session with.
internal:
authorization:
credentials:
mechanism: oauthbearer
credentials: "Bearer ${guarded['cognito0'].credentials}"options.topics
arrayofobject
Topic configuration list.
topics[].name
string
Topic name, as observed by the external client.
topics[].alias
string
Template for the internal topic name. Supports ${topic} to reference the topic's own name, along with identity and attribute placeholders such as ${guarded['my_guard'].identity} and ${guarded['my_guard'].attributes.my_attribute}. When omitted, the existing rules apply, either cluster-id prefixed or match the external name.
topics:
- name: messages
alias: "${topic}-${guarded['my_guard'].identity}"topics[].key
enum[avro,boolean,double,float,int32,int64,json,string],object
Enforce validation for key.
key.model*
enum[avro,boolean,double,float,int32,int64,json,string]
A schema or type to validate the topic's key. Refer to the individual model docs for type specific implementation.
topics[].value
enum[avro,boolean,double,float,int32,int64,json,string],object
Enforce validation for value.
value.model*
enum[avro,boolean,double,float,int32,int64,json,string]
A schema or type to validate the topic's value. Refer to the individual model docs for type specific implementation.
catalog
objectas map of namedarray
Catalog for schema retrieval. Required when model is avro, json, or protobuf. Applies to both key and value models.
catalog[].id*
integer
Define specific schema id to refer from catalog.
catalog[].strategy*
enum[topic]
To determine the subject based on the specified strategy.
catalog[].version
string| Default:latest
Specific iteration or version of a registered schema in the defined catalog.
catalog[].subject*
string
Unique identifier for schema categorization in the catalog.
topics[].limit
string
Topic limit.
topics[].constraints
arrayofobject
Constraints applied to this topic.
constraints[].mode
enum[enforce,warn]
Constraint enforcement mode.
constraints[].regex
string
Constraint regex pattern.
constraints[].partitions
object
Partition constraints.
partitions.min
integer| Minimum:1
Minimum number of partitions.
partitions.max
integer| Minimum:1
Maximum number of partitions.
constraints[].replicas
object
Replica constraints.
replicas.min
integer| Minimum:1
Minimum number of replicas.
replicas.max
integer| Minimum:1
Maximum number of replicas.
constraints[].configs
objectas map of namedstringproperties,objectas map of namedobjectproperties
Topic configuration constraints.
configs.min
integer
Minimum configs.
configs.max
integer
Maximum configs.
configs.enum
arrayofstring
Allowed config values.
constraints[].deletion
enum[protected]
Topic deletion constraint.
options.limits
objectas map of namedobjectproperties
Rate limits by named group.
limits.produce
object
Produce rate limit.
produce.bytes
string| Pattern:^[0-9]+(\\.[0-9]+)?\\s*(B|kB|KB|MB|mB|GB|gB|TB|tB|b|kb|Kb|mb|Mb|gb|Gb|tb|Tb)/s$
Maximum produce data rate.
options.constraints
arrayofobject
Global connection constraints.
constraints[].client_id
string| Pattern:^[a-zA-Z0-9_-]*\\*?$
Client ID pattern to match.
constraints[].api_versions
object
API version constraints.
api_versions.min
objectas map of namedintegerproperties
Minimum API versions by key.
api_versions.max
objectas map of namedintegerproperties
Maximum API versions by key.
constraints[].cooldown
string
Cooldown duration.
constraints[].producer
enum[idempotent]
Producer constraint.
constraints[].compression
arrayofenum[none,gzip,snappy,lz4,zstd]
Allowed compression types.
routes
arrayofobject
Conditional kafka-proxy specific routes.
routes[].when
arrayofobject
List of conditions (any match) to match this route.
when[].topic
string
Topic name to match.
when[].api
arrayofenum[produce,fetch,metadata,update_metadata,offset_commit,offset_fetch,offset_delete,find_coordinator,list_offsets,sasl_handshake,api_versions,join_group,heartbeat,leave_group,sync_group,init_producer_id,offset_for_leader_epoch,add_partitions_to_transaction,add_offsets_to_transaction,end_transaction,write_transaction_markers,transaction_offset_commit,sasl_authenticate,create_topics,describe_configs,alter_configs,incremental_alter_configs,create_partitions,delete_topics,delete_records,consumer_group_heartbeat,share_group_heartbeat,share_group_describe,leader_and_isr,elect_leaders,alter_partition,alter_partition_reassignments,list_partition_reassignments,describe_topic_partitions,describe_log_directories,alter_replica_log_directories,describe_producers]
Kafka API keys to match.
routes[].guarded
objectas map of namedarrayofstring
List of roles required by each named guard to authorize this route.
routes[].exit
string
Next binding when following this route.
exit
string
Default exit binding when no conditional routes are viable.
exit: echo_servertelemetry
object
Defines the desired telemetry for the binding.
telemetry.metrics
array
Telemetry metrics to track
telemetry:
metrics:
- stream.*telemetry.attributes
objectas map of namedstringproperties
Telemetry attributes to add to the binding metrics.

