Configuration

Configuration

You can configure the properties to connect to Confluent Cloud through the Jikkou client configuration property jikkou.provider.confluent-cloud.

Example:

jikkou {
  provider.confluent-cloud {
    enabled = true
    type = io.jikkou.extension.confluent.ConfluentCloudExtensionProvider
    config = {
      # URL to the Confluent Cloud REST API (default: https://api.confluent.cloud)
      apiUrl = "https://api.confluent.cloud"
      # Confluent Cloud API Key (must be a Cloud API Key, not a Cluster API Key)
      apiKey = ${CONFLUENT_CLOUD_API_KEY}
      # Confluent Cloud API Secret
      apiSecret = ${CONFLUENT_CLOUD_API_SECRET}
      # CRN pattern used to scope role binding list operations
      crnPattern = ${CONFLUENT_CLOUD_CRN_PATTERN}
      # HTTP proxy URL, e.g. 'http://proxy.example.com:3128' (optional)
      proxyUrl = "http://proxy.example.com:3128"
      # Username for proxy Basic authentication (optional)
      proxyUsername = null
      # Password for proxy Basic authentication (optional)
      proxyPassword = null
      # Comma-separated hosts that bypass the proxy (optional)
      nonProxyHosts = "localhost,127.0.0.1"
      # Enable debug logging (default: false)
      debugLoggingEnabled = false

      # Additional HTTP headers sent on every request to the Confluent Cloud REST API.
      # Applied last, so these override headers Jikkou sets itself, including 'Authorization'.
      clientHeaders {
        X-Api-Gateway-Key = "my-gateway-key"
        X-Tenant = "acme"
      }
    }
  }
}

Configuration Properties

If proxyUrl is not set, Jikkou honors the standard JVM proxy system properties (-Dhttps.proxyHost, -Dhttp.proxyHost, -Dhttp.proxyUser, -Dhttp.proxyPassword, -Dhttp.nonProxyHosts), which can be supplied via JAVA_TOOL_OPTIONS. The OS-level http_proxy / https_proxy environment variables are not read by the JVM and have no effect.

Custom HTTP headers

The clientHeaders property attaches arbitrary HTTP headers to every request Jikkou sends to the Confluent Cloud REST API. It is useful for API gateway keys, tenant identifiers, and tracing headers.

clientHeaders {
  X-Api-Gateway-Key = "my-gateway-key"
  X-Tenant = "acme"
}

Custom headers are applied last, so a header set here replaces the one Jikkou would otherwise send under the same name, including the Authorization header built from apiKey and apiSecret. Header names are matched case-insensitively.

When debug logging is enabled, header values are redacted if the header name is Authorization, Proxy-Authorization, Cookie, or Set-Cookie, or if it contains token, secret, key, or password. Header names are always logged in full.

Creating a Cloud API Key

Cloud API Keys can be created using the Confluent Cloud CLI:

confluent api-key create --resource cloud --description "Jikkou role binding management"

Important: You must use a Cloud API Key (organization-level), not a Cluster API Key. Cluster API Keys will result in a 401 Unauthorized error.

CRN Pattern

The crnPattern property is required and scopes all list operations to a specific part of your organization hierarchy. Examples: