Configuration

Configuration

You can configure the properties to be used to connect the Kafka Connect cluster through the Jikkou client configuration property: jikkou.provider.kafkaconnect.

Example:

jikkou {
  provider.kafkaconnect {
    enabled = true
    type = io.jikkou.kafka.connect.KafkaConnectExtensionProvider
    config = {
      # Array of Kafka Connect clusters configurations.
      clusters = [
        {
          # Name of the cluster (e.g., dev, staging, production, etc.)
          name = "localhost"
          # URL of the Kafka Connect service
          url = "http://localhost:8083"
          # Method to use for authenticating on Kafka Connect. Available values are: [none, basicauth, ssl]
          authMethod = none
          # Use when 'authMethod' is 'basicauth' to specify the username for Authorization Basic header
          basicAuthUser = null
          # Use when 'authMethod' is 'basicauth' to specify the password for Authorization Basic header
          basicAuthPassword = null
          # Enable debug logging
          debugLoggingEnabled = false

          # Ssl Config: Use when 'authMethod' is 'ssl'
          # The location of the key store file.
          sslKeyStoreLocation = "/certs/registry.keystore.jks"
          # The file format of the key store file.
          sslKeyStoreType = "JKS"
          # The password for the key store file.
          sslKeyStorePassword = "password"
          # The password of the private key in the key store file.
          sslKeyPassword = "password"
          # The location of the trust store file.
          sslTrustStoreLocation = "/certs/registry.truststore.jks"
          # The file format of the trust store file.
          sslTrustStoreType = "JKS"
          # The password for the trust store file.
          sslTrustStorePassword = "password"
          # Specifies whether to ignore the hostname verification.
          sslIgnoreHostnameVerification = true

          # HTTP proxy: route requests to the Kafka Connect REST API through a forward proxy.
          # Proxy URL, e.g. 'http://proxy.example.com:3128'. When empty, JVM proxy system properties are used.
          proxyUrl = "http://proxy.example.com:3128"
          # Username for proxy Basic authentication (optional).
          proxyUsername = null
          # Password for proxy Basic authentication (optional).
          proxyPassword = null
          # Comma-separated hosts that bypass the proxy, e.g. 'localhost,127.0.0.1,*.internal'.
          nonProxyHosts = "localhost,127.0.0.1"

          # Additional HTTP headers sent on every request to this Kafka Connect cluster.
          # Applied last, so these override headers Jikkou sets itself, including 'Authorization'.
          clientHeaders {
            X-Api-Gateway-Key = "my-gateway-key"
            X-Tenant = "acme"
          }
        }
      ]
      # Regular expression matching connector config values masked by the Kafka Connect REST API.
      # Set to an empty string to disable.
      maskedConfigValuePattern = "^\\u2022+$"
    }
  }
}

HTTP proxy

Jikkou can reach the Kafka Connect REST API through an HTTP/HTTPS forward proxy.

If proxyUrl is not set, Jikkou honors the standard JVM proxy system properties (-Dhttps.proxyHost, -Dhttp.proxyHost, -Dhttp.proxyUser, -Dhttp.proxyPassword, -Dhttp.nonProxyHosts), which can be supplied via JAVA_TOOL_OPTIONS.

Custom HTTP headers

The clientHeaders property attaches arbitrary HTTP headers to every request Jikkou sends to a Kafka Connect cluster. It is useful for API gateway keys, tenant identifiers, and tracing headers. It is set per cluster, inside a clusters entry.

clientHeaders {
  X-Api-Gateway-Key = "my-gateway-key"
  X-Tenant = "acme"
}

Custom headers are applied last, so a header set here replaces the one Jikkou would otherwise send under the same name, including Authorization. Setting Authorization through clientHeaders is the supported way to use a bearer token or another authentication scheme that authMethod does not cover. Header names are matched case-insensitively.

Masked config values

Some Kafka Connect distributions, such as Confluent Platform, mask sensitive values (e.g. passwords) when a connector config is read back from GET /connectors/{name}/config. A value set through a ConfigProvider reference like ${file:/path/secrets.properties:connection.password} is then returned as ••••••••, which would otherwise be reported as a change on every run.

The maskedConfigValuePattern property is a regular expression matched against each value returned by Kafka Connect. When a value matches, Jikkou cannot know the real value, so it assumes it is equal to the desired one and reports no change for that property. The default, ^\u2022+$, matches a non-empty sequence of bullet characters.

jikkou {
  provider.kafkaconnect {
    config = {
      # Also treat '[hidden]' as a masked value.
      maskedConfigValuePattern = "^(\\u2022+|\\[hidden\\])$"
    }
  }
}