Broker configuration reference
krabka-broker --config-file PATH reads one TOML document. This page lists
every key that document accepts, with the type, the default, the units, and
the description from the field’s doc comment. A key whose default is broker default leaves the broker’s built-in value in place when it is absent. The
CLI flag or environment variable for the same setting, when one exists, wins
over the file.
The schema behind this page is docs/config-schema.json,
which krabka-broker --print-config-schema prints. Two annotated examples sit
beside it: broker-single-node.toml and
broker-three-node-quorum.toml.
A duration is a string with a unit suffix, for example "500ms", "30s",
or "10m". A byte size is a string with a unit suffix, for example "1MiB"
or "10GB". A ratio is a string such as "10%" or "0.1". A key whose
units column says milliseconds or seconds is a plain integer in that unit.
Top-level keys
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
audit |
table | broker default | [audit] section of broker. (Fed 20x MLA). See [audit] below. |
|
authorization |
table | broker default | TOML shape of [authorization]. type (renamed to authz_ on the Rust side to avoid shadowing the keyword) defaults to Allow; super_ is the principal bypass list consulted by every concrete authorizer impl. Omitting the whole block leaves the cluster with no authorizer, which is what Kafka has when authorizer. is unset: every principal is allowed everything, and the ACL administration RPCs – Describe, Create and Delete – answer SECURITY_ (54) rather than an empty listing or a stored binding nothing would consult. kafka-acls reports that refusal. deny_ so a misspelled super_ typo at the top of the [authorization] block is rejected at parse time rather than silently producing the wrong authorizer. See [authorization] below. |
|
auto_ |
boolean | broker default | Enable automatic dynamic controller enrollment. | |
bootstrap_ |
array of string | [] |
KIP-853 controller discovery endpoints. Hosts remain unresolved so DNS names can be refreshed on each retry. | |
break_ |
table | broker default | TOML shape of [break_. Maps to crate::. Every field is Option, so approvers = [] and signed_ are each a written choice and are distinct from omitting the key. deny_ so a misspelled key is rejected at parse time. See [break_ below. |
|
broker_ |
integer (int32) | broker default | This node’s id, Kafka’s node. / broker.. It is the id the broker registers with the controller and reports in Metadata responses. Absent leaves the Broker default intact. |
|
connections_ |
string | broker default | duration | How long a connection may go without a complete request frame before the broker closes it (Kafka connections.). Absent leaves the Broker default of ten minutes, which is Kafka’s 600000. A [[listeners]] entry may carry its own connections_, which wins for that listener. |
connections_ |
string | broker default | duration | KIP-368 connections.: how long an authenticated SASL session may live before the client must re-authenticate in band. Absent, or non-positive, disables re-authentication, which is Kafka’s default. It applies to every mechanism: PLAIN, SCRAM and GSSAPI sessions are bounded by it alone, while an OAUTHBEARER or delegation-token session expires at the earlier of its credential’s expiry and this window. A [[listeners]] entry may carry its own connections_, which wins for that listener. |
controller_ |
string | broker default | duration | Controller election timeout, Kafka’s controller.. It is the follower fetch watchdog, and 1.5x of it is the leader’s check-quorum window: a leader that has not been fetched from by a majority of the voters within that window resigns its epoch. Absent leaves the Broker default intact. |
controller_ |
string | broker default | duration | Controller heartbeat interval. Absent leaves the Broker default intact. |
controller_ |
string | broker default | Controller listener security protocol. When Some(Ssl) the controller listener terminates TLS using tls_. |
|
controller_ |
array of string | [] |
KIP-595 static controller quorum voter set. Each entry is <node_ pointing at a broker’s controller listener (port 9093). At apply time each entry is parsed (NOT DNS-resolved) and its <host>:<port> is carried verbatim into Broker. The inter-broker dialer re-resolves the host on every (re)connect (Tcp), so a peer that restarts on a new pod IP (a Stateful pod keeps its stable DNS name but gets a fresh A record) is reached again without restarting this broker — pre-resolving here would freeze the peer’s boot-time IP and strand a rejoining voter. Empty leaves the single self-voter the binary seeds (standalone). |
|
controller_ |
string | broker default | TLS server name (SNI) presented when dialing a PEER’s controller listener for the KIP-595 quorum. The operator renders the shared headless-Service FQDN here — a SAN on every broker’s serving cert — so mTLS validation succeeds no matter which peer (resolved to a pod IP) is dialed. Absent falls back to "localhost". Maps to crate::. |
|
delegation_ |
table | broker default | TOML shape of [delegation_. Maps to the three delegation_ fields on crate::. See [delegation_ below. |
|
extra_ |
array of string | [] |
Additional JBOD data directories (KIP-113). Maps to crate::. |
|
freeze |
table | broker default | TOML shape of [freeze]. Maps to crate::. Every field is Option: a present value replaces the current broker value, an absent one retains it. deny_ so a misspelled require_ is rejected at parse time rather than leaving the broker on the opposite policy to the one the operator wrote. See [freeze] below. |
|
gssapi |
table | broker default | TOML shape of [gssapi]. Maps to crate::. principal_ are parsed into Kerberos at apply_ time. See [gssapi] below. |
|
heartbeat_ |
string | broker default | duration | How often this broker sends Broker to the controller leader. Absent leaves the Broker default intact. |
heartbeat_ |
string | broker default | duration | Controller-side session timeout for broker heartbeats. Absent leaves the Broker default intact. |
inter_ |
table | broker default | TOML shape of [inter_. A type discriminator selects the variant. PLAIN/SCRAM inter-broker over TOML remain intentionally unexposed. See the [inter_ sections below. |
|
inter_ |
string | broker default | Name of the listener that carries inter-broker traffic — raft, replication, and heartbeats. Kafka’s inter.. It must match a name in [listeners][Self::Broker default "PLAINTEXT". |
|
inter_ |
map of string to integer (uint64) | broker default | Exact authenticated principal name to broker node ID bindings for diskless WAL follower fetches. | |
listeners |
array of tables | [] |
See [[listeners]] below. |
|
log_ |
string | broker default | Primary log directory, the first entry of Kafka’s log.. It is the partition data directory when [extra_][Self::_ raft log unless [metadata_][Self::Broker default intact. |
|
max_ |
integer (uint) | broker default | Maximum number of live broker connections across all listeners (Kafka max.). Connections accepted past this ceiling are closed immediately. Absent leaves the Broker default usize:: (unlimited), matching Kafka’s Integer.. |
|
max_ |
integer (uint) | broker default | Maximum number of live connections from any single client IP (Kafka max.). Absent leaves the Broker default usize:: (unlimited). |
|
metadata_ |
string | broker default | The metadata log directory, Kafka’s metadata.. It holds the _ raft log, its snapshots, the node’s meta. and the bootstrap records. A directory that is none of the data directories holds the metadata log only: no partition is placed there, and Describe does not report it. Absent keeps the metadata log in [log_][Self::log.. --metadata-log-dir wins over it. |
|
oauthbearer |
table | broker default | TOML shape of [oauthbearer]. Maps to krabka_. Setting jwks_ selects the signed-JWT validator; setting introspection_ selects the RFC 7662 introspection validator; the two endpoint URIs are mutually exclusive. With neither set, the unsecured-JWS validator (development only) is used, and that fallback is rejected at config-load unless allow_. See [oauthbearer] below. |
|
operator_ |
array of tables | [] |
[[operator_ — the shared operator key trust set. Top-level rather than nested under [break_, because two subsystems verify against it: a freeze record’s detached signature and a break-glass approval’s. One provisioning step covers both. Empty is the default and means no operator key is configured. See [[operator_ below. |
|
process |
table | broker default | [process] TOML section — KRaft process.. See [process] below. |
|
rack |
string | broker default | KIP-392: this broker’s rack id. Maps to Broker. |
|
remote_ |
table | broker default | TOML shape of [remote_. Maps to crate::. Exactly one of storage_ (local filesystem), [remote_ (S3-compatible object store), or [remote_ (native Google Cloud Storage) should be set. Setting more than one errors at load time. See [remote_ below. |
|
replica_ |
string | broker default | duration | Maximum follower lag before the leader proposes ISR shrink. Absent leaves the Broker default intact. |
replica_ |
string | broker default | KIP-392: replica selector name ("leader" | "rack-aware"). Maps to Broker. |
|
runtime |
table | broker default | Validated operational policy loaded from [runtime]. See [runtime] below. |
|
sasl_ |
table | broker default | TOML shape of [sasl_. Maps to crate::. See [sasl_ below. |
|
schema_ |
table | broker default | TOML shape of [schema_. Mirrors the constructor arguments of crate::, the one registry client each broker holds. deny_ so a misspelled key is rejected at parse time. A silently ignored fail_ would leave the operator with the opposite of the policy they wrote. See [schema_ below. |
|
server_ |
map of string to string | {} |
Raw Apache Kafka server. keys, for the settings krabka reads under their Kafka names rather than a dedicated TOML key. The broker consults transaction., quota., quota., num., default., log., delete., auto., transaction., the KIP-1066 cordoned., the KIP-1331 group., and Kafka’s two internal switches. krabka cannot load a JVM class, so group. accepts only org.. krabka builds in that plugin, which keeps the latest topology description of each streams group in memory until the broker stops. unstable. (default false) advertises and serves what krabka implements from Kafka trunk beyond 4.3.1: Api v5 (KIP-1242), Txn v6 (KIP-1319), Streams and Streams v1 (KIP-1331, KIP-1357), Streams (93) and Unregister (94), Init v6 and with 2PC the KIP-939 keep recovery, and trunk’s group config keys; while it is false every listener serves exactly Kafka 4.3.1’s API versions. unstable. (default false) lets this node support metadata. past 4.3.1’s 4. (30), up to trunk’s 4. (34), which the CIDR ACL hosts of KIP-1276 and the controller unregistration of KIP-1312 need. Any other entry is accepted and ignored. A key set here loses to the equivalent dedicated key, which is applied first. |
|
stretch |
table | broker default | [stretch] TOML section — the three-site stretch deployment. The table is all-or-nothing. When it is present, all three fields must be, because a half-built profile would let the broker start with a site layout that no node agrees on. See [stretch] below. |
|
super_ |
array of string | broker default | Principals that are unconditionally authorized for all operations, including KIP-48 delegation-token act-as. Super-user status does not substitute for authentication. The delegation-token RPCs (Create, Renew, Expire) require a principal that authenticated with SASL or mTLS, and answer DELEGATION_ (64) on a PLAINTEXT or one-way-TLS connection whatever this list holds. An entry may use Kafka’s User:<name> form. As in Kafka, User:ANONYMOUS is accepted: it makes every unauthenticated client a super user, and a PLAINTEXT controller listener with a deny-capable authorizer needs it. None and Some(empty) are equivalent — both leave Broker empty. |
|
tls_ |
table | broker default | TLS material for the controller listener (and any listener whose protocol is TLS-bearing). See [tls_ below. |
|
topic_ |
table | broker default | TOML shape of [topic_. Maps to crate::. The whole table is the KIP-108 / KIP-133 policy Kafka loads from a Java class named by create. and alter.. krabka cannot load a class, so the rules are declared here instead. Omitting the table declares no rule, which is Kafka’s default of no policy class: every Create and every topic Alter that passes ordinary config validation is accepted. A request that breaks a rule is answered with POLICY_ (44) and an error_ naming the rule, which is what a Policy from a Java policy class produces. The two replica rules apply to Create alone, because an Alter request carries neither number, exactly as Alter does not. deny_ so a misspelled rule name is rejected at parse time rather than leaving the broker enforcing nothing where the operator wrote a rule. See [topic_ below. |
[audit]
[audit] section of broker.toml (FedRAMP 20x MLA).
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
checkpoint |
table | broker default | [audit. — checkpoint cadence. See [audit. below. |
|
enabled |
boolean | true |
Whether the audit subsystem is active. | |
failure_ |
string | broker default | Whether privileged operations continue when audit processing fails. | |
signing |
table | broker default | [audit. — Ed25519 checkpoint signing key. See [audit. below. |
|
spool |
table | broker default | [audit. — durable spool for the AU-5 degraded path. See [audit. below. |
|
topic |
string | "_ |
Internal topic name for audit records. It has to start with _: the broker reports it internal on Metadata and refuses to freeze it by that prefix, and a name outside the convention would satisfy only the first of the two. |
[audit.checkpoint]
[audit.checkpoint] — checkpoint cadence.
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
every_ |
integer (uint64) | 1000 |
Emit a checkpoint after this many audit records. | |
every_ |
integer (uint64) | 60 |
seconds | Emit a checkpoint at least this often, in seconds. |
[audit.signing]
[audit.signing] — Ed25519 checkpoint signing key.
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
key_ |
string | required | Key id recorded on each checkpoint, so a verifier can follow a key rotation. | |
key_ |
string | required | Path to the PKCS#8 Ed25519 private key that signs audit checkpoints. |
[audit.spool]
[audit.spool] — durable spool for the AU-5 degraded path.
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
dir |
string | "audit-spool" |
Directory that holds the spool files. A relative path resolves under the broker’s log directory. | |
max_ |
integer (uint64) | 1073741824 |
bytes | Cap on the total size of the spool on disk. |
sync_ |
integer (uint64) | 1 |
Number of appended records between durable file syncs. |
[authorization]
TOML shape of [authorization]. type (renamed to authz_type on the Rust side to avoid shadowing the keyword) defaults to AllowAll; super_users is the principal bypass list consulted by every concrete authorizer impl. Omitting the whole block leaves the cluster with no authorizer, which is what Kafka has when authorizer.class.name is unset: every principal is allowed everything, and the ACL administration RPCs – DescribeAcls, CreateAcls and DeleteAcls – answer SECURITY_DISABLED (54) rather than an empty listing or a stored binding nothing would consult. kafka-acls reports that refusal. deny_unknown_fields so a misspelled super_user typo at the top of the [authorization] block is rejected at parse time rather than silently producing the wrong authorizer.
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
allow_ |
boolean | false |
Kafka’s allow.. Only consulted by type = "simple". When true, a request is allowed if NO ACL at all applies to the resource – by type, name, and LITERAL/false, matching Kafka’s Standard. |
|
opa |
table | broker default | TOML shape of [authorization.. Mirrors the constructor arguments of crate::. Defaults are picked to match Strimzi’s Kafka (50_ LRU entries, 1 h TTL, fail-closed on OPA error). See [authorization. below. |
|
super_ |
array of string | [] |
Principals that bypass every ACL check, Kafka’s super.. The active authorizer and the delegation-token act-as gate both read it. An entry may use Kafka’s User:<name> form. User:ANONYMOUS is accepted, as in Kafka. Empty is the default and grants no bypass. |
|
type |
one of allow_, simple, opa |
broker default | Which crate:: impl to instantiate. snake_ to match the spec’s type = "allow_ wire shape. allow_ is the default and is not an authorizer: it allows every principal every operation, and the ACL administration RPCs answer SECURITY_ (54), as Kafka does with no authorizer.. simple and opa are decision points, and under either the ACL RPCs serve requests normally. |
[authorization.opa]
TOML shape of [authorization.opa]. Mirrors the constructor arguments of crate::authorizer::opa::OpaAuthorizer::new. Defaults are picked to match Strimzi’s KafkaAuthorizationOpa (50_000 LRU entries, 1 h TTL, fail-closed on OPA error).
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
allow_ |
boolean | false |
Security-sensitive. Permit the operation when the OPA call fails (timeout, 5xx, parse error). When true, an OPA outage authorizes every request (fail-open). Default false (fail-closed) — omitting this field denies on error, matching the upstream Open Policy Agent Kafka plugin’s allow.. |
|
expire_ |
integer (int64) | 3600000 |
milliseconds | Decision TTL, in milliseconds. Default 3_ (1 h). |
maximum_ |
integer (uint) | 50000 |
entries | LRU cache capacity, in entries. Default 50_. |
url |
string | required | OPA decision endpoint URL — must include the data-API path, e.g. http:/. |
[break_glass]
TOML shape of [break_glass]. Maps to crate::config::BreakGlassConfig. Every field is Option, so approvers = [] and signed_actions = [] are each a written choice and are distinct from omitting the key. deny_unknown_fields so a misspelled key is rejected at parse time.
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
approvers |
array of string | broker default | Principals that may approve a proposal. Omitted leaves the Broker value, which is empty. |
|
background_ |
one of off, audit-only, require |
broker default | What the background unclean-recovery path does when it cannot ask anybody for a break-glass approval. The controller starts unclean recovery from leader election and from the broker-heartbeat path. Neither carries a request context, so neither has a caller to refuse. An operator who types an unclean election can be asked for a second signature; a controller that reacts to a dead broker at 03:00 cannot. The TOML spelling is off | audit-only | require, so the serde rename is kebab-case. |
|
proposal_ |
string | broker default | duration | How long a proposal stays usable. Default crate::. |
required_ |
integer (uint) | broker default | Distinct approving principals a proposal needs. Default crate::. Values below crate:: are a startup error: a two-person rule with one approval is one person. |
|
signed_ |
array of string | broker default | Actions whose approvals must also carry a detached operator signature. Omitted inside a present [break_ section selects crate::, the irreversible set. Naming any action with no [[operator_ entry is a startup error; write signed_ to demand no signature. |
[delegation_token]
TOML shape of [delegation_token]. Maps to the three delegation_token_* fields on crate::BrokerConfig.
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
default_ |
integer (int64) | broker default | milliseconds | Default renew period — the initial expiry_ offset at create time and the implicit renew period when Renew. Distinct from max_ (the absolute ceiling). Default 24 hours. |
expiry_ |
integer (int64) | broker default | milliseconds | Background sweep cadence, ms. Default 1 hour. |
max_ |
integer (int64) | broker default | milliseconds | Hard upper bound on token lifetime, ms. Default 7 days. |
secret_ |
string | broker default | HMAC master key. Overridden by KRABKA_ when set. Bytes are wrapped in krabka_ before reaching Broker. |
[freeze]
TOML shape of [freeze]. Maps to crate::config::FreezeConfig. Every field is Option: a present value replaces the current broker value, an absent one retains it. deny_unknown_fields so a misspelled require_signature is rejected at parse time rather than leaving the broker on the opposite policy to the one the operator wrote.
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
max_ |
integer (uint) | broker default | entries | Ceiling on live freeze registry entries. Default crate::. Must be at least 1. |
require_ |
boolean | broker default | Security-sensitive. Demand a detached operator signature on a freeze as well as on a thaw. Default false, which keeps a freeze available in one command during an incident on a cluster with no key material yet. A thaw is signed either way. Setting this to true with no [[operator_ entry is a startup error: there would be no key to verify the demanded signature against. |
|
signature_ |
string | broker default | duration | How far a signed freeze record’s timestamp may sit from the controller’s clock. Default crate::. |
[gssapi]
TOML shape of [gssapi]. Maps to crate::network::auth::GssapiConfig. principal_to_local_rules are parsed into KerberosRule at apply_to time.
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
kdc |
string | broker default | KDC endpoint (e.g. tcp:/) that bypasses krb5.conf discovery; falls back to krb5.conf when omitted. |
|
keytab_ |
string | required | Keytab that holds this broker’s Kerberos service key. The SASL/GSSAPI accept path reads it to answer a client’s ticket. | |
max_ |
string | broker default | duration | Maximum tolerated difference between client and broker clocks. |
principal_ |
array of string | ["DEFAULT"] |
auth_ rule specs, applied in order (first match wins). Kafka’s default for sasl. is ["DEFAULT"], and an empty list maps no principal. |
|
realm |
string | broker default | Default Kerberos realm, the only realm the DEFAULT rule accepts. Kafka reads it from krb5.; when it is omitted DEFAULT matches no principal and the rules have to name the realm. |
|
service_ |
string | broker default | sasl.. Defaults to "kafka" when omitted. |
[inter_broker_credentials] with type = "gssapi"
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
client_ |
string | required | Kerberos principal this broker authenticates as when it dials a peer. | |
kdc_ |
string | required | KDC endpoint (for example tcp:/) used to obtain the service ticket, bypassing krb5.conf discovery. |
|
keytab_ |
string | required | Keytab that holds the key for client_. |
|
service_ |
string | broker default | The peer’s sasl.. Defaults to "kafka" when omitted. |
|
type |
constant "gssapi" |
required | Selects this variant of the table. |
[inter_broker_credentials] with type = "oauth-bearer"
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
token_ |
string | required | File containing the bearer token. A trailing newline is ignored. The token itself never appears in the parsed config’s Debug form. |
|
type |
constant "oauth-bearer" |
required | Selects this variant of the table. |
[[listeners]]
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
advertised |
string | required | host:port published to clients in Metadata responses, Kafka’s advertised. entry for this listener. |
|
bind_ |
string | required | Local host:port this listener binds. |
|
connections_ |
string | broker default | duration | Per-listener connections.. Absent leaves this listener on the broker-wide connections_. Maps to an entry in crate::. |
connections_ |
string | broker default | duration | Per-listener KIP-368 connections.. Absent leaves this listener on the broker-wide connections_. Maps to an entry in crate::. |
name |
string | required | Listener name, for example "PLAINTEXT" or "SASL_. It is the name inter_ and Kafka’s listener. refer to. |
|
protocol |
string | required | Security protocol this listener speaks: Plaintext, Ssl, Sasl, or Sasl. |
|
sasl_ |
table | broker default | See [listeners. below. |
|
tls_ |
table | broker default | See [listeners. below. |
[listeners.sasl_config]
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
enabled_ |
array of string | [] |
SASL mechanisms this listener accepts, Kafka’s sasl.. Each entry is a wire name such as PLAIN, SCRAM-SHA-256, GSSAPI, or OAUTHBEARER; an unknown name is rejected at parse time. |
[listeners.tls_config]
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
cert_ |
string | required | PEM file holding this listener’s server certificate chain. | |
client_ |
one of Disabled, Optional, Required |
broker default | Whether a TLS listener asks for and requires a client certificate, Kafka’s ssl.. Disabled is the default and never asks; Optional asks and accepts a connection that presents none; Required rejects a connection that presents none. Optional and Required both need a client_. |
|
client_ |
string | broker default | PEM file of CA(s) this listener validates client certificates against. Absent leaves mTLS without a client trust store, so client_ has to be Disabled. |
|
key_ |
string | required | PEM file holding the private key for cert_. |
|
principal_ |
array of string | ["DEFAULT"] |
KIP-371 ssl.: how the Subject DN of an mTLS peer certificate becomes the principal name ACLs and super_ are written against. Each entry is either DEFAULT, which uses the DN itself, or RULE:pattern/, where pattern has to match the whole DN, replacement may reference capture groups as $1, and a trailing L or U lowercases or uppercases the result. The rules are tried in order and the first match wins. Defaults to ["DEFAULT"], so a listener that says nothing keeps Kafka’s behaviour of using the full DN. A malformed entry is rejected at startup. Case-insensitive backreferences have a Unicode compatibility edge: under (?i), non-ASCII case pairs may match here when Java rejects them (for example é and É); under (?iu), pairs Java accepts may fail here (for example i and İ, or s and ſ). Ordinary ASCII DNs are unaffected. Keep both captured and referenced text ASCII, or avoid case-insensitive backreferences when exact Java behavior matters. |
|
trust_ |
string | broker default | PEM file of CA(s) this broker trusts when validating a PEER’s server cert as an outbound inter-broker / controller-quorum dialer. The operator renders the cluster CA here so KIP-595 controller peers can mutually authenticate over the controller listener. Maps to krabka_. |
[oauthbearer]
TOML shape of [oauthbearer]. Maps to krabka_security::OAuthBearerValidator. Setting jwks_endpoint_uri selects the signed-JWT validator; setting introspection_endpoint_uri selects the RFC 7662 introspection validator; the two endpoint URIs are mutually exclusive. With neither set, the unsecured-JWS validator (development only) is used, and that fallback is rejected at config-load unless allow_unsecured = true.
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
allow_ |
boolean | broker default | Opt-in for the unsecured-JWS (alg:none) development validator. Default false. With neither jwks_ nor introspection_ set and a listener enabling OAUTHBEARER, the broker refuses to start rather than silently trusting unsigned tokens; set this to true to accept that fallback in development. Never set it in production. |
|
allowable_ |
integer (int64) | broker default | milliseconds | Clock-skew tolerance, in milliseconds, for exp / iat / nbf. Default 30000. |
custom_ |
string | broker default | Optional Json expression (RFC 9535, via jsonpath-rust) evaluated against the token claim set. Token is rejected when the expression yields empty/ |
|
expected_ |
string | broker default | When set, the token aud claim must contain this. Signed validator only. |
|
fallback_ |
string | broker default | Alternate claim name for principal-name fallback. | |
fallback_ |
string | broker default | Prepended on fallback only. | |
groups_ |
string | broker default | Json expression (RFC 9535) extracting groups. Compiled once at broker startup; malformed expression panics with descriptive error. |
|
groups_ |
string | broker default | When groups_ resolves to a string, split on this delimiter. |
|
idp_ |
string | broker default | PEM file containing the CA certificate(s) used to verify the Id’s TLS certificate on ALL outbound HTTPS to the Id — JWKS endpoint, introspection endpoint, and userinfo endpoint. When set, these are the only trust roots used for the outbound HTTPS (replaces the default webpki-roots — Strimzi-shaped). When unset, the broker uses reqwest’s default rustls webpki-roots. |
|
introspection_ |
string | broker default | client_ the broker uses to authenticate (HTTP Basic Auth) against the introspection endpoint. Required when introspection_ is set. |
|
introspection_ |
string | broker default | Filesystem path to a file containing the client secret the broker uses to authenticate against the introspection endpoint. Required when introspection_ is set. File-based (not literal) so secret material doesn’t sit in the TOML; operator mounts a Secret and writes the mount path here. The file’s trailing newline (if any) is stripped at config-load. |
|
introspection_ |
string | broker default | RFC 7662 introspection endpoint URL. When set, selects the introspection validator (mutually exclusive with jwks_). |
|
introspection_ |
integer (uint64) | broker default | milliseconds | Timeout for the introspection (and userinfo) HTTP requests, in milliseconds. Default 10 000 (10 s). |
jwks_ |
string | broker default | JWKS endpoint URL. When set, tokens are validated as signed JWTs (RS256 / ES256) against the keys fetched from this URL, and the broker spawns a background refresher. When unset, the unsecured-JWS (alg:none) development validator is used. |
|
jwks_ |
integer (uint32) | broker default | seconds | Maximum age (seconds) of the cached JWKS before validators reject tokens until the next successful refresh. Strimzi default 360 (6 minutes). Unset = no expiry check. Fails closed on prolonged Id outage. Signed validator only. |
jwks_ |
boolean | broker default | When true, the JWKS parser keeps keys regardless of use field. Default false (filter out use=enc). Some identity providers publish signing keys with use="enc" by mistake; operators set this to true to accept them. Signed validator only. |
|
jwks_ |
integer (uint32) | broker default | seconds | Minimum pause (seconds) between on-demand JWKS refreshes triggered by validator signals (unknown-kid / bad-signature tokens). Defaults to 1 (Strimzi parity). Signed validator only. |
jwks_ |
integer (uint64) | broker default | milliseconds | JWKS re-fetch interval, in milliseconds. Default 300000 (5 minutes). Signed validator only. |
principal_ |
string | broker default | Claim whose value becomes the principal name. Default sub. |
|
userinfo_ |
string | broker default | Optional OIDC userinfo endpoint URL. When set, the introspection validator calls GET userinfo after a successful introspection and merges the profile claims over the introspection claims (introspection wins for active, exp, iat, nbf, scope, client_, sub). |
|
valid_ |
string | broker default | When set, the token iss claim must equal this. Signed validator only. |
|
valid_ |
string | broker default | Optional JWT typ header check. When set, JWT-mode validators (unsecured + signed JWS) require the JWT header’s typ field to equal this string. Introspection-mode skips (no JWT header). Ignored when unset. |
[[operator_keys]]
TOML shape of one [[operator_keys]] entry. Maps to crate::operator_keys::OperatorKeyEntry. deny_unknown_fields so a misspelled key is rejected at parse time. An ignored principal typo would leave a key bound to nobody, and the principal binding is what stops one operator’s key signing in another operator’s name.
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
key_ |
string | required | Stable identifier that a signed freeze record or break-glass approval names. Must be unique across the array. | |
principal |
string | required | The principal this key speaks for, e.g. "User:alice". Must be unique across the array. The broker refuses a signed record whose claimed author is not this principal. |
|
public_ |
string | required | Path to the raw 32-byte Ed25519 public key, the bytes an krabka_ reports as its public key. It is read at startup, so a bad path stops the broker at boot and not in the middle of an incident. |
[process]
[process] TOML section — KRaft process.roles.
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
roles |
array of string | [] |
Role strings: "controller", "broker", "witness" (case-insensitive). Empty or absent leaves the Broker default [Controller, Broker]. A "witness" entry is a modifier: it must come with both of the other two roles. |
[remote_storage]
TOML shape of [remote_storage]. Maps to crate::BrokerConfig::remote_storage_backend. Exactly one of storage_dir (local filesystem), [remote_storage.s3] (S3-compatible object store), or [remote_storage.gcs] (native Google Cloud Storage) should be set. Setting more than one errors at load time.
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
copier_ |
integer (uint) | broker default | How many partitions may be copying segments to the remote tier at once. Kafka’s remote.; defaults to 10. Raising it is the remedy for a copy backlog on an object store with bandwidth to spare. |
|
copy_ |
string | broker default | duration | Deadline on one segment copy to the remote tier. Defaults to 10 minutes. A partition holds one copier slot for the whole of its copy pass, so a copy that hangs on a stalled object store spends that slot on a partition moving no bytes. Past this deadline the copy is abandoned and retried on the next tick; the segment stays in Copy, which local retention refuses to delete against. |
expiration_ |
integer (uint) | broker default | How many partitions may be running their local- and remote-retention passes at once. Kafka’s remote.; defaults to 10. |
|
gcs |
table | broker default | TOML shape of [remote_. Maps to krabka_. Omitting all credential fields (service_, service_, application_) selects GKE Workload Identity / Application Default Credentials (keyless) — the primary production path. See [remote_ below. |
|
index_ |
string | broker default | byte size | Byte budget of the on-disk cache of remote segment indexes under <log_. Kafka’s remote.; defaults to 1 GiB. |
kafka_ |
table | broker default | TOML shape of [remote_. Maps to crate::. See [remote_ below. |
|
reader_ |
integer (uint) | broker default | How many cold-tier reads may wait for a reader slot before one is refused. Kafka’s remote.; defaults to 100. |
|
reader_ |
integer (uint) | broker default | How many cold-tier reads may run at once. Kafka’s remote.; defaults to 10. |
|
s3 |
table | broker default | TOML shape of [remote_. Maps to krabka_. See [remote_ below. |
|
storage_ |
string | broker default | Root directory for the local Local backend. |
|
worm |
table | broker default | TOML shape of [remote_. Maps to krabka_. Presence of the table enables WORM archive mode. Unlike File this derives Debug plainly, and that is deliberate: it holds a path to a signing key and the key’s public id, neither of which is credential material, and an operator debugging a chain needs to see which key signed it. Do not “fix” this into a redacting impl. See [remote_ below. |
[remote_storage.gcs]
TOML shape of [remote_storage.gcs]. Maps to krabka_remote_storage::GcsConfig. Omitting all credential fields (service_account_path, service_account_key, application_credentials_path) selects GKE Workload Identity / Application Default Credentials (keyless) — the primary production path.
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
allow_ |
boolean | false |
Allow plaintext HTTP (off-by-default; required by emulators running without TLS). | |
application_ |
string | broker default | Path to an Application Default Credentials JSON file. Omit (along with the other credential fields) to use Workload Identity / ADC. | |
bucket |
string | required | GCS bucket name. | |
connect_ |
string | broker default | duration | Ceiling on the connect phase alone. When None, krabka_ (5s) applies. |
endpoint |
string | broker default | Optional custom GCS API base URL (for emulators / fakes). | |
max_ |
integer (uint) | broker default | How many times one object-store request is retried before the error reaches the broker. When None, krabka_ (10) applies; 0 disables retries. Under a store that answers 503 Slow this is what bounds how long one call holds its caller before the failure is counted and the sweep moves on. |
|
multipart_ |
integer (uint) | broker default | bytes | Optional override of the per-part multipart chunk size (bytes). When None, krabka_ applies. |
multipart_ |
integer (uint64) | broker default | bytes | Optional override of the multipart-upload threshold (bytes). When None, krabka_ applies. Operators typically leave this alone; lower it to force multipart on smaller segments for testing. |
prefix |
string | broker default | Optional key prefix inside the bucket (lets multiple clusters share a bucket). | |
request_ |
string | broker default | duration | Ceiling on one HTTP request, connect phase included. When None, krabka_ (30s) applies. This is the bound on a store that accepts the connection and then answers nothing. |
retry_ |
string | broker default | duration | Ceiling on the wall-clock time one request may spend across all of its retries. When None, krabka_ (3m) applies. Keep it under 5 minutes: retries reuse the original request’s credentials. |
service_ |
string | broker default | Inline service-account JSON key. Omit (along with the other credential fields) to use Workload Identity / ADC. | |
service_ |
string | broker default | Path to a service-account JSON key file. Omit (along with the other credential fields) to use Workload Identity / ADC. |
[remote_storage.kafka_metadata]
TOML shape of [remote_storage.kafka_metadata]. Maps to crate::config::KafkaRlmmConfig.
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
bootstrap |
string | "" |
host:port the manager dials to reach its own broker. May be empty; the broker derives the address from the inter-broker listener at startup. |
|
event_ |
integer (uint) | broker default | Capacity of the shared metadata-event delivery queue. | |
fetch_ |
string | broker default | byte size | Maximum bytes returned by each per-partition metadata fetch. |
fetch_ |
string | broker default | duration | Maximum wait for each per-partition metadata fetch. |
fetch_ |
string | broker default | duration | Backoff after a failed metadata fetch. |
in_ |
boolean | false |
Explicit opt-out: run the non-durable in-memory RLMM instead of the topic-backed default. Tests / single-node dev only. | |
min_ |
integer (int32) | broker default | min. for _ on first creation. Defaults to 2 (Kafka’s remote.). Keep it at or below replication: a topic whose min. exceeds its replica count rejects every acks=all write, so a single-broker setup that sets replication = 1 sets this to 1 as well. |
|
num_ |
integer (int32) | broker default | Partition count for _ on first creation. Defaults to 50 (Kafka’s remote.). |
|
replication |
integer (int32) | broker default | Replication factor for _ on first creation. Defaults to 3 (Kafka’s remote.). |
|
snapshot_ |
string | broker default | duration | RLMM cache snapshot cadence. |
topic_ |
string | broker default | duration | Timeout for provisioning each internal metadata topic. |
[remote_storage.s3]
TOML shape of [remote_storage.s3]. Maps to krabka_remote_storage::S3Config.
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
access_ |
string | broker default | Explicit access key id. Falls back to the AWS credential chain (env vars, instance profile, …) when omitted. | |
allow_ |
boolean | false |
Allow plaintext HTTP (off-by-default; required by Min running without TLS). |
|
bucket |
string | required | S3 bucket name. | |
checksum_ |
boolean | broker default | Optional override of the x-amz-checksum-sha256 header, which has the server verify each object on ingest. When None, the krabka_ default of true applies. |
|
conditional_ |
boolean | broker default | Optional override of conditional puts (If-None-Match), which make a create-mode write fail on an existing key instead of overwriting it. When None, the krabka_ default of true applies. Turn it off only for an S3-compatible store that mishandles the header; WORM archive mode relies on it. |
|
connect_ |
string | broker default | duration | Ceiling on the connect phase alone. When None, krabka_ (5s) applies. |
endpoint |
string | broker default | Optional custom endpoint URL (e.g. Min or Cloudflare R2). |
|
max_ |
integer (uint) | broker default | How many times one object-store request is retried before the error reaches the broker. When None, krabka_ (10) applies; 0 disables retries. Under a store that answers 503 Slow this is what bounds how long one call holds its caller before the failure is counted and the sweep moves on. |
|
multipart_ |
integer (uint) | broker default | bytes | Optional override of the per-part multipart chunk size (bytes). When None, krabka_ applies. AWS requires parts ≥ 5 MiB except the last; Min tolerates smaller values. |
multipart_ |
integer (uint64) | broker default | bytes | Optional override of the multipart-upload threshold (bytes). When None, krabka_ applies. Operators typically leave this alone; lower it to force multipart on smaller segments for testing. |
prefix |
string | broker default | Optional key prefix inside the bucket (lets multiple clusters share a bucket). | |
region |
string | required | AWS region. Required even for non-AWS endpoints (use any value). | |
request_ |
string | broker default | duration | Ceiling on one HTTP request, connect phase included. When None, krabka_ (30s) applies. This is the bound on a store that accepts the connection and then answers nothing. |
retry_ |
string | broker default | duration | Ceiling on the wall-clock time one request may spend across all of its retries. When None, krabka_ (3m) applies. Keep it under 5 minutes: retries reuse the original request’s credentials. |
secret_ |
string | broker default | Explicit secret access key. Falls back to the AWS credential chain when omitted. |
[remote_storage.worm]
TOML shape of [remote_storage.worm]. Maps to krabka_remote_storage::WormConfig. Presence of the table enables WORM archive mode. Unlike FileRemoteStorageS3Config this derives Debug plainly, and that is deliberate: it holds a path to a signing key and the key’s public id, neither of which is credential material, and an operator debugging a chain needs to see which key signed it. Do not “fix” this into a redacting impl.
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
signing_ |
string | broker default | Stable identifier recorded in every manifest signature, so a chain stays verifiable across a key rotation. Default: unset. Setting this requires signing_ as well. |
|
signing_ |
string | broker default | Path to the PKCS#8 Ed25519 key that signs each segment manifest. Default: unset. Manifests then carry no signature, and the archive keeps only the per-object digests and the hash chain. Setting this requires signing_ as well. |
|
write_ |
boolean | false |
Refuse every remote fetch from this archive. Default: false. When true, remote fetch is unavailable: a consumer that asks for an offset whose local segment has already been evicted gets an error, not a slow read. The archive is then a compliance sink, not a storage tier. |
[runtime]
Validated operational policy loaded from [runtime].
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
audit_ |
integer (uint) | broker default | Capacity of the asynchronous audit event queue. | |
audit_ |
string | broker default | duration | Maximum wait for the audit partition to become available. |
audit_ |
string | broker default | duration | Cadence at which the audit spool replays records it could not append. |
audit_ |
string | broker default | duration | Cadence of the audit statistics poll. |
audit_ |
string | broker default | byte size | Maximum bytes read by one audit tail request. |
audit_ |
integer (int64) | broker default | Number of offsets included in one audit tail request. | |
auto_ |
string | broker default | duration | Retry delay between KIP-853 dynamic-quorum auto-join attempts. |
auto_ |
string | broker default | duration | Timeout carried by a dynamic-quorum Add request. |
barrier_ |
string | broker default | duration | Deadline for one barrier injection to reach every target partition. |
barrier_ |
integer (uint) | broker default | Maximum number of barrier groups the cluster accepts. | |
barrier_ |
integer (uint) | broker default | Maximum number of topics in one barrier group. | |
barrier_ |
string | broker default | duration | Shortest periodic injection interval a barrier group may ask for. |
barrier_ |
string | broker default | byte size | Maximum bytes requested by one _ recovery read. |
barrier_ |
integer (int32) | broker default | Number of cuts a barrier group keeps before it tombstones the oldest. | |
barrier_ |
integer (int32) | broker default | Partition count of the _ internal topic. |
|
barrier_ |
integer (int16) | broker default | Replication factor of the _ internal topic. |
|
classic_ |
string | broker default | duration | Initial delay before a classic group begins rebalancing, Kafka’s group.. Zero completes a new group’s first rebalance as soon as its first member joins. |
classic_ |
string | broker default | duration | Upper bound on a classic Join session timeout, Kafka’s group.. |
classic_ |
integer (uint) | broker default | Maximum number of members in one classic group, Kafka’s group.. |
|
classic_ |
string | broker default | duration | Lower bound on a classic Join session timeout, Kafka’s group.. |
cleaner_ |
string | broker default | duration | Cadence of log cleaner maintenance. |
client_ |
string | broker default | duration | Default KIP-714 client telemetry subscription push interval. |
client_ |
boolean | broker default | Whether the broker advertises the KIP-714 client-metrics RPCs, Get (71) and Push (72). Kafka advertises them only when metric. holds a Client implementation, so the default here is false as well and a client starts no telemetry handshake the broker has nowhere to forward. A configured [telemetry] OTLP endpoint turns them on without this key. |
|
client_ |
string | broker default | duration | Cadence at which the KIP-714 client-metrics cache evicts entries. |
client_ |
integer (uint) | broker default | Capacity of the client-metrics OTLP forwarding queue. | |
client_ |
string | broker default | duration | Lifetime of a Prometheus client-metrics snapshot. |
client_ |
string | broker default | duration | Minimum age at which a client-metrics entry counts as stale. |
client_ |
integer (uint32) | broker default | Number of missed push intervals after which client metrics expire. | |
client_ |
string | broker default | byte size | Maximum accepted KIP-714 client telemetry payload size. |
connection_ |
string | broker default | duration | Maximum KIP-612 connection-creation quota delay. |
connection_ |
string | broker default | duration | How long a failed SASL authentication holds its response and the close that follows, Kafka’s connection.. Zero closes at once. |
consumer_ |
string | broker default | duration | Default KIP-848 consumer-group heartbeat interval, Kafka’s group.. |
consumer_ |
string | broker default | duration | Upper bound on the negotiated consumer-group heartbeat interval, Kafka’s group.. |
consumer_ |
string | broker default | duration | Upper bound on the negotiated consumer-group session timeout, Kafka’s group.. |
consumer_ |
integer (uint) | broker default | Maximum number of members in one consumer group, Kafka’s group.. |
|
consumer_ |
string | broker default | duration | Lower bound on the negotiated consumer-group heartbeat interval, Kafka’s group.. |
consumer_ |
string | broker default | duration | Lower bound on the negotiated consumer-group session timeout, Kafka’s group.. |
consumer_ |
string | broker default | duration | Default KIP-848 consumer-group session timeout, Kafka’s group.. |
controlled_ |
string | broker default | duration | How long a controlled shutdown waits for the controller to acknowledge should_ before it falls back to a hard shutdown. |
controller_ |
string | broker default | duration | Controller election timeout, Kafka’s controller.. It is the follower fetch watchdog, and 1.5x of it is the leader’s check-quorum window: a leader that a majority of the voters has not fetched from within that window resigns its epoch. |
controller_ |
integer (uint32) | broker default | Consecutive follower fetch misses tolerated before a new election. | |
controller_ |
string | broker default | duration | Raft heartbeat interval on the controller quorum. It should stay at or below controller_. |
controller_ |
string | broker default | duration | Time window whose throughput defines the KIP-599 controller-mutation quota burst capacity (default 11 s), Kafka’s controller. x controller.. |
coordinator_ |
integer (uint) | broker default | Mailbox capacity of each coordinator actor. | |
coordinator_ |
string | broker default | duration | Cadence of the consumer-group session expiry scan. |
coordinator_ |
string | broker default | duration | Maximum wait for coordinator shutdown acknowledgements. |
default_ |
integer (int32) | broker default | Broker default for a topic’s min., Kafka’s min.. A topic override wins over it. |
|
default_ |
integer (int16) | broker default | Replication factor of a topic that Create creates with replication_, Kafka’s default.. |
|
delegation_ |
string | broker default | duration | KIP-48: default renew period, Kafka’s delegation.. It is the initial expiry offset at create time, and the implicit renew period when a Renew request asks for -1. |
delegation_ |
string | broker default | duration | KIP-48: cadence of the sweep that tombstones expired delegation tokens, Kafka’s delegation.. |
delegation_ |
string | broker default | duration | KIP-48: hard upper bound on a delegation token’s lifetime, Kafka’s delegation.. A renew request is clamped to it. |
diskless_ |
string | broker default | duration | Cadence of diskless WAL flushes to the object store. |
diskless_ |
string | broker default | byte size | Maximum bytes included in one diskless WAL object-store flush. |
diskless_ |
string | broker default | byte size | Broker-wide byte ceiling for quorum-committed diskless hot-tail batches. |
diskless_ |
string | broker default | duration | Maximum wait for a published diskless WAL index record to be projected. |
diskless_ |
integer (uint) | broker default | Local replica count used in diskless WAL mode. | |
diskless_ |
integer (int64) | broker default | Committed offsets retained behind the diskless WAL trim frontier. | |
fetch_ |
string | broker default | byte size | Maximum bytes returned by one consumer Fetch or Share, Kafka’s fetch.. Kafka’s default is 57,671,680 bytes. |
future_ |
string | broker default | byte size | Bytes copied per read during a KIP-113 future-log move. |
future_ |
string | broker default | duration | Retry delay after a KIP-113 future-log move fails. |
gauge_ |
string | broker default | duration | Cadence at which broker gauges are refreshed. |
heartbeat_ |
string | broker default | duration | How often this broker sends Broker to the controller leader. |
heartbeat_ |
string | broker default | duration | How long the controller waits without a heartbeat before it marks a broker dead. |
inter_ |
string | broker default | TLS SNI and SASL server name used for outbound inter-broker connections. | |
isr_ |
string | broker default | duration | Cadence of in-sync-replica maintenance. |
leader_ |
string | broker default | duration | How often the auto-rebalance ticker fires, Kafka’s leader.. |
legacy_ |
boolean | broker default | Whether the broker serves the request versions Kafka 4.x removed: Fetch v0-v3, List v0 and Produce v0-v2. krabka-only, with no Kafka equivalent. The default is false, which advertises and accepts exactly Kafka 4.3.1’s minimums (Fetch v4, List v1, and Produce v3 though it is still advertised from v0, KAFKA-18659) and closes a connection that sends an older version, as a 4.3.1 broker does. true keeps a pre-0.11 client working. |
|
liveness_ |
string | broker default | duration | Cadence of broker liveness maintenance. |
log_ |
string | broker default | duration | Declared bound on how far this broker’s clock can be from true time. It has an effect only under the scheduled delivery policy: a batch becomes visible once max_, so delivery is never early and is late by at most twice this bound. |
log_ |
string | broker default | byte size | Cap on how far past a fetch read’s own byte range the broker asks the kernel to read ahead, so a consumer that is behind finds its next fetch in the page cache. The hint reaches up to one more range of the same size, and no further than this. The default is 4 MiB, and 0 limits the hint to the fetch’s own range. The hint has no effect on a host other than Linux. |
log_ |
string | broker default | byte size | Cap on the initial allocation a decoded or raw segment read makes. |
log_ |
string | broker default | duration | Cadence of local-retention maintenance: how often retention., retention. and segment. are applied to every hosted log. |
log_ |
string | broker default | byte size | Roll the active segment once it grows past this. Kafka’s log., the broker default for a topic’s segment.. |
log_ |
string | broker default | byte size | How much of the newest data a partition with preallocate=true keeps in memory to serve reads with. Such a partition writes its active segment through O_, which bypasses the page cache, so without this a consumer reading right behind the producer reads from disk. Every such partition holds up to this much, plus one batch. The default is 32 MiB, and 0 keeps only the newest batch. |
log_ |
string | broker default | byte size | Size of the window a timestamp search reads the log in. |
max_ |
integer (uint) | broker default | Maximum number of live broker connections across all listeners, Kafka’s max.. A connection accepted past this ceiling is closed immediately. |
|
max_ |
integer (uint) | broker default | Maximum number of live connections from any single client IP, Kafka’s max.. |
|
max_ |
integer (uint) | broker default | KIP-227: maximum number of incremental-fetch sessions kept in the per- broker cache, Kafka’s max.. When the cache is full, a new session displaces only a session that has been unused for more than two minutes, or a smaller one created more than two minutes ago (a follower-fetch session may also displace any consumer session); otherwise it is refused and the fetch runs sessionless, as in Kafka’s Fetch. |
|
max_ |
integer (uint) | broker default | Maximum number of produce requests combined into one append group. | |
max_ |
integer (int32) | broker default | Upper clamp on Describe’ response_, Kafka’s max.. |
|
message_ |
string | broker default | byte size | Kafka’s broker-wide message.: the largest record batch a topic that sets no max. accepts. |
metadata_ |
string | broker default | byte size | Largest size of one metadata-log segment, Kafka’s metadata.. The active segment rolls before an append that takes it past this size. A whole number of bytes from 8 MiB to 2147483647 bytes, as Kafka’s INT with at. |
metadata_ |
string | broker default | duration | Longest time one metadata-log segment stays active, Kafka’s metadata.. A positive whole number of milliseconds. |
metadata_ |
string | broker default | byte size | Committed metadata-log bytes between snapshots, Kafka’s metadata.. |
metadata_ |
string | broker default | duration | KIP-835: how often the active controller appends a No to the metadata log, Kafka’s metadata.. A whole number of milliseconds up to 2147483647 ms. Zero disables the no-op records. |
metadata_ |
string | broker default | duration | Age after which a metadata snapshot and the log prefix it covers are deleted, Kafka’s metadata.. A whole number of milliseconds. Zero is a value. Kafka’s negative value, which sets no age limit, has no form here. |
metadata_ |
string | broker default | byte size | Largest combined size of the metadata log and its snapshots before the oldest snapshot and the log prefix it covers are deleted, Kafka’s metadata.. A whole number of bytes. Zero is a value. Kafka’s negative value, which sets no size limit, has no form here. |
metadata_ |
string | broker default | duration | Maximum time between metadata-log snapshots, Kafka’s metadata.. Zero disables the time-based cap. |
metadata_ |
integer (uint) | broker default | Capacity of the metadata Raft engine command queue. | |
metadata_ |
string | broker default | byte size | Per-read and per-snapshot-request byte budget on the metadata Raft log. |
metadata_ |
string | broker default | byte size | Maximum metadata snapshot size a follower fetches. The Raft core enforces an immutable 1 GiB ceiling above it. |
metadata_ |
integer (uint64) | broker default | KIP-630: snapshot the metadata log once the committed offset advances this many records past the last snapshot. The metadata log keeps the records below a snapshot until its retention limits let them go. | |
num_ |
integer (int32) | broker default | Partition count of a topic that Create creates with num_, Kafka’s num.. |
|
oauth_ |
string | broker default | duration | Timeout for one OAuth JWKS fetch. |
observer_ |
string | broker default | byte size | Maximum bytes fetched by one metadata observer request. |
observer_ |
integer (uint64) | broker default | KIP-853: maximum log-entry lag an observer may have and still be promotable to a voter. | |
observer_ |
string | broker default | duration | Cadence of the KIP-853 observer promotion poll. |
offsets_ |
string | broker default | duration | How long a committed consumer offset is kept after its group becomes empty, Kafka’s offsets.. It must be a whole number of minutes. |
offsets_ |
string | broker default | duration | Cadence of the expired-offset sweep, Kafka’s offsets.. |
offsets_ |
integer (int32) | broker default | Partition count of the _ internal topic, Kafka’s offsets.. |
|
offsets_ |
integer (int16) | broker default | Replication factor of the _ internal topic, Kafka’s offsets.. |
|
offsets_ |
string | broker default | byte size | segment. of the _ internal topic, Kafka’s offsets.. |
opa_ |
string | broker default | duration | Timeout for one OPA authorization request. |
operator_ |
string | broker default | duration | Deadline for an operator-triggered unclean recovery. |
partition_ |
string | broker default | duration | Cadence of the partition disk-usage scan that feeds the partition_ gauge. Zero disables the scanner and spawns no background task. |
partition_ |
integer (uint) | broker default | Capacity of each partition-writer request queue. | |
producer_ |
string | broker default | duration | How long a producer id may stay idle before its state expires, Kafka’s producer.. |
producer_ |
string | broker default | duration | Cadence of the producer-state expiry scan, Kafka’s producer.. |
queued_ |
string | broker default | byte size | Maximum byte size across all queued requests before accepting additional requests is paused, Kafka’s queued.. |
queued_ |
integer (uint) | broker default | Maximum number of queued requests allowed in the broker dispatch queue, Kafka’s queued.. |
|
quota_ |
string | broker default | duration | Maximum request-quota throttle delay, which bounds how long one response over request_ mutes a client. Equivalent to Kafka’s quota.; byte-rate and controller-mutation throttles are not bounded. |
quota_ |
string | broker default | duration | Time window that sizes the client byte-rate quota token bucket’s burst capacity. Equivalent to Kafka’s sampling window quota.. |
record_ |
string | broker default | ratio | Maximum accepted decompression ratio for a produced record batch. |
record_ |
string | broker default | byte size | Maximum decompressed-output allowance granted to a record batch. |
record_ |
string | broker default | byte size | Minimum decompressed-output allowance granted to a record batch, whatever the ratio bound computes. |
remote_ |
string | broker default | duration | KIP-405: tick cadence of the Remote copy and retention task. Kafka’s remote.. |
replica_ |
integer (uint) | broker default | How many fetchers this broker runs per leader it follows, Kafka’s num.. Every partition followed from one leader is hashed onto one of that leader’s fetchers, and each fetcher holds one connection and sends one batched Fetch per round. |
|
replica_ |
string | broker default | duration | Maximum follower lag before the leader proposes an ISR shrink. Kafka’s replica.. |
replication_ |
string | broker default | duration | Retry delay after a leader-epoch fence. |
replication_ |
string | broker default | byte size | Maximum bytes a follower requests from a leader in one replication fetch. It reaches the leader as the fetch request’s max_. |
replication_ |
string | broker default | duration | Maximum time a leader holds a replication fetch that is not yet satisfied. It reaches the leader as the fetch request’s max_. |
replication_ |
string | broker default | byte size | Minimum bytes that satisfy a replication fetch. It reaches the leader as the fetch request’s min_, which the leader honours as a floor. |
replication_ |
string | broker default | duration | Maximum delay between leader reconnection attempts. |
replication_ |
string | broker default | duration | Initial delay before a follower reconnects to a leader. |
replication_ |
string | broker default | duration | Retry delay after sending a replication request fails. |
replication_ |
string | broker default | duration | Delay after a follower exhausts its replication throttle budget. |
replication_ |
string | broker default | duration | Retry delay after an unexpected replication error. |
replication_ |
string | broker default | duration | Retry delay when the leader does not yet know the topic. |
rlmm_ |
string | broker default | duration | Initial retry delay while remote-log metadata bootstrap is incomplete. |
rlmm_ |
string | broker default | duration | Maximum retry delay while remote-log metadata bootstrap is incomplete. |
rlmm_ |
string | broker default | duration | Cadence of KIP-405 remote-log metadata reconciliation. |
sasl_ |
string | broker default | byte size | Largest request frame a connection may send before it finishes authenticating on a SASL listener, Kafka’s sasl.. It replaces socket_ for that stretch, and a larger frame fails the authentication. |
schema_ |
string | broker default | duration | Timeout for one schema-registry request. |
self_ |
string | broker default | duration | Maximum delay between broker self-registration attempts. |
self_ |
string | broker default | duration | Initial delay between broker self-registration attempts. |
self_ |
integer (uint32) | broker default | Maximum self-registration attempts before startup fails. | |
sendfile_ |
string | broker default | byte size | Minimum response size eligible for a sendfile kernel drain. Smaller responses go through the pread and write copy. |
share_ |
string | broker default | duration | How old the latest snapshot of a share key may get before the share coordinator writes a new one, Kafka’s share.. |
share_ |
integer (int32) | broker default | milliseconds | Kafka’s share., a whole number of milliseconds, or -1 (the default) for an adaptive linger. Accepted and has no effect: each share-state write is its own append, and the partition writer groups concurrent appends without waiting for more. |
share_ |
string | broker default | byte size | Kafka’s share., at least 512KiB, default 1MiB plus 12 bytes. Accepted and has no effect: the share coordinator encodes each record into a new buffer and keeps no buffer for reuse. |
share_ |
string | broker default | byte size | Maximum bytes read by one share-state recovery read, Kafka’s share.. |
share_ |
integer (int32) | broker default | Kafka’s share., at least 1. Accepted and has no effect: the share coordinator runs as tasks on the broker’s shared async runtime rather than on a thread pool of its own. |
|
share_ |
string | broker default | duration | How long an append to _ may take before the share coordinator answers COORDINATOR_, Kafka’s share.. |
share_ |
string | broker default | duration | Cadence of the share-group backlog poll. |
share_ |
integer (int16) | broker default | The delivery count at which a share record is archived, Kafka’s group.: from 2 to 10, within the minimum and maximum below. |
|
share_ |
string | broker default | duration | Default share-group heartbeat interval, Kafka’s group.. |
share_ |
integer (int16) | broker default | Upper bound on the delivery count limit, and on a group’s share., Kafka’s group.: from 5 to 25. |
|
share_ |
string | broker default | duration | Upper bound on the share-group heartbeat interval, and on a group’s share., Kafka’s group.. |
share_ |
integer (int32) | broker default | Upper bound on the record lock limit, and on a group’s share., Kafka’s group.: from 2000 to 10000. |
|
share_ |
string | broker default | duration | Upper bound on the record lock duration, and on a group’s share., Kafka’s group.: from 30s to 1h. |
share_ |
string | broker default | duration | Upper bound on the share-group session timeout, and on a group’s share., Kafka’s group.. |
share_ |
integer (uint) | broker default | Maximum number of members in one share group, Kafka’s group.: from 1 to 1000. |
|
share_ |
integer (int16) | broker default | Lower bound on the delivery count limit, and on a group’s share., Kafka’s group.: from 2 to 5. |
|
share_ |
string | broker default | duration | Lower bound on the share-group heartbeat interval, and on a group’s share., Kafka’s group.. |
share_ |
integer (int32) | broker default | Lower bound on the record lock limit, and on a group’s share., Kafka’s group.: from 100 to 2000. |
|
share_ |
string | broker default | duration | Lower bound on the record lock duration, and on a group’s share., Kafka’s group.: from 1s to 30s. |
share_ |
string | broker default | duration | Lower bound on the share-group session timeout, and on a group’s share., Kafka’s group.. |
share_ |
integer (int32) | broker default | Maximum records a share partition may hold in flight, Kafka’s group.: from 100 to 10000, within the minimum and maximum below. |
|
share_ |
string | broker default | duration | How long an acquired share record stays locked before it is released for redelivery, Kafka’s group.: a whole number of milliseconds from 1s to 1h, within the minimum and maximum below. |
share_ |
string | broker default | duration | Default share-group session timeout, Kafka’s group.. |
share_ |
integer (uint) | broker default | Ceiling on the share-session cache when the group count is unlimited. | |
share_ |
integer (uint32) | broker default | Updates of one share key between two snapshots of it, Kafka’s share.. At most 500. |
|
share_ |
integer (int32) | broker default | Codec of the batches the share coordinator appends to _, Kafka’s share., as Kafka’s codec id: 0 none (the default), 1 gzip, 2 snappy, 3 lz4 or 4 zstd. |
|
share_ |
integer (int32) | broker default | min. of the _ internal topic, Kafka’s share.. |
|
share_ |
integer (int32) | broker default | Partition count of the _ internal topic, Kafka’s share.. |
|
share_ |
string | broker default | duration | How often the share coordinator trims the redundant prefix of each _ partition it leads, Kafka’s share.. |
share_ |
integer (int16) | broker default | Replication factor of the _ internal topic, Kafka’s share.. |
|
share_ |
string | broker default | byte size | segment. of the _ internal topic, Kafka’s share.. |
socket_ |
string | broker default | byte size | Broker socket receive-buffer size, Kafka’s socket.. |
socket_ |
string | broker default | byte size | Maximum encoded request size accepted from a socket, Kafka’s socket.. |
socket_ |
string | broker default | byte size | Broker socket send-buffer size, Kafka’s socket.. |
startup_ |
string | broker default | duration | Maximum time the broker waits for a controller leader during startup. |
streams_ |
integer (int64) | broker default | Changelog lag, in records, below which a task is treated as caught up, the group’s streams.. |
|
streams_ |
string | broker default | Server-side task assignor for streams groups: auto, sticky, or highly-available. auto picks highly-available when the topology has a stateful subtopology and sticky otherwise. |
|
streams_ |
boolean | broker default | Whether the broker serves KIP-1071 streams groups. | |
streams_ |
string | broker default | duration | Default streams-group heartbeat interval, the group’s streams.. |
streams_ |
string | broker default | duration | Highest heartbeat interval a streams group may run with, Kafka’s group.. |
streams_ |
string | broker default | duration | Highest session timeout a streams group may run with, Kafka’s group.. |
streams_ |
integer (uint) | broker default | Maximum number of members in one streams group. | |
streams_ |
string | broker default | duration | Lowest heartbeat interval a streams group may run with, Kafka’s group.. |
streams_ |
string | broker default | duration | Lowest session timeout a streams group may run with, Kafka’s group.. |
streams_ |
integer (int32) | broker default | Number of standby replicas the assignor places for each task, the group’s streams.. |
|
streams_ |
integer (int32) | broker default | Maximum number of warm-up replicas the assignor may move at once, the group’s streams.. |
|
streams_ |
array of string | broker default | Client tag keys every streams-group member must send, Kafka’s group. and the default of a group’s streams.. A repeated or an empty tag key is refused. |
|
streams_ |
string | broker default | duration | Default streams-group session timeout, the group’s streams.. |
streams_ |
string | broker default | duration | Cadence at which members report task offsets, the group’s streams.. |
sync_ |
string | broker default | duration | Maximum time a classic-protocol follower waits for its Sync assignment. |
tls_ |
string | broker default | duration | Cadence at which the TLS watcher polls the certificate, key, and client-CA files and rebuilds the server configuration if any changed. Zero disables the periodic watcher. |
transaction_ |
string | broker default | duration | Maximum transaction timeout a producer may request, Kafka’s transaction.. |
transaction_ |
boolean | broker default | Whether a partition leader checks with the transaction coordinator that a transaction contains a partition before it appends transactional records to it, Kafka’s transaction.. This is the static value. A dynamic broker config of the same name, per-broker or cluster-wide, overrides it, and the server_ entry of that name applies only when this key is absent. The default is true. |
|
transaction_ |
string | broker default | byte size | Maximum bytes requested by one _ recovery read. |
transaction_ |
integer (int32) | broker default | min. of the _ internal topic, Kafka’s transaction.. |
|
transaction_ |
integer (int32) | broker default | Partition count of the _ internal topic, Kafka’s transaction.. |
|
transaction_ |
integer (int16) | broker default | Replication factor of the _ internal topic, Kafka’s transaction.. |
|
transaction_ |
string | broker default | byte size | segment. of the _ internal topic, Kafka’s transaction.. |
txn_ |
string | broker default | duration | KIP-98: how often the idle-transaction reaper scans for Ongoing transactions whose timeout has elapsed and aborts them. Kafka’s transaction.. Zero disables the reaper and spawns no background task. |
txn_ |
string | broker default | duration | KIP-98: how long a transactional id may sit in a terminal or idle state before the coordinator tombstones it out of _. Kafka’s transactional.. |
txn_ |
string | broker default | duration | KIP-98: how often the transactional-id expiry sweep scans the _ partitions this broker leads. Kafka’s transaction.. Zero disables the sweep and spawns no background task. |
unclean_ |
string | broker default | duration | Replica-log collection deadline under the aggressive unclean-recovery strategy. |
unclean_ |
string | broker default | duration | Replica-log collection deadline under the balanced unclean-recovery strategy. |
unclean_ |
integer (uint) | broker default | Capacity of the unclean-recovery work queue. |
[sasl_plain]
TOML shape of [sasl_plain]. Maps to crate::BrokerConfig::plain_credentials.
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
credentials_ |
string | broker default | Filesystem path to the SASL/PLAIN credential file: one username=password per line, split at the first =, so a password may contain =. Line endings are stripped. A line whose trimmed content is empty or starts with # is ignored. The username is trimmed of surrounding whitespace, since it is matched against the SASL authcid and padding there is a typo rather than intent; the password is stored exactly as written, including any leading or trailing whitespace, so a secret is never silently rewritten. File-based (not literal) so no password sits in the TOML; the operator mounts a Secret and writes the mount path here. |
[schema_registry]
TOML shape of [schema_registry]. Mirrors the constructor arguments of crate::schema_validation::SchemaValidator::new, the one registry client each broker holds. deny_unknown_fields so a misspelled key is rejected at parse time. A silently ignored fail_open would leave the operator with the opposite of the policy they wrote.
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
basic_ |
string | broker default | File containing the HTTP Basic password. One trailing newline is ignored. Set this together with basic_; keeping the password in a separate mounted secret avoids putting it in broker arguments or TOML. |
|
basic_ |
string | broker default | HTTP Basic username for an authenticated registry. Set this together with basic_. |
|
expire_ |
integer (int64) | 300000 |
milliseconds | Schema-cache entry TTL, in milliseconds. Default 300_, which is 5 minutes. |
fail_ |
boolean | false |
Security-sensitive. Admit a record that the broker could not validate because the registry was unreachable. When true, a validated topic accepts whatever it is sent for the length of a registry outage. That is fail-open. Default false, which fails the produce instead. An unknown schema id, or a body that does not match its schema, is a rejection under either setting. This field governs only the case where the broker could not get an answer at all. |
|
maximum_ |
integer (uint) | 50000 |
entries | Schema-cache capacity, in entries. Default 50_. |
url |
string | required | Base URL of the Confluent-compatible schema registry, e.g. http:/. The registry API path is appended to it. |
[stretch]
[stretch] TOML section — the three-site stretch deployment. The table is all-or-nothing. When it is present, all three fields must be, because a half-built profile would let the broker start with a site layout that no node agrees on.
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
preferred_ |
string | broker default | The site that partition leadership prefers while both data sites are up. It must not be the witness site. | |
sites |
array of string | broker default | The three site names. Each one is a rack value that some node of the cluster reports. |
|
witness_ |
string | broker default | The site that holds the witness nodes. |
[tls_config]
TLS material for the controller listener (and any listener whose protocol is TLS-bearing).
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
cert_ |
string | required | PEM file holding this listener’s server certificate chain. | |
client_ |
one of Disabled, Optional, Required |
broker default | Whether a TLS listener asks for and requires a client certificate, Kafka’s ssl.. Disabled is the default and never asks; Optional asks and accepts a connection that presents none; Required rejects a connection that presents none. Optional and Required both need a client_. |
|
client_ |
string | broker default | PEM file of CA(s) this listener validates client certificates against. Absent leaves mTLS without a client trust store, so client_ has to be Disabled. |
|
key_ |
string | required | PEM file holding the private key for cert_. |
|
principal_ |
array of string | ["DEFAULT"] |
KIP-371 ssl.: how the Subject DN of an mTLS peer certificate becomes the principal name ACLs and super_ are written against. Each entry is either DEFAULT, which uses the DN itself, or RULE:pattern/, where pattern has to match the whole DN, replacement may reference capture groups as $1, and a trailing L or U lowercases or uppercases the result. The rules are tried in order and the first match wins. Defaults to ["DEFAULT"], so a listener that says nothing keeps Kafka’s behaviour of using the full DN. A malformed entry is rejected at startup. Case-insensitive backreferences have a Unicode compatibility edge: under (?i), non-ASCII case pairs may match here when Java rejects them (for example é and É); under (?iu), pairs Java accepts may fail here (for example i and İ, or s and ſ). Ordinary ASCII DNs are unaffected. Keep both captured and referenced text ASCII, or avoid case-insensitive backreferences when exact Java behavior matters. |
|
trust_ |
string | broker default | PEM file of CA(s) this broker trusts when validating a PEER’s server cert as an outbound inter-broker / controller-quorum dialer. The operator renders the cluster CA here so KIP-595 controller peers can mutually authenticate over the controller listener. Maps to krabka_. |
[topic_policy]
TOML shape of [topic_policy]. Maps to crate::topic_policy::TopicPolicy. The whole table is the KIP-108 / KIP-133 policy Kafka loads from a Java class named by create.topic.policy.class.name and alter.config.policy.class.name. krabka cannot load a class, so the rules are declared here instead. Omitting the table declares no rule, which is Kafka’s default of no policy class: every CreateTopics and every topic AlterConfigs that passes ordinary config validation is accepted. A request that breaks a rule is answered with POLICY_VIOLATION (44) and an error_message naming the rule, which is what a PolicyViolationException from a Java policy class produces. The two replica rules apply to CreateTopics alone, because an AlterConfigs request carries neither number, exactly as AlterConfigPolicy.RequestMetadata does not. deny_unknown_fields so a misspelled rule name is rejected at parse time rather than leaving the broker enforcing nothing where the operator wrote a rule.
| Key | Type | Default | Units | Description |
|---|---|---|---|---|
forbidden |
map of string to string | {} |
Config keys the topic must not set to the named value, written as a TOML table: forbidden = { "unclean.. Any other value for that key, and omitting the key, both pass. |
|
max_ |
integer (uint) | broker default | Highest partition count Create may be asked for, checked against the effective count. Omitted enforces no ceiling. Must be at least 1. |
|
min_ |
integer (uint) | broker default | Lowest min. a topic may carry. A topic that does not set the key passes: it runs on the cluster default, which the same operator sets. Omitted enforces no floor. Must be at least 1. |
|
min_ |
integer (uint) | broker default | Lowest replication factor Create may be asked for. The effective factor is checked, so a request that leaves it -1 is judged on the factor the placement resolved. Omitted enforces no floor. Must be at least 1. |
|
required |
map of string to string | {} |
Config keys the topic must set, with the exact value it must set them to, written as a TOML table: required = { "cleanup.. A topic that omits the key, or sets it to another value, is refused. |