.. _cloud-c3-config:

Connecting |c3-short| to |ccloud|
=====================================

:ref:`control_center` can monitor data streams that are running in |ccloud|.

To configure this, you must enable interceptors for producers and consumers, and enable |c3-short| to write data to |ccloud|.

Prerequisites
    .. include:: includes/installation.rst
        :start-line: 2
        :end-line: 4
    - |ccloud| users require an additional subscription to use |c3-short|. |c3-short| subscription is included by
      default for |ccloud-ent| users.

Here are the basic configuration steps:

#. Using an API key and secret, generate a configuration to connect to |ccloud| using one of these methods:

   -  Use ``ccloud init`` to generate your configuration
   -  Download the Java configuration from the |ccloud| web page and provide the API secret.

#. Validate that |ccloud| can be accessed from the machine where you are installing |c3-short|.

   -  Check connection by using ``ccloud topic list``.
   -  Try producing or consuming from the machine.

#. Install |c3-short| using the :ref:`documentation <controlcenter_install>`.
#. Configure |c3-short| with the |ccloud| specific settings. A minimum valid configuration is shown below. These settings
   are different from the standard |ccloud| configuration. Customize the ``bootstrap.servers`` and ``confluent.controlcenter.streams.sasl.jaas.config``
   for your |ccloud| cluster.

   .. code:: bash

        bootstrap.servers=<cloud-bootstrap-servers>
        confluent.controlcenter.streams.security.protocol=SASL_SSL
        confluent.controlcenter.streams.sasl.mechanism=PLAIN
        confluent.controlcenter.streams.sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required \
          username="<api-key-id>" \
          password="<secret-access-key>";
        confluent.controlcenter.streams.ssl.endpoint.identification.algorithm=https

5. Configure data stream interceptors by following the :ref:`documentation <controlcenter_clients>`. Here is an example of the required
   security configuration that must be added:

   .. code:: bash

        confluent.monitoring.interceptor.security.protocol=SASL_SSL
        confluent.monitoring.interceptor.sasl.mechanism=PLAIN
        confluent.monitoring.interceptor.sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="<api-key-id>" password="<secret-access-key>";
        confluent.monitoring.interceptor.ssl.endpoint.identification.algorithm=https

Example
-------

This example shows the topics that are created when |c3-short| starts:

.. code:: bash

     ccloud topic list
    _confluent-controlcenter-4-0-0-1-KSTREAM-OUTERTHIS-0000000095-store-changelog
    _confluent-controlcenter-4-0-0-1-AlertHistoryStore-changelog
    _confluent-controlcenter-4-0-0-1-MonitoringStream-ONE_MINUTE-changelog
    _confluent-controlcenter-4-0-0-1-aggregatedTopicPartitionTableWindows-THREE_HOURS-changelog
    _confluent-controlcenter-4-0-0-1-aggregatedTopicPartitionTableWindows-ONE_MINUTE-changelog
    _confluent-controlcenter-4-0-0-1-error-topic
    _confluent-controlcenter-4-0-0-1-cluster-rekey
    _confluent-controlcenter-4-0-0-1-MonitoringTriggerStore-changelog
    _confluent-controlcenter-4-0-0-1-actual-group-consumption-rekey
    _confluent-controlcenter-4-0-0-1-Group-ONE_MINUTE-changelog
    _confluent-controlcenter-4-0-0-1-expected-group-consumption-rekey
    _confluent-controlcenter-4-0-0-1-monitoring-message-rekey
    _confluent-controlcenter-4-0-0-1-MetricsAggregateStore-changelog
    _confluent-metrics
    _confluent-controlcenter-4-0-0-1-Group-THREE_HOURS-changelog
    _confluent-controlcenter-4-0-0-1-group-stream-extension-rekey
    _confluent-controlcenter-4-0-0-1-group-aggregate-topic-ONE_MINUTE
    _confluent-controlcenter-4-0-0-1-MonitoringMessageAggregatorWindows-THREE_HOURS-changelog
    _confluent-controlcenter-4-0-0-1-MonitoringMessageAggregatorWindows-ONE_MINUTE-changelog
    _confluent-controlcenter-4-0-0-1-group-aggregate-topic-THREE_HOURS-changelog
    _confluent-controlcenter-4-0-0-1-monitoring-trigger-event-rekey
    _confluent-controlcenter-4-0-0-1-TriggerActionsStore-changelog
    _confluent-controlcenter-4-0-0-1-aggregate-topic-partition-changelog
    _confluent-command
    _confluent-controlcenter-4-0-0-1-TriggerEventsStore-changelog
    _confluent-controlcenter-4-0-0-1-MonitoringVerifierStore-changelog
    _confluent-controlcenter-4-0-0-1-metrics-trigger-measurement-rekey
    _confluent-controlcenter-4-0-0-1-MetricsAggregateStore-repartition
    _confluent-controlcenter-4-0-0-1-monitoring-aggregate-rekey-changelog
    _confluent-controlcenter-4-0-0-1-aggregate-topic-partition
    _confluent-controlcenter-4-0-0-1-monitoring-aggregate-rekey
    _confluent-controlcenter-4-0-0-1-group-aggregate-topic-ONE_MINUTE-changelog
    _confluent-monitoring
    _confluent-controlcenter-4-0-0-1-MonitoringStream-THREE_HOURS-changelog
    _confluent-controlcenter-4-0-0-1-KSTREAM-OUTEROTHER-0000000096-store-chang

Limitations
-----------

|c3-short| does not show system health details. This is because |ccloud| does not provide the instrumentation from
Confluent Metrics Reporter outside of the |ccloud|. |cp| internally monitors the system and broker health and takes actions
based on that monitoring.

|c3-short| requires an Apache Kafka cluster to store data. |c3-short| creates partitions for data storage, that count
toward partition limits, and data throughput within |ccloud|.


|c3-short| will log this warning which can be ignored:

.. code:: bash

    WARN broker=15 is not instrumented with ConfluentMetricsReporter (io.confluent.controlcenter.util.HealthCheck)elog
    _confluent-controlcenter-4-0-0-1-group-aggregate-topic-THREE_HOURS