# Manage Kafka Cluster Configuration Settings in Confluent Cloud Confluent Cloud applies default Apache Kafka® cluster configuration settings to every Kafka cluster. For a complete description of all Kafka configurations, see [Confluent Platform Configuration Reference](/platform/current/installation/configuration/index.html). Considerations: - You cannot edit cluster settings on Basic, Standard, Enterprise, and Freight clusters in Confluent Cloud. Many configuration settings are available at the topic level instead. For more information, see [Manage Topics in Confluent Cloud](../topics/overview.md#cloud-topics-manage). - You can change some configuration settings on Dedicated clusters using the Confluent CLI or REST API. See [Change cluster settings for Dedicated clusters](#custom-settings-dedicated). - The default maximum session timeout for registered consumers differs between Confluent Cloud Kafka clusters and Confluent Platform clusters, and you cannot change it on Confluent Cloud. - `group.max.session.timeout.ms` default is 1,200,000 ms (20 minutes). ## Access cluster settings in the Confluent Cloud Console You can view settings for your clusters with the Cloud Console. For Dedicated clusters, [cluster settings](#custom-settings-dedicated) are view-only in the Cloud Console; to change them, use the Confluent CLI or REST API. To view cluster settings: 1. Sign in to your Confluent Cloud account. 2. Select an environment and choose a cluster. 3. Click **Settings**. The **Settings** page displays. ![Settings tab on the cluster page in |ccloud-console|.](images/_clusters/cluster-detail-header.png) ## Change cluster settings for Dedicated clusters The following table lists editable cluster settings for Dedicated clusters and their default parameter values. | Parameter Name | Default | Editable | More Info | |------------------------------------------------------|---------------------|------------|------------------------------------------------------------------------------------------------------| | [auto.create.topics.enable](#topic-creation) | false | Yes | | | [ssl.enabled.protocols](#manage-tls-protocols) | TLSv1.2 | Yes | Options: `TLSv1.2`, `TLSv1.3`, or both. | | [ssl.cipher.suites](#restrict-ciphers) | “” | Yes | | | [num.partitions](#default-partitions) | 6 | Yes | Limits vary, see:
[Kafka Cluster Types in Confluent Cloud](cluster-types.md#cloud-cluster-types) | | [log.cleaner.max.compaction.lag.ms](#lag-compaction) | 9223372036854775807 | Yes | Min: `21600000` ms | | [log.retention.ms](#log-retention) | 604800000 | Yes | Set to -1 for Infinite Storage | To change these settings, use the [CLI](https://docs.confluent.io/confluent-cli/current/command-reference/kafka/cluster/configuration/index.html#confluent-kafka-cluster-configuration) or the [Kafka REST APIs](https://docs.confluent.io/cloud/current/ccloud/update-kafka-cluster-config/). For more information, see [Get Started with Confluent CLI](https://docs.confluent.io/confluent-cli/current/overview.html) or [Kafka REST API Quick Start for Confluent Cloud](../kafka-rest/krest-qs.md#cloud-rest-api-quickstart). Confluent Cloud applies setting changes to your cluster automatically. The new values persist until you change them again. #### IMPORTANT These settings apply only to Dedicated clusters and cannot be modified on Basic, Standard, Enterprise, and Freight clusters. ### Enable automatic topic creation Automatic topic creation (`auto.create.topics.enable`) is disabled by default (`false`) to help prevent unexpected costs. The following commands show how to enable it. For more on this property, see [broker configurations](/platform/current/installation/configuration/broker-configs.html#auto-create-topics-enable). ### Confluent CLI ```none confluent kafka cluster configuration update --config auto.create.topics.enable=true ``` ### REST API ```none curl --location --request PUT 'https:///kafka/v3/clusters//broker-configs/auto.create.topics.enable' \ --header 'Authorization: Basic ' \ --header 'Content-Type: application/json' \ --data-raw '{ "value": "true" }' ``` ### Manage TLS protocols All Kafka cluster types support TLS 1.3. Basic, Standard, Freight, and Enterprise clusters support TLS 1.3 and TLS 1.2, with both protocol versions enabled and not configurable. For Dedicated clusters only, you can enable TLS 1.3 by updating the Kafka broker configuration property for the Kafka cluster. For details on migrating to TLS 1.3, see [Enable TLS 1.3 on Dedicated clusters](../security/encrypt/tls.md#enable-tls-1-3). ### Confluent CLI Use the following `confluent kafka cluster configuration update` command to enable TLS 1.3 on a Dedicated cluster: ```bash confluent kafka cluster configuration update \ --cluster \ --config ssl.enabled.protocols= ``` For example, to enable TLS 1.3 on a Dedicated cluster `lkc-abc123`, but to continue supporting TLS 1.2, you can use the following command: ```bash confluent kafka cluster configuration update \ --cluster lkc-abc123 \ --config ssl.enabled.protocols=TLSv1.3,TLSv1.2 ``` After you run the command, the response displays: `Successfully requested to update configuration "ssl.enabled.protocols".` You can verify that the Dedicated cluster is using TLS 1.3 by running the `confluent kafka cluster configuration describe` command. For details, see [Verify TLS protocols](../security/encrypt/tls.md#verify-tls-protocols). For details on using the `confluent kafka cluster configuration update` command, see [confluent kafka cluster configuration update](https://docs.confluent.io/confluent-cli/current/command-reference/kafka/cluster/configuration/confluent_kafka_cluster_configuration_update.html). ### Confluent Cloud APIs To enable TLS 1.3 on a Dedicated cluster, use the `PUT /kafka/v3/clusters/{cluster_id}/broker-configs/ssl.enabled.protocols` endpoint. Replace the `` placeholder with the REST endpoint for the Kafka cluster you want to update, replace the `` placeholder with the ID of the Dedicated cluster you want to update, and replace the `` placeholder with the TLS protocols you want to enable. ```shell curl --location --request PUT 'https:///kafka/v3/clusters//broker-configs/ssl.enabled.protocols' \ --header 'Authorization: Basic ' \ --header 'Content-Type: application/json' \ --data-raw '{ "value": "" }' ``` For example, to enable TLS 1.3 on a Dedicated cluster `lkc-abc123`, but to continue supporting TLS 1.2, you can use the following cURL command: ```shell curl --location --request PUT 'https://pkc-00000.region.provider.confluent.cloud/kafka/v3/clusters/lkc-abc123/broker-configs/ssl.enabled.protocols' \ --header 'Authorization: Basic BASIC_AUTH_TOKEN' \ --header 'Content-Type: application/json' \ --data-raw '{ "value": "TLSv1.3,TLSv1.2" }' ``` For details on using the `PUT /kafka/v3/clusters/{cluster_id}/broker-configs/ssl.enabled.protocols` endpoint, see [Update Dynamic Broker Configs](https://docs.confluent.io/cloud/current/ccloud/update-kafka-cluster-config/). After enabling TLS 1.3, you must also configure your clients to use TLS 1.3. For Kafka clients, update the `ssl.enabled.protocols` configuration property to include `TLSv1.3`. ### Restrict cipher suites Restricting cipher suites is supported on only Dedicated clusters. The following commands show how to restrict the allowed TLS or SSL cipher suites (`ssl.cipher.suites`). For more on this property, see [broker configurations](/platform/current/installation/configuration/broker-configs.html#ssl-cipher-suites). For the list of cipher suites supported by Confluent Cloud, see [Supported cipher suites](../security/encrypt/tls.md#supported-cipher-suites). ### Confluent CLI ```none confluent kafka cluster configuration update \ --cluster \ --config ssl.cipher.suites=[""] ``` ### REST API ```none curl --location --request PUT 'https:///kafka/v3/clusters//broker-configs/ssl.cipher.suites' \ --header 'Authorization: Basic ' \ --header 'Content-Type: application/json' \ --data-raw '{ "value": "" }' ``` Supported cipher suites: ```text #TLS 1.2 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 #TLS 1.3 TLS_AES_256_GCM_SHA384 TLS_AES_128_GCM_SHA256 TLS_CHACHA20_POLY1305_SHA256 ``` ### Change the default number of partitions for new topics The following commands show how to set the default number of partitions (`num.partitions`) for newly created topics. On clusters, `num.partitions` allows you to set a default for newly created topics. On topics, `num.partitions` allows you to specify the number of partitions for a particular topic. For more information, see [topic configurations](../topics/manage.md#topics-num-partitions) and [confluent kafka cluster configuration update](https://docs.confluent.io/confluent-cli/current/command-reference/kafka/cluster/configuration/confluent_kafka_cluster_configuration_update.html). ### Confluent CLI ```none confluent kafka cluster configuration update --config num.partitions= ``` ### REST API ```none curl --location --request PUT 'https:///kafka/v3/clusters//broker-configs/num.partitions' \ --header 'Authorization: Basic ' \ --header 'Content-Type: application/json' \ --data-raw '{ "value": "" }' ``` ### Change maximum compaction lag time The following commands show how to set the default maximum lag compaction time (`log.cleaner.max.compaction.lag.ms`) for new topics. For more on this property, see [max.compaction.lag.ms](../topics/manage.md#topics-max-compaction-lag-ms). ### Confluent CLI ```none confluent kafka cluster configuration update --config log.cleaner.max.compaction.lag.ms= ``` ### REST API ```none curl --location --request PUT 'https:///kafka/v3/clusters//broker-configs/log.cleaner.max.compaction.lag.ms' \ --header 'Authorization: Basic ' \ --header 'Content-Type: application/json' \ --data-raw '{ "value": "" }' ``` ### Change log retention time The following commands show how to set the default log retention time (`log.retention.ms`) for new topics. For more on this property, see [retention.ms](../topics/manage.md#topics-retention-ms). ### Confluent CLI ```none confluent kafka cluster configuration update --config log.retention.ms= ``` ### REST API ```none curl --location --request PUT 'https:///kafka/v3/clusters//broker-configs/log.retention.ms' \ --header 'Authorization: Basic ' \ --header 'Content-Type: application/json' \ --data-raw '{ "value": "" }' ``` ### Release priority If your organization uses multiple Kafka clusters for testing and production workloads, you can enable release priority on your test clusters so that they receive updates first. Release priority ensures that the selected cluster receives updates from Confluent before other clusters in the same organization that don’t have release priority. To confirm updates are stable before they reach your non-test clusters, set release priority on clusters that run consistent, representative test workloads. Release priority is available only for Dedicated clusters and only if you have the [Premier support plan](../support.md#support-plans-overview) or higher. #### NOTE Changes to this setting apply on the next release. If an update is already in progress, the change takes effect with the next regular Kafka update. Confluent reserves the right to update clusters in the case of critical fixes, in which case release priority might not apply. For more information, see [Minor Upgrades for Confluent Cloud](../release-notes/upgrade-policy.md#minor-ccloud-upgrade). ### Confluent Cloud Console To enable release priority in the [Confluent Cloud Console](https://confluent.cloud/environments), toggle on **Enable update priority** in the **Advanced settings** section. For new clusters, enable this setting on the **Create cluster** page. For existing clusters, go to your cluster’s [settings](#cluster-settings-console) page. ![Toggle to enable update priority on the cluster settings page.](images/_clusters/cluster-update-priority-enable.png) ### REST API To set release priority when you create a cluster, include `release_priority` in the cluster configuration: ```bash curl --request POST 'https://api.confluent.cloud/cmk/v2/clusters' \ --header 'Authorization: Basic ' \ --header 'Content-Type: application/json' \ --data-raw '{ "spec": { "display_name": "dedicated-PRIORITY", "availability": "MULTI_ZONE", "cloud": "AWS", "region": "us-west-2", "config": { "kind": "Dedicated", "cku": 2, "release_priority": "PRIORITY" }, "environment": { "id": "" } } }' ``` To enable release priority on an existing cluster, send a `PATCH` request to the Confluent Cloud API. Replace `` with the cluster ID and `` with the environment ID. ```bash curl --request PATCH 'https://api.confluent.cloud/cmk/v2/clusters/' \ --header 'Authorization: Basic ' \ --header 'Content-Type: application/json' \ --data-raw '{ "spec": { "config": { "kind": "Dedicated", "release_priority": "PRIORITY" }, "environment": { "id": "" } } }' ``` ## Related content - [Topic configuration settings](../topics/overview.md#cloud-topics-manage) - [Manage topics](../topics/overview.md#cloud-topics) - [Cluster types](cluster-types.md#cloud-cluster-types)