<a id="cc-google-cloud-functions-gen2-sink"></a>

# Google Cloud Functions Gen 2 Sink Connector for Confluent Cloud

The fully managed Google Cloud Functions Gen 2 Sink connector for Confluent Cloud moves data from an Apache Kafka® topic
to a specified [Google Cloud Functions](https://cloud.google.com/functions/docs/console-quickstart). The connector supports Avro, JSON Schema, JSON (schemaless),
and Protobuf data output format from Kafka topics.

Confluent Cloud is available through [Google Cloud Marketplace](https://console.cloud.google.com/marketplace/product/confluent-prod/apache-kafka-on-confluent-cloud?inv=1&invt=Ab2Ryw)
or [directly from Confluent](https://www.confluent.io/get-started/).

## Features

The Google Cloud Functions Gen 2 Sink connector includes the following features:

* **Google Cloud Functions Gen 2 and Gen 1 support**: The connector supports both Gen 2 and Gen 1
  functions while delivering improved performance.
* **Secure access and data exchange**: The connector supports the following
  authentication mechanisms:
  - Google Cloud Service Account
  - None
* **API error reporting management**: You can configure the connector to notify
  you when an API error occurs through email or through the Confluent Cloud user
  interface. You also can configure the connector to ignore when an API error
  occurs.
* **Supported data formats**: The connector supports Avro, Bytes, JSON
  (schemaless), JSON Schema, and Protobuf data formats. [Schema Registry](../get-started/schema-registry.md#cloud-sr-config) must be enabled to use a Schema Registry-based format (for example,
  Avro, JSON Schema, or Protobuf).
* **Schema Registry and Schema Context support**: The connector allows you to
  map an API to a specific schema context so that you can leverage the schema
  context feature in different environments.
* **Custom offset support**: The connector allows you to configure [custom
  offsets](offsets.md#connect-custom-offsets) using the Confluent Cloud Console to prevent
  data loss and data duplication.
* **Configurable retry functionality**: The connector allows you to customize
  retry settings based on your requirements.
* **Client-side encryption (CSFLE and CSPE) support**: The connector supports CSFLE and CSPE for sensitive data.
  For more information about CSFLE or CSPE setup, see the [connector configuration](#cc-google-cloud-functions-gen2-sink-connection).
* **Custom URL support**: The connector allows you to configure custom URL to connect with
  [Cloud Run](https://docs.cloud.google.com/run/docs/triggering/https-request). You must set `gcf.custom.url.enabled` to `true` and set `gcf.custom.url` and
  `gcf.audience.url` configurations to the Cloud Run URL.

For more information and examples to use with the Confluent Cloud API for Connect,
see the [Confluent Cloud API for Connect Usage Examples](connect-api-section.md#ccloud-connect-api) section.

## Limitations

Be sure to review the following information.

* If you plan to use one or more Single Message Transformations (SMTs), see [SMT Limitations](single-message-transforms.md#cc-single-message-transforms-limitations).
* The connector only supports invoking only a single function.
* The target Google Cloud Function must be in the same region as your Confluent Cloud cluster by default.
  Cross-region access is disabled by default, but it can be enabled by contacting Confluent account team
  or [Confluent Support](https://support.confluent.io/).
* The connector is only supported in Google Cloud clusters.
* Messages in the reporter topic can be out of order relative to the order that the records were provided
* If you plan to migrate from [Gen 1 to Gen 2 connector](#cc-google-cloud-functions-gen2-sink-legacy-v2-migration), enable cross-cloud support in the Gen 2 connector
  if the function and Kafka cluster are in different regions. For more information, contact Confluent account team
  or [Confluent Support](https://support.confluent.io/).

## Quick Start

Use this quick start to get up and running with the Google Cloud Functions Gen 2 Sink connector on Confluent Cloud
connector.

<a id="cc-google-cloud-functions-gen2-sink-prereqs"></a>

### Prerequisites

- Authorized access to a [Confluent Cloud](https://www.confluent.io/confluent-cloud/) cluster on Amazon Web Services
  (AWS), Microsoft Azure (Azure), or Google Cloud.
- The Confluent CLI installed and configured for the cluster. For help, see
  [Install the Confluent CLI](https://docs.confluent.io/confluent-cli/current/install.html).
- [Schema Registry](../get-started/schema-registry.md#cloud-sr-config) must be enabled to use a
  Schema Registry-based format (for example, Avro, JSON_SR (JSON Schema), or Protobuf).
- At least one source Kafka topic must exist in your Confluent Cloud cluster before
  creating the sink connector.

### Using the Confluent Cloud Console

#### Step 1: Launch your Confluent Cloud cluster

To create and launch a Kafka cluster in Confluent Cloud, see [Create a kafka cluster in Confluent Cloud](../get-started/index.md#cloud-create-kafka-cluster).

#### Step 2: Add a connector

In the left navigation menu, click **Connectors**. If you already have connectors in your cluster, click **+ Add
connector**.

#### Step 3: Select your connector

Click the **Google Cloud Functions Gen 2 Sink** connector card.

![Google Cloud Functions Gen 2 Sink Connector Card](images/ccloud-google-cloud-functions-gen2-sink-icon.png)

<a id="cc-google-cloud-functions-gen2-sink-connection"></a>

#### Step 4: Enter the connector details

#### NOTE
* Ensure you have all your [prerequisites](#cc-google-cloud-functions-gen2-sink-prereqs) completed.
* An asterisk ( \* ) designates a required entry.

At the **Add Google Cloud Functions Gen 2 Sink Connector** screen, complete the following:

### Select or create new topics

If you’ve already populated your Kafka topics, select the topics you want
to connect from the **Topics** list.

To create a new topic, click **+Add new topic**.

### Kafka access

1. Select the way you want to provide **Kafka Cluster credentials**. You can
   choose one of the following options:
   - **My account**: This setting allows your connector to globally access everything
     that you have access to. With a user account, the connector uses an API key and
     secret to access the Kafka cluster. This option is not recommended for production.
   - **Service account**: This setting limits the access for your connector by using a
     [service account](service-account.md#s3-cloud-service-account). This option is recommended for
     production.
   - **Use an existing API key**: This setting allows you to specify an API key and a
     secret pair. You can use an existing pair or create a new one. This method is not
     recommended for production environments.

   #### NOTE
   Freight clusters support only service accounts for Kafka authentication.
2. Click **Continue**.

### Authentication

1. Configure the authentication properties:

   **Authentication**
   - **Authentication method**: Authentication method of the connector. Valid values are `None`, `Google Cloud Service Account`.
   - **GCP credentials file**: GCP service account JSON file.
   - **SSL Enabled**: Determine whether the connection to the endpoint should use SSL.
   - **Key Store**: The keystore that contains the client certificate and private key. Supported formats are `JKS` or `PKCS12`. File system paths are not supported.
   - **Keystore Password**: The store password for the key store file.
   - **Key Password**: The password for the private key in the key store file.
   - **Trust Store**: The truststore that contains the server CA certificate(s). Supported formats are JKS or PKCS12. File system paths are not supported.
   - **Trust Store Password**: The trust store password containing a server CA certificate.
   - **SSL Protocol**: The protocol to use for SSL connections.
2. Click **Continue**.

### Configuration

- **Input Kafka record value format**: Select the input Kafka record value format (data coming from the
  Kafka topic). Valid entires are AVRO, or BYTES, JSON, JSON_SR, or PROTOBUF. A valid schema
  must be available in [Schema Registry](../get-started/schema-registry.md#cloud-sr-config) to use a
  schema-based message format (for example, Avro, JSON Schema, or
  Protobuf).
  Note that to consume STRING
  data, select schemaless JSON.

**Google Cloud Functions configurations**

- **Function Name**: Name of the function to be invoked
- **Region Name**: Region of the given function to be invoked as in `https://<region-name>-<project-id>.cloudfunctions.net/`.
- **Project ID**: Project identifier for the given function to be invoked as in `https://<region-name>-<project-id>.cloudfunctions.net/`.

**Data decryption**

- Enable **Client-Side Field Level Encryption** for
  data decryption. Specify a **Service Account** to
  access the Schema Registry and associated encryption rules or keys with that schema. Select the connector behavior
  (`ERROR` or `NONE`) on data decryption failure. If set to `ERROR`, the connector fails and writes the encrypted data
  in the DLQ. If set to `NONE`, the connector writes the encrypted data in the target system without decryption.
  For more information on CSFLE or CSPE setup, see [Manage encryption for connectors](csfle.md#connect-csfle).

### **Show advanced configurations**

- **Schema context**: Select a schema context to use for this connector, if using
  a schema-based data format. This property defaults to the **Default** context,
  which configures the connector to use the default schema set up for Schema Registry in your
  Confluent Cloud environment. A schema context allows you to use separate schemas (like
  schema sub-registries) tied to topics in different Kafka clusters that share the
  same Schema Registry environment. For example, if you select a non-default context, a
  **Source** connector uses only that schema context to register a schema and a
  **Sink** connector uses only that schema context to read from. For more
  information about setting up a schema context, see [What are schema contexts and when should you use them?](../sr/faqs-cc.md#faq-schema-contexts).
- **Behavior for null valued records**: Behavior of the connector when it encounters a record with a null value. Valid options are `IGNORE` and `FAIL`. This defaults to `IGNORE`.
- **Behavior on errors**: Select the error handling behavior
  setting for handling error responses from HTTP requests. Valid options
  are `IGNORE` and `FAIL`. This defaults to `FAIL`.

**Additional Configs**

- **Value Converter Replace Null With Default**: Specifies whether to replace fields that have a default value and that are null to the default value. When set to `true`, the connector uses the default value; otherwise, it uses `null`. Applies to the `JSON` converter.
- **Value Converter Schema ID Deserializer**: Sets the class name of the schema ID deserializer for values. The deserializer reads schema IDs from message headers.
- **Value Converter Reference Subject Name Strategy**: Sets the subject reference name strategy for values. Valid entries are `DefaultReferenceSubjectNameStrategy` or `QualifiedReferenceSubjectNameStrategy`. You can use this strategy only with `PROTOBUF` format; the default strategy is `DefaultReferenceSubjectNameStrategy`.
- **Schema ID For Value Converter**: Sets the schema ID to use for deserialization when using `ConfigSchemaIdDeserializer`. This lets you specify a fixed schema ID for deserializing message values. This property is applicable only when `value.converter.value.schema.id.deserializer` is set to `ConfigSchemaIdDeserializer`.
- **Value Converter Schemas Enable**: Includes schema within each of the serialized values. Input messages must contain `schema` and `payload` fields and must not contain additional fields. For plain `JSON` data, set this to `false`. Applies to the `JSON` converter.
- **Errors Tolerance**: Use this property to configure the connector’s error handling behavior.

  #### WARNING
  Use this property with caution for sink connectors, as it can lead to data loss. If you set this property to `all`, the connector does not fail on errant records, but logs them (and sends to DLQ for sink connectors) and continues processing. If you set this property to `none`, the connector task fails on errant records.
- **Value Converter Ignore Default For Nullables**: When set to `true`, this property ensures that the corresponding record in Kafka is `null`, instead of showing the default column value. Applies to the `AVRO`, `PROTOBUF`, and `JSON_SR` converters.
- **Key Converter Schema ID Deserializer**: Sets the class name of the schema ID deserializer for keys. The deserializer reads schema IDs from message headers.
- **Value Converter Decimal Format**: Specifies the `JSON` or `JSON_SR` serialization format for Connect `DECIMAL` logical type values with two allowed literals:
  `BASE64` to serialize `DECIMAL` logical types as base64 encoded binary data, and
  `NUMERIC` to serialize `DECIMAL` logical type values in `JSON` or `JSON_SR` as a number representing the decimal value.
- **Schema GUID For Key Converter**: Sets the schema GUID to use for deserialization when using `ConfigSchemaIdDeserializer`. This lets you specify a fixed schema GUID for deserializing message keys. This property is applicable only when `key.converter.key.schema.id.deserializer` is set to `ConfigSchemaIdDeserializer`.
- **Schema GUID For Value Converter**: Sets the schema GUID to use for deserialization when using `ConfigSchemaIdDeserializer`. This lets you specify a fixed schema GUID for deserializing message values. This property is applicable only when `value.converter.value.schema.id.deserializer` is set to `ConfigSchemaIdDeserializer`.
- **Value Converter Connect Meta Data**: Enables the Connect converter to add its metadata to the output schema. Applies to Avro converters.
- **Value Converter Value Subject Name Strategy**: Determines how to construct the subject name under which the value schema is registered with Schema Registry.
- **Key Converter Key Subject Name Strategy**: Determines how to construct the subject name for key schema registration.
- **Schema ID For Key Converter**: Sets the schema ID to use for deserialization when using `ConfigSchemaIdDeserializer`. This lets you specify a fixed schema ID for deserializing message keys. This property is applicable only when `key.converter.key.schema.id.deserializer` is set to `ConfigSchemaIdDeserializer`.

**Auto-restart policy**

- **Enable Connector Auto-restart**: Enables the auto-restart behavior of the connector and its
  task in the event of user-actionable errors. Defaults to `true`, enabling the connector to
  automatically restart in case of user-actionable errors. Set this property to `false` to
  disable auto-restart for failed connectors. If disabled, you must manually restart the connector.

**Consumer configuration**

- **Max poll interval(ms)**: Sets the maximum delay between subsequent consume requests to Kafka. Use this property to
  improve connector performance in cases when the connector cannot send records to the sink system.
  The default is 300,000 milliseconds (5 minutes).
- **Max poll records**: Sets the maximum number of records to consume from Kafka in a single request. Use this property to
  improve connector performance in cases when the connector cannot send records to the sink system.
  The default is 500 records.

**Google Cloud Functions configurations**

- **Enable Custom URL**: Set to true to use a custom URL for the Google Cloud Function instead of `https://<region-name>-<project-id>.cloudfunctions.net/<function-name>`.
- **Custom URL**: The custom URL for the Google Cloud Function to invoke instead of `https://<region-name>-<project-id>.cloudfunctions.net/<function-name>`. Note that you must set `enable.custom.url` to `true`. Do not append a trailing slash (/); the connector automatically appends it for proper path resolution.
- **Audience URL**: The audience URL the connector uses to generate the token sent in the Authorization header. If you do not set this, the connector uses the function URL as the audience. Note that you must set `gcf.custom.url.enabled` to `true`.

**Batch configurations**

- **Batch max size**: The number of records accumulated in a batch before the Google Cloud Functions API is invoked. Default is 1.
- **Batch json as array**: Whether or not to use an array to bundle JSON records. Setting this to true will send records as a JSON array. Default is `false`.
- **Report only status code to success topic**: Whether to report only the status code to the success topic. If the API response payload is huge, it is recommended to set this to `true`, for better throughput.

**Retry configurations**

- **Maximum Retries**: The maximum number of times the connector
  retries a request when an error occurs, before the task fails.
- **Retry Backoff Policy**: The backoff policy to use in terms of a
  retry. Must be configured to `CONSTANT_VALUE` OR
  `EXPONENTIAL_WITH_JITTER`.
- **Retry Backoff (ms)**: The time in milliseconds to wait following an error before the connector retries the task.
- **Retry HTTP Status Codes**: The HTTP response status codes
  returned that prompt the connector to retry the request. Enter a
  comma- separated list of codes or range of codes. Ranges are
  specified with a start and optional end code. Range boundaries are
  inclusive. For example: `400-` includes all codes greater than
  or equal to `400` and `400-500` includes codes from 400 to
  500, including 500. Multiple ranges and single codes can be
  specified together to achieve fine-grained control over retry
  behavior. For example: `404,408,500-` prompts the connector to
  retry on `404 NOT FOUND`, `408 REQUEST TIMEOUT`, and all
  `5xx` error codes. Note that some status codes are always
  retried, such as unauthorized, timeouts, and too many requests.

**Connection configurations**

- **Connect timeout (milliseconds)**: Timeout for the connection to the Google Cloud Functions. Default is `30000` ms.
- **Request timeout (milliseconds)**: Timeout for the request to the Google Cloud Functions. Default is `30000` ms.

**Transforms**

- **Single Message Transformations**: To add a new SMT, see [Add transforms](single-message-transforms.md#cc-single-message-transforms-ui).
  For more information about unsupported SMTs, see
  [Unsupported transformations](single-message-transforms.md#cc-single-message-transforms-unsupported-transforms).

**Processing position**

- **Set offsets**: Click **Set offsets** to define a specific offset for
  this connector to begin procession data from. For more information
  on managing offsets, see [Manage offsets](offsets.md#connect-custom-offsets).

For all property values and definitions, see
[Configuration Properties](#cc-google-cloud-functions-gen2-sink-config-properties).

- Click **Continue**.

### Sizing

Based on the number of topic partitions you select, you will be provided
with a recommended number of tasks.

1. To change the number of recommended tasks, enter the number of
   [tasks](/platform/current/connect/concepts.html#tasks) for the connector to use
   in the **Tasks** field.
2. Click **Continue**.

### Review and Launch

1. Verify the connection details.
2. Click **Continue**.

   The status for the connector should go from **Provisioning** to
   **Running**.

#### Step 5: Check for records

Verify that records are being produced at the endpoint.

For more information and examples to use with the Confluent Cloud API for Connect,
see the [Confluent Cloud API for Connect Usage Examples](connect-api-section.md#ccloud-connect-api) section.

### Using the Confluent CLI

To set up and run the connector using the Confluent CLI, complete the
following steps, but ensure you have met all [prerequisites](#cc-google-cloud-functions-gen2-sink-prereqs).

#### Step 1: List the available connectors

Enter the following command to list available connectors:

```none
confluent connect plugin list
```

#### Step 2: List the connector configuration properties

Enter the following command to show the connector configuration properties:

```none
confluent connect plugin describe <connector-plugin-name>
```

The command output shows the required and optional configuration properties.

<a id="cc-google-cloud-functions-gen2-sink-cli-configuration-file"></a>

#### Step 3: Create the connector configuration file

Create a JSON file that contains the connector configuration properties. The
following example shows the required connector properties.

```json
{
  "topics": "topic_0",
  "schema.context.name": "default",
  "input.data.format": "JSON",
  "connector.class": "GoogleCloudFunctionsGen2Sink",
  "name": "GoogleCloudFunctionsGen2SinkConnector_0",
  "kafka.auth.mode": "KAFKA_API_KEY",
  "kafka.api.key": "****************",
  "kafka.api.secret": "****************************************************************",
  "max.poll.interval.ms": "300000",
  "max.poll.records": "500",
  "tasks.max": "1",
  "gcf.auth.type": "Google Cloud Service Account",
  "gcp.credentials.json": "*\n*************************\n",
  "behavior.on.error": "FAIL",
  "max.retries": "5",
  "retry.backoff.policy": "EXPONENTIAL_WITH_JITTER",
  "retry.backoff.ms": "3000",
  "retry.on.status.codes": "401,429,500-",
  "gcf.connect.timeout.ms": "30000",
  "gcf.request.timeout.ms": "30000",
  "behavior.on.null.values": "IGNORE",
  "gcf.name": "function-1",
  "gcf.region.name": "us-central1",
  "gcf.project.id": "connect-2024",
  "max.batch.size": "1",
  "batch.json.as.array": "false"
}
```

Note the following property definitions:

* `"connector.class"`: Identifies the connector plugin name.
* `"input.data.format"`:  Sets the input Kafka record value format (data coming
  from the Kafka topic). Valid entries are **AVRO**, **JSON_SR**, **PROTOBUF**,
  or **JSON**. You must have Confluent Cloud Schema Registry configured if using a schema-based
  message format (for example, Avro, JSON Schema or Protobuf).

* `"kafka.auth.mode"`: Identifies the connector authentication mode you want to use. There are two options: `SERVICE_ACCOUNT` or `KAFKA_API_KEY` (the default). To use an API key and secret, specify the configuration properties `kafka.api.key` and `kafka.api.secret`, as shown in the example configuration (above).  To use a [service account](service-account.md#s3-cloud-service-account), specify the **Resource ID** in the property `kafka.service.account.id=<service-account-resource-ID>`. To list the available service account resource IDs, use the following command:
  ```bash
  confluent iam service-account list
  ```

  For example:
  ```bash
  confluent iam service-account list

     Id     | Resource ID |       Name        |    Description
  +---------+-------------+-------------------+-------------------
     123456 | sa-l1r23m   | sa-1              | Service account 1
     789101 | sa-l4d56p   | sa-2              | Service account 2
  ```

* `"name"`: Sets a name for your new connector.
* `"topics"`: Identifies the topic name or a comma-separated list of topic names.
* `"tasks.max"`: Enter the maximum number of
  [tasks](/platform/current/connect/concepts.html#tasks) for the connector to use. More
  tasks might improve performance.
* `"gcf.name"`: Name of the function to be invoked.
* `"gcf.region.name"`: Region of the given function to be invoked as in ‘[https:/](https:/)/<region-name>-<project-id>.cloudfunctions.net/’.
* `"gcf.project.id"`: Project ID for the given function to be invoked as in ‘[https:/](https:/)/<region-name>-<project-id>.cloudfunctions.net/’.
* `"gcf.auth.type"`: Authentication type for the given function. Currently the connector supports Google Cloud Service Account authentication and unauthorized invocation.

#### NOTE
To enable CSFLE or CSPE for data encryption, specify the following properties:

* `csfle.enabled`: Flag to indicate whether the connector honors CSFLE or CSPE rules.
* `sr.service.account.id`: A Service Account to access the Schema Registry and associated encryption rules or keys with that schema.
* `csfle.onFailure`: Configures the connector behavior (`ERROR` or `NONE`) on data decryption failure.
  If set to `ERROR`, the connector fails and writes the encrypted data
  in the DLQ. If set to `NONE`, the connector writes the encrypted data in the target system without decryption.

When using CSFLE or CSPE with connectors that route failed messages to a Dead Letter Queue (DLQ),
be aware that data sent to the DLQ is written in unencrypted plaintext. This poses
a significant security risk as sensitive data that should be encrypted may be exposed in the DLQ.

Do not use DLQ with CSFLE or CSPE in the current version. If you need error handling for
CSFLE- or CSPE-enabled data, use alternative approaches such as:

* Setting the connector behavior to `ERROR` to throw exceptions instead of routing to DLQ
* Implementing custom error handling in your applications
* Using `NONE` to pass encrypted data through without decryption

For more information on CSFLE or CSPE setup, see [Manage encryption for connectors](csfle.md#connect-csfle).

**SMTs**: For details about adding SMTs using the Confluent CLI, see
the [Single Message Transformations](single-message-transforms.md#cc-single-message-transforms)
documentation. For all property values and descriptions, see
[Configuration Properties](#cc-google-cloud-functions-gen2-sink-config-properties).

#### Step 4: Load the properties file and create the connector

To load the configuration and start the connector, run the following Confluent CLI command:

```none
confluent connect cluster create --config-file <file-name>.json
```

For example:

```none
confluent connect cluster create --config-file google-cloud-functions-gen2-sink-config.json
```

Example output:

```none
Created connector GoogleCloudFunctionsGen2SinkConnector_0 lcc-do6vzd
```

#### Step 5: Check the connector status.

To check the connector status, run the following Confluent CLI command:

```none
confluent connect cluster list
```

Example output:

```none
ID           |             Name                           | Status  | Type | Trace |
+------------+--------------------------------------------+---------+------+-------+
lcc-do6vzd   | GoogleCloudFunctionsGen2SinkConnector_0    | RUNNING | sink |       |
```

#### Step 6: Check for records

Verify that records are populating the endpoint.

For more information and examples to use with the Confluent Cloud API for Connect,
see the [Confluent Cloud API for Connect Usage Examples](connect-api-section.md#ccloud-connect-api) section.

<a id="cc-google-cloud-functions-gen2-sink-legacy-v2-migration"></a>

## Legacy to Gen 2 Connector Migration

Use the following steps to migrate to Gen 2 connector. Implement and validate any
connector changes in a pre-production environment before promoting to
production.

1. Pause the Gen 1 connector.
2. Get the [offset](https://docs.confluent.io/cloud/current/ccloud/get-connectv-1-connector-offsets/) for the Gen 1 connector.
3. Create the Gen 2 connector using the offset from the previous step.
   ```none
   confluent connect cluster create [flags]
   ```

   For example:

   Create a configuration file with connector configs and offsets.
   ```none
   {
     "name": "(connector-name)",
     "config": {
         ... // connector specific configuration
     },
     "offsets": [
         {
             "partition": {
         ... // connector specific configuration
             },
             "offset": {
         ... // connector specific configuration
             }
         }
     ]
   }
   ```

   Create a Gen 2 connector in the current or specified Kafka cluster context.
   ```none
   confluent connect cluster create --config-file config.json
   ```

   #### NOTE
   The configuration payload differs between Gen 1 and Gen 2 connectors. In the Gen 2 connector,
   the value field contains only the value of the key-value pair and does not include the key,
   topic, partition, and offset. Make necessary changes in the Gen 2 connector to match the
   configurations from the Gen 1 connector.
4. Verify the migration and confirm that the connector is running successfully with the Gen 1 payloads.
5. Enable cross-cloud support in Gen 2 connector, in case the function and Kafka cluster are in different regions.
   For more information, contact Confluent account team or [Confluent Support](https://support.confluent.io/).
6. [Delete](https://docs.confluent.io/cloud/current/ccloud/delete-connectv-1-connector/) the Gen 1 connector.

For more information, see [Manage Offsets for Fully Managed Connectors in Confluent Cloud](offsets.md#connect-custom-offsets).

<a id="cc-google-cloud-functions-gen2-sink-config-properties"></a>

## Configuration Properties

Use the following configuration properties with the fully managed Google Cloud Functions Gen 2 Sink
connector.

### Which topics do you want to get data from?

`topics`
: Identifies the topic name or a comma-separated list of topic names.
  <br/>
  * Type: list
  * Importance: high

`errors.deadletterqueue.topic.name`
: The name of the topic to be used as the dead letter queue (DLQ) for messages that result in an error when processed by this sink connector, or its transformations or converters. Defaults to ‘dlq-${connector}’ if not set. The DLQ topic will be created automatically if it does not exist. You can provide `${connector}` in the value to use it as a placeholder for the logical cluster ID.
  <br/>
  * Type: string
  * Default: dlq-${connector}
  * Importance: low

`reporter.result.topic.name`
: The name of the topic to produce records to after successfully processing a sink record. Defaults to ‘success-${connector}’ if not set. You can provide `${connector}` in the value to use it as a placeholder for the logical cluster ID.
  <br/>
  * Type: string
  * Default: success-${connector}
  * Importance: low

`reporter.error.topic.name`
: The name of the topic to produce records to after each unsuccessful record sink attempt. Defaults to ‘error-${connector}’ if not set. You can provide `${connector}` in the value to use it as a placeholder for the logical cluster ID.
  <br/>
  * Type: string
  * Default: error-${connector}
  * Importance: low

### Schema Config

`schema.context.name`
: Add a schema context name. A schema context represents an independent scope in Schema Registry. It is a separate sub-schema tied to topics in different Kafka clusters that share the same Schema Registry instance. If not used, the connector uses the default schema configured for Schema Registry in your Confluent Cloud environment.
  <br/>
  * Type: string
  * Default: default
  * Importance: medium

### Input messages

`input.data.format`
: Sets the input Kafka record value format. Valid entries are AVRO, JSON_SR, PROTOBUF, JSON or BYTES. Note that you need to have Confluent Cloud Schema Registry configured if using a schema-based message format like AVRO, JSON_SR, and PROTOBUF.
  <br/>
  * Type: string
  * Default: JSON
  * Importance: high

### How should we connect to your data?

`name`
: Sets a name for your connector.
  <br/>
  * Type: string
  * Valid Values: A string at most 64 characters long
  * Importance: high

### Kafka Cluster credentials

`kafka.auth.mode`
: Kafka Authentication mode. It can be one of KAFKA_API_KEY or SERVICE_ACCOUNT. It defaults to KAFKA_API_KEY mode, whenever possible.
  <br/>
  * Type: string
  * Valid Values: SERVICE_ACCOUNT, KAFKA_API_KEY
  * Importance: high

`kafka.api.key`
: Kafka API Key. Required when kafka.auth.mode==KAFKA_API_KEY.
  <br/>
  * Type: password
  * Importance: high

`kafka.service.account.id`
: The Service Account that will be used to generate the API keys to communicate with Kafka Cluster.
  <br/>
  * Type: string
  * Importance: high

`kafka.api.secret`
: Secret associated with Kafka API key. Required when kafka.auth.mode==KAFKA_API_KEY.
  <br/>
  * Type: password
  * Importance: high

### Consumer configuration

`max.poll.interval.ms`
: The maximum delay between subsequent consume requests to Kafka. This configuration property may be used to improve the performance of the connector, if the connector cannot send records to the sink system. Defaults to 300000 milliseconds (5 minutes).
  <br/>
  * Type: long
  * Default: 300000 (5 minutes)
  * Valid Values: [60000,…,1800000] for non-dedicated clusters and [60000,…] for dedicated clusters
  * Importance: low

`max.poll.records`
: The maximum number of records to consume from Kafka in a single request. This configuration property may be used to improve the performance of the connector, if the connector cannot send records to the sink system. Defaults to 500 records.
  <br/>
  * Type: long
  * Default: 500
  * Valid Values: [1,…,500] for non-dedicated clusters and [1,…] for dedicated clusters
  * Importance: low

### Number of tasks for this connector

`tasks.max`
: Maximum number of tasks for the connector.
  <br/>
  * Type: int
  * Valid Values: [1,…]
  * Importance: high

### Authentication

`gcf.auth.type`
: Authentication method of the connector. Valid values are `None`, `Google Cloud Service Account`.
  <br/>
  * Type: string
  * Default: Google Cloud Service Account
  * Importance: high

`gcp.credentials.json`
: GCP service account JSON file.
  <br/>
  * Type: password
  * Importance: high

`gcf.ssl.enabled`
: Determine whether the connection to the endpoint should use SSL.
  <br/>
  * Type: boolean
  * Default: false
  * Importance: medium

`gcf.ssl.keystorefile`
: The keystore that contains the client certificate and private key. Supported formats are JKS or PKCS12. File system paths are not supported.
  <br/>
  * Type: password
  * Default: [hidden]
  * Importance: low

`gcf.ssl.keystore.password`
: The store password for the key store file.
  <br/>
  * Type: password
  * Importance: high

`gcf.ssl.key.password`
: The password for the private key in the key store file.
  <br/>
  * Type: password
  * Importance: high

`gcf.ssl.truststorefile`
: The truststore that contains the server CA certificate(s). Supported formats are JKS or PKCS12. File system paths are not supported.
  <br/>
  * Type: password
  * Default: [hidden]
  * Importance: high

`gcf.ssl.truststore.password`
: The trust store password containing a server CA certificate.
  <br/>
  * Type: password
  * Importance: high

`gcf.ssl.protocol`
: The protocol to use for SSL connections.
  <br/>
  * Type: string
  * Default: TLSv1.3
  * Importance: medium

### Behavior on error

`behavior.on.error`
: Error handling behavior setting for handling error response from HTTP requests.
  <br/>
  * Type: string
  * Default: FAIL
  * Importance: low

### Retry configurations

`max.retries`
: The maximum number of times to retry on errors before failing the task.
  <br/>
  * Type: int
  * Default: 5
  * Importance: medium

`retry.backoff.policy`
: The backoff policy to use in terms of retry - CONSTANT_VALUE or EXPONENTIAL_WITH_JITTER
  <br/>
  * Type: string
  * Default: EXPONENTIAL_WITH_JITTER
  * Importance: medium

`retry.backoff.ms`
: The initial duration in milliseconds to wait following an error before a retry attempt is made. Subsequent backoff attempts can be a constant value or exponential with jitter (can be configured using retry.backoff.policy parameter). Jitter adds randomness to the exponential backoff algorithm to prevent synchronized retries.
  <br/>
  * Type: int
  * Default: 3000 (3 seconds)
  * Valid Values: [100,…]
  * Importance: medium

`retry.on.status.codes`
: Comma-separated list of HTTP status codes or range of codes to retry on. Ranges are specified with start and optional end code. Range boundaries are inclusive. For instance, 400- includes all codes greater than or equal to 400. 400-500 includes codes from 400 to 500, including 500. Multiple ranges and single codes can be specified together to achieve fine-grained control over retry behavior. For example, 404,408,500- will retry on 404 NOT FOUND, 408 REQUEST TIMEOUT, and all 5xx error codes. Note that some status codes will always be retried, such as unauthorized, timeouts and too many requests.
  <br/>
  * Type: string
  * Default: 401,429,500-
  * Importance: medium

### Connection configurations

`gcf.connect.timeout.ms`
: The time in milliseconds to wait for a connection to be established
  <br/>
  * Type: int
  * Default: 30000 (30 seconds)
  * Valid Values: [1000,…,600000]
  * Importance: medium

`gcf.request.timeout.ms`
: The time in milliseconds to wait for a request response from the server
  <br/>
  * Type: int
  * Default: 30000 (30 seconds)
  * Valid Values: [1000,…,600000]
  * Importance: medium

### Behavior on records

`behavior.on.null.values`
: How to handle records with a non-null key and a null value (i.e. Kafka tombstone records). Valid options are `IGNORE` and `FAIL`
  <br/>
  * Type: string
  * Default: IGNORE
  * Importance: low

### Google Cloud Functions configurations

`gcf.name`
: The name of the function to invoke. You don’t need to set this if you use the Custom URL option.
  <br/>
  * Type: string
  * Importance: high

`gcf.region.name`
: The region where the function is located (for example, in the URL: [https:/](https:/)/<region-name>-<project-id>.cloudfunctions.net/.)
  <br/>
  * Type: string
  * Importance: high

`gcf.project.id`
: The Project ID for the function to invoke (for example, in the URL: [https:/](https:/)/<region-name>-<project-id>.cloudfunctions.net/). You don’t need to set this if you use the Custom URL option.
  <br/>
  * Type: string
  * Importance: high

`gcf.custom.url.enabled`
: Set to true to use a custom URL for the Google Cloud Function instead of [https:/](https:/)/<region-name>-<project-id>.cloudfunctions.net/<function-name>.
  <br/>
  * Type: boolean
  * Default: false
  * Importance: medium

`gcf.custom.url`
: The custom URL for the Google Cloud Function to invoke instead of [https:/](https:/)/<region-name>-<project-id>.cloudfunctions.net/<function-name>. Note that you must set `enable.custom.url` to `true`. Do not append a trailing slash (/); the connector automatically appends it for proper path resolution.
  <br/>
  * Type: string
  * Importance: medium

`gcf.audience.url`
: The audience URL the connector uses to generate the token sent in the Authorization header. If you do not set this, the connector uses the custom URL as the audience. Note that you must set `gcf.custom.url.enabled` to `true`. Do not append a trailing slash (/).
  <br/>
  * Type: string
  * Default: “”
  * Importance: medium

### Batch configurations

`max.batch.size`
: The number of records accumulated in a batch before the Google Cloud Functions API is invoked
  <br/>
  * Type: int
  * Default: 1
  * Importance: high

`batch.json.as.array`
: Whether or not to use an array to bundle json records. Setting this to true will send records as json array.
  <br/>
  * Type: boolean
  * Default: false
  * Importance: high

`report.only.status.code.to.success.topic`
: Whether to report only the status code to the success topic. If the API response payload is huge, it is recommended to set this to true, for better throughput.
  <br/>
  * Type: boolean
  * Default: false
  * Importance: medium

### Additional Configs

`consumer.override.auto.offset.reset`
: Defines the behavior of the consumer when there is no committed position (which occurs when the group is first initialized) or when an offset is out of range. You can choose either to reset the position to the “earliest” offset (the default) or the “latest” offset. You can also select “none” if you would rather set the initial offset yourself and you are willing to handle out of range errors manually. More details: [https://docs.confluent.io/platform/current/installation/configuration/consumer-configs.html#auto-offset-reset](https://docs.confluent.io/platform/current/installation/configuration/consumer-configs.html#auto-offset-reset)
  <br/>
  * Type: string
  * Importance: low

`consumer.override.isolation.level`
: Controls how to read messages written transactionally. If set to read_committed, consumer.poll() will only return transactional messages which have been committed. If set to read_uncommitted (the default), consumer.poll() will return all messages, even transactional messages which have been aborted. Non-transactional messages will be returned unconditionally in either mode.  More details: [https://docs.confluent.io/platform/current/installation/configuration/consumer-configs.html#isolation-level](https://docs.confluent.io/platform/current/installation/configuration/consumer-configs.html#isolation-level)
  <br/>
  * Type: string
  * Importance: low

`header.converter`
: The converter class for the headers. This is used to serialize and deserialize the headers of the messages.
  <br/>
  * Type: string
  * Importance: low

`key.converter.use.schema.guid`
: The schema GUID to use for deserialization when using ConfigSchemaIdDeserializer. This allows you to specify a fixed schema GUID to be used for deserializing message keys. Only applicable when key.converter.key.schema.id.deserializer is set to ConfigSchemaIdDeserializer.
  <br/>
  * Type: string
  * Importance: low

`key.converter.use.schema.id`
: The schema ID to use for deserialization when using ConfigSchemaIdDeserializer. This allows you to specify a fixed schema ID to be used for deserializing message keys. Only applicable when key.converter.key.schema.id.deserializer is set to ConfigSchemaIdDeserializer.
  <br/>
  * Type: int
  * Importance: low

`value.converter.allow.optional.map.keys`
: Allow optional string map key when converting from Connect Schema to Avro Schema. Applicable for Avro Converters.
  <br/>
  * Type: boolean
  * Importance: low

`value.converter.auto.register.schemas`
: Specify if the Serializer should attempt to register the Schema.
  <br/>
  * Type: boolean
  * Importance: low

`value.converter.connect.meta.data`
: Allow the Connect converter to add its metadata to the output schema. Applicable for Avro Converters.
  <br/>
  * Type: boolean
  * Importance: low

`value.converter.enhanced.avro.schema.support`
: Enable enhanced schema support to preserve package information and Enums. Applicable for Avro Converters.
  <br/>
  * Type: boolean
  * Importance: low

`value.converter.enhanced.protobuf.schema.support`
: Enable enhanced schema support to preserve package information. Applicable for Protobuf Converters.
  <br/>
  * Type: boolean
  * Importance: low

`value.converter.flatten.unions`
: Whether to flatten unions (oneofs). Applicable for Protobuf Converters.
  <br/>
  * Type: boolean
  * Importance: low

`value.converter.generate.index.for.unions`
: Whether to generate an index suffix for unions. Applicable for Protobuf Converters.
  <br/>
  * Type: boolean
  * Importance: low

`value.converter.generate.struct.for.nulls`
: Whether to generate a struct variable for null values. Applicable for Protobuf Converters.
  <br/>
  * Type: boolean
  * Importance: low

`value.converter.int.for.enums`
: Whether to represent enums as integers. Applicable for Protobuf Converters.
  <br/>
  * Type: boolean
  * Importance: low

`value.converter.latest.compatibility.strict`
: Verify latest subject version is backward compatible when use.latest.version is true.
  <br/>
  * Type: boolean
  * Importance: low

`value.converter.object.additional.properties`
: Whether to allow additional properties for object schemas. Applicable for JSON_SR Converters.
  <br/>
  * Type: boolean
  * Importance: low

`value.converter.optional.for.nullables`
: Whether nullable fields should be specified with an optional label. Applicable for Protobuf Converters.
  <br/>
  * Type: boolean
  * Importance: low

`value.converter.optional.for.proto2`
: Whether proto2 optionals are supported. Applicable for Protobuf Converters.
  <br/>
  * Type: boolean
  * Importance: low

`value.converter.scrub.invalid.names`
: Whether to scrub invalid names by replacing invalid characters with valid characters. Applicable for Avro and Protobuf Converters.
  <br/>
  * Type: boolean
  * Importance: low

`value.converter.use.latest.version`
: Use latest version of schema in subject for serialization when auto.register.schemas is false.
  <br/>
  * Type: boolean
  * Importance: low

`value.converter.use.optional.for.nonrequired`
: Whether to set non-required properties to be optional. Applicable for JSON_SR Converters.
  <br/>
  * Type: boolean
  * Importance: low

`value.converter.use.schema.guid`
: The schema GUID to use for deserialization when using ConfigSchemaIdDeserializer. This allows you to specify a fixed schema GUID to be used for deserializing message values. Only applicable when value.converter.value.schema.id.deserializer is set to ConfigSchemaIdDeserializer.
  <br/>
  * Type: string
  * Importance: low

`value.converter.use.schema.id`
: The schema ID to use for deserialization when using ConfigSchemaIdDeserializer. This allows you to specify a fixed schema ID to be used for deserializing message values. Only applicable when value.converter.value.schema.id.deserializer is set to ConfigSchemaIdDeserializer.
  <br/>
  * Type: int
  * Importance: low

`value.converter.wrapper.for.nullables`
: Whether nullable fields should use primitive wrapper messages. Applicable for Protobuf Converters.
  <br/>
  * Type: boolean
  * Importance: low

`value.converter.wrapper.for.raw.primitives`
: Whether a wrapper message should be interpreted as a raw primitive at root level. Applicable for Protobuf Converters.
  <br/>
  * Type: boolean
  * Importance: low

`errors.tolerance`
: Use this property if you would like to configure the connector’s error handling behavior. WARNING: This property should be used with CAUTION for SOURCE CONNECTORS as it may lead to dataloss. If you set this property to ‘all’, the connector will not fail on errant records, but will instead log them (and send to DLQ for Sink Connectors) and continue processing. If you set this property to ‘none’, the connector task will fail on errant records.
  <br/>
  * Type: string
  * Default: all
  * Importance: low

`key.converter.key.schema.id.deserializer`
: The class name of the schema ID deserializer for keys. This is used to deserialize schema IDs from the message headers.
  <br/>
  * Type: string
  * Default: io.confluent.kafka.serializers.schema.id.DualSchemaIdDeserializer
  * Importance: low

`key.converter.key.subject.name.strategy`
: How to construct the subject name for key schema registration.
  <br/>
  * Type: string
  * Default: TopicNameStrategy
  * Importance: low

`value.converter.decimal.format`
: Specify the JSON/JSON_SR serialization format for Connect DECIMAL logical type values with two allowed literals:
  <br/>
  BASE64 to serialize DECIMAL logical types as base64 encoded binary data and
  <br/>
  NUMERIC to serialize Connect DECIMAL logical type values in JSON/JSON_SR as a number representing the decimal value.
  <br/>
  * Type: string
  * Default: BASE64
  * Importance: low

`value.converter.flatten.singleton.unions`
: Whether to flatten singleton unions. Applicable for Avro and JSON_SR Converters.
  <br/>
  * Type: boolean
  * Default: false
  * Importance: low

`value.converter.ignore.default.for.nullables`
: When set to true, this property ensures that the corresponding record in Kafka is NULL, instead of showing the default column value. Applicable for AVRO,PROTOBUF and JSON_SR Converters.
  <br/>
  * Type: boolean
  * Default: false
  * Importance: low

`value.converter.reference.subject.name.strategy`
: Set the subject reference name strategy for value. Valid entries are DefaultReferenceSubjectNameStrategy or QualifiedReferenceSubjectNameStrategy. Note that the subject reference name strategy can be selected only for PROTOBUF format with the default strategy being DefaultReferenceSubjectNameStrategy.
  <br/>
  * Type: string
  * Default: DefaultReferenceSubjectNameStrategy
  * Importance: low

`value.converter.replace.null.with.default`
: Whether to replace fields that have a default value and that are null to the default value. When set to true, the default value is used, otherwise null is used. Applicable for JSON Converter.
  <br/>
  * Type: boolean
  * Default: true
  * Importance: low

`value.converter.schemas.enable`
: Include schemas within each of the serialized values. Input messages must contain schema and payload fields and may not contain additional fields. For plain JSON data, set this to false. Applicable for JSON Converter.
  <br/>
  * Type: boolean
  * Default: false
  * Importance: low

`value.converter.value.schema.id.deserializer`
: The class name of the schema ID deserializer for values. This is used to deserialize schema IDs from the message headers.
  <br/>
  * Type: string
  * Default: io.confluent.kafka.serializers.schema.id.DualSchemaIdDeserializer
  * Importance: low

`value.converter.value.subject.name.strategy`
: Determines how to construct the subject name under which the value schema is registered with Schema Registry.
  <br/>
  * Type: string
  * Default: TopicNameStrategy
  * Importance: low

### Auto-restart policy

`auto.restart.on.user.error`
: Enable connector to automatically restart on user-actionable errors.
  <br/>
  * Type: boolean
  * Default: true
  * Importance: medium

<a id="cc-google-cloud-functions-gen2-sink-faq"></a>

## Frequently asked questions

Find answers to frequently asked questions about the Google Cloud Functions Gen 2 Sink connector for Confluent Cloud.

### Deployment model and product fit

#### Can the Google Cloud Functions Gen 2 Sink connector run on a self-managed Kafka Connect cluster?

No. The Google Cloud Functions Gen 2 Sink connector is available only as a fully managed connector on Confluent Cloud.
You cannot download it for self-managed environments.

### Migration from Gen 1 to Gen 2

#### What are the key differences between Gen 1 and Gen 2 connector payloads?

The Gen 2 connector has significant payload format differences compared to Gen 1:

* **Payload structure**: In Gen 2, the value field contains only the value of the key-value pair and does not include the key, topic, partition, and offset metadata that was present in Gen 1.
* **Metadata handling**: Gen 1 included metadata fields in the payload sent to the function. In Gen 2, this metadata is not included by default in the payload structure.

**Impact**: If your Google Cloud Function expects the Gen 1 payload format, you must update the function code to handle the Gen 2 payload structure before migration.

**Resolution**: Review and update your function implementation to parse the Gen 2 payload format. Test thoroughly in a non-production environment before migrating production connectors.

#### Why do errors occur about deprecated configuration parameters during migration?

When migrating from Gen 1 to Gen 2, certain configuration parameters are deprecated or renamed:

* Some Gen 1 configuration parameters are no longer supported in Gen 2.
* Configuration parameter names can change between versions.
* New required parameters can be introduced in Gen 2.

**Resolution**:

1. Review the [configuration properties](#cc-google-cloud-functions-gen2-sink-config-properties) for the Gen 2 connector.
2. Update your connector configuration to use the Gen 2 parameter names and remove any deprecated Gen 1 parameters.
3. Follow the [migration guide](#cc-google-cloud-functions-gen2-sink-legacy-v2-migration) for detailed steps.
4. Test the migration in a development environment before applying to production.

#### Does cross-region support need to be enabled when migrating from Gen 1 to Gen 2?

Yes. If the Google Cloud Function and Apache Kafka® cluster are in different regions, enable cross-region support in the Gen 2 connector. By default, cross-region access is disabled.

**Resolution**:

1. Contact [Confluent Support](https://support.confluent.io/) to enable cross-region support.
2. Ensure cross-region support is enabled before completing the migration to avoid connectivity issues.

For more information, see the [cross-region limitations](#cc-google-cloud-functions-gen2-sink-prereqs).

### Provisioning and infrastructure

#### Why does a connector get stuck in a provisioning loop when using Terraform?

When deploying the Gen 2 connector using Terraform, the connector can get stuck in a `PROVISIONING` state and fail to reach `RUNNING` status.

**Common causes**:

* **Configuration errors**: Invalid or missing required configuration parameters.
* **Cross-region access**: Attempting to connect to a function in a different region without cross-region support enabled.
* **Authentication issues**: Invalid or insufficient Google Cloud service account credentials.
* **Resource dependencies**: The connector is created before dependent resources such as topics or service accounts are fully provisioned.

**Resolution**:

1. Check the connector error logs in the Confluent Cloud Console for specific error messages.
2. Verify all required configuration parameters are correctly set.
3. Ensure the Google Cloud service account has the necessary permissions such as `cloudfunctions.functions.invoke`.
4. If using cross-region connectivity, contact support to enable this feature.
5. When using Terraform, add proper `depends_on` clauses to ensure resources are created in the correct order.
6. Delete and recreate the connector after fixing configuration issues, as some errors cannot resolve without recreating the resource.

### Authentication and permissions

#### What permissions does the Google Cloud service account need?

The Google Cloud service account used by the connector requires the following IAM permissions:

* `cloudfunctions.functions.invoke`: Required to invoke the Google Cloud Function.

**Best practice**: Create a dedicated service account for the connector with only the required permissions.

**Resolution**:

1. In the Google Cloud Console, create or identify the service account for the connector.
2. Grant the service account the `Cloud Functions Invoker` role on the target function.
3. Download the service account JSON key and provide it in the connector’s `gcp.credentials.json` configuration parameter.

For more information about service account authentication, see the [Google Cloud IAM documentation](https://cloud.google.com/iam/docs/service-accounts).

#### Why do authentication errors occur even with valid credentials?

If you receive authentication errors despite having valid credentials, verify the following:

* **Service account key format**: Ensure the entire JSON key file content (including newlines) is correctly provided in the `gcp.credentials.json` configuration parameter.
* **Function URL permissions**: Verify the service account has permissions on the specific function (not just project-level permissions).
* **Token expiration**: Service account tokens may need to be refreshed. The connector handles this automatically, but initial configuration issues can cause problems.
* **Authentication type mismatch**: Ensure `gcf.auth.type` is set to `Google Cloud Service Account` when using service account credentials.

**Resolution**:

1. Verify the service account JSON key is valid by testing it with the `gcloud` CLI.
2. Ensure the `gcp.credentials.json` configuration parameter contains the complete, properly formatted JSON key.
3. Confirm the service account has the `Cloud Functions Invoker` role on the target function.

### Connectivity and networking

#### Why does the connector fail to reach the Google Cloud Function?

Connectivity issues typically occur due to network configuration or cross-region limitations.

**Common causes**:

* **Region mismatch**: The connector can only access functions in the same region as the Confluent Cloud cluster by default.
* **Cross-region access disabled**: Cross-region access is disabled by default and must be enabled by Confluent support.
* **VPC/Firewall restrictions**: If the function is restricted by VPC Service Controls or firewall rules, the connector cannot reach it.

**Resolution**:

1. Verify the Google Cloud Function is in the same region as the Confluent Cloud cluster.
2. If cross-region access is required, contact the Confluent account team or [Confluent Support](https://support.confluent.io/) to enable this feature.
3. Ensure the function is not restricted by VPC Service Controls that would block access from Confluent Cloud.
4. Check Google Cloud Function logs for connection attempts and errors.

#### Can this connector work with Cloud Run instead of Google Cloud Functions?

Yes. The connector supports custom URL configuration to connect with [Cloud Run](https://cloud.google.com/run/docs).

**Resolution**:

1. Set `gcf.custom.url.enabled` to `true`.
2. Set `gcf.custom.url` to the Cloud Run service URL.
3. Set `gcf.audience.url` to the same Cloud Run service URL.
4. Ensure the service account has the necessary permissions to invoke the Cloud Run service.

For more information about Cloud Run authentication, see [Authenticating service-to-service](https://cloud.google.com/run/docs/authenticating/service-to-service).

### Error handling and retries

#### How does the connector handle errors when invoking the function?

The connector provides configurable error handling and retry mechanisms:

* **behavior.on.error**: Controls what happens when an error occurs. Options include:
  - `FAIL`: Stop the connector on error. This is the default.
  - `IGNORE`: Continue processing and skip the failed record.
* **Retry configuration**: Configure automatic retries with exponential back-off:
  - `max.retries`: Max number of retry attempts. Default is `5`.
  - `retry.backoff.policy`: Back-off strategy. Use `EXPONENTIAL_WITH_JITTER` for best results.
  - `retry.backoff.ms`: Initial back-off time in milliseconds. Default is `3000`.
  - `retry.on.status.codes`: HTTP status codes to retry such as `401,429,500-`.

**Resolution**:

1. Configure `behavior.on.error` based on data consistency requirements.
2. Adjust retry settings based on the function’s expected error patterns.
3. Consider implementing a Dead Letter Queue topic to capture failed records for later analysis.

For more information, see [View Connector Dead Letter Queue Errors in Confluent Cloud](dead-letter-queue.md#ccloud-dlq-topics).

#### What HTTP status codes should be configured for retries?

Configure retries for transient errors that can succeed on retry.

**Retry status codes**:

* `401`: Unauthorized - can be transient authentication token issues.
* `429`: Too Many Requests - rate limiting.
* `500-`: Server errors in the 500-599 range.
* `503`: Service Unavailable.

**Do not retry**:

* `400`: Bad Request - indicates a data problem that retrying does not fix.
* `403`: Forbidden - indicates a permissions problem.
* `404`: Not Found - indicates configuration problem.

**Resolution**: Use the `retry.on.status.codes` configuration parameter. For example: `401,429,500-`.

## Next Steps

For an example that shows fully managed Confluent Cloud connectors in action with
Confluent Cloud for Apache Flink, see the [Cloud ETL Demo](/platform/current/tutorials/examples/cloud-etl/docs/index.html).
This example also shows how to use Confluent CLI to manage your resources in
Confluent Cloud.

[![image](images/topology.png)](https://docs.confluent.io/platform/current/tutorials/examples/cloud-etl/docs/index.html)