<a id="c3-ccloud-bootstrap"></a>

# Use Confluent Cloud as the bootstrap cluster for Confluent Control Center

If you use self-managed Kafka Connect or ksqlDB clusters to move data
between Confluent Cloud and on-premises systems, you can use Control Center with a
Confluent Cloud bootstrap Kafka cluster to manage them.

#### IMPORTANT
This configuration is supported only in
[Reduced infrastructure mode](../overview.md#reduced-infra-mode), which you
set with `confluent.controlcenter.mode.enable=management`.
Control Center doesn’t collect metrics or display monitoring data for
a Confluent Cloud bootstrap cluster.

On Confluent for Kubernetes, omit `spec.services` and the `prometheusClient` and
`alertManagerClient` dependencies, and set the properties in the following
section under `spec.configOverrides.server`. CFK then deploys Control Center
without Prometheus or Alertmanager. Ansible-based deployments install and start
Prometheus and Alertmanager on the Control Center host even in this
configuration. These components remain unused. Override
`confluent.controlcenter.prometheus.enable` to `false` in
`control_center_next_gen_custom_properties`.

## Configure Control Center to use Confluent Cloud

To configure Control Center to use Confluent Cloud as the bootstrap cluster, set the
following properties in `control-center.properties`:

```none
# Confluent Cloud bootstrap cluster
bootstrap.servers=<ccloud_bootstrap_server>:9092

# Required: Run in Reduced infrastructure mode
confluent.controlcenter.mode.enable=management

# Required: Turn off Prometheus in Reduced infrastructure mode
confluent.controlcenter.prometheus.enable=false

# Connect to Confluent Cloud using a Confluent Cloud API key and secret
confluent.controlcenter.streams.security.protocol=SASL_SSL
confluent.controlcenter.streams.sasl.mechanism=PLAIN
confluent.controlcenter.streams.sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="<api_key>" password="<api_secret>";
confluent.controlcenter.streams.ssl.endpoint.identification.algorithm=https

# On-premises Kafka Connect cluster
confluent.controlcenter.connect.<connect_cluster_name>.cluster=http://localhost:8083

# On-premises ksqlDB cluster
confluent.controlcenter.ksql.<ksql_cluster_name>.url=http://localhost:8088

# Schema Registry: use one of the following
# Confluent Cloud Schema Registry (include the :443 port)
confluent.controlcenter.schema.registry.url=https://<ccloud_sr_endpoint>:443
confluent.controlcenter.schema.registry.basic.auth.credentials.source=USER_INFO
confluent.controlcenter.schema.registry.basic.auth.user.info=<sr_api_key>:<sr_api_secret>

# On-premises Schema Registry cluster
# confluent.controlcenter.schema.registry.url=http://localhost:8081
```

#### NOTE
Include the `:443` port in the Confluent Cloud Schema Registry URL. Without an explicit
port, Control Center checks the Schema Registry endpoint on port 80 and reports it
as down.

For a Confluent Cloud API key and secret, see
[Use API Keys to Control Access in Confluent Cloud](/cloud/current/security/authenticate/workload-identities/service-accounts/api-keys/overview.html).

## Configure CFK to use Confluent Cloud

On Confluent for Kubernetes, set the properties under `spec.configOverrides.server` in the
`ControlCenter` custom resource. Define the Confluent Cloud bootstrap cluster and API
key under `spec.dependencies.kafka`. The following example omits
`spec.services`, `prometheusClient`, and `alertManagerClient` so that
CFK doesn’t deploy Prometheus or Alertmanager:

```yaml
spec:
  configOverrides:
    server:
      - confluent.controlcenter.mode.enable=management
      - confluent.controlcenter.prometheus.enable=false
  dependencies:
    kafka:
      bootstrapEndpoint: <ccloud_bootstrap_server>:9092
      authentication:
        type: plain
        jaasConfig:
          secretRef: <secret_name>
      tls:
        enabled: true
        ignoreTrustStoreConfig: true
```

The secret must contain a `plain.txt` key with the Confluent Cloud API key and secret
in the following format:

```none
username=<api_key>
password=<api_secret>
```

## Related content

- [Reduced infrastructure mode](../overview.md#reduced-infra-mode)
- [Mode settings](configuration.md#mode-settings)
- [Kafka-less mode for Confluent Control Center](kafkaless-mode.md#c3-kafkaless-mode)
- [Control Center Configuration Reference for Confluent Platform](configuration.md#controlcenter-configuration)