Important

You are viewing documentation for an older version of Confluent Platform. For the latest, click here.

Prefixes for Configuring Security

Configuration Parameters

Each component in the Confluent Platform can be configured for security. This tables shows for each component, what is the prefix for security configuration properties and where to configure the property.

Component Prefix Where to Configure
Broker none etc/kafka/server.properties
Console Clients none client properties, e.g. producer.config or consumer.config
Connect workers none, and producer. or consumer. etc/kafka/connect-distributed.properties
Control Center confluent.controlcenter.streams. etc/confluent-control-center/control-center.properties
Java Clients

Java clients use static parameters defined in the Javadoc:

SslConfigs or SaslConfigs in Properties class
Metrics Reporter confluent.metrics.reporter. etc/kafka/server.properties
Monitoring Interceptors in clients confluent.monitoring.interceptor. client properties, e.g. producer.config or consumer.config
Monitoring Interceptors in Connect producer.confluent.monitoring.interceptor. consumer.confluent.monitoring.interceptor. etc/kafka/connect-distributed.properties
Monitoring Interceptors in Replicator src.consumer.confluent.monitoring.interceptor. connector JSON file (not the worker properties file)
Replicator
  • dest.kafka.
  • src.kafka.
connector JSON file (not the worker properties file)
REST Proxy client. etc/kafka/kafka-rest.properties
Schema Registry kafkastore. etc/schema-registry/schema-registry.properties
ZooKeeper none etc/kafka/zookeeper.properties

Environment Variables for Configuring HTTPS

If a component in the Confluent Platform needs to connect to a service via HTTPS, for example to a HTTPS-enabled Confluent Schema Registry, you may need to configure the SSL credentials for that HTTPS connection. This table shows for each component, the name of the environment variable to configure with SSL credentials for those HTTPS connections.

Component Environment Variable
Broker KAFKA_OPTS
Console Clients KAFKA_OPTS
KSQL KSQL_OPTS
Connect workers KAFKA_OPTS
Control Center CONTROL_CENTER_OPTS
Schema Registry SCHEMA_REGISTRY_OPTS
REST Proxy KAFKAREST_OPTS

Additional Environment Variables

If you using the Schema Registry ACL Authorizer with SASL, pass in JAAS configuration file using the SECURITY_PLUGINS_OPTS environment variable before calling sr-acl-cli.

export SECURITY_PLUGINS_OPTS=-Djava.security.auth.login.config=/etc/schema-registry/kafka_client_jaas.conf