Configuration reference
The Kafka connector settings at a glance — the opt-in flag, the 9092/9093 ports, and TOML/environment/Docker examples, plus the full settings reference.
Overview
The canonical field-by-field reference is
connector settings — every Connectors.Kafka.*
field, its default, its valid range, and its CONNECTORS_KAFKA_* / spec.kafka.* names. This
page is an orientation pass: the handful of settings that decide whether the connector is on,
which ports it opens, and how it's secured, plus copy-paste TOML/environment/Docker examples. For
the narrative behind these settings — why the connector is opt-in and what its security posture
looks like — see Configuration concepts.
At a glance
| Setting | Default | What it controls |
|---|---|---|
Enable — CONNECTORS_KAFKA_ENABLE / spec.kafka.enabled | false | Opt-in. The wire listeners stay closed until this is true. |
Port — CONNECTORS_KAFKA_PORT / spec.kafka.port | 9092 | The plaintext TCP listener. |
TlsPort — CONNECTORS_KAFKA_TLS_PORT / spec.kafka.tlsPort | 9093 | The TLS listener — the only listener OAUTHBEARER and mTLS are enforced on. |
Credentials / SaslMechanisms | none / [] | Populating the SASL credential store turns on SASL/PLAIN + SCRAM auth; SaslMechanisms narrows which mechanisms SaslHandshake offers. |
OAuthBearer.Issuer | "" | Non-empty activates OAUTHBEARER — there's no separate enable flag. |
AdvertisedHost / AdvertisedPort | "" / 0 | The client-reachable address handed to Kafka clients in Metadata/FindCoordinator — set this in Kubernetes to avoid a connect-then-hang. |
This table is an orientation pass, not the full settings list — the connector has roughly two dozen fields, including advanced tuning knobs (fetch wait, offsets retention, transaction timeouts, quotas) that have no CRD/Helm path yet. See connector settings → Kafka for every field, and Authentication for the full SASL/OAUTHBEARER/mTLS story.
Examples
The same settings can be supplied through a TOML config file, environment variables, or docker run flags. Every environment variable uses the CONNECTORS_KAFKA_ prefix.
[Connectors.Kafka]
Enable = true
Port = "9092"
TlsPort = "9093"
AdvertisedHost = ""
AdvertisedPort = 0
MaxConnections = 1000
MaxMessageBytes = 1048576CONNECTORS_KAFKA_ENABLE=true
CONNECTORS_KAFKA_PORT=9092
CONNECTORS_KAFKA_TLS_PORT=9093
CONNECTORS_KAFKA_ADVERTISED_HOST=
CONNECTORS_KAFKA_ADVERTISED_PORT=0
CONNECTORS_KAFKA_MAX_CONNECTIONS=1000
CONNECTORS_KAFKA_MAX_MESSAGE_BYTES=1048576docker run -d \ --name kubemq \ -p 9092:9092 \ -p 9093:9093 \ -p 50000:50000 \ -e KUBEMQ_TOKEN=YOUR_LICENSE_KEY \ -e CONNECTORS_KAFKA_ENABLE=true \ europe-docker.pkg.dev/kubemq/images/kubemq:nextThe Docker example includes CONNECTORS_KAFKA_ENABLE=true — without it the connector stays
disabled and neither 9092 nor 9093 is bound. Port 50000 is the native KubeMQ gRPC
listener, included so the same container also accepts KubeMQ SDK clients.
Related
Connector settings — Kafka
Every Connectors.Kafka.* field, its default, its valid range, and its env/CRD names.
Configuration
Why the connector is opt-in, its security posture, and how config maps to connector behavior.
Authentication
SASL/PLAIN and SCRAM, OAUTHBEARER/OIDC, mTLS, and the ACL model that authorizes each request.
Limits & rules
The numeric ceilings behind these settings — partitions, message bytes, connections, and groups.
Was this page helpful?
Capabilities
What the KubeMQ Kafka connector supports — every implemented Kafka API, from Produce/Fetch and consumer groups to transactions and share groups (preview).
Connections & Observability
The Kafka connector's observability surface — the /api/kafka/* dashboard endpoints, Prometheus metric families, and the per-connection principal view.