# Configuration reference (/connectors/kafka/reference/configuration)



## Overview [#overview]

The canonical field-by-field reference is
[connector settings](/configure/reference/connectors#kafka) — every `Connectors.Kafka.*`
field, its default, its valid range, and its `CONNECTORS_KAFKA_*` / `spec.kafka.*` names. This
page is an orientation pass: the handful of settings that decide whether the connector is on,
which ports it opens, and how it's secured, plus copy-paste TOML/environment/Docker examples. For
the narrative behind these settings — why the connector is opt-in and what its security posture
looks like — see [Configuration concepts](/connectors/kafka/concepts/configuration).

## At a glance [#at-a-glance]

| Setting                                                        | Default     | What it controls                                                                                                                            |
| -------------------------------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| `Enable` — `CONNECTORS_KAFKA_ENABLE` / `spec.kafka.enabled`    | `false`     | **Opt-in.** The wire listeners stay closed until this is `true`.                                                                            |
| `Port` — `CONNECTORS_KAFKA_PORT` / `spec.kafka.port`           | `9092`      | The plaintext TCP listener.                                                                                                                 |
| `TlsPort` — `CONNECTORS_KAFKA_TLS_PORT` / `spec.kafka.tlsPort` | `9093`      | The TLS listener — the only listener OAUTHBEARER and mTLS are enforced on.                                                                  |
| `Credentials` / `SaslMechanisms`                               | none / `[]` | Populating the SASL credential store turns on SASL/PLAIN + SCRAM auth; `SaslMechanisms` narrows which mechanisms `SaslHandshake` offers.    |
| `OAuthBearer.Issuer`                                           | `""`        | Non-empty activates OAUTHBEARER — there's no separate enable flag.                                                                          |
| `AdvertisedHost` / `AdvertisedPort`                            | `""` / `0`  | The client-reachable address handed to Kafka clients in `Metadata`/`FindCoordinator` — set this in Kubernetes to avoid a connect-then-hang. |

<Callout type="info">
  This table is an orientation pass, not the full settings list — the connector has roughly two
  dozen fields, including advanced tuning knobs (fetch wait, offsets retention, transaction
  timeouts, quotas) that have no CRD/Helm path yet. See
  [connector settings → Kafka](/configure/reference/connectors#kafka) for every field, and
  [Authentication](/connectors/kafka/how-to/authentication) for the full SASL/OAUTHBEARER/mTLS story.
</Callout>

## Examples [#examples]

The same settings can be supplied through a TOML config file, environment variables, or `docker
run` flags. Every environment variable uses the `CONNECTORS_KAFKA_` prefix.

<Tabs groupId="config-source" items="['TOML', 'Environment', 'Docker']">
  <Tab value="TOML">
    ```toml title="config.toml"
    [Connectors.Kafka]
      Enable = true
      Port = "9092"
      TlsPort = "9093"
      AdvertisedHost = ""
      AdvertisedPort = 0
      MaxConnections = 1000
      MaxMessageBytes = 1048576
    ```
  </Tab>

  <Tab value="Environment">
    ```bash title="kafka.env"
    CONNECTORS_KAFKA_ENABLE=true
    CONNECTORS_KAFKA_PORT=9092
    CONNECTORS_KAFKA_TLS_PORT=9093
    CONNECTORS_KAFKA_ADVERTISED_HOST=
    CONNECTORS_KAFKA_ADVERTISED_PORT=0
    CONNECTORS_KAFKA_MAX_CONNECTIONS=1000
    CONNECTORS_KAFKA_MAX_MESSAGE_BYTES=1048576
    ```
  </Tab>

  <Tab value="Docker">
    <RunKubeMQ ports="[9092, 9093, 50000]" env="{ CONNECTORS_KAFKA_ENABLE: 'true' }" />
  </Tab>
</Tabs>

<Callout type="info">
  The Docker example includes `CONNECTORS_KAFKA_ENABLE=true` — without it the connector stays
  disabled and neither `9092` nor `9093` is bound. Port `50000` is the native KubeMQ gRPC
  listener, included so the same container also accepts KubeMQ SDK clients.
</Callout>

## Related [#related]

<Cards>
  <Card title="Connector settings — Kafka" href="/configure/reference/connectors#kafka" description="Every Connectors.Kafka.* field, its default, its valid range, and its env/CRD names." />

  <Card title="Configuration" href="/connectors/kafka/concepts/configuration" description="Why the connector is opt-in, its security posture, and how config maps to connector behavior." />

  <Card title="Authentication" href="/connectors/kafka/how-to/authentication" description="SASL/PLAIN and SCRAM, OAUTHBEARER/OIDC, mTLS, and the ACL model that authorizes each request." />

  <Card title="Limits & rules" href="/connectors/kafka/reference/limits-and-rules" description="The numeric ceilings behind these settings — partitions, message bytes, connections, and groups." />
</Cards>