### Run Kafka UI with Docker (Quick Start)

Source: https://github.com/provectus/kafka-ui-docs/blob/main/overview/getting-started.md

This command starts a Kafka UI instance using a pre-built Docker image. It maps port 8080 and enables dynamic configuration. This is suitable for a quick demo or trial.

```bash
docker run -it -p 8080:8080 -e DYNAMIC_CONFIG_ENABLED=true provectuslabs/kafka-ui
```

--------------------------------

### Install Kafka UI via Helm Repository

Source: https://github.com/provectus/kafka-ui-docs/blob/main/configuration/helm-charts/quick-start.md

Commands to add the Kafka UI Helm repository and perform a standard installation of the application.

```bash
helm repo add kafka-ui https://provectus.github.io/kafka-ui-charts
helm install kafka-ui kafka-ui/kafka-ui
```

--------------------------------

### Complete Multi-Cluster Configuration Example

Source: https://context7.com/provectus/kafka-ui-docs/llms.txt

This YAML snippet provides a comprehensive configuration example for Kafka UI, demonstrating multi-cluster setup with authentication, RBAC, and monitoring features enabled. It serves as a template for advanced deployments.

```yaml
# This is a placeholder for a more complete configuration example.
# Actual content would detail multiple clusters, auth providers, RBAC roles, etc.
```

--------------------------------

### Configure Kafka UI using ConfigMap

Source: https://github.com/provectus/kafka-ui-docs/blob/main/configuration/helm-charts/quick-start.md

Creates a Kubernetes ConfigMap to store the application configuration and installs the Helm chart referencing that ConfigMap.

```yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: kafka-ui-configmap
data:
  config.yml: |-
    kafka:
      clusters:
        - name: yaml
          bootstrapServers: kafka-cluster-broker-endpoints:9092
    auth:
      type: disabled
    management:
      health:
        ldap:
          enabled: false
```

```bash
helm install helm-release-name charts/kafka-ui --set yamlApplicationConfigConfigMap.name="kafka-ui-configmap",yamlApplicationConfigConfigMap.keyName="config.yml"
```

--------------------------------

### Persistent Kafka UI Installation with Docker Compose

Source: https://github.com/provectus/kafka-ui-docs/blob/main/overview/getting-started.md

This Docker Compose configuration sets up a persistent Kafka UI instance. It defines the container, image, port mapping, environment variables, and a volume for configuration files. This allows for a more robust and configurable setup.

```yaml
services:
  kafka-ui:
    container_name: kafka-ui
    image: provectuslabs/kafka-ui:latest
    ports:
      - 8080:8080
    environment:
      DYNAMIC_CONFIG_ENABLED: true
    volumes:
      - ~/kui/config.yml:/etc/kafkaui/dynamic_config.yaml
```

--------------------------------

### Install Docker on Ubuntu

Source: https://github.com/provectus/kafka-ui-docs/blob/main/development/building/prerequisites.md

A sequence of commands to install the Docker engine on Ubuntu, including adding the repository and configuring user permissions to run Docker without sudo.

```bash
sudo apt update
sudo apt install -y apt-transport-https ca-certificates curl software-properties-common
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
sudo add-apt-repository -y "deb [arch=amd64] https://download.docker.com/linux/ubuntu focal stable"
sudo apt -y install docker-ce
sudo usermod -aG docker ${USER}
su - ${USER}
sudo chmod 666 /var/run/docker.sock
```

--------------------------------

### Configure Kafka UI using values.yml

Source: https://github.com/provectus/kafka-ui-docs/blob/main/configuration/helm-charts/quick-start.md

Defines a values.yml file to configure Kafka clusters and authentication settings, followed by the Helm install command to apply these values.

```yaml
yamlApplicationConfig:
  kafka:
    clusters:
      - name: yaml
        bootstrapServers:  kafka-cluster-broker-endpoints:9092
  auth:
    type: disabled
  management:
    health:
      ldap:
        enabled: false
```

```bash
helm install helm-release-name charts/kafka-ui -f values.yml
```

--------------------------------

### Configure Kafka UI using Environment Variables via ConfigMap

Source: https://github.com/provectus/kafka-ui-docs/blob/main/configuration/helm-charts/quick-start.md

Uses a Kubernetes ConfigMap to define environment variables for Kafka UI configuration and installs the chart using the existingConfigMap parameter.

```yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: kafka-ui-helm-values
data:
  KAFKA_CLUSTERS_0_NAME: "kafka-cluster-name"
  KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS: "kafka-cluster-broker-endpoints:9092"
  AUTH_TYPE: "DISABLED"
  MANAGEMENT_HEALTH_LDAP_ENABLED: "FALSE"
```

```bash
helm install helm-release-name charts/kafka-ui --set existingConfigMap="kafka-ui-helm-values"
```

--------------------------------

### Install Java 17 and Configure Environment on macOS

Source: https://github.com/provectus/kafka-ui-docs/blob/main/development/building/prerequisites.md

Instructions for installing Eclipse Temurin 17 via Homebrew and setting the JAVA_HOME path variable to ensure the correct version is used by the system.

```bash
brew tap homebrew/cask-versions
brew install temurin17
export PATH="$(/usr/libexec/java_home -v 17)/bin:$PATH"
export JAVA_HOME="$(/usr/libexec/java_home -v 17)"
```

--------------------------------

### Deploy Kafka UI with Helm Charts

Source: https://context7.com/provectus/kafka-ui-docs/llms.txt

These bash commands demonstrate how to deploy Kafka UI using Helm. It includes adding the Kafka UI Helm repository, updating repositories, and installing the chart with default or custom configurations.

```bash
# Add the Helm repository
helm repo add kafka-ui https://provectus.github.io/kafka-ui-charts
helm repo update

# Install with default configuration
helm install kafka-ui kafka-ui/kafka-ui
```

```bash
# Install with custom values
helm install kafka-ui kafka-ui/kafka-ui -f values.yml

# Or install using ConfigMap for configuration
helm install kafka-ui kafka-ui/kafka-ui \
  --set yamlApplicationConfigConfigMap.name="kafka-ui-configmap" \
  --set yamlApplicationConfigConfigMap.keyName="config.yml"
```

--------------------------------

### Install and Configure OpenJDK 17 on Linux

Source: https://github.com/provectus/kafka-ui-docs/blob/main/development/building/prerequisites.md

Commands to install OpenJDK 17 on Ubuntu systems and configure the default Java version using update-alternatives. This ensures the environment meets the project's Java runtime requirements.

```bash
sudo apt update
sudo apt install openjdk-17-jdk
sudo update-alternatives --config java
```

--------------------------------

### Install Kafka-UI via Helm

Source: https://github.com/provectus/kafka-ui-docs/blob/main/configuration/helm-charts/configuration/README.md

Adds the Kafka-UI Helm repository and installs the application with basic cluster configuration. It uses the --set flag to define Kafka bootstrap servers and cluster names.

```bash
helm repo add kafka-ui https://provectus.github.io/kafka-ui
helm install kafka-ui kafka-ui/kafka-ui --set envs.config.KAFKA_CLUSTERS_0_NAME=local --set envs.config.KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS=kafka:9092
```

--------------------------------

### Setup Basic Authentication

Source: https://context7.com/provectus/kafka-ui-docs/llms.txt

Secure the Kafka UI dashboard by enabling LOGIN_FORM authentication with a static username and password.

```yaml
services:
  kafka-ui:
    image: provectuslabs/kafka-ui:latest
    environment:
      AUTH_TYPE: LOGIN_FORM
      SPRING_SECURITY_USER_NAME: admin
      SPRING_SECURITY_USER_PASSWORD: secure-password-here
```

--------------------------------

### Kafka-UI MSK IAM Authentication Properties

Source: https://github.com/provectus/kafka-ui-docs/blob/main/quick-start/prerequisites/permissions/msk-+serverless-setup.md

Environment variables for configuring Kafka-UI to connect to MSK clusters using AWS IAM for authentication. These settings specify the security protocol, SASL mechanism, and JAAS configuration required for IAM-based authentication.

```env
KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL=SASL_SSL
KAFKA_CLUSTERS_0_PROPERTIES_SASL_MECHANISM=AWS_MSK_IAM
KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG='software.amazon.msk.auth.iam.IAMLoginModule required;'
KAFKA_CLUSTERS_0_PROPERTIES_SASL_CLIENT_CALLBACK_HANDLER_CLASS='software.amazon.msk.auth.iam.IAMClientCallbackHandler'
```

--------------------------------

### AWS IAM Policy for MSK Access

Source: https://github.com/provectus/kafka-ui-docs/blob/main/quick-start/prerequisites/permissions/msk-+serverless-setup.md

A JSON policy defining permissions for accessing MSK clusters and related resources. This policy grants necessary actions like DescribeCluster, AlterCluster, Connect, ReadData, and CreateTopic, specifying resource ARNs for cluster and topic access.

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "kafka-cluster:DescribeCluster",
                "kafka-cluster:AlterCluster",
                "kafka-cluster:Connect"
            ],
            "Resource": "arn:aws:kafka:eu-central-1:297478128798:cluster/test-wizard/7b39802a-21ac-48fe-b6e8-a7baf2ae2533-s2"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "kafka-cluster:DeleteGroup",
                "kafka-cluster:DescribeCluster",
                "kafka-cluster:ReadData",
                "kafka-cluster:DescribeTopicDynamicConfiguration",
                "kafka-cluster:AlterTopicDynamicConfiguration",
                "kafka-cluster:AlterGroup",
                "kafka-cluster:AlterClusterDynamicConfiguration",
                "kafka-cluster:AlterTopic",
                "kafka-cluster:CreateTopic",
                "kafka-cluster:DescribeTopic",
                "kafka-cluster:AlterCluster",
                "kafka-cluster:DescribeGroup",
                "kafka-cluster:DescribeClusterDynamicConfiguration",
                "kafka-cluster:Connect",
                "kafka-cluster:DeleteTopic",
                "kafka-cluster:WriteData"
            ],
            "Resource": "arn:aws:kafka:eu-central-1:297478128798:topic/test-wizard/7b39802a-21ac-48fe-b6e8-a7baf2ae2533-s2/*"
        },
        {
            "Sid": "VisualEditor2",
            "Effect": "Allow",
            "Action": [
                "kafka-cluster:AlterGroup",
                "kafka-cluster:DescribeGroup"
            ],
            "Resource": "arn:aws:kafka:eu-central-1:297478128798:group/test-wizard/7b39802a-21ac-48fe-b6e8-a7baf2ae2533-s2/*"
        }
    ]
}
```

--------------------------------

### Configure AWS MSK IAM Authentication for Kafka UI

Source: https://context7.com/provectus/kafka-ui-docs/llms.txt

This snippet shows how to configure Kafka UI to authenticate with AWS Managed Streaming for Apache Kafka (MSK) using IAM. It includes Docker run commands and a YAML configuration file example. Dependencies include the AWS SDK and appropriate IAM permissions.

```bash
# Docker run with AWS MSK IAM authentication
docker run -p 8080:8080 \
    -e KAFKA_CLUSTERS_0_NAME=msk-cluster \
    -e KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS=b-1.msk-cluster.xxxxx.kafka.us-east-1.amazonaws.com:9098 \
    -e KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL=SASL_SSL \
    -e KAFKA_CLUSTERS_0_PROPERTIES_SASL_MECHANISM=AWS_MSK_IAM \
    -e KAFKA_CLUSTERS_0_PROPERTIES_SASL_CLIENT_CALLBACK_HANDLER_CLASS=software.amazon.msk.auth.iam.IAMClientCallbackHandler \
    -e "KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG=software.amazon.msk.auth.iam.IAMLoginModule required awsProfileName=\"default\";" \
    -v ~/.aws:/root/.aws:ro \
    -d provectuslabs/kafka-ui:latest
```

```yaml
# config.yml - AWS MSK IAM configuration
kafka:
  clusters:
    - name: msk-production
      bootstrapServers: b-1.msk-cluster.xxxxx.kafka.us-east-1.amazonaws.com:9098
      properties:
        security.protocol: SASL_SSL
        sasl.mechanism: AWS_MSK_IAM
        sasl.client.callback.handler.class: software.amazon.msk.auth.iam.IAMClientCallbackHandler
        sasl.jaas.config: software.amazon.msk.auth.iam.IAMLoginModule required awsProfileName="default";
```

--------------------------------

### Configure Okta OIDC for Kafka UI

Source: https://context7.com/provectus/kafka-ui-docs/llms.txt

Configures Okta OIDC for enterprise identity management and groups-based RBAC. This setup requires Okta client ID, client secret, and specific URIs for issuer and JWK set.

```yaml
# config.yml - Okta OAuth2 configuration
kafka:
  clusters:
    - name: production
      bootstrapServers: kafka:9092

auth:
  type: OAUTH2
  oauth2:
    client:
      okta:
        clientId: your-okta-client-id
        clientSecret: your-okta-client-secret
        scope: ['openid', 'profile', 'email', 'groups']
        client-name: Okta
        provider: okta
        redirect-uri: http://localhost:8080/login/oauth2/code/okta
        authorization-grant-type: authorization_code
        issuer-uri: https://your-domain.okta.com
        jwk-set-uri: https://your-domain.okta.com/.well-known/jwks.json
        user-name-attribute: sub
        custom-params:
          type: oauth
          roles-field: groups  # Required for RBAC integration
```

--------------------------------

### Configure Docker Memory Limits on Ubuntu

Source: https://github.com/provectus/kafka-ui-docs/blob/main/development/building/prerequisites.md

Steps to allocate 4GB of memory to Docker containers by modifying the daemon configuration file and restarting the service.

```bash
sudo nano /etc/default/docker
# Add: DOCKER_OPTS="--default-ulimit memlock=-1:-1 --memory=4g --memory-swap=-1"
sudo service docker restart
docker info | grep -i memory
```

--------------------------------

### Provide Kafka UI Config Path via JAR

Source: https://github.com/provectus/kafka-ui-docs/blob/main/configuration/configuration-file.md

Illustrates how to specify a configuration file path for Kafka UI when running it as a JAR file. This is done using the `-Dspring.config.additional-location` system property when executing the Java command.

```bash
java -Dspring.config.additional-location=<path-to-application-local.yml> -jar <path-to-jar>.jar
```

--------------------------------

### Configure topic-specific serdes via YAML

Source: https://github.com/provectus/kafka-ui-docs/blob/main/configuration/serialization-serde.md

Defines how to map specific Kafka topics to serdes using regex patterns for keys and values. Kafka-UI selects the first matching serde based on these patterns.

```yaml
kafka:
  clusters:
    - name: Cluster1
      serde:
        - name: String
          topicKeysPattern: click-events|imp-events
        
        - name: Int64
          topicKeysPattern: ".*-events"
        
        - name: SchemaRegistry
          topicValuesPattern: click-events|imp-events
```

--------------------------------

### Configure Git Global User Name and Email

Source: https://github.com/provectus/kafka-ui-docs/blob/main/development/setting-up-git.md

This snippet shows how to set your Git username and email address globally. These settings are used for your commit history. Ensure you replace the placeholder values with your actual name and email.

```bash
git config --global user.name "Mona Lisa"
git config --global user.email "monalisa@louvre.net"
```

--------------------------------

### Provide Kafka UI Config Path via Docker

Source: https://github.com/provectus/kafka-ui-docs/blob/main/configuration/configuration-file.md

Demonstrates how to specify a configuration file path for Kafka UI when running it as a Docker container. This involves using the `-e` flag to set the `spring.config.additional-location` environment variable and the `-v` flag to mount the local configuration file into the container.

```bash
docker run -it -p 8080:8080 -e spring.config.additional-location=/tmp/config.yml -v /tmp/kui/config.yml:/tmp/config.yml provectuslabs/kafka-ui
```

--------------------------------

### Configure Kafka Clusters via YAML

Source: https://context7.com/provectus/kafka-ui-docs/llms.txt

Define multiple Kafka clusters, schema registry settings, and metrics collection using a YAML configuration file. This file can be mounted into the container at runtime.

```yaml
kafka:
  clusters:
    - name: production
      bootstrapServers: kafka-broker-1:9092,kafka-broker-2:9092
      schemaRegistry: http://schema-registry:8085
      schemaRegistryAuth:
        username: sr-user
        password: sr-password
      metrics:
        port: 9997
        type: JMX
      readOnly: false

    - name: staging
      bootstrapServers: staging-kafka:9092
      readOnly: true
```

```bash
docker run -it -p 8080:8080 \
  -e spring.config.additional-location=/tmp/config.yml \
  -v /path/to/config.yml:/tmp/config.yml \
  provectuslabs/kafka-ui
```

--------------------------------

### Configure Serialization/Deserialization (SerDe) for Kafka UI

Source: https://context7.com/provectus/kafka-ui-docs/llms.txt

This snippet details the configuration for custom serializers and deserializers (SerDe) in Kafka UI. It supports various formats like Protobuf, Avro, and custom plugins, allowing for flexible message handling. Configuration can be done via YAML or environment variables.

```yaml
# config.yml - SerDe configuration
kafka:
  clusters:
    - name: production
      bootstrapServers: kafka:9092
      schemaRegistry: http://schema-registry:8081
      defaultKeySerde: String
      defaultValueSerde: SchemaRegistry
      serde:
        # String serde with custom encoding
        - name: AsciiString
          className: com.provectus.kafka.ui.serdes.builtin.StringSerde
          properties:
            encoding: "ASCII"

        # Hex serde for binary data
        - name: HexData
          className: com.provectus.kafka.ui.serdes.builtin.HexSerde
          properties:
            uppercase: "true"
            delimiter: ":"

        # Protobuf file-based serde
        - name: ProtobufFile
          properties:
            protobufFilesDir: "/etc/kafkaui/protos"
            protobufMessageName: my.events.DefaultMessage
            protobufMessageNameForKey: my.events.MessageKey
            protobufMessageNameByTopic:
              user-events: my.events.UserEvent
              order-events: my.events.OrderEvent

        # Additional Schema Registry instance
        - name: SecondarySchemaRegistry
          className: com.provectus.kafka.ui.serdes.builtin.sr.SchemaRegistrySerde
          properties:
            url: http://secondary-schema-registry:8081
            username: sr-user
            password: sr-password

        # Custom plugin serde
        - name: CustomSerde
          className: com.mycompany.kafka.CustomSerde
          filePath: /var/lib/kafka-ui/serdes/custom-serde.jar
          properties:
            customProp1: value1

        # Assign serdes to specific topic patterns
        - name: String
          topicKeysPattern: "string-keys-.*"

        - name: SchemaRegistry
          topicValuesPattern: "avro-.*|protobuf-.*"
```

--------------------------------

### Configure Kafka UI with Environment Variables

Source: https://context7.com/provectus/kafka-ui-docs/llms.txt

Use environment variables to configure server settings, cluster connections, and integrations like Kafka Connect or KSQL DB. This method is preferred for container orchestration platforms.

```yaml
services:
  kafka-ui:
    image: provectuslabs/kafka-ui:latest
    ports:
      - 8080:8080
    environment:
      SERVER_PORT: 8080
      SERVER_SERVLET_CONTEXT_PATH: /kafka-ui
      KAFKA_CLUSTERS_0_NAME: production
      KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS: kafka:9092
      KAFKA_CLUSTERS_0_KAFKACONNECT_0_NAME: connect-cluster
      KAFKA_CLUSTERS_0_KAFKACONNECT_0_ADDRESS: http://kafka-connect:8083
      DYNAMIC_CONFIG_ENABLED: 'true'
```

--------------------------------

### Set default serdes for Kafka clusters

Source: https://github.com/provectus/kafka-ui-docs/blob/main/configuration/serialization-serde.md

Configures global default serializers/deserializers for keys and values when no specific pattern match is found for a topic.

```yaml
kafka:
  clusters:
    - name: Cluster1
      defaultKeySerde: Int32
      defaultValueSerde: String
      serde:
        - name: Int32
          topicKeysPattern: click-events|imp-events
```

--------------------------------

### Basic Kafka UI YAML Configuration Structure

Source: https://github.com/provectus/kafka-ui-docs/blob/main/configuration/configuration-file.md

Presents a fundamental YAML structure for configuring Kafka UI, focusing on defining Kafka clusters. It includes essential properties for connecting to a Kafka cluster, such as name, bootstrap servers, schema registry details, and authentication credentials.

```yaml
kafka:
  clusters:
    -
      name: local
      bootstrapServers: localhost:29091
      schemaRegistry: http://localhost:8085
      schemaRegistryAuth:
        username: username
        password: password
#     schemaNameTemplate: "%s-value"
      metrics:
        port: 9997
        type: JMX
      readOnly: false
```

--------------------------------

### Docker Compose Deployment (YAML)

Source: https://context7.com/provectus/kafka-ui-docs/llms.txt

This Docker Compose configuration deploys Kafka UI, mounting a complete configuration file and necessary volumes for protos and serdes. It exposes the UI on port 8080 and includes a health check.

```yaml
services:
  kafka-ui:
    image: provectuslabs/kafka-ui:latest
    ports:
      - 8080:8080
    environment:
      SPRING_CONFIG_ADDITIONAL-LOCATION: /config.yml
    volumes:
      - ./complete-config.yml:/config.yml
      - ./protos:/etc/kafkaui/protos:ro
      - ./serdes:/var/lib/kafka-ui/serdes:ro
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/actuator/health"]
      interval: 30s
      timeout: 10s
      retries: 3

```

--------------------------------

### Enable Dynamic Configuration via Docker Compose

Source: https://github.com/provectus/kafka-ui-docs/blob/main/configuration/configuration-wizard.md

Configures the Kafka-UI container to enable the dynamic configuration feature using environment variables. This allows the application to accept cluster configuration changes at runtime.

```yaml
services:
  kafka-ui:
    container_name: kafka-ui
    image: provectuslabs/kafka-ui:latest
    ports:
      - 8080:8080
    depends_on:
      - kafka0
    environment:
      DYNAMIC_CONFIG_ENABLED: 'true'
      KAFKA_CLUSTERS_0_NAME: wizard_test
      KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS: kafka0:29092
```

--------------------------------

### Complete Production Configuration (YAML)

Source: https://context7.com/provectus/kafka-ui-docs/llms.txt

This YAML file defines a complete production configuration for Kafka UI, including Kafka cluster details, schema registry, Kafka Connect, ksqlDB, audit logging, masking, and authentication settings. It also includes RBAC roles for fine-grained access control.

```yaml
kafka:
  admin-client-timeout: 30000
  clusters:
    - name: production
      bootstrapServers: prod-kafka-1:9092,prod-kafka-2:9092,prod-kafka-3:9092
      schemaRegistry: http://prod-schema-registry:8081
      schemaRegistryAuth:
        username: sr-admin
        password: sr-password
      metrics:
        port: 9997
        type: JMX
      kafkaConnect:
        - name: prod-connect
          address: http://kafka-connect:8083
          username: connect-user
          password: connect-pass
      ksqldbServer: http://ksqldb:8088
      audit:
        topic-audit-enabled: true
        console-audit-enabled: false
        topic: '__audit-log'
        level: ALTER_ONLY
      masking:
        - type: MASK
          fields: ["email", "phone", "ssn"]
          topicValuesPattern: ".*-pii-.*"
      serde:
        - name: SchemaRegistry
          topicValuesPattern: ".*"
    - name: staging
      bootstrapServers: staging-kafka:9092
      schemaRegistry: http://staging-schema-registry:8081
      readOnly: true
      metrics:
        type: PROMETHEUS
        port: 9308

auth:
  type: OAUTH2
  oauth2:
    client:
      okta:
        clientId: kafka-ui-client-id
        clientSecret: kafka-ui-client-secret
        scope: ['openid', 'profile', 'email', 'groups']
        issuer-uri: https://yourcompany.okta.com
        user-name-attribute: email
        custom-params:
          type: oauth
          roles-field: groups

rback:
  roles:
    - name: "platform-admins"
      clusters: [production, staging]
      subjects:
        - provider: oauth
          type: group
          value: "kafka-admins"
      permissions:
        - resource: applicationconfig
          actions: all
        - resource: clusterconfig
          actions: all
        - resource: topic
          value: ".*"
          actions: all
        - resource: consumer
          value: ".*"
          actions: all
        - resource: schema
          value: ".*"
          actions: all
        - resource: connect
          value: ".*"
          actions: all
        - resource: ksql
          actions: all
        - resource: acl
          actions: [view, edit]

    - name: "developers"
      clusters: [staging]
      subjects:
        - provider: oauth
          type: group
          value: "developers"
      permissions:
        - resource: topic
          value: ".*"
          actions: [VIEW, MESSAGES_READ, MESSAGES_PRODUCE]
        - resource: consumer
          value: ".*"
          actions: [VIEW]
        - resource: schema
          value: ".*"
          actions: [VIEW]

dynamic:
  config:
    enabled: true

```

--------------------------------

### Provide Kafka UI Config Path via Docker Compose

Source: https://github.com/provectus/kafka-ui-docs/blob/main/configuration/configuration-file.md

Shows how to configure Kafka UI with an additional configuration file using Docker Compose. This is achieved by setting the `SPRING_CONFIG_ADDITIONAL-LOCATION` environment variable within the `kafka-ui` service definition and mapping a local configuration file to a path inside the container using the `volumes` directive.

```yaml
services:
  kafka-ui:
    container_name: kafka-ui
    image: provectuslabs/kafka-ui:latest
    environment:
      KAFKA_CLUSTERS_0_NAME: local
      # other properties, omitted
      SPRING_CONFIG_ADDITIONAL-LOCATION: /config.yml
    volumes:
      - /tmp/config.yml:/config.yml
```

--------------------------------

### Configure OAuth2 Authentication

Source: https://context7.com/provectus/kafka-ui-docs/llms.txt

Integrate enterprise SSO providers like Google for secure access control. Includes support for domain restrictions to manage user access.

```yaml
auth:
  type: OAUTH2
  oauth2:
    client:
      google:
        provider: google
        clientId: your-client-id.apps.googleusercontent.com
        clientSecret: GOCSPX-your-client-secret
        user-name-attribute: email
        custom-params:
          type: google
          allowedDomain: yourcompany.com
```

--------------------------------

### Persistent Deployment with Docker Compose

Source: https://context7.com/provectus/kafka-ui-docs/llms.txt

Deploy Kafka UI in production environments using Docker Compose with persistent configuration volumes. This ensures settings are maintained across container restarts.

```yaml
services:
  kafka-ui:
    container_name: kafka-ui
    image: provectuslabs/kafka-ui:latest
    ports:
      - 8080:8080
    environment:
      DYNAMIC_CONFIG_ENABLED: 'true'
      KAFKA_CLUSTERS_0_NAME: local
      KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS: kafka:9092
    volumes:
      - ~/kui/config.yml:/etc/kafkaui/dynamic_config.yaml
```

```bash
docker-compose up -d
```

--------------------------------

### Include RBAC Configuration in Docker Compose for Kafka UI

Source: https://context7.com/provectus/kafka-ui-docs/llms.txt

Demonstrates how to include an external RBAC configuration file (e.g., `rbac-config.yml`) into the Kafka UI service definition within a `docker-compose.yml` file.

```yaml
# docker-compose.yml - Include RBAC config file
services:
  kafka-ui:
    image: provectuslabs/kafka-ui:latest
    environment:
      SPRING_CONFIG_ADDITIONAL-LOCATION: /roles.yml
    volumes:
      - ./rbac-config.yml:/roles.yml
```

--------------------------------

### Implement Groovy Smart Filters for Message Processing

Source: https://github.com/provectus/kafka-ui-docs/blob/main/faq/faq.md

Demonstrates how to use Groovy expressions to filter Kafka messages based on headers, keys, and JSON-parsed values. The context provides access to variables like partition, timestampMs, and message payloads.

```Groovy
def name = value.name
def age = value.age
name == "iliax" && age == 30
```

--------------------------------

### Execute Kafka UI JAR file

Source: https://github.com/provectus/kafka-ui-docs/blob/main/development/building/without-docker.md

Runs the Kafka UI application using the Java runtime. It requires a path to a custom configuration file and specific JVM arguments to handle module access.

```bash
java -Dspring.config.additional-location=<path-to-application-local.yml> --add-opens java.rmi/javax.rmi.ssl=ALL-UNNAMED -jar <path-to-kafka-ui-jar>
```

--------------------------------

### Environment Variable to YAML Configuration Mapping

Source: https://github.com/provectus/kafka-ui-docs/blob/main/configuration/misc-configuration-properties.md

Demonstrates how environment variables like KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS can be translated into a YAML configuration structure for Kafka UI.

```yaml
kafka:
  clusters:
    - bootstrapServers: xxx
```

--------------------------------

### Configure GitHub OAuth2 for Kafka UI

Source: https://context7.com/provectus/kafka-ui-docs/llms.txt

Sets up GitHub as an OAuth2 provider for authenticating users with Kafka UI. Requires client ID, client secret, and specifies the user name attribute for identification.

```yaml
# config.yml - GitHub OAuth2 configuration
kafka:
  clusters:
    - name: production
      bootstrapServers: kafka:9092

auth:
  type: OAUTH2
  oauth2:
    client:
      github:
        provider: github
        clientId: your-github-client-id
        clientSecret: your-github-client-secret
        scope: read:org
        user-name-attribute: login
        custom-params:
          type: github
```

--------------------------------

### Configure Keycloak for Kafka UI

Source: https://context7.com/provectus/kafka-ui-docs/llms.txt

Sets up Keycloak for self-hosted identity management and SSO integration. Requires Keycloak client ID, secret, and the issuer URI for the realm.

```yaml
# config.yml - Keycloak OAuth2 configuration
kafka:
  clusters:
    - name: production
      bootstrapServers: kafka:9092

auth:
  type: OAUTH2
  oauth2:
    client:
      keycloak:
        clientId: kafka-ui-client
        clientSecret: your-keycloak-secret
        scope: openid
        issuer-uri: https://keycloak.example.com/auth/realms/your-realm
        user-name-attribute: preferred_username
        client-name: keycloak
        provider: keycloak
        custom-params:
          type: keycloak
```

--------------------------------

### Configure Basic Authentication (Environment Variables)

Source: https://github.com/provectus/kafka-ui-docs/blob/main/configuration/authentication/basic-authentication.md

Set environment variables to enable basic username and password authentication. This method is not compatible with other authentication types or RBAC.

```properties
AUTH_TYPE: "LOGIN_FORM"
SPRING_SECURITY_USER_NAME: admin
SPRING_SECURITY_USER_PASSWORD: pass
```

--------------------------------

### Kubernetes Health Probes (YAML)

Source: https://context7.com/provectus/kafka-ui-docs/llms.txt

This Kubernetes deployment manifest configures Kafka UI with liveness and readiness probes using the Actuator health endpoint. It ensures that the container is restarted if it becomes unresponsive and is only considered ready when healthy.

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kafka-ui
spec:
  template:
    spec:
      containers:
        - name: kafka-ui
          image: provectuslabs/kafka-ui:latest
          ports:
            - containerPort: 8080
          livenessProbe:
            httpGet:
              path: /actuator/health
              port: 8080
            initialDelaySeconds: 60
            periodSeconds: 30
          readinessProbe:
            httpGet:
              path: /actuator/health
              port: 8080
            initialDelaySeconds: 30
            periodSeconds: 10

```

--------------------------------

### Register custom pluggable serdes

Source: https://github.com/provectus/kafka-ui-docs/blob/main/configuration/serialization-serde.md

Registers a custom Java implementation of the Serde interface by specifying the class name and the path to the JAR file or directory containing the dependencies.

```yaml
kafka:
  clusters:
    - name: Cluster1
      serde:
        - name: MyCustomSerde
          className: my.lovely.org.KafkaUiSerde
          filePath: /var/lib/kui-serde/my-kui-serde.jar
          
        - name: MyCustomSerde2
          className: my.lovely.org.KafkaUiSerde2
          filePath: /var/lib/kui-serde2
          properties:
            prop1: v1
```

--------------------------------

### Health Check Endpoints (Bash)

Source: https://context7.com/provectus/kafka-ui-docs/llms.txt

These bash commands demonstrate how to check the health and retrieve build information from the Kafka UI Actuator endpoints. The health endpoint returns 'UP' when the UI is running correctly.

```bash
# Liveness and readiness probe endpoint
curl http://localhost:8080/actuator/health
# Response: {"status":"UP"}

# Build info endpoint
curl http://localhost:8080/actuator/info
# Response: {"build":{"version":"0.7.1","artifact":"kafka-ui-api",...}}

```

--------------------------------

### Configure Google OAuth Provider for RBAC

Source: https://github.com/provectus/kafka-ui-docs/blob/main/configuration/rbac-role-based-access-control/supported-identity-providers.md

This configuration snippet demonstrates setting up Google OAuth for RBAC. It supports mapping by 'domain' or 'user'. Ensure Google authentication is configured prior to using these settings. The 'provider' is 'oauth_google'.

```yaml
        - provider: oauth_google
          type: domain
          value: "memelord.lol"
        - provider: oauth_google
          type: user
          value: "kek@memelord.lol"
```

--------------------------------

### Configure Keycloak OAuth2 Authentication for Kafka UI

Source: https://github.com/provectus/kafka-ui-docs/blob/main/configuration/authentication/oauth2.md

This YAML configuration sets up OAuth2 authentication for Kafka UI with Keycloak. It includes essential parameters such as client ID, secret, scope, issuer URI, and user name attribute. The `type` custom parameter is set to `keycloak` for specific integration.

```yaml
auth:
  type: OAUTH2
  oauth2:
    client:
      keycloak:
        clientId: xxx
        clientSecret: yyy
        scope: openid
        issuer-uri: https://<keycloak_instance>/auth/realms/<realm>
        user-name-attribute: preferred_username
        client-name: keycloak
        provider: keycloak
        custom-params:
          type: keycloak
```

--------------------------------

### Access Kafka-UI via Port Forwarding

Source: https://github.com/provectus/kafka-ui-docs/blob/main/configuration/helm-charts/configuration/README.md

Exposes the Kafka-UI service locally on port 8080 using kubectl. This allows users to access the web interface at http://127.0.0.1:8080.

```bash
kubectl port-forward svc/kafka-ui 8080:80
```

--------------------------------

### Create Kubernetes ConfigMap for Kafka UI Configuration

Source: https://context7.com/provectus/kafka-ui-docs/llms.txt

This Kubernetes ConfigMap resource stores the Kafka UI configuration, including Kafka cluster details, authentication, and management settings. The configuration is provided as a multi-line string under the 'config.yml' key.

```yaml
# kubernetes-configmap.yml - ConfigMap for Kafka UI configuration
apiVersion: v1
kind: ConfigMap
metadata:
  name: kafka-ui-configmap
data:
  config.yml: |-
    kafka:
      clusters:
        - name: production
          bootstrapServers: kafka-broker:9092
    auth:
      type: disabled
    management:
      health:
        ldap:
          enabled: false
```

--------------------------------

### Configure LDAP/Active Directory Authentication for Kafka UI

Source: https://context7.com/provectus/kafka-ui-docs/llms.txt

Configures Kafka UI to use LDAP or Active Directory for enterprise directory integration. Requires LDAP server URLs, base DNs, and credentials for searching users and groups.

```yaml
# config.yml - LDAP configuration
auth:
  type: LDAP

spring:
  ldap:
    urls: ldap://ldap-server:389
    base: "cn={0},ou=people,dc=example,dc=com"
    admin-user: "cn=admin,dc=example,dc=com"
    admin-password: "admin-password"
    user-filter-search-base: "dc=example,dc=com"
    user-filter-search-filter: "(&(uid={0})(objectClass=inetOrgPerson))"
    group-filter-search-base: "ou=groups,dc=example,dc=com"  # Required for RBAC

oauth2:
  ldap:
    activeDirectory: false
```

--------------------------------

### Deploy Kafka UI with Multi-Broker Kraft Cluster

Source: https://github.com/provectus/kafka-ui-docs/blob/main/configuration/configuration/complex-configuration-examples/kraft-mode-+-multiple-brokers.md

This Docker Compose configuration defines a Kafka UI service connected to three Kafka brokers (kafka0, kafka1, kafka2) running in Kraft mode. It includes specific environment variables for listener security protocols, controller quorum voters, and JMX monitoring.

```yaml
version: '2'
services:
  kafka-ui:
    container_name: kafka-ui
    image: provectuslabs/kafka-ui:latest
    ports:
      - 8080:8080
    depends_on:
      - kafka0
      - kafka1
      - kafka2
    environment:
      KAFKA_CLUSTERS_0_NAME: local
      KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS: kafka0:29092,kafka1:29092,kafka2:29092

  kafka0:
    image: confluentinc/cp-kafka:7.2.1
    hostname: kafka0
    container_name: kafka0
    environment:
      KAFKA_PROCESS_ROLES: 'broker,controller'
      KAFKA_NODE_ID: 1
      KAFKA_CONTROLLER_QUORUM_VOTERS: '1@kafka0:29093,2@kafka1:29093,3@kafka2:29093'
      KAFKA_LISTENERS: 'PLAINTEXT://kafka0:29092,CONTROLLER://kafka0:29093,PLAINTEXT_HOST://0.0.0.0:9092'
      KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://kafka0:29092,PLAINTEXT_HOST://localhost:9092
    command: "bash -c 'if [ ! -f /tmp/update_run.sh ]; then echo \"ERROR\" && exit 1 ; else /tmp/update_run.sh && /etc/confluent/docker/run ; fi'"
```

--------------------------------

### Configure Helm Chart Values in values.yml

Source: https://context7.com/provectus/kafka-ui-docs/llms.txt

This YAML file specifies values for the Kafka UI Helm chart. It includes Kafka cluster configurations, authentication settings, management health checks, resource limits, and ingress configurations.

```yaml
# values.yml - Helm chart values
yamlApplicationConfig:
  kafka:
    clusters:
      - name: production
        bootstrapServers: kafka-broker:9092
      - name: staging
        bootstrapServers: staging-kafka:9092
  auth:
    type: disabled
  management:
    health:
      ldap:
        enabled: false

# Resource limits
resources:
  limits:
    cpu: 1000m
    memory: 1Gi
  requests:
    cpu: 200m
    memory: 512Mi

# Ingress configuration
ingress:
  enabled: true
  hosts:
    - host: kafka-ui.example.com
      paths:
        - path: /
          pathType: Prefix
```

--------------------------------

### Configure Data Masking Policies in Kafka UI

Source: https://github.com/provectus/kafka-ui-docs/blob/main/configuration/data-masking.md

Demonstrates how to define masking policies using YAML configuration or environment variables. These policies target specific fields and apply to topics matching defined regex patterns.

```yaml
kafka:
  clusters:
    - name: ClusterName
      masking:
        - type: REMOVE
          fields: [ "id" ]
          topicKeysPattern: "events-with-ids-.*"
          topicValuesPattern: "events-with-ids-.*"
          
        - type: REPLACE
          fields: [ "companyName", "organizationName" ]
          replacement: "***MASKED_ORG_NAME***"
          topicValuesPattern: "org-events-.*"
        
        - type: MASK
          fields: [ "name", "surname" ]
          maskingCharsReplacement: ["A", "a", "N", "_"]
          topicValuesPattern: "user-states"

        - type: MASK
          topicValuesPattern: "very-secured-topic"
```

```properties
KAFKA_CLUSTERS_0_MASKING_0_TYPE: REMOVE
KAFKA_CLUSTERS_0_MASKING_0_FIELDS_0: "id"
KAFKA_CLUSTERS_0_MASKING_0_TOPICKEYSPATTERN: "events-with-ids-.*"
KAFKA_CLUSTERS_0_MASKING_0_TOPICVALUESPATTERN: "events-with-ids-.*"

KAFKA_CLUSTERS_0_MASKING_1_TYPE: REPLACE
KAFKA_CLUSTERS_0_MASKING_1_FIELDS_0: "companyName"
KAFKA_CLUSTERS_0_MASKING_1_FIELDS_1: "organizationName"
KAFKA_CLUSTERS_0_MASKING_1_REPLACEMENT: "***MASKED_ORG_NAME***"
KAFKA_CLUSTERS_0_MASKING_1_TOPICVALUESPATTERN: "org-events-.*"

KAFKA_CLUSTERS_0_MASKING_2_TYPE: MASK
KAFKA_CLUSTERS_0_MASKING_2_FIELDS_0: "name"
KAFKA_CLUSTERS_0_MASKING_2_FIELDS_1: "surname"
KAFKA_CLUSTERS_0_MASKING_2_MASKING_CHARS_REPLACEMENT_0: 'A'
KAFKA_CLUSTERS_0_MASKING_2_MASKING_CHARS_REPLACEMENT_1: 'a'
KAFKA_CLUSTERS_0_MASKING_2_MASKING_CHARS_REPLACEMENT_2: 'N'
KAFKA_CLUSTERS_0_MASKING_2_MASKING_CHARS_REPLACEMENT_3: '_'
KAFKA_CLUSTERS_0_MASKING_2_TOPICVALUESPATTERN: "user-states"

KAFKA_CLUSTERS_0_MASKING_3_TYPE: MASK
KAFKA_CLUSTERS_0_MASKING_3_TOPICVALUESPATTERN: "very-secured-topic"
```

--------------------------------

### Configure GitHub OAuth Provider for RBAC

Source: https://github.com/provectus/kafka-ui-docs/blob/main/configuration/rbac-role-based-access-control/supported-identity-providers.md

This snippet illustrates configuring GitHub OAuth for RBAC. It allows mapping by 'organization' or 'user'. GitHub authentication must be set up beforehand. The 'provider' is specified as 'oauth_github'.

```yaml
        - provider: oauth_github
          type: organization
          value: "provectus"
        - provider: oauth_github
          type: user
          value: "memelord"
```