Skip to content

v0.1.1-beta

Pre-release
Pre-release

Choose a tag to compare

View all tags
@PetitPrinc3 PetitPrinc3 released this 22 Sep 20:11
· 26 commits to main since this release
v0.1.1-beta
eaa054e

Locking Down the Wire: TLS, SASL & Kerberos for Kafka 🔐

This release turns the Kafka connection from "trusted network only" into something you can actually run over the open wire or against a broker that requires authentication.

✨ Highlights

  • 🔒 TLS support for the Kafka producer (kafka-tls feature) — CA/certificate/key files, with an optional encrypted key password
  • 🔑 SASL authentication — PLAIN/SCRAM-SHA-256/SCRAM-SHA-512 out of the box, Kerberos GSSAPI (kafka-auth-gssapi) and OAuth 2.0/OIDC (kafka-auth-oauth) behind opt-in features
  • 🧩 security.protocol auto-selection — plaintext/ssl/sasl_plaintext/sasl_ssl derived automatically from your [kafka.tls]/[kafka.auth] sections, no manual wiring
  • 🗝️ SecretSource — every credential (password, token, key passphrase) can come from a literal, an environment variable, or a file
  • 🛡️ Unix permission enforcement — NBD refuses to start if a secret-bearing file is group- or world-readable
  • 🧹 Reduced secret retention — the Kafka client config and its copies are explicitly dropped from memory right after the producer is created
  • ⚙️ Fully configurable producer tuning — compression, idempotence, linger, acks, queue size, and in-flight request limits are no longer hard-coded
  • 🚀 New release.yml pipeline — tagged versions now build and publish automatically

🧹 Also in this release

  • 🪵 Cleaner error reporting — fatal errors are now logged through the same tracing pipeline as the rest of the daemon's output (timestamped, leveled), with full context instead of a raw debug dump — e.g. TOML config errors now show the exact line/column and a source snippet

⚠️ Build note

The binaries attached to this release are the standard and with_metrics variants. TLS and SASL/Kerberos/OAuth support are currently opt-in at compile time — until dedicated prebuilt variants ship, build from source to enable them:

cargo build --release --features metrics-exporter,kafka-tls,kafka-auth-gssapi,kafka-auth-oauth

See the Configuration and Build sections of the README for the full [kafka.tls] / [kafka.auth] schema and feature flags.

🚧 Beta status

Still single-maintainer, best-effort. Config schema may keep evolving before 1.0. Feedback welcome via CONTRIBUTING.md; vulnerabilities via SECURITY.md.

📝 Full changelog: CHANGELOG.md

Assets 6
Loading