ntk v1.2.0

Log in to more managed Kafka services, with OAUTHBEARER and AWS MSK IAM, and decide per profile what happens with destructive commands.

Breaking changes

• --confirm and typed confirmation are gone. Destructive commands no longer ask you to type a name. Each profile's new deletion_prevention setting decides instead (see below), and the default asks y/N. Remove --confirm from scripts; -y is all they need.
• Profile labels are gone, and prod is no longer special. The labels field and --labels flag were removed, so a prod label no longer changes how ntk confirms anything. To protect a production profile, set ntk profile edit prod --set deletion_prevention=always, or --set read_only=true.
• Tombstones on compacted topics and unclean leader elections now count as destructive. With the default setting they ask first, so a script that sends tombstones without -y will stop and ask. Add -y, or set deletion_prevention to never on that profile.

Highlights

• OAUTHBEARER authentication, for Confluent Cloud, Strimzi with Keycloak, Azure Event Hubs and other OAuth setups. The token comes from client credentials (ntk fetches it from your identity provider), a file another tool keeps up to date, or a command that prints it. Tokens from an identity provider are cached between runs until shortly before they expire. SASL extensions are supported for services that need them, such as Confluent Cloud's logicalCluster.
• AWS MSK IAM authentication. ntk finds AWS credentials the way the AWS CLI does (environment, ~/.aws profiles including SSO, EC2, ECS and EKS roles), and you can name an AWS profile or a role to assume.
• deletion_prevention on every profile. always refuses destructive commands, even with -y; prompt, the default, shows the plan and asks; never just runs them. --dry-run always works.
• Every profile gets its own colour. New profiles get a colour no other profile uses, shown in prompts and the TUI header. You can still set one yourself, as a hex value like #ff00ee or a name like red.

Install

• Binaries for Linux (amd64, arm64, armv7), macOS (Intel and Apple silicon), Windows (amd64, arm64) and FreeBSD (amd64) are attached below, each with a .sha256 file.
• Docker: ghcr.io/ntailio/ntk:v1.2.0, also tagged latest
• Go: go install github.com/ntailio/ntk/cmd/ntk@v1.2.0

ntk v1.1.0

Windows gets the same pipe-friendly messaging as Linux and macOS: named pipes now do what Unix sockets do elsewhere.

Highlights

• Named pipes on Windows. consume -o npipe:<name> sends each Kafka message as one pipe message, and produce --in npipe:<name> creates a pipe and produces every message written to it, from any number of senders at once. It works like the Unix socket support: -m carries keys, headers and tombstones, --npipe-wait waits for the pipe to appear, --receipt and --idle-timeout work as you'd expect, and ctrl-c produces whatever was already sent before exiting. orders is short for \\.\pipe\orders.

  ntk -p staging p orders --in npipe:orders -m
  ntk -p prod c orders -f -m -o npipe:orders --npipe-wait

• A .sha256 next to every binary. Instead of one combined checksums file, each download now has its own, so sha256sum -c ntk-v1.1.0-linux-amd64.sha256 checks just the file you downloaded.

Fixes

• topic add-partitions waits until the new partitions are everywhere. It used to return as soon as the controller accepted the change, so a describe or produce right after it could still see the old partition count on some brokers.

Install

• Binaries for Linux (amd64, arm64, armv7), macOS (Intel and Apple silicon), Windows (amd64, arm64) and FreeBSD (amd64) are attached below, each with a .sha256 file.
• Docker: ghcr.io/ntailio/ntk:v1.1.0, also tagged latest
• Go: go install github.com/ntailio/ntk/cmd/ntk@v1.1.0

Good to know

• Windows is now fully supported. Everything that used a Unix socket has a named pipe equivalent.
• Includes the fix from v1.0.1 for messages lost when stopping produce --in unix:.

ntk v1.0.1

A bug fix release for the Unix socket input.

Fixes

• Stopping produce --in unix: no longer loses messages. On ctrl-c or SIGTERM, ntk is meant to produce every message already waiting on the socket before it exits. A timing issue could make it stop reading too early, so messages that had already been sent to the socket were dropped. It now reads the whole queue every time.

Install

• Binaries for Linux (amd64, arm64, armv7), macOS (Intel and Apple silicon), Windows (amd64, arm64) and FreeBSD (amd64) are attached below, with a checksums file.
• Docker: ghcr.io/ntailio/ntk:v1.0.1
• Go: go install github.com/ntailio/ntk/cmd/ntk@v1.0.1

ntk v1.0.0

The first stable release of ntk, a CLI and terminal UI for Apache Kafka. It covers the day-to-day work of inspecting clusters, moving messages, watching lag and fixing things, in a single binary.

Highlights

• Profiles for every cluster: keep connection details for all your clusters in one file and switch with -p. Supports plaintext, TLS, mTLS (including encrypted keys) and SASL PLAIN or SCRAM. ntk profile create walks you through it, can import a Java client.properties, and ntk profile test checks DNS, TCP, TLS, SASL and metadata one step at a time.
• Topics: list, describe, create with presets, change configs with human units like 7d or 4MiB, add partitions, truncate, reassign replicas and run leader elections.
• Consume and produce as raw bytes: no decoding, no surprises. Read from any position (--from -1h, -10, @offset), pipe values to other tools, export to lossless JSON Lines and replay them with produce --in jsonl.
• A command per message: consume -o exec:<command> runs a command for each message with the bytes on stdin and the key, partition and offset in NTK_* variables.
• Mirroring: copy a topic between clusters with produce --from-topic --from-profile, through a pipe with -m, or over a Unix socket with consume -o unix: and produce --in unix:. Keys, headers and tombstones are kept.
• Consumer groups: lag per partition, members and assignments, and offset resets that show a dry run until you add --execute, in the CLI and in the TUI, where partition lists like orders:0,3-5 work too. Classic groups, the new consumer protocol and share groups are all understood.
• Monitoring: live throughput and lag with topic watch and group watch, rankings with top, time lag and an ETA to catch up, stuck-consumer detection, and ntk health for a one-line cluster check. group lag and health exit non-zero on problems, so they work in scripts and CI.
• Access control: ACLs granted by role (acl grant consumer, producer, streams-app and more), acl check to see why a principal can or can't do something, export and import, SCRAM users and quotas.
• Transactions: find hanging transactions that block consumers, and abort them.
• Terminal UI: run ntk to browse topics, messages, groups, ACLs and cluster health, with the same safety checks as the CLI.
• Safe by default: risky changes show a plan and ask before doing anything, and --dry-run previews any change to the cluster without touching it, including produce. Read-only profiles refuse writes. Deleting topics by pattern, and anything destructive on a prod profile, needs a typed confirmation, and acl delete refuses filters that would match ACLs across the whole cluster.

Install

• Binaries for Linux (amd64, arm64, armv7), macOS (Intel and Apple silicon), Windows (amd64, arm64) and FreeBSD (amd64) are attached below, with a checksums file.
• Docker: ghcr.io/ntailio/ntk:v1.0.0, also tagged latest
• Go: go install github.com/ntailio/ntk/cmd/ntk@v1.0.0

Good to know

• Tested against Apache Kafka 4.3 in KRaft mode.
• OAUTHBEARER, AWS MSK IAM and Kerberos authentication aren't supported yet.
• On Windows, everything works except the Unix socket input and output.
• Coming from v1.0.0-rc.1? topic delete --regex with -y now also needs --confirm, and acl delete needs a --principal or a resource.

ntk v1.0.0-rc.1

The first release candidate of ntk, a CLI and terminal UI for Apache Kafka. It covers the day-to-day work of inspecting clusters, moving messages, watching lag and fixing things, in a single binary. Please try it against your clusters and open an issue for anything that breaks or feels wrong before v1.0.0.

Highlights

• Profiles for every cluster: keep connection details for all your clusters in one file and switch with -p. Supports plaintext, TLS, mTLS (including encrypted keys) and SASL PLAIN or SCRAM. ntk profile create walks you through it, can import a Java client.properties, and ntk profile test checks DNS, TCP, TLS, SASL and metadata one step at a time.
• Topics: list, describe, create with presets, change configs with human units like 7d or 4MiB, add partitions, truncate, reassign replicas and run leader elections.
• Consume and produce as raw bytes: no decoding, no surprises. Read from any position (--from -1h, -10, @offset), pipe values to other tools, export to lossless JSON Lines and replay them with produce --in jsonl.
• A command per message: consume -o exec:<command> runs a command for each message with the bytes on stdin and the key, partition and offset in NTK_* variables.
• Mirroring: copy a topic between clusters with produce --from-topic --from-profile, through a pipe with -m, or over a Unix socket with consume -o unix: and produce --in unix:. Keys, headers and tombstones are kept.
• Consumer groups: lag per partition, members and assignments, and offset resets that show a dry run until you add --execute. Classic groups, the new consumer protocol and share groups are all understood.
• Monitoring: live throughput and lag with topic watch and group watch, rankings with top, time lag and an ETA to catch up, stuck-consumer detection, and ntk health for a one-line cluster check. group lag and health exit non-zero on problems, so they work in scripts and CI.
• Access control: ACLs granted by role (acl grant consumer, producer, streams-app and more), acl check to see why a principal can or can't do something, export and import, SCRAM users and quotas.
• Transactions: find hanging transactions that block consumers, and abort them.
• Terminal UI: run ntk to browse topics, messages, groups, ACLs and cluster health, with the same safety checks as the CLI.
• Safe by default: changes to topics, configs, groups and ACLs show a plan first and can be previewed with --dry-run, read-only profiles refuse writes, and prod profiles ask you to type the name before anything destructive.

Install

• Binaries for Linux (amd64, arm64, armv7), macOS (Intel and Apple silicon), Windows (amd64, arm64) and FreeBSD (amd64) are attached below, with a checksums file.
• Docker: ghcr.io/ntailio/ntk:v1.0.0-rc.1
• Go: go install github.com/ntailio/ntk/cmd/ntk@v1.0.0-rc.1

Good to know

• Tested against Apache Kafka 4.3 in KRaft mode.
• OAUTHBEARER, AWS MSK IAM and Kerberos authentication aren't supported yet.
• On Windows, everything works except the Unix socket input and output.
• This is a release candidate, so command flags may still change before v1.0.0.