Skip to content

Add auth and docker documentation #348

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion INTRODUCTION.md
Original file line number Diff line number Diff line change
Expand Up @@ -1102,7 +1102,10 @@ const producer = new Kafka().producer({
});
```

For a special case of OAuthBearer token authentication, where the token is fetched from an OIDC provider using the `client_credentials` grant type, the library provides a built-in callback, which can be set through just the configuration without any custom function required:
For a special case of OAuthBearer token authentication where the token is fetched from an OIDC provider using the `client_credentials` or `jwt_bearer` grant type, the library provides a built-in mechanism for authentication.
Copy link
Preview

Copilot AI Jul 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing comma after 'authentication'. Should be: 'For a special case of OAuthBearer token authentication, where the token is fetched from an OIDC provider using the client_credentials or jwt_bearer grant type, the library provides a built-in mechanism for authentication.'

Suggested change
For a special case of OAuthBearer token authentication where the token is fetched from an OIDC provider using the `client_credentials` or `jwt_bearer` grant type, the library provides a built-in mechanism for authentication.
For a special case of OAuthBearer token authentication, where the token is fetched from an OIDC provider using the `client_credentials` or `jwt_bearer` grant type, the library provides a built-in mechanism for authentication.

Copilot uses AI. Check for mistakes.

No `oauthbearer_token_refresh_cb` needs to be provided in these cases. Instead, authentication can be set through just the configuration.

If using `client_credentials` grant type, you can do the following:

```js
const producer = new Kafka().producer({
Expand All @@ -1118,6 +1121,8 @@ const producer = new Kafka().producer({
});
```

If using `jwt_bearer` grant type, refer to the [librdkafka documentation](https://github.com/confluentinc/librdkafka/blob/master/INTRODUCTION.md#jwt-bearer-grant-type-kip-1139).

These examples are for the promisified API, but the callback-based API can be used with the same configuration settings.

## Installation Instructions
Expand Down
45 changes: 26 additions & 19 deletions examples/node-rdkafka/docker-alpine.md
Original file line number Diff line number Diff line change
@@ -1,30 +1,37 @@
When using docker to install `confluent-kafka-javascript`, you need to make sure you install appropriate library dependencies. Alpine linux is a lighter weight version of linux and does not come with the same base libraries as other distributions (like glibc).
# Dockerfile for confluent-kafka-javascript

You can see some of the differences here: https://linuxacademy.com/blog/cloud/alpine-linux-and-docker/
A sample Dockerfile to run the `confluent-kafka-javascript` library using Node.js:

```dockerfile
FROM node:14-alpine

RUN apk --no-cache add \
bash \
g++ \
ca-certificates \
lz4-dev \
musl-dev \
cyrus-sasl-dev \
openssl-dev \
make \
python3

RUN apk add --no-cache --virtual .build-deps gcc zlib-dev libc-dev bsd-compat-headers py-setuptools bash
# The official (Debian-based) and Alpine-based Node.js images are both useable.
FROM node:24

# Create app directory
RUN mkdir -p /usr/local/app

# Move to the app directory
WORKDIR /usr/local/app

# Install confluent-kafka-javascript
RUN npm install confluent-kafka-javascript
# Copy package.json first to check if an npm install is needed
# Copy relevant files
COPY . .

# Install application dependencies, if node_modules is not already present.
RUN npm install

# Rebuild the @confluentinc/kafka-javascript package for this environment. See
# below for more details on why this is necessary, and if you can skip this step.
RUN rm -rf node_modules/@confluentinc/kafka-javascript
RUN npm install @confluentinc/kafka-javascript

# Start application
CMD ["node", "index.js"]
```

`confluent-kafka-javascript` contains platform specific binary code (to talk to the underlying C library).
Depending on the OS, platform, architecture, and the libc type (glibc or musl), a different binary is required.

The correct binary is downloaded from GitHub when installing the package for the first time, however, if you copy
the `node_modules` directory from a different environment (e.g., your local machine) into the Docker container, it may not work correctly due to platform differences.

If you can ensure that the `node_modules` directory is not copied into the Docker container, or that the platform
where the image is built is identical to the Docker container's platform, you can skip the reinstallation step.