docs: add schema.registry.ca_pem_path option for schema registry

[Copilot]

Documents the new schema.registry.ca_pem_path optional parameter for Confluent Schema Registry connections, which enables custom root CA certificate configuration or TLS verification bypass.

Changes

• changelog/release-notes.mdx: Added v2.8.0 Connectors entry for schema.registry.ca_pem_path.
• ingestion/sources/kafka-config.mdx: Added schema.registry.ca_pem_path to the format/encode parameter table.
• ingestion/formats-and-encoding-options.mdx: Added schema.registry.ca_pem_path to the parameter reference table for all schema-registry-capable format/encode combinations (PLAIN/UPSERT/DEBEZIUM × AVRO, PLAIN/UPSERT × JSON, PLAIN PROTOBUF).

Usage

FORMAT PLAIN ENCODE AVRO (
  schema.registry = 'https://registry:8081',
  schema.registry.username = 'username',
  schema.registry.password = 'password',
  schema.registry.ca_pem_path = '/path/to/ca.pem'  -- or 'ignore' to skip TLS verification
)

-- With secret management
FORMAT PLAIN ENCODE AVRO (
  schema.registry = 'https://registry:8081',
  schema.registry.ca_pem_path = SECRET custom_ca AS FILE
)

Related code PR

risingwavelabs/risingwave#17826

Related doc issue

Checklist

• I have run the documentation build locally to verify the updates are applied correctly.
• For new pages, I have updated mint.json to include the page in the table of contents.
• All links and references have been checked and are not broken.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Document: feat: add ca option for schema registry</issue_title>
<issue_description>This issue tracks the documentation update needed for the merged PR risingwavelabs/risingwave-docs#17826.

Source PR URL: risingwavelabs/risingwave#17826
Source PR Merged At: 2026-03-02T09:14:40Z

If it is a major improvement that deserves a new page or a new section in the documentation, please check if we should label it as an experiment feature.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Document: feat: add ca option for schema registry #1042

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Pull request overview

Adds documentation for the new schema.registry.ca_pem_path SQL option used when connecting to Confluent Schema Registry, including release notes and reference tables for relevant FORMAT/ENCODE combinations.

Changes:

• Adds a v2.8.0 release note entry for schema.registry.ca_pem_path.
• Documents schema.registry.ca_pem_path in Kafka source config options.
• Extends the format/encoding parameter reference table to include schema.registry.ca_pem_path (and adds schema registry username/password rows for Avro).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
changelog/release-notes.mdx	Adds release note item for the new schema registry CA/TLS option.
ingestion/sources/kafka-config.mdx	Adds schema.registry.ca_pem_path to Kafka format/encode parameter list.
ingestion/formats-and-encoding-options.mdx	Updates parameter reference table for schema-registry-capable formats/encodings to include schema.registry.ca_pem_path (and Avro auth rows).

---

You can also share your feedback on Copilot code review. Take the survey.