Skip to content

Update security doc and CHANGES_NEXT_RELEASE #29

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AlvaroVega merged 2 commits into from
Feb 18, 2026
Merged

Update security doc and CHANGES_NEXT_RELEASE #29

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
15c1499
Add forgotten update CHANGES_NEXT_RELEASE
GregorioBlazquez Feb 18, 2026
9681d97
Add important note about internal kafnus-connect topics
GregorioBlazquez Feb 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGES_NEXT_RELEASE
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
- Fix: allow empty fiware-servicepath in DM_BY_ENTITY_TYPE_DATABASE datamodel (#27)
- Fix Openjdk (minor) version to 17.0.1 in Dockerfile (#12)
- Refactor HeaderRouter SMT to use datamodel-based dynamic schema/table routing with NGSI headers and optional suffix support (#13)
- Add support for secure Kafka SASL protocols (#28)
- Add MongoNamespacePrefix SMT for configurable MongoDB database and collection name prefixing (#15)
22 changes: 22 additions & 0 deletions doc/technical_configuration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,6 +127,28 @@ These variables are automatically applied by the `docker-entrypoint.sh` script w

This ensures that all Kafka connections (incoming and outgoing) respect the authentication settings without modifying connector definitions directly.

#### ⚠️ Protect Internal Kafka Connect Topics

When running Kafnus-Connect in distributed mode, Kafka Connect stores connector configurations and status information in internal Kafka topics (e.g., `connect-config`, `connect-offsets`, `connect-status`).

⚠️ These topics may contain fully resolved connector configurations, including sensitive information such as:

- Database credentials
- API tokens
- Authentication passwords
- Connection strings

For this reason:

- **Do not expose these topics externally**
- Restrict access using Kafka ACLs
- Ensure only the Connect worker principal has read/write permissions
- Never grant broad topic access (e.g., `User:*`) in production environments

In particular, access to `connect-config` must be strictly limited, as it stores connector configurations in plain form.

Securing Kafka itself (SASL + ACLs) is therefore mandatory in production deployments to prevent credential leakage via internal topics.

---

## 🧩 Kafnus Connect Plugins
Expand Down