Skip to content

Conversation

@EricWittmann
Copy link
Member

Summary

This PR addresses the inconsistent naming of KafkaSQL SSL security configuration properties by introducing new properties with the consistent apicurio.kafkasql.security.ssl.* prefix while maintaining full backward compatibility.

  • Added new properties with consistent .security prefix for all SSL configuration
  • Deprecated old apicurio.kafkasql.ssl.* properties with @Deprecated annotations
  • Implemented fallback logic to support both old and new property names seamlessly
  • Added runtime warnings when deprecated properties are used, directing users to migrate
  • Updated documentation to reflect new properties and mark deprecated ones

Related Issue

Fixes #6398

Changes Made

Configuration Properties (KafkaSqlConfiguration.java)

New Properties (consistent naming):

  • apicurio.kafkasql.security.ssl.truststore.password
  • apicurio.kafkasql.security.ssl.keystore.location
  • apicurio.kafkasql.security.ssl.keystore.type
  • apicurio.kafkasql.security.ssl.keystore.password
  • apicurio.kafkasql.security.ssl.key.password

Deprecated Properties (still functional):

  • apicurio.kafkasql.ssl.truststore.password → use apicurio.kafkasql.security.ssl.truststore.password
  • apicurio.kafkasql.ssl.keystore.location → use apicurio.kafkasql.security.ssl.keystore.location
  • apicurio.kafkasql.ssl.keystore.type → use apicurio.kafkasql.security.ssl.keystore.type
  • apicurio.kafkasql.ssl.keystore.password → use apicurio.kafkasql.security.ssl.keystore.password
  • apicurio.kafkasql.ssl.key.password → use apicurio.kafkasql.security.ssl.key.password

Implementation Details

  1. Backward Compatibility: The tryToConfigureClientSecurity() method uses Optional.or() to prefer new property names while falling back to deprecated ones if needed
  2. User Warnings: Added SLF4J logging to warn users when deprecated properties are detected, with clear migration guidance
  3. Documentation: Updated ref-registry-all-configs.adoc to include new properties and mark deprecated ones

Migration Guide

Users currently using the deprecated properties should update their configurations:

Old Property (Deprecated) New Property (Recommended)
apicurio.kafkasql.ssl.truststore.password apicurio.kafkasql.security.ssl.truststore.password
apicurio.kafkasql.ssl.keystore.location apicurio.kafkasql.security.ssl.keystore.location
apicurio.kafkasql.ssl.keystore.type apicurio.kafkasql.security.ssl.keystore.type
apicurio.kafkasql.ssl.keystore.password apicurio.kafkasql.security.ssl.keystore.password
apicurio.kafkasql.ssl.key.password apicurio.kafkasql.security.ssl.key.password

Note: Old properties continue to work but will be removed in a future major version.

Test Plan

  • Verify that new properties work correctly with SSL/TLS configuration
  • Verify that deprecated properties still work (backward compatibility)
  • Verify that fallback logic prefers new properties over deprecated ones
  • Verify that deprecation warnings are logged when old properties are used
  • Verify that no warnings are logged when new properties are used
  • Review documentation updates for accuracy

…ard compatibility

Introduces new configuration properties with the consistent 'apicurio.kafkasql.security.ssl.*' prefix
to align with existing security naming conventions. The old 'apicurio.kafkasql.ssl.*' properties are
deprecated but remain fully functional through fallback logic. Users are warned via logging when using
deprecated properties and are directed to the new property names.

Fixes #6398
@EricWittmann EricWittmann merged commit 9fb286f into main Dec 5, 2025
21 checks passed
@EricWittmann EricWittmann deleted the issues/6398 branch December 5, 2025 01:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Inconsistent use of apicurio.kafkasql.security prefix in KafkaSqlFactory configuration

2 participants