Keith Wall

Better detect a invalid/expired Vault token

3

If the `EnvelopeEncryption` configuration passes an invalid or expired token to Vault when trying to perform an encryption operation, the filter will get a `403` response and the filter will...

Support variable expansion (environment and system properties) in Kroxylicious config

11

### Type of change - Enhancement / new feature ### Description Working on example content for Kroxylicious got me thinking that the current config file is pretty inflexible. You often...

In due course, we will want ensure that kroxy works with librdkafka based clients. We may need a simple python/go test suit which can also orchestrate brokers/kroxy. We'd want to...

Metrics labels use camel case rather than snake case.

2

**Describe the bug** Advice from the Prometheus community is to favour snake case over camel case for metric names. I think that advice extends to label names too. Kroxylicious uses...

Release process should automate the 'release' stage of the release process down to a single manual step

1

**Is your feature request related to a problem? Please describe.** We currently have a `stage` workflow step which involves running a workflow action followed by a `release`. 1. The `stage`...

Think about behaviour of RecordEncryption when the KMS is unavailable

16

We do need to think about what we should do with produce and fetch requests when then KMS is unavailable I'm not sure we should just reject them because they...

Should we also have a glossary of terms? Where?

2

- Should we also have a glossary of terms. e.g. DEK, KEK, KMS? - Should it be project wide or should filters have a scoped glossary of terms? _Originally posted...

Do we have a way to know which offset to seek to? _Originally posted by @showuon in https://github.com/kroxylicious/kroxylicious/pull/932#discussion_r1482341346_ If a user deletes a key (or key version) that is still...

[Kafka 3.7] KIP-848 MultiTenantFilter - next gen consumer rebalance

4

Whilst reviewing changes in 3.7, [KIP-848](https://cwiki.apache.org/confluence/display/KAFKA/KIP-848%3A+The+Next+Generation+of+the+Consumer+Rebalance+Protocol) came to my attention. KIP-848 isn't completely delivered, but some parts have made it into Kafka 3.7. The MultiTenantFilter is aware of the old...

Enforce minimum access rights on any confidential files

1

**Is your feature request related to a problem? Please describe.** Kroxylicious has the ability to consume passwords and private key material from the filesystem. In order to comply with security...