Keith Wall

**Is your feature request related to a problem? Please describe.** Kroxylicious exposes a HTTP interface for the collection of metrics. Even though you wouldn't expect this HTTP interface to be...

Support configuration of TLS cipher suites/protocols in Kafka and HTTP transports

6

**Is your feature request related to a problem? Please describe.** Organisations often has security policies that dictate restrict what TLS protocols and ciphers suites may be used in a production...

Some folks producing derivative distributions of Kroxylicuous might wish to trim dependencies that don't support their use-case (for instance, netty-transport-classes-kqueue.jar for a distribution that doesn't care to support FreeBSD). Currently...

Kroxylicious fails "Unexpected api key: 84" when proxying Confluent Cloud and using the Kaf (sarama based) client

5

**Describe the bug** A clear and concise description of what the bug is. ``` 2023-12-12 18:21:33 ERROR io.kroxylicious.proxy.internal.codec.KafkaRequestDecoder:55 - ChannelHandlerContext(requestDecoder, [id: 0x78da5426, L:/10.244.0.15:30192 - R:/10.244.0.1:10906]): Error in decoder java.lang.IllegalArgumentException: Unexpected...

Absence of PKCS12 keystore password goes undetected until connection time

1

**Describe the bug** If you are using PKCS12 keystores and you misconfigure it in such a way that the password is not passed, the issue goes undetected until the connection...

Strength HashiCorp Vault KMS HTTP interactions against failure cases such as HTTP timeout

2

We could set a hardcoded [timeout](https://docs.oracle.com/en/java/javase/17/docs/api/java.net.http/java/net/http/HttpRequest.Builder.html#timeout(java.time.Duration)) here to match the connect timeout on the client. > Sets a timeout for this request. If the response is not received within the...

This is definitely good enough for this PR, but I think we need to have a conversation about the longer term. Looking at the vault API docs they do seem...

Behaviour of properties such as fetch.min.bytes under the topic encryption use-case

1

Client properties such as `fetch.min.bytes` / `fetch.max.bytes` have interesting implications for topic-encryption. These configuration settings are relayed to the broker via the FetchRequest. They control the amount data returned to...

HashiCorp Vault does not possess an immutable key id.

1

It seems the only kind of key identifier HashiCorp Vault supports is a name. It also supports a delete key operation. So name is not immutable in time and space,...

Computation stages chained to the CompletionStage returned from `context.forwardRequest()` should be able to mutate filter state with thread safety.

2

The filter API already makes this guarantee about chain actions to asynchronous requests: ``` NOTE: Kroxylicious provides the guarantee that the chained stage is completed on the same thread as...