application.conf

ksm {
  debug = false
  debug = ${?KSM_DEBUG}

  extract {
    enable = false
    enable = ${?KSM_EXTRACT_ENABLE}
    format = csv
    format = ${?KSM_EXTRACT_FORMAT}
  }

  num.failed.refreshes.before.notification = 1
  num.failed.refreshes.before.notification = ${?KSM_NUM_FAILED_REFRESHES_BEFORE_NOTIFICATION}

  refresh.frequency.ms = 10000
  refresh.frequency.ms = ${?KSM_REFRESH_FREQUENCY_MS}

  readonly = true
  readonly = ${?KSM_READONLY}

}

parser {
  csv {
    delimiter = ","
    delimiter = ${?ACL_PARSER_CSV_DELIMITER}
  }
}

authorizer {
  class = "kafka.security.auth.SimpleAclAuthorizer"
  class = ${?AUTHORIZER_CLASS}
  admin-client-config {
    // options below needed when AUTHORIZER_CLASS is "io.conduktor.ksm.compat.AdminClientAuthorizer"
    // see org.apache.kafka.clients.admin.AdminClientConfig for more options
    "client.id"               = "kafka-security-manager"
    "client.id"               = ${?ADMIN_CLIENT_ID}
    "bootstrap.servers"       = ${?ADMIN_CLIENT_BOOTSTRAP_SERVERS}
    "security.protocol"       = ${?ADMIN_CLIENT_SECURITY_PROTOCOL}
    "sasl.jaas.config"        = ${?ADMIN_CLIENT_SASL_JAAS_CONFIG}
    "sasl.mechanism"          = ${?ADMIN_CLIENT_SASL_MECHANISM}
    "ssl.key.password"        = ${?ADMIN_CLIENT_SSL_KEY_PASSWORD}
    "ssl.keystore.location"   = ${?ADMIN_CLIENT_SSL_KEYSTORE_LOCATION}
    "ssl.keystore.password"   = ${?ADMIN_CLIENT_SSL_KEYSTORE_PASSWORD}
    "ssl.truststore.location" = ${?ADMIN_CLIENT_SSL_TRUSTSTORE_LOCATION}
    "ssl.truststore.password" = ${?ADMIN_CLIENT_SSL_TRUSTSTORE_PASSWORD}
  }
  config {
    "zookeeper.connect" = "localhost:2181"
    "zookeeper.connect" = ${?AUTHORIZER_ZOOKEEPER_CONNECT}
    "zookeeper.connection.timeout.ms" = ${?AUTHORIZER_CONNECTION_TIMEOUT_MS}
    "zookeeper.session.timeout.ms" = ${?AUTHORIZER_SESSION_TIMEOUT_MS}
    "zookeeper.set.acl" = "false"
    "zookeeper.set.acl" = ${?AUTHORIZER_ZOOKEEPER_SET_ACL}
  }
}

source {
  // we default to a no "source" acl
  class = "io.conduktor.ksm.source.NoSourceAcl"
  class = ${?SOURCE_CLASS}
  file {
    filename = "example/acls.csv"
    filename = ${?SOURCE_FILE_FILENAME}
  }
  github {
    user = "conduktor"
    user = ${?SOURCE_GITHUB_USER}
    repo = "kafka-security-manager"
    repo = ${?SOURCE_GITHUB_REPO}
    filepath = "example/acls.csv"
    filepath = ${?SOURCE_GITHUB_FILEPATH}
    branch = "master"
    branch = ${?SOURCE_GITHUB_BRANCH}
    hostname = "api.github.com"
    // hostname for private github is: hostname/api/v3
    hostname = ${?SOURCE_GITHUB_HOSTNAME}
    auth {
      // of the form username:password or username:token
      basic = ${?SOURCE_GITHUB_BASIC}
      // oauth2 token or SAML token
      token = ${?SOURCE_GITHUB_TOKEN}
    }
  }
  gitlab {
    repoid = ${?SOURCE_GITLAB_REPOID}
    filepath = "example/acls.csv"
    filepath = ${?SOURCE_GITLAB_FILEPATH}
    branch = "master"
    branch = ${?SOURCE_GITLAB_BRANCH}
    hostname = "gitlab.com"
    // hostname for private gitlab is: $hostname/api/v4
    hostname = ${?SOURCE_GITLAB_HOSTNAME}
    accesstoken = ${?SOURCE_GITLAB_ACCESSTOKEN}
  }
  s3 {
    region = ${?SOURCE_S3_REGION}
    bucketname = ${?SOURCE_S3_BUCKETNAME}
    objectkey = ${?SOURCE_S3_OBJECTKEY}
  }
  bitbucket-server {
    hostname = "localhost"
    hostname = ${?SOURCE_BITBUCKET_SERVER_HOSTNAME}
    port = "7990"
    port = ${?SOURCE_BITBUCKET_SERVER_PORT}
    protocol = "http"
    protocol = ${?SOURCE_BITBUCKET_SERVER_PROTOCOL}
    project = "KAF"
    project = ${?SOURCE_BITBUCKET_SERVER_PROJECT}
    repo = "kafka-acls"
    repo = ${?SOURCE_BITBUCKET_SERVER_REPO}
    filepath = "acls.csv"
    filepath = ${?SOURCE_BITBUCKET_SERVER_FILEPATH}
    branch = ${?SOURCE_BITBUCKET_SERVER_BRANCH}
    auth {
      username = ${?SOURCE_BITBUCKET_SERVER_AUTH_USERNAME}
      password = ${?SOURCE_BITBUCKET_SERVER_AUTH_PASSWORD}
    }
  }
  bitbucket-cloud {
    api {
      url = "https://api.bitbucket.org/2.0"
      url = ${?SOURCE_BITBUCKET_CLOUD_API_URL}
    }

   organization = ${?SOURCE_BITBUCKET_CLOUD_ORGANIZATION}
   repo = "kafka-acls"
   repo = ${?SOURCE_BITBUCKET_CLOUD_REPO}
   filepath = "acls.csv"
   filepath = ${?SOURCE_BITBUCKET_CLOUD_FILEPATH}
   auth {
      username = ${?SOURCE_BITBUCKET_CLOUD_AUTH_USERNAME}
      password = ${?SOURCE_BITBUCKET_CLOUD_AUTH_PASSWORD}
    }
  }
  http {
    url = ${?SOURCE_HTTP_URL}

    parser = "csv"
    parser = ${?SOURCE_HTTP_PARSER}


    method = "GET"
    method = ${?SOURCE_HTTP_METHOD}

    auth {
        type = "NONE"
        type = ${?SOURCE_HTTP_AUTH_TYPE}
        googleiam {
            service-account = ""
            service-account = ${?SOURCE_HTTP_AUTH_GOOGLEIAM_SERVICE_ACCOUNT}

            service-account_key = ""
            service-account-key = ${?SOURCE_HTTP_AUTH_GOOGLEIAM_SERVICE_ACCOUNT_KEY}

            target-audience = ""
            target-audience = ${?SOURCE_HTTP_AUTH_GOOGLEIAM_TARGET_AUDIENCE}
        }
    }
  }
}

notification {
  class = "io.conduktor.ksm.notification.ConsoleNotification"
  class = ${?NOTIFICATION_CLASS}
  console {

  }
  slack {
    // https://hooks.slack.com/services/etc/etc/etc
    webhook = ${?NOTIFICATION_SLACK_WEBHOOK}
    username = "Kafka Security Manager"
    username = ${?NOTIFICATION_SLACK_USERNAME}
    icon = "https://cdn.iconscout.com/public/images/icon/free/png-512/kafka-logo-brand-3f2f9aed5b9ae1e2-512x512.png"
    icon = ${?NOTIFICATION_SLACK_ICON}
    channel = "general"
    channel = ${?NOTIFICATION_SLACK_CHANNEL}
  }
}