Conduktor Console environment variables reference

Docker image environment variables

Environment variable	Description	Default value	Since Console version
Logs
`CDK_DEBUG`	Enable Console debug logs (equivalent to `CDK_ROOT_LOG_LEVEL=DEBUG`)	`false`	1.0.0
`CDK_ROOT_LOG_LEVEL`	Set the Console global log level (one of `DEBUG`, `INFO`, `WARN`, `ERROR`)	`INFO`	1.11.0
`CDK_ROOT_LOG_FORMAT`	Set logs format (one of `TEXT`, `JSON`)	`TEXT`	1.26.0
`CDK_ROOT_LOG_COLOR`	Enable ANSI colors in logs	`true`	1.11.0
`CDK_LOG_TIMEZONE`	Timezone for dates in logs (in Olson timezone ID format, e.g. `Europe/Paris`)	`TZ` environment variable or `UTC` if `TZ` is not defined	1.28.0
Proxy settings
`CDK_HTTP_PROXY_HOST`	Proxy hostname	∅	1.10.0
`CDK_HTTP_PROXY_PORT`	Proxy port	`80`	1.10.0
`CDK_HTTP_NON_PROXY_HOSTS`	List of hosts that should be reached directly, bypassing the proxy. Hosts must be separated by `\|`, end with a `*` for wildcards, and not contain any `/`.	∅	1.10.0
`CDK_HTTP_PROXY_USERNAME`	Proxy username	∅	1.10.0
`CDK_HTTP_PROXY_PASSWORD`	Proxy password	∅	1.10.0
SSL
`CDK_SSL_TRUSTSTORE_PATH`	Truststore file path used by Console for Kafka, SSO, S3,… clients SSL/TLS verification	∅	1.5.0
`CDK_SSL_TRUSTSTORE_PASSWORD`	Truststore password (optional)	∅	1.5.0
`CDK_SSL_TRUSTSTORE_TYPE`	Truststore type (optional)	`jks`	1.5.0
`CDK_SSL_DEBUG`	Enable SSL/TLS debug logs	`false`	1.9.0
Java
`CDK_GLOBAL_JAVA_OPTS`	Custom JAVA_OPTS parameters passed to Console	∅	1.10.0
`CONSOLE_MEMORY_OPTS`	Configure Java memory options	`-XX:+UseContainerSupport -XX:MaxRAMPercentage=80`	1.18.0
Console
`CDK_LISTENING_PORT`	Console listening port	`8080`	1.2.0
`CDK_VOLUME_DIR`	Volume directory where Console stores data	`/var/conduktor`	1.0.2
`CDK_IN_CONF_FILE`	Console configuration file location	`/opt/conduktor/default-platform-config.yaml`	1.0.2
`CDK_PLUGINS_DIR`	Volume directory for Custom Deserializer plugins	`/opt/conduktor/plugins`	1.22.0
Nginx
`PROXY_BUFFER_SIZE`	Tune internal Nginx `proxy_buffer_size`	`8k`	1.16.0

Console properties reference

You can configure Console via environment variables or using the YAML file. Environment variables can be set on the container or imported from a file. When importing from a file, mount the file into the container and provide its path by setting the environment variable CDK_ENV_FILE. Use the .env file with key value pairs.

MY_ENV_VAR1=value
MY_ENV_VAR2=otherValue

The logs will confirm, Sourcing environment variables from $CDK_ENV_FILE, or warn if set and the file is not found

Warning: CDK_ENV_FILE is set but the file does not exist or is not readable.

Lists start at index 0 and are provided using the _idx_ syntax.If you set both the environment variable and a YAML value for a specific field, the environment variable will take precedence.

YAML property cases

YAML configuration supports multiple case formats (camelCase/kebab-case/lowercase) for property fragments such as:

clusters[].schemaRegistry.ignoreUntrustedCertificate
clusters[].schema-registry.ignore-untrusted-certificate
clusters[].schemaregistry.ignoreuntrustedcertificate

All are valid and equivalent in YAML.

Environment variable conversion

At startup, Conduktor Console will merge environment variables and YAML based configuration files into one unified configuration. The conversion rules are:

Filter for environment variables that start with CDK_
Remove the CDK_ prefix
Convert the variable name to lower case
Replace _ with . for nested properties
Replace _[0-9]+_ with [0-9]. for list properties. Lists start at index 0.

For example, the environment variable CDK_DATABASE_URL will be converted to database.url; CDK_SSO_OAUTH2_0_OPENID_ISSUER will be converted to sso.oauth2[0].openid.issuer. The YAML equivalent would be:

database:
  url: "..."
sso:
  oauth2:
    - openid:
        issuer: "..."

When converting environment variables to YAML configuration, environment variables in UPPER-KEBAB-CASE will be converted to kebab-case in the YAML configuration.

Conversion edge cases

Because of YAML multiple case formats support, the conversion rules have some edge cases when trying to mix environment variables and YAML configuration. Extra rules when mixing environment variables and YAML configuration:

Don’t use camelCase in YAML configuration. Use kebab-case or lowercase
Stick to one compatible case format for a given property fragment using the following compatibility matrix

Compatibility matrix:

YAML\Environment	`UPPER-KEBAB-CASE`	`UPPERCASE`
`kebab-case`	✅	🚫
`lowercase`	🚫	✅
`camelCase`	🚫	🚫

For example, the CDK_CLUSTERS_0_SCHEMAREGISTRY_IGNOREUNTRUSTEDCERTIFICATE environment variable :

# Is equivalent to and compatible with
clusters:
  - schemaregistry:
      ignoreuntrustedcertificate: true
# but not with
clusters:
  - schema-registry:
      ignore-untrusted-certificate: true

And conversely, for CDK_CLUSTERS_0_SCHEMA-REGISTRY_IGNORE-UNTRUSTED-CERTIFICATE environment variable. That’s why camelCase is not recommended in YAML configuration when mixing with environment variables.

Shell expansion in the YAML configuration file

Console supports shell expansion for environment variables and home tilde ~. This is useful if you have to use custom environment variables in your configuration. For example, you can use the following syntax:

YAML configuration file

database:
  url: "jdbc:postgresql://${DB_LOGIN}:${DB_PWD}@${DB_HOST}:${DB_PORT:-5432}/${DB_NAME}"

with the following environment variables:

Environment variable	Value
`DB_LOGIN`	`usr`
`DB_PWD`	`pwd`
`DB_HOST`	`some_host`
`DB_NAME`	`cdk`

This will be expanded to:

Expanded configuration

database:
  url: "jdbc:postgresql://usr:pwd@some_host:5432/cdk"

If you want to escape the shell expansion, you can use the following syntax: $$. For example, if you want admin.password to be secret$123, set admin.password: "secret$$123".

Support for *_FILE environment variables

When an environment variable ending with _FILE is set to a file path, its corresponding unprefixed environment variable will be replaced with the content of that file. For instance, if you set CDK_LICENSE_FILE=/run/secrets/license, the value of CDK_LICENSE will be overridden by the content of the file located at /run/secrets/license.

The CDK_IN_CONF_FILE is not supported.

Global properties

Property	Description	Environment variable	Mandatory	Type	Default
`organization.name`	Your organization’s name	`CDK_ORGANIZATION_NAME`	false	string	`"default"`
`admin.email`	Your organization’s root administrator account email	`CDK_ADMIN_EMAIL`	true	string	∅
`admin.password`	Your organization’s root administrator account password. Must be at least 8 characters in length, and include at least 1 uppercase letter, 1 lowercase letter, 1 number, and 1 special symbol	`CDK_ADMIN_PASSWORD`	true	string	∅
`license`	Enterprise license key. If not provided, fallback to free plan.	`CDK_LICENSE` or `LICENSE_KEY`	false	string	∅
`platform.external.url`	Force Console external URL. Useful for SSO callback URL when using a reverse proxy. Can include a context path (e.g., `https://mycompany.com/conduktor`) for context path deployments (since 1.41.0). By default, Console will try to guess it automatically using X-Forwarded-* headers coming from upstream reverse proxy.	`CDK_PLATFORM_EXTERNAL_URL`	false	string	∅
`platform.https.cert.path`	Path to the SSL certificate file	`CDK_PLATFORM_HTTPS_CERT_PATH`	false	string	∅
`platform.https.key.path`	Path to the SSL private key file	`CDK_PLATFORM_HTTPS_KEY_PATH`	false	string	∅
`enable_product_metrics`	In order to improve Conduktor Console, we collect anonymous usage metrics. With an enterprise license, if set to `false`, this configuration disables all of our metrics collection. With a community license this property cannot be disabled and product metrics will always be collected.	`CDK_ENABLE_PRODUCT_METRICS`	false	boolean	`true`

Database properties

Console uses PostgreSQL to persist application state and operational data. The database maintains user accounts and their group memberships, along with associated permissions and role-based access controls. It also stores your cluster definitions and connection details, indexed metadata from connected clusters (including topics, schemas, and connectors), alert configurations and audit log entries that track system activity.

Property	Description	Environment variable	Mandatory	Type	Default
`database.url`	External PostgreSQL configuration URL in format `[jdbc:]postgresql://[user[:password]@][[netloc][:port],...][/dbname][?param1=value1&...]`	`CDK_DATABASE_URL`	false	string	∅
`database.hosts[].host`	External PostgreSQL servers hostname	`CDK_DATABASE_HOSTS_0_HOST`	false	string	∅
`database.hosts[].port`	External PostgreSQL servers port	`CDK_DATABASE_HOSTS_0_PORT`	false	int	∅
`database.host`	External PostgreSQL server hostname (Deprecated, use `database.hosts` instead)	`CDK_DATABASE_HOST`	false	string	∅
`database.port`	External PostgreSQL server port (Deprecated, use `database.hosts` instead)	`CDK_DATABASE_PORT`	false	int	∅
`database.name`	External PostgreSQL database name	`CDK_DATABASE_NAME`	false	string	∅
`database.username`	External PostgreSQL login role	`CDK_DATABASE_USERNAME`	false	string	∅
`database.password`	External PostgreSQL login password	`CDK_DATABASE_PASSWORD`	false	string	∅
`database.connection_timeout`	External PostgreSQL connection timeout in seconds	`CDK_DATABASE_CONNECTIONTIMEOUT`	false	int	∅
`database.options`	External PostgreSQL options (available via YAML configuration only)		false	map	∅
`CDK_DATABASE_CONNECTION_POOL_SIZE`	External PostgreSQL connection pool size (via environment variable only)	`CDK_DATABASE_CONNECTION_POOL_SIZE`	false	int	15

Example configuration for PostgreSQL connection options:

database:
  hosts:
    host: localhost
    port: 5432
  name: postgres
  username: postgres
  password: password
  options:
    socketTimeout: "30"
    tcpKeepAlive: "true"
    keepaliveTime: "30000"
    application_name: "myapp"

To pass options via environment variable, use CDK_DATABASE_URL. The equivalent of the above configuration is:

CDK_DATABASE_URL="jdbc:postgresql://postgres:password@localhost:5432/database?socketTimeout=30&tcpKeepAlive=true&keepaliveTime=30000&application_name=myapp"

Console supports all valid JDBC PostgreSQL configuration options. For Hikari configuration, only the following options are supported:

keepaliveTime
connectionTimeout
idleTimeout
maxLifetime

Session lifetime properties

Property	Description	Environment variable	Mandatory	Type	Default value
`auth.sessionLifetime`	Max session lifetime in seconds	`CDK_AUTH_SESSIONLIFETIME`	false	int	`259200`
`auth.idleTimeout`	Max idle session time in seconds (access token lifetime). Should be lower than `auth.sessionLifetime`	`CDK_AUTH_IDLETIMEOUT`	false	int	`259200`

Local user properties

Optional local accounts list, used to log into Console.

Property	Description	Environment variable	Mandatory	Type	Default value
`auth.local-users[].email`	User login	`CDK_AUTH_LOCALUSERS_0_EMAIL`	true	string	`"admin@conduktor.io"`
`auth.local-users[].password`	User password	`CDK_AUTH_LOCALUSERS_0_PASSWORD`	true	string	`"admin"`

Monitoring properties

We provide a pre-configured monitoring solution based on Cortex (conduktor/conduktor-console-cortex). It’s a custom implementation of Prometheus used in several production systems including Amazon Managed Service for Prometheus (AMP). If using your own solution, set the monitoring.backend property. We support Cortex, Mimir and Prometheus. You can choose to not deploy any monitoring solution. If none is deployed, you won’t be able to see the monitoring graphs or configure alerts. Depending on the chosen solution, you’ll need to provide the corresponding URL and other properties. The mandatory column indicates whether the property is required for the chosen backend. For example, if you choose mimir, you have to provide the monitoring.mimir-url property but if you select conduktor, you have to provide the monitoring.cortex-url. If an alert manager URL isn’t provided, Console will use its built-in alert system.

Property	Description	Environment variable	Mandatory	Type	Default
`monitoring.backend`	Type of monitoring solution installed	`CDK_MONITORING_BACKEND`	false	string one of: `conduktor`, `cortex`, `mimir`, `prometheus`	`conduktor`
`monitoring.cortex-url`	Cortex search query URL (default port is 9009 for `conduktor` backend)	`CDK_MONITORING_CORTEXURL`	if backend is `conduktor` or `cortex`	string	∅
`monitoring.mimir-url`	Mimir URL	`CDK_MONITORING_MIMIRURL`	If backend is `mimir`	string	∅
`monitoring.prometheus-url`	Prometheus URL	`CDK_MONITORING_PROMETHEUSURL`	If backend is `prometheus`	string	∅
`monitoring.prometheus-http-prefix`	Path to prometheus API for Cortex and Mimir	`CDK_MONITORING_PROMETHEUSHTTPPREFIX`	false	string	`/prometheus`
`monitoring.tenant-id`	Value of the X-Scope-OrgId header to authenticate to Cortex or Mimir when multi-tenancy is enabled	`CDK_MONITORING_TENANTID`	false	string	∅
`monitoring.alert-manager-url`	Alert Manager URL (default port is 9010 for `conduktor` backend)	`CDK_MONITORING_ALERTMANAGERURL`	false	string	∅
`monitoring.callback-url`	Console API	`CDK_MONITORING_CALLBACKURL`	If `monitoring.alert-manager-url` is configured	string	∅
`monitoring.rules-namespace`	Namespace for rules configured in Prometheus	`CDK_MONITORING_RULESNAMESPACE`	false	string	`conduktor`
`monitoring.notifications-callback-url`	Where the Slack notification should redirect	`CDK_MONITORING_NOTIFICATIONSCALLBACKURL`	true	string	∅
`monitoring.clusters-refresh-interval`	Refresh rate in seconds for metrics	`CDK_MONITORING_CLUSTERREFRESHINTERVAL`	false	int	`60`
`monitoring.use-aggregated-metrics`	Defines whether use the new aggregated metrics in the Console graphs	`CDK_MONITORING_USEAGGREGATEDMETRICS`	false	Boolean	`false`
`monitoring.enable-non-aggregated-metrics`	Toggles the collection of obsolete granular metrics	`CDK_MONITORING_ENABLENONAGGREGATEDMETRICS`	false	Boolean	`true`
`monitoring.repeat-alert-frequency-minutes`	Frequency in minutes of the repetition of firing alerts (built-in alert system)	`CDK_MONITORING_REPEATALERTFREQUENCYMINUTES`	false	int	`60`
`monitoring.check-alert-frequency-minutes`	Frequency in minutes of the verification of alert status (built-in alert system)	`CDK_MONITORING_CHECKALERTFREQUENCYMINUTES`	false	int	`1`
`monitoring.check-alert-parallelism`	How many alerts are verified in parallel (built-in alert system)	`CDK_MONITORING_CHECKALERTPARALLELISM`	false	int	`5`
`monitoring.prometheus_auth.username`	Username for basic authentication to Prometheus/Cortex/Mimir	`CDK_MONITORING_PROMETHEUSAUTH_USERNAME`	false	string	∅
`monitoring.prometheus_auth.password`	Password for basic authentication to Prometheus/Cortex/Mimir	`CDK_MONITORING_PROMETHEUSAUTH_PASSWORD`	false	string	∅
`monitoring.basic-auth.email`	Basic auth username for monitoring backend to scrape Console metrics. When using the bundled Cortex component, configure matching credentials using `CDK_SCRAPER_BASICAUTH_EMAIL`.	`CDK_MONITORING_BASICAUTH_EMAIL`	false	string	∅
`monitoring.basic-auth.password`	Basic auth password for monitoring backend to scrape Console metrics. When using the bundled Cortex component, configure matching credentials using `CDK_SCRAPER_BASICAUTH_PASSWORD`. Must contain at least 8 characters, including one uppercase letter, one lowercase letter, one number and one special symbol.	`CDK_MONITORING_BASICAUTH_PASSWORD`	false	string	∅

monitoring.use-aggregated-metrics and monitoring.enable-non-aggregated-metrics are temporary flags to help you transition to the new metrics collection system. They will be removed in a future release.Swap their default value if you experience performance issues when Console is connected with large Kafka clusters:

CDK_MONITORING_USEAGGREGATEDMETRICS: true
CDK_MONITORING_ENABLENONAGGREGATEDMETRICS: false

SSO properties

Property	Description	Environment variable	Mandatory	Type	Default
`sso.ignoreUntrustedCertificate`	Disable SSL checks	`CDK_SSO_IGNOREUNTRUSTEDCERTIFICATE`	false	boolean	`false`
`sso.trustedCertificates`	SSL public certificates for SSO authentication (LDAPS and OAuth2) as PEM	`CDK_SSO_TRUSTEDCERTIFICATES`	false	string	∅

LDAP properties

Property	Description	Environment variable	Mandatory	Type	Default
`sso.ldap[].name`	Ldap connection name	`CDK_SSO_LDAP_0_NAME`	true	string	∅
`sso.ldap[].server`	Ldap server host and port	`CDK_SSO_LDAP_0_SERVER`	true	string	∅
`sso.ldap[].managerDn`	Sets the manager DN	`CDK_SSO_LDAP_0_MANAGERDN`	true	string	∅
`sso.ldap[].managerPassword`	Sets the manager password	`CDK_SSO_LDAP_0_MANAGERPASSWORD`	true	string	∅
`sso.ldap[].search-subtree`	Sets if the subtree should be searched.	`CDK_SSO_LDAP_0_SEARCHSUBTREE`	false	boolean	`true`
`sso.ldap[].search-base`	Sets the base DN to search.	`CDK_SSO_LDAP_0_SEARCHBASE`	true	string	∅
`sso.ldap[].search-filter`	Sets the search filter. By default, the filter is set to `(uid={0})` for users using class type `InetOrgPerson`.	`CDK_SSO_LDAP_0_SEARCHFILTER`	false	string	`"(uid={0})"`
`sso.ldap[].search-attributes`	Sets the attributes list to return. By default, all attributes are returned. Search for `uid`, `cn`, `mail`, `email`, `givenName`, `sn`, `displayName` attributes to map into user token.	`CDK_SSO_LDAP_0_SEARCHATTRIBUTES`	false	string array	`[]`
`sso.ldap[].groups-enabled`	Sets if group search is enabled.	`CDK_SSO_LDAP_0_GROUPSENABLED`	false	boolean	`false`
`sso.ldap[].groups-subtree`	Sets if the subtree should be searched.	`CDK_SSO_LDAP_0_GROUPSSUBTREE`	false	boolean	`true`
`sso.ldap[].groups-base`	Sets the base DN to search from.	`CDK_SSO_LDAP_0_GROUPSBASE`	true	string	∅
`sso.ldap[].groups-filter`	Sets the group search filter. If using group class type `GroupOfUniqueNames` use the filter `"uniqueMember={0}"`. For group class `GroupOfNames` use `"member={0}"`.	`CDK_SSO_LDAP_0_GROUPSFILTER`	false	string	`"uniquemember={0}"`
`sso.ldap[].groups-filter-attribute`	Sets the name of the user attribute to bind to the group search filter. Defaults to the user’s DN.	`CDK_SSO_LDAP_0_GROUPSFILTERATTRIBUTE`	false	string	∅
`sso.ldap[].groups-attribute`	Sets the group attribute name. Defaults to `cn`.	`CDK_SSO_LDAP_0_GROUPSATTRIBUTE`	false	string	`"cn"`
`sso.ldap[].properties`	Additional properties that will be passed to identity provider context.	`CDK_SSO_LDAP_0_PROPERTIES`	false	dictionary	∅

OAuth2 properties

Property	Description	Environment variable	Mandatory	Type	Default
`sso.oauth2[].name`	OAuth2 connection name	`CDK_SSO_OAUTH2_0_NAME`	true	string	∅
`sso.oauth2[].default`	Use as default	`CDK_SSO_OAUTH2_0_DEFAULT`	true	boolean	∅
`sso.oauth2[].client-id`	OAuth2 client ID	`CDK_SSO_OAUTH2_0_CLIENTID`	true	string	∅
`sso.oauth2[].client-secret`	OAuth2 client secret	`CDK_SSO_OAUTH2_0_CLIENTSECRET`	true	string	∅
`sso.oauth2[].openid.issuer`	Issuer to check on token	`CDK_SSO_OAUTH2_0_OPENID_ISSUER`	true	string	∅
`sso.oauth2[].scopes`	Scopes to be requested in the client credentials request	`CDK_SSO_OAUTH2_0_SCOPES`	true	string	`[]`
`sso.oauth2[].groups-claim`	Group attribute from your identity provider	`CDK_SSO_OAUTH2_0_GROUPSCLAIM`	false	string	∅
`sso.oauth2[].username-claim`	Username attribute from your identity provider	`CDK_SSO_OAUTH2_0_USERNAMECLAIM`	false	string	`email`
`sso.oauth2[].email-claim`	Email attribute from your identity provider	`CDK_SSO_OAUTH2_0_EMAILCLAIM`	false	string	`email`	`email`
`sso.oauth2[].allow-unsigned-id-tokens`	Allow unsigned ID tokens	`CDK_SSO_OAUTH2_0_ALLOWUNSIGNEDIDTOKENS`	false	boolean	false
`sso.oauth2[].preferred-jws-algorithm`	Configure preferred JWS algorithm	`CDK_SSO_OAUTH2_0_PREFERREDJWSALGORITHM`	false	string one of: “HS256”, “HS384”, “HS512”, “RS256”, “RS384”, “RS512”, “ES256”, “ES256K”, “ES384”, “ES512”, “PS256”, “PS384”, “PS512”, “EdDSA”	∅
`sso.oauth2[].pkce-method`	Configure PKCE method	`CDK_SSO_OAUTH2_0_PKCEMETHOD`	false	string one of: “plain”, “S256”	∅
`sso.oauth2-logout`	Whether the central identity provider logout should be called or not	`CDK_SSO_OAUTH2LOGOUT`	false	boolean	true

JWT auth properties

Property	Description	Environment variable	Mandatory	Type	Default
`sso.jwt-auth.issuer`	Issuer of your identity provider	`CDK_SSO_JWTAUTH_ISSUER`	true	string	∅
`sso.jwt-auth.username-claim`	Email attribute from your identity provider	`CDK_SSO_JWTAUTH_USERNAMECLAIM`	false	string	`email`
`sso.jwt-auth.groups-claim`	Group attribute from your identity provider	`CDK_SSO_JWTAUTH_GROUPSCLAIM`	false	string	`groups`
`sso.jwt-auth.api-key-claim`	API key attribute from your identity provider	`CDK_SSO_JWTAUTH_APIKEYCLAIM`	false	string	`apikey`

Kafka cluster properties

Property	Description	Environment variable	Mandatory	Type	Default
`clusters[].id`	String used to uniquely identify your Kafka cluster	`CDK_CLUSTERS_0_ID`	true	string	∅
`clusters[].name`	Alias or user-friendly name for your Kafka cluster	`CDK_CLUSTERS_0_NAME`	true	string	∅
`clusters[].color`	Attach a color to associate with your cluster in the UI	`CDK_CLUSTERS_0_COLOR`	false	string in hexadecimal format (`#FFFFFF`)	random
`clusters[].ignoreUntrustedCertificate`	Skip SSL certificate validation	`CDK_CLUSTERS_0_IGNOREUNTRUSTEDCERTIFICATE`	false	boolean	`false`
`clusters[].bootstrapServers`	List of host:port for your Kafka brokers separated by coma `,`	`CDK_CLUSTERS_0_BOOTSTRAPSERVERS`	true	string	∅
`clusters[].properties`	Any cluster configuration properties	`CDK_CLUSTERS_0_PROPERTIES`	false	string where each line is a property	∅

Kafka vendor specific properties

Note that you only need to set the Kafka cluster properties to use the core features of Console. For additional benefits though, set the flavor of your cluster. To define that, go to Settings > Clusters and open the Provider tab.

Property	Description	Environment variable	Mandatory	Type	Default
`clusters[].kafkaFlavor.type`	Kafka flavor type, one of `Confluent`, `ConfluentPlatform`, `Aiven`, `Gateway`	`CDK_CLUSTERS_0_KAFKAFLAVOR_TYPE`	false	string	∅
Flavor is `Confluent`	Manage Confluent Cloud service accounts, API keys, and ACLs
`clusters[].kafkaFlavor.key`	Confluent Cloud API Key	`CDK_CLUSTERS_0_KAFKAFLAVOR_KEY`	true	string	∅
`clusters[].kafkaFlavor.secret`	Confluent Cloud API Secret	`CDK_CLUSTERS_0_KAFKAFLAVOR_SECRET`	true	string	∅
`clusters[].kafkaFlavor.confluentEnvironmentId`	Confluent Environment ID	`CDK_CLUSTERS_0_KAFKAFLAVOR_CONFLUENTENVIRONMENTID`	true	string	∅
`clusters[].kafkaFlavor.confluentClusterId`	Confluent Cluster ID	`CDK_CLUSTERS_0_KAFKAFLAVOR_CONFLUENTCLUSTERID`	true	string	∅
Flavor is `ConfluentPlatform`	Manage Confluent Platform service accounts and RBAC role bindings via the Metadata Service (MDS)
`clusters[].kafkaFlavor.kafkaClusterId`	Confluent Platform Kafka cluster ID	`CDK_CLUSTERS_0_KAFKAFLAVOR_KAFKACLUSTERID`	true	string	∅
`clusters[].kafkaFlavor.mdsUrl`	URL of the Confluent Platform Metadata Service (MDS)	`CDK_CLUSTERS_0_KAFKAFLAVOR_MDSURL`	false	string	∅
`clusters[].kafkaFlavor.authentication.username`	MDS username (LDAP user with `SystemAdmin` privileges)	`CDK_CLUSTERS_0_KAFKAFLAVOR_AUTHENTICATION_USERNAME`	false	string	∅
`clusters[].kafkaFlavor.authentication.password`	MDS password	`CDK_CLUSTERS_0_KAFKAFLAVOR_AUTHENTICATION_PASSWORD`	false	string	∅
`clusters[].kafkaFlavor.schemaRegistryClusterId`	Schema Registry cluster ID, required to provision subject role bindings	`CDK_CLUSTERS_0_KAFKAFLAVOR_SCHEMAREGISTRYCLUSTERID`	false	string	∅
`clusters[].kafkaFlavor.enableRbacRoleBindings`	Manage permissions through Confluent Platform RBAC role bindings instead of Kafka ACLs	`CDK_CLUSTERS_0_KAFKAFLAVOR_ENABLERBACROLEBINDINGS`	false	boolean	`false`
`clusters[].kafkaFlavor.ignoreUntrustedCertificate`	Skip SSL certificate validation when contacting MDS	`CDK_CLUSTERS_0_KAFKAFLAVOR_IGNOREUNTRUSTEDCERTIFICATE`	false	boolean	`false`
Flavor is `Aiven`	Manage Aiven service accounts and ACLs
`clusters[].kafkaFlavor.apiToken`	Aiven API token	`CDK_CLUSTERS_0_KAFKAFLAVOR_APITOKEN`	true	string	∅
`clusters[].kafkaFlavor.project`	Aiven project	`CDK_CLUSTERS_0_KAFKAFLAVOR_PROJECT`	true	string	∅
`clusters[].kafkaFlavor.serviceName`	Aiven service name	`CDK_CLUSTERS_0_KAFKAFLAVOR_SERVICENAME`	true	string	∅
Flavor is `Gateway`	Manage Conduktor Gateway interceptors
`clusters[].kafkaFlavor.url`	Gateway API endpoint URL	`CDK_CLUSTERS_0_KAFKAFLAVOR_URL`	true	string	∅
`clusters[].kafkaFlavor.user`	Gateway API username	`CDK_CLUSTERS_0_KAFKAFLAVOR_USER`	true	string	∅
`clusters[].kafkaFlavor.password`	Gateway API password	`CDK_CLUSTERS_0_KAFKAFLAVOR_PASSWORD`	true	string	∅
`clusters[].kafkaFlavor.virtualCluster`	Gateway virtual cluster	`CDK_CLUSTERS_0_KAFKAFLAVOR_VIRTUALCLUSTER`	true	string	∅

Schema registry properties

Property	Description	Environment variable	Mandatory	Type	Default
`clusters[].schemaRegistry.url`	The schema registry URL	`CDK_CLUSTERS_0_SCHEMAREGISTRY_URL`	true	string	∅
`clusters[].schemaRegistry.ignoreUntrustedCertificate`	Skip SSL certificate validation	`CDK_CLUSTERS_0_SCHEMAREGISTRY_IGNOREUNTRUSTEDCERTIFICATE`	false	boolean	`false`
`clusters[].schemaRegistry.properties`	Any schema registry configuration parameters	`CDK_CLUSTERS_0_SCHEMAREGISTRY_PROPERTIES`	false	string where each line is a property	∅
Basic authentication
`clusters[].schemaRegistry.security.username`	Basic auth username	`CDK_CLUSTERS_0_SCHEMAREGISTRY_SECURITY_USERNAME`	false	string	∅
`clusters[].schemaRegistry.security.password`	Basic auth password	`CDK_CLUSTERS_0_SCHEMAREGISTRY_SECURITY_PASSWORD`	false	string	∅
Bearer token authentication
`clusters[].schemaRegistry.security.token`	Bearer auth token	`CDK_CLUSTERS_0_SCHEMAREGISTRY_SECURITY_TOKEN`	false	string	∅
mTLS authentication
`clusters[].schemaRegistry.security.key`	Access Key	`CDK_CLUSTERS_0_SCHEMAREGISTRY_SECURITY_KEY`	false	string	∅
`clusters[].schemaRegistry.security.certificateChain`	Access certificate	`CDK_CLUSTERS_0_SCHEMAREGISTRY_SECURITY_CERTIFICATECHAIN`	false	string	∅

Amazon Glue properties

Property	Description	Environment variable	Mandatory	Type	Default
`clusters[].schemaRegistry.region`	The Glue schema registry region	`CDK_CLUSTERS_0_SCHEMAREGISTRY_REGION`	true	string	∅
`clusters[].schemaRegistry.registryName`	The Glue schema registry name	`CDK_CLUSTERS_0_SCHEMAREGISTRY_REGISTRYNAME`	false	string	∅
`clusters[].schemaRegistry.amazonSecurity.type`	Authentication with credentials, one of `Credentials`, `FromContext`, `FromRole`	`CDK_CLUSTERS_0_SCHEMAREGISTRY_AMAZONSECURITY_TYPE`	true	string	∅
Credentials Security
`clusters[].schemaRegistry.amazonSecurity.accessKeyId`	Credentials auth access key	`CDK_CLUSTERS_0_SCHEMAREGISTRY_AMAZONSECURITY_ACCESSKEYID`	true	string	∅
`clusters[].schemaRegistry.amazonSecurity.secretKey`	Credentials auth secret key	`CDK_CLUSTERS_0_SCHEMAREGISTRY_AMAZONSECURITY_SECRETKEY`	true	string	∅
FromContext Security
`clusters[].schemaRegistry.amazonSecurity.profile`	Authentication profile	`CDK_CLUSTERS_0_SCHEMAREGISTRY_AMAZONSECURITY_PROFILE`	false	string	∅
FromRole Security
`clusters[].schemaRegistry.amazonSecurity.role`	Authentication role	`CDK_CLUSTERS_0_SCHEMAREGISTRY_AMAZONSECURITY_ROLE`	true	string	∅

Kafka Connect properties

Property	Description	Environment variable	Mandatory	Type	Default
`clusters[].kafkaConnects[].id`	String used to uniquely identify your Kafka Connect	`CDK_CLUSTERS_0_KAFKACONNECTS_0_ID`	true	string	∅
`clusters[].kafkaConnects[].name`	Name your Kafka Connect	`CDK_CLUSTERS_0_KAFKACONNECTS_0_NAME`	true	string	∅
`clusters[].kafkaConnects[].url`	The Kafka connect URL	`CDK_CLUSTERS_0_KAFKACONNECTS_0_URL`	true	string	∅
`clusters[].kafkaConnects[].headers`	Optional additional headers (ie: `X-API-Token=123,X-From=Test`)	`CDK_CLUSTERS_0_KAFKACONNECTS_0_HEADERS`	false	string	∅
`clusters[].kafkaConnects[].ignoreUntrustedCertificate`	Skip SSL certificate validation	`CDK_CLUSTERS_0_KAFKACONNECTS_0_IGNOREUNTRUSTEDCERTIFICATE`	false	boolean	`false`
Basic authentication
`clusters[].kafkaConnects[].security.username`	Basic auth username	`CDK_CLUSTERS_0_KAFKACONNECTS_0_SECURITY_USERNAME`	false	string	∅
`clusters[].kafkaConnects[].security.password`	Basic auth password	`CDK_CLUSTERS_0_KAFKACONNECTS_0_SECURITY_PASSWORD`	false	string	∅
Bearer token authentication
`clusters[].kafkaConnects[].security.token`	Bearer token	`CDK_CLUSTERS_0_KAFKACONNECTS_0_SECURITY_TOKEN`	false	string	∅
mTLS authentication
`clusters[].kafkaConnects[].security.key`	Access key	`CDK_CLUSTERS_0_KAFKACONNECTS_0_SECURITY_KEY`	false	string	∅
`clusters[].kafkaConnects[].security.certificateChain`	Access certificate	`CDK_CLUSTERS_0_KAFKACONNECTS_0_SECURITY_CERTIFICATECHAIN`	false	string	∅

ksqlDB properties

Property	Description	Environment variable	Mandatory	Type	Default
`clusters[].ksqlDBs[].id`	String used to uniquely identify your ksqlDB Cluster	`CDK_CLUSTERS_0_KSQLDBS_0_ID`	true	string	∅
`clusters[].ksqlDBs[].name`	Name of your ksqlDB Cluster	`CDK_CLUSTERS_0_KSQLDBS_0_NAME`	true	string	∅
`clusters[].ksqlDBs[].url`	The ksqlDB API URL	`CDK_CLUSTERS_0_KSQLDBS_0_URL`	true	string	∅
`clusters[].ksqlDBs[].headers`	Optional additional headers (e.g., `X-API-Token=123,X-From=Test`)	`CDK_CLUSTERS_0_KSQLDBS_0_HEADERS`	false	string	∅
`clusters[].ksqlDBs[].ignoreUntrustedCertificate`	Skip SSL certificate validation	`CDK_CLUSTERS_0_KSQLDBS_0_IGNOREUNTRUSTEDCERTIFICATE`	false	boolean	`false`
Basic Authentication
`clusters[].ksqlDBs[].security.username`	Basic auth username	`CDK_CLUSTERS_0_KSQLDBS_0_SECURITY_USERNAME`	false	string	∅
`clusters[].ksqlDBs[].security.password`	Basic auth password	`CDK_CLUSTERS_0_KSQLDBS_0_SECURITY_PASSWORD`	false	string	∅
Bearer Token Authentication
`clusters[].ksqlDBs[].security.token`	Bearer token	`CDK_CLUSTERS_0_KSQLDBS_0_SECURITY_TOKEN`	false	string	∅
mTLS Authentication
`clusters[].ksqlDBs[].security.key`	Access key	`CDK_CLUSTERS_0_KSQLDBS_0_SECURITY_KEY`	false	string	∅
`clusters[].ksqlDBs[].security.certificateChain`	Access certificate	`CDK_CLUSTERS_0_KSQLDBS_0_SECURITY_CERTIFICATECHAIN`	false	string	∅

Indexing properties

Indexing fetches metadata from your Kafka cluster (e.g. topics, consumer groups, subjects). You should only modify these parameters if you see an issue with the performance.

Property	Description	Environment variable	Mandatory	Type	Default
Lag exporter
`lagexporter.frequency`	Frequency in seconds of the execution of the lag exporter	`CDK_LAGEXPORTER_FREQUENCY`	false	int	`30`
`lagexporter.clusterparallelism`	Number of clusters indexed in parallel for the lag exporter	`CDK_LAGEXPORTER_CLUSTERPARALLELISM`	false	int	`1`
`lagexporter.indexertimeout`	Lag exporter timeout in seconds	`CDK_LAGEXPORTER_INDEXERTIMEOUT`	false	int	`300` (5 minutes)
`lagexporter.blockingduration`	Circuit breaker blocking duration in seconds - defines how long the indexer will wait after a series of failed requests before reattempting indexing	`CDK_LAGEXPORTER_BLOCKINGDURATION`	false	int	`60`
`lagexporter.sequentialfailurethreshold`	Number of sequential failures before the circuit breaker activates	`CDK_LAGEXPORTER_SEQUENTIALFAILURETHRESHOLD`	false	int	`10`
Metadata indexer
`metadataindexer.frequency`	Frequency in seconds of the execution of the metadata indexer	`CDK_METADATAINDEXER_FREQUENCY`	false	int	`30`
`metadataindexer.clusterparallelism`	Number of clusters indexed in parallel for the metadata indexer	`CDK_METADATAINDEXER_CLUSTERPARALLELISM`	false	int	`1`
`metadataindexer.indexertimeout`	Metadata indexer timeout in seconds	`CDK_METADATAINDEXER_INDEXERTIMEOUT`	false	int	`300` (5 minutes)
`metadataindexer.blockingduration`	Circuit breaker blocking duration in seconds - defines how long the indexer will wait after a series of failed requests before reattempting indexing	`CDK_METADATAINDEXER_BLOCKINGDURATION`	false	int	`600`
`metadataindexer.sequentialfailurethreshold`	Number of sequential failures before the circuit breaker activates	`CDK_METADATAINDEXER_SEQUENTIALFAILURETHRESHOLD`	false	int	`10`
Monitoring indexer
`monitoringconfig.frequency`	Frequency in seconds of the execution of the monitoring indexer	`CDK_MONITORINGCONFIG_FREQUENCY`	false	int	`30`
`monitoringconfig.clusterparallelism`	Number of clusters indexed in parallel for the monitoring indexer	`CDK_MONITORINGCONFIG_CLUSTERPARALLELISM`	false	int	`1`
`monitoringconfig.indexertimeout`	Monitoring indexer timeout in seconds	`CDK_MONITORINGCONFIG_INDEXERTIMEOUT`	false	int	`300` (5 minutes)
`monitoringconfig.blockingduration`	Circuit breaker blocking duration in seconds - defines how long the indexer will wait after a series of failed requests before reattempting indexing	`CDK_MONITORINGCONFIG_BLOCKINGDURATION`	false	int	`600`
`monitoringconfig.sequentialfailurethreshold`	Number of sequential failures before the circuit breaker activates	`CDK_MONITORINGCONFIG_SEQUENTIALFAILURETHRESHOLD`	false	int	`10`
Schema registry indexer
`registryindexer.frequency`	Frequency in seconds of the execution of the schema registry indexer	`CDK_REGISTRYINDEXER_FREQUENCY`	false	int	`30`
`registryindexer.clusterparallelism`	Number of clusters indexed in parallel for the schema registry indexer	`CDK_REGISTRYINDEXER_CLUSTERPARALLELISM`	false	int	`1`
`registryindexer.indexertimeout`	Schema registry indexer timeout in seconds	`CDK_REGISTRYINDEXER_INDEXERTIMEOUT`	false	int	`300` (5 minutes)
`registryindexer.blockingduration`	Circuit breaker blocking duration in seconds - defines how long the indexer will wait after a series of failed requests before reattempting indexing	`CDK_REGISTRYINDEXER_BLOCKINGDURATION`	false	int	`600`
`registryindexer.sequentialfailurethreshold`	Number of sequential failures before the circuit breaker activates	`CDK_REGISTRYINDEXER_SEQUENTIALFAILURETHRESHOLD`	false	int	`10`
Kafka connect indexer
`connectindexer.frequency`	Frequency in seconds of the execution of the kafka connect indexer	`CDK_CONNECTINDEXER_FREQUENCY`	false	int	`30`
`connectindexer.clusterparallelism`	Number of clusters indexed in parallel for the kafka connect indexer	`CDK_CONNECTINDEXER_CLUSTERPARALLELISM`	false	int	`1`
`connectindexer.indexertimeout`	Kafka connect indexer timeout in seconds	`CDK_CONNECTINDEXER_INDEXERTIMEOUT`	false	int	`300` (5 minutes)
`connectindexer.blockingduration`	Circuit breaker blocking duration in seconds - defines how long the indexer will wait after a series of failed requests before reattempting indexing	`CDK_CONNECTINDEXER_BLOCKINGDURATION`	false	int	`600`
`connectindexer.sequentialfailurethreshold`	Number of sequential failures before the circuit breaker activates	`CDK_CONNECTINDEXER_SEQUENTIALFAILURETHRESHOLD`	false	int	`10`
Refresh analytics
`refreshanalytics.frequency`	Frequency in seconds for refreshing of analytics materialized views such as Insights. Note that there is a performance penalty to increasing this frequency	`CDK_REFRESHANALYTICS_FREQUENCY`	false	int	`900`
`refreshanalytics.timeout`	Timeout in seconds for refreshing of analytics materialized views such as Insights	`CDK_REFRESHANALYTICS_TIMEOUT`	false	int	`600`
`refreshanalytics.enabled`	Enable or disable refreshing of analytics materialized views such as Insights. Defaults to `true`. Only disable if you do not wish to refresh analytic views such as Insights	`CDK_REFRESHANALYTICS_ENABLED`	false	boolean	`true`
Kafka admin client configuration
`kafka_admin.list_consumer_group_offsets_batch_size`	The number of consumer groups offset to fetch in a single query. Old versions of Kafka may time out when fetching too many offsets at once.	`CDK_KAFKAADMIN_LISTCONSUMERGROUPOFFSETSBATCHSIZE`	false	int	`100`
`kafka_admin.describe_consumer_groups_batch_size`	The number of consumer groups to be described in a single query.	`CDK_KAFKAADMIN_DESCRIBECONSUMERGROUPSBATCHSIZE`	false	int	`10000`
`kafka_admin.list_consumer_group_offsets_batch_size`	The number of consumer groups offset to fetch in a single query. Old versions of Kafka may time out when fetching too many offsets at once.	`CDK_KAFKAADMIN_LISTCONSUMERGROUPOFFSETSBATCHSIZE`	false	int	`100`
`kafka_admin.describe_consumer_groups_batch_size`	The number of consumer groups to be described in a single query.	`CDK_KAFKAADMIN_DESCRIBECONSUMERGROUPSBATCHSIZE`	false	int	`10000`
`kafka_admin.batch_parallel_size`	Maximum of batched requests that can be sent in parallel	`CDK_KAFKAADMIN_BATCHPARALLELSIZE`	false	int	`5`
`kafka_admin.record_size_limit`	Maximum size in bytes of a single message to display in the consume page. For larger messages, you’ll get a link to open in a dedicated page.	`CDK_KAFKAADMIN_RECORDSIZELIMIT`	false	int	`102400` (bytes)

Audit log export properties

The audit log can be exported to a Kafka topic, once configured in Console.

Property	Description	Environment variable	Mandatory	Type	Default
`audit_log_publisher.cluster`	The cluster ID where the audit logs will be exported	`CDK_AUDITLOGPUBLISHER_CLUSTER`	false	string	∅
`audit_log_publisher.topicName`	The topic name where the audit logs will be exported	`CDK_AUDITLOGPUBLISHER_TOPICNAME`	false	string	∅
`audit_log_publisher.topicConfig.partition`	The number of partitions for the audit log topic	`CDK_AUDITLOGPUBLISHER_TOPICCONFIG_PARTITION`	false	int	`1`
`audit_log_publisher.topicConfig.replicationFactor`	The replication factor for the audit log topic	`CDK_AUDITLOGPUBLISHER_TOPICCONFIG_REPLICATIONFACTOR`	false	int	`1`

Conduktor SQL properties

In order to use Conduktor SQL, you need to configure a second database to store the Topics data. You can configure Conduktor SQL Database using CDK_KAFKASQL_DATABASE_URL or alternatively, set each value individually CDK_KAFKASQL_DATABASE_*.

Property	Description	Environment variable	Mandatory	Type	Default
`kafka_sql.database.url`	External PostgreSQL configuration URL in format `[jdbc:]postgresql://[user[:password]@][[netloc][:port],...][/dbname][?param1=value1&...]`	`CDK_KAFKASQL_DATABASE_URL`	false	string	∅
`kafka_sql.database.hosts[].host`	External PostgreSQL servers hostname	`CDK_KAFKASQL_DATABASE_HOSTS_0_HOST`	false	string	∅
`kafka_sql.database.hosts[].port`	External PostgreSQL servers port	`CDK_KAFKASQL_DATABASE_HOSTS_0_PORT`	false	int	∅
`kafka_sql.database.host`	External PostgreSQL server hostname (Deprecated, use `kafka_sql.database.hosts` instead)	`CDK_KAFKASQL_DATABASE_HOST`	false	string	∅
`kafka_sql.database.port`	External PostgreSQL server port (Deprecated, use `kafka_sql.database.hosts` instead)	`CDK_KAFKASQL_DATABASE_PORT`	false	int	∅
`kafka_sql.database.name`	External PostgreSQL database name	`CDK_KAFKASQL_DATABASE_NAME`	false	string	∅
`kafka_sql.database.username`	External PostgreSQL login role	`CDK_KAFKASQL_DATABASE_USERNAME`	false	string	∅
`kafka_sql.database.password`	External PostgreSQL login password	`CDK_KAFKASQL_DATABASE_PASSWORD`	false	string	∅
`kafka_sql.database.connection_timeout`	External PostgreSQL connection timeout in seconds	`CDK_KAFKASQL_DATABASE_CONNECTIONTIMEOUT`	false	int	∅
`kafka_sql.database.options`	External PostgreSQL options (available via YAML configuration only)		false	map	∅

Find out more about database properties. These are advanced properties that typically won’t need to be changed.

Property	Description	Environment variable	Mandatory	Type	Default
`kafka_sql.commit_offset_every_in_sec`	Frequency at which Conduktor SQL commits offsets into Kafka and flushes rows in the database	`CDK_KAFKASQL_COMMITOFFSETEVERYINSEC`	false	int	`30` (seconds)
`kafka_sql.clean_expired_record_every_in_hour`	How often to check for expired records and delete them from the Database	`CDK_KAFKASQL_CLEANEXPIREDRECORDEVERYINHOUR`	false	int	`1` (hour)
`kafka_sql.refresh_topic_configuration_every_in_sec`	Frequency at which Conduktor SQL looks for new topics to start indexing or stop indexing	`CDK_KAFKASQL_REFRESHTOPICCONFIGURATIONEVERYINSEC`	false	int	`30` (seconds)
`kafka_sql.consumer_group_id`	Consumer group used to identify Conduktor SQL	`CDK_KAFKASQL_CONSUMER-GROUP-ID`	false	string	`conduktor-sql`
`kafka_sql.refresh_user_permissions_every_in_sec`	Frequency at which Conduktor SQL refreshes the role permissions in the DB to match the RBAC setup in Console	`CDK_KAFKASQL_REFRESHUSERPERMISSIONSEVERYINSEC`	false	string	`conduktor-sql`

Partner Zones properties

These are advanced properties that typically won’t need to be changed.

Property	Description	Environment variable	Mandatory	Type	Default
`partner_zone.reconcile_with_gateway_every_seconds`	The interval at which the partner zone’s state that is stored on Console, is synchronized with Gateway. A lower value results in faster alignment between the desired state and the current state on Gateway. The default value is set to 5 seconds.	CDK_PARTNERZONE_RECONCILEWITHGATEWAYEVERYSECONDS	false	int	`5` (seconds)

Data quality properties

These are advanced properties that typically won’t need to be changed.

Property	Description	Environment variable	Mandatory	Type	Default
`data_quality.reconcile_every_seconds`	The interval at which the data quality’s state on Console is synchronized with Gateway. A lower value results in faster alignment between the required state and the current state on Gateway. The default value is 5 seconds.	CDK_DATAQUALITY_RECONCILEEVERYSECONDS	false	int	`5` (seconds)
`data_quality.report_max_per_second`	The number of violations reported in data quality can be high. This value fixes the max number of violations that will be reported, per second. If more violations are produced, they won’t be reported in Console.	CDK_DATAQUALITY_REPORTMAXPERSECOND	false	int	10 (unit)
`data_quality.report_retention_day`	The number of days that the violation history logs will be retained.	CDK_DATAQUALITY_REPORTRETENTIONDAYS	false	int	7 (days)

Data quality overview properties

These properties configure the data quality overview page which provides coverage and health metrics.

Property	Description	Environment variable	Mandatory	Type	Default
`refresh_data_quality_overview.enabled`	Enable or disable the data quality overview feature.	`CDK_REFRESH-DATA-QUALITY-OVERVIEW_ENABLED`	false	boolean	`true`
`refresh_data_quality_overview.frequency`	The interval in seconds at which the data quality overview metrics are refreshed.	`CDK_REFRESH-DATA-QUALITY-OVERVIEW_FREQUENCY`	false	int	`300` (5 minutes)
`refresh_data_quality_overview.timeout`	The timeout in seconds for data quality overview computations.	`CDK_REFRESH-DATA-QUALITY-OVERVIEW_TIMEOUT`	false	int	`120` (2 minutes)

Data policy properties

These are advanced properties that typically won’t need to be changed.

Property	Description	Environment variable	Mandatory	Type	Default
`data_policy.disable_key_masking`	Disables data masking policy for record keys. Set to `true` if your record keys don’t use JSON or schema-based structures.	CDK_DATAPOLICY_DISABLEKEYMASKING	false	boolean	`false`

Chargeback properties

These properties enable and configure Chargeback functionality, both with and without Gateway.

Property	Description	Environment variable	Mandatory	Type	Default
`chargebackv2.enabled`	Enable Chargeback functionality (both with and without Gateway). Enabled by default from Console v1.46.0; set to `false` to disable.	`CDK_CHARGEBACKV2_ENABLED`	false	boolean	`true`
`chargebackv2.metrics-update-frequency`	Frequency in seconds for metrics collection for Chargeback without Gateway (available in Console v1.41.0 and later).	`CDK_CHARGEBACKV2_METRICSUPDATEFREQUENCY`	false	long	`3600`

Stream lineage properties

These properties control Stream lineage graph caching in Console.

Property	Description	Environment variable	Mandatory	Type	Default
`stream.lineage.enabled`	Enable Stream lineage. Set to `false` to disable the feature and avoid the in-memory graph cache overhead.	`CDK_STREAM_LINEAGE_ENABLED`	false	boolean	`true`
`stream.lineage.indexer.frequency.seconds`	How often Console rebuilds each cluster’s Stream lineage graph, in seconds. Acts as the cache TTL.	`CDK_STREAM_LINEAGE_INDEXER_FREQUENCY_SECONDS`	false	long	`900`

UI settings properties

Customize Console UI behavior for your organization, including default topic creation settings and custom support links.

Property	Description	Environment variable	Mandatory	Type	Default
`ui_settings.default_number_of_partitions`	Default number of partitions in the create-topic dialog. When set, overrides the Kafka cluster default for all topic creation in Console.	`CDK_UISETTINGS_DEFAULTNUMBEROFPARTITIONS`	false	integer	∅
`ui_settings.support_request_url`	URL for the Support link in the Console help menu. When set, replaces the default Conduktor support portal link.	`CDK_UISETTINGS_SUPPORTREQUESTURL`	false	string	∅
`ui_settings.feature_request_url`	URL for the Feedback link in the Console help menu. When set, replaces the default Conduktor roadmap link.	`CDK_UISETTINGS_FEATUREREQUESTURL`	false	string	∅

​Docker image environment variables

​Console properties reference

​YAML property cases

​Environment variable conversion

​Conversion edge cases

​Shell expansion in the YAML configuration file

​Support for *_FILE environment variables

​Global properties

​Database properties

​Session lifetime properties

​Local user properties

​Monitoring properties

​SSO properties

​LDAP properties

​OAuth2 properties

​JWT auth properties

​Kafka cluster properties

​Kafka vendor specific properties

​Schema registry properties

​Amazon Glue properties

​Kafka Connect properties

​ksqlDB properties

​Indexing properties

​Audit log export properties

​Conduktor SQL properties

​Partner Zones properties

​Data quality properties

​Data quality overview properties

​Data policy properties

​Chargeback properties

​Stream lineage properties

​UI settings properties

Docker image environment variables

Console properties reference

YAML property cases

Environment variable conversion

Conversion edge cases

Shell expansion in the YAML configuration file

Support for *_FILE environment variables

Global properties

Database properties

Session lifetime properties

Local user properties

Monitoring properties

SSO properties

LDAP properties

OAuth2 properties

JWT auth properties

Kafka cluster properties

Kafka vendor specific properties

Schema registry properties

Amazon Glue properties

Kafka Connect properties

ksqlDB properties

Indexing properties

Audit log export properties

Conduktor SQL properties

Partner Zones properties

Data quality properties

Data quality overview properties

Data policy properties

Chargeback properties

Stream lineage properties

UI settings properties