Configure Apache Kafka (KRaft, Hardened)

Configuration files

/opt/kafka/config/kraft-server.properties

Credential rotation

No application credential exists; rotate your SSH keys through your cloud's own key management.

Monitoring & logging

• Logs: /var/log/kafka; `journalctl -u kafka -f`
• Health: /opt/kafka/bin/kafka-broker-api-versions.sh --bootstrap-server localhost:9092 — wire this into your cloud's monitoring agent or an external probe.
• Cloud-native agents (CloudWatch agent, Google Cloud Ops Agent) install normally on this image if you want metrics/log shipping — none is pre-installed or phoning home by default.

Upgrades

Replace the instance with the newest image version. Data topics ride /var/lib/kafka — for eval workloads, re-create; for durable pipelines, mirror to the new instance before cutover.

Backup & restore

Snapshot the volume with kafka stopped, or use MirrorMaker 2 to replicate topics off-box.