Conduktor Platform
Conduktor is three products that work together around Apache Kafka:
- Console (
conduktor/conduktor-console, port 8080) observes and manages Kafka clusters. It provides RBAC, a topic catalog, monitoring, a self-service framework, and data quality policies. Requires PostgreSQL. - Gateway (
conduktor/conduktor-gateway, port 6969) is a transparent Kafka proxy that intercepts and modifies requests and responses. It provides interceptors, virtual clusters, field-level encryption, data masking, and traffic control. Clients connect to Gateway instead of Kafka directly. - CLI (
conduktorbinary) is a kubectl-style tool that manages both Console and Gateway resources declaratively via YAML apply/get/delete.
Console and Gateway are separate services. Console can manage Gateway, but they deploy independently.
Always read first
For any Conduktor question, load references/mental-model.md to understand product boundaries, the Gateway resource model, virtual clusters, and the self-service framework.
For things AI assistants commonly get wrong, see references/anti-patterns.md.
For Conduktor-to-Kafka terminology mapping, see references/terminology.md.
Use cases
Platform engineer
| I want to... | Read |
|---|---|
| Deploy Console and Gateway (Docker, Helm, Kubernetes) | use-cases/platform/deploy-conduktor.md |
| Encrypt or mask Kafka data (field-level, payload) | use-cases/platform/encrypt-kafka-data.md |
| Enforce data quality rules (CEL, JSON Schema) | use-cases/platform/enforce-data-quality.md |
| Set up multi-tenancy (virtual clusters, ACLs, service accounts) | use-cases/platform/multi-tenancy.md |
| Apply traffic control and safeguards (rate limits, topic policies) | use-cases/platform/traffic-control.md |
| Automate with CLI and GitOps (apply, CI/CD, state management) | use-cases/platform/gitops-automation.md |
| Set up self-service GitHub CI/CD (workflows, CODEOWNERS, tokens, policies) | use-cases/platform/self-service-github-cicd-cli.md |
| Bootstrap self-service from existing clusters, topics, and permissions | use-cases/platform/bootstrap-self-service-cli.md |
| Manage infrastructure as code with Terraform | use-cases/platform/terraform.md |
Application developer
| I want to... | Read |
|---|---|
| Get started with Kafka through Conduktor (connect, discover topics) | use-cases/app-developer/onboard-to-kafka.md |
| Create a topic through self-service | use-cases/app-developer/create-topic.md |
| Produce and consume through Gateway (client configs, schemas) | use-cases/app-developer/produce-consume.md |
| Request access to another team's topic | use-cases/app-developer/request-access.md |
Agent behavior
IMPORTANT: Do NOT call any documentation MCP tool before completing steps 1-2 below. These skill files + CLI discovery contain everything you need. MCP docs are a last resort (step 5).
When a user asks about Conduktor, do not just explain how things work. Be an active assistant:
- Discover first with CLI — read the matching use-case file, then run the exact
conduktor getcommands from its "Agent workflow" section. The CLI gives you real state; docs give you generic examples. - Ask with options — use discovery results to offer concrete choices instead of open-ended questions. If an
AskUserQuestiontool is available, use it with predefined options (e.g. topic name suggestions, partition counts, retention presets). Ask one question at a time, not a list of numbered questions. Prefer sensible defaults — only ask when the choice genuinely matters. - Generate ready-to-use output — produce complete YAML, HCL, or client configs with real names from discovery. Never give templates with placeholders when you can fill in real values.
- Execute with confirmation — offer to run
conduktor apply -f --dry-runfirst, thenconduktor apply -fon approval. For Terraform, offerterraform planthenterraform apply. - Look up what you don't know — only after checking skill files AND CLI discovery, if the answer is still missing, check your available tools for a
search_conduktor_documentationtool (Conduktor's MCP docs server). This is a fallback, not a first step. Never invent env var names, config fields, or API endpoints that are not in these files. If the MCP tool is not available, tell the user to add it with this config:{"mcpServers": {"conduktor-docs": {"type": "url", "url": "https://docs.conduktor.io/mcp"}}}
The CLI requires auth. If commands fail with 401/connection errors, help the user configure CDK_BASE_URL + CDK_API_KEY (Console) or CDK_GATEWAY_BASE_URL + CDK_GATEWAY_USER/CDK_GATEWAY_PASSWORD (Gateway).
Intent routing
When a user mentions these keywords, load the corresponding file:
- encrypt, mask, PII, GDPR, shield ->
use-cases/platform/encrypt-kafka-data.md - data quality, CEL, validate, enforce schema ->
use-cases/platform/enforce-data-quality.md - virtual cluster, tenant, isolation, team namespace ->
use-cases/platform/multi-tenancy.md - rate limit, throttle, safeguard, quota, traffic ->
use-cases/platform/traffic-control.md - deploy, Docker, Helm, Kubernetes, install ->
use-cases/platform/deploy-conduktor.md - conduktor CLI, apply, GitOps, CI/CD, pipeline, automation ->
use-cases/platform/gitops-automation.md - GitHub Actions, CODEOWNERS, workflow, token scope, ResourcePolicy examples, onboarding app ->
use-cases/platform/self-service-github-cicd-cli.md - bootstrap, self-service, adopt, migrate, ownership, reverse-engineer ->
use-cases/platform/bootstrap-self-service-cli.md - Terraform, IaC, HCL, provider ->
use-cases/platform/terraform.md - onboard, connect, credentials, getting started, bootstrap ->
use-cases/app-developer/onboard-to-kafka.md - create topic, new topic, self-service topic ->
use-cases/app-developer/create-topic.md - produce, consume, schema registry, consumer group ->
use-cases/app-developer/produce-consume.md - access, permission, request, share topic ->
use-cases/app-developer/request-access.md