Apache Kafka (KRaft, Hardened) — documentation & support card

At a glance

Type	Hardened VM image
Upstream / license	Apache Kafka (Apache-2.0) — see licenses
Version	Kafka 4.3 line on AWS (KRaft-only; /opt/kafka/config/server.properties); Kafka 3.9.1 on GCE (KRaft; /opt/kafka/config/kraft-server.properties). Per-instance cluster id generated at first boot on both. Current builds: release notes.
Architecture	x86-64
Sizing	Any current-generation instance with ≥ 4 vCPU (pay-as-you-go floor); 8 vCPU recommended for production.

Marketplaces

• Google Cloud Marketplace — public on Google Cloud Marketplace (Compute Engine VM image + deployment package) (base: Ubuntu 24.04 LTS)
• AWS Marketplace — view listing (base: Amazon Linux 2023)

Network ports

Port	Purpose	State
22	SSH (key-only)	default-open
9092	Kafka broker — bound to 127.0.0.1 (AWS) / bound to all interfaces but advertised as localhost (GCE); single-node evaluation posture	customer-must-open (config + firewall)
9093	KRaft controller — 127.0.0.1 (AWS) / all interfaces, quorum voter localhost (GCE)	optional

"customer-must-open" means a cloud firewall rule and, where noted, an in-image configuration change — both deliberate. Closed by default is the design.

Access & credentials

No shared or default credentials are included in this image. Access uses the SSH key you supply at launch; any application credential is generated uniquely on your instance at first boot and stored only there — we never know it.

Log in: SSH with your launch key. Kafka CLI tools live in /opt/kafka/bin; the broker runs as the kafka user.

This product has no application credential of its own.

Step-by-step: first login / credentials.

Data & dependencies

• Data locations: /var/lib/kafka — all data stays on your instance and volumes.
• Does any data leave your tenant? No. Telemetry: none. Our images contain no phone-home, no usage beacons, no license servers. The only parties that know you deployed our software are you and your cloud provider's billing system.
• We have no access to your deployment. Your instance runs in your tenancy under your IAM; remote access for a support session exists only if you explicitly grant it, and you can revoke it at any time.
• External dependencies at deploy/runtime: None — the image is fully self-contained at deploy time; no internet access is required to boot and run.

Operate

• First boot: A one-shot format unit — kafka-firstboot.service (AWS) / kafka-format.service (GCE) — generates a fresh KRaft cluster id and formats /var/lib/kafka once (guarded by meta.properties), then kafka.service starts. Broker answers within ~1 minute. No credential is generated (Kafka ships with no authentication).
• Update / patch: Replace the instance with the newest image version. Data topics ride /var/lib/kafka — for eval workloads, re-create; for durable pipelines, mirror to the new instance before cutover.
• Backup / restore: Snapshot the volume with kafka stopped, or use MirrorMaker 2 to replicate topics off-box.
• Uninstall: delete the VM/deployment and its volumes — nothing else persists, and software billing stops with the instance under your cloud's marketplace terms.
• Logs: /var/log/kafka; `journalctl -u kafka -f`
• Health check: /opt/kafka/bin/kafka-broker-api-versions.sh --bootstrap-server localhost:9092

Known limitations

Single node = evaluation/small-pipeline posture. Multi-broker clusters need a deliberate design (listeners, storage, quorum) — this image is one node of it.

Support

Email support@dcassociatesgroup.com — first response within 1 business day (US Eastern), most tickets same-day. To escalate an open ticket, reply "ESCALATE"; it is reviewed by the founder within 1 business day. Security reports: vulnerability disclosure.

Privacy: policy · Terms: terms · Security practices: security & trust · Vulnerability reports: disclosure policy