KIP-1110 — Metadata of sensitive configuration

Discussion AdminBroker

Proposes adding metadata about sensitive configuration values to the DescribeConfigs response — such as a hash or last-modified timestamp — so operators can verify that a sensitive config was set correctly without exposing the actual value. Currently, describing a sensitive config returns null, making it impossible to determine whether the config has been updated or whether an expected value is in effect, complicating certificate rotation and vault-based dynamic config workflows.

Protocol Impact

DescribeConfigs

Details