KIP-1188 — New ConnectorClientConfigOverridePolicy with allowlist of configurations

Accepted Kafka 4.2 Connect

Introduces a new built-in ConnectorClientConfigOverridePolicy named AllowlistConnectorClientConfigOverridePolicy with a configurable connector.client.config.override.policy.allowlist that restricts connector config overrides to an explicit set. Multiple CVEs (including RCE via SASL JAAS JndiLoginModule) exploited the default All policy; the None policy is too restrictive while the Principal policy proved unsafe.

Details