KIP-1329 — ListClientConnections Admin API

Discussion AdminSecurityProtocol

Adds a ListClientConnections Admin API that surfaces the authenticated KafkaPrincipal already held in memory on each broker KafkaChannel, so operators can enumerate active connections and their identities. Kafka exposes no API, CLI, MBean, or log answering which principals are currently connected — a gap every comparable system fills (MySQL SHOW PROCESSLIST, pg_stat_activity, RabbitMQ /api/connections) — leaving incident response after a credential compromise, credential-rotation verification, and compliance reporting to rely on DEBUG loggers, expiring quota sensors, or heap dumps.

Protocol Impact

ApiVersions

Details