KIP-297 — Externalizing Secrets for Connect Configurations

Accepted Kafka 2.0 ConnectSecurity

Introduces a ConfigProvider SPI for Kafka Connect that resolves ${provider:path:key} placeholders in connector configs from external secret stores like Vault, AWS Secrets Manager, or Kubernetes Secrets. Connector configurations containing passwords and credentials were stored in plaintext in Connect's internal config topic, accessible to anyone with Read permission on that topic.

Details