conduktor.io ↗

Producer Must Compress with lz4 or zstd (Gateway)

Every produce request must arrive compressed with LZ4 or ZSTD. Enforced at the Gateway.

Rationale

Compression has to happen at the producer (broker recompression is a CPU tax — see topic-compression-passthrough), but nothing in Kafka itself forces a producer to set `compression.type` correctly. The Gateway ProducePolicyPlugin inspects the compression codec advertised in the produce request batch header and rejects NONE / GZIP / SNAPPY. LZ4 and ZSTD give the best throughput/CPU tradeoff on modern Kafka; GZIP is slow and CPU-heavy, SNAPPY is acceptable but consistently beaten by LZ4 in benchmarks.

Pattern

produce.compressions in {LZ4, ZSTD}

Examples

Producer config compression.type=lz4 → accepted
Producer config compression.type=zstd → accepted
compression.type=none → INVALID_RECORD
compression.type=gzip → INVALID_RECORD
compression.type=snappy → INVALID_RECORD

Parameters

NameDefaultDescription
allowed_codecs ["LZ4","ZSTD"] Producer compression codecs the Gateway accepts.
action "BLOCK" BLOCK rejects; INFO audits only; THROTTLE delays.

Governs

This policy relates to the following Kafka configuration keys:

Implementation

Drop this YAML into Conduktor Console as a ResourcePolicy, then link it from an ApplicationInstance, Application, or KafkaCluster.

Conduktor ResourcePolicy
# Conduktor Gateway Interceptor — wire-layer enforcement.
# Plugin: io.conduktor.gateway.interceptor.safeguard.ProducePolicyPlugin
# Docs:   https://docs.conduktor.io/guide/use-cases/apply-traffic-control-policies
# Pairs with topic-compression-passthrough (compression.type=producer on the
# broker side) — broker stores bytes verbatim, Gateway forces the codec choice.
---
apiVersion: gateway/v2
kind: Interceptor
metadata:
  name: producer-compression-required
  scope:
    vCluster: passthrough
spec:
  pluginClass: io.conduktor.gateway.interceptor.safeguard.ProducePolicyPlugin
  priority: 100
  config:
    topic: ".*"
    compressions:
      value:
        - LZ4
        - ZSTD
      action: BLOCK

Related policies

Try Conduktor Console

Enforce policies like this across your team — central audit history, pre-commit guardrails, ApplicationInstance bindings. 5-min Docker install.

Get Started →