errors.tolerance=all Requires a DLQ

If a connector sets errors.tolerance=all, it must also configure a dead-letter-queue topic.

Rationale

`errors.tolerance=all` without a DLQ drops poison records silently. The connector reports "healthy" while data disappears. Several incidents in field-intel were caused by this exact misconfig (one fintech lost 4h of transaction events before catching it via downstream lag). Force DLQ wiring whenever tolerance is opened up.

Pattern

errors.tolerance == "all" → errors.deadletterqueue.topic.name set and non-empty

Examples

Implementation

Drop this YAML into Conduktor Console as a ResourcePolicy, then link it from an ApplicationInstance, Application, or KafkaCluster.

# Conduktor self-service ResourcePolicy
---
apiVersion: self-serve/v1
kind: ResourcePolicy
metadata:
  name: connector-error-tolerance-bounded
spec:
  targetKind: Connector
  description: errors.tolerance=all requires errors.deadletterqueue.topic.name to be set
  rules:
    - condition: '!("errors.tolerance" in spec.config) || spec.config["errors.tolerance"] != "all" || ("errors.deadletterqueue.topic.name" in spec.config && spec.config["errors.deadletterqueue.topic.name"] != "")'
      errorMessage: "errors.tolerance=all requires errors.deadletterqueue.topic.name — otherwise poison records are silently dropped"

Related policies

• Only Allow Vetted connector.class Plugins
• connector tasks.max Within [1, 16]
• No Inline Credentials in Connector Config
• JDBC Connector Host Allowlist
• Connector Topics Must Match Owning Tenant