# AKHQ (A Kafka Headquarters)

AKHQ is a web-based user interface for managing Apache Kafka clusters. It provides a comprehensive overview of clusters, topics, consumer groups, and much more, making it easier for developers and Kafka administrators to interact with their Kafka clusters. AKHQ aims to bring operational efficiency and visibility into Kafka cluster management.

## Features

- **Topic Management:** View, create, delete, and configure topics.
- **Consumer Group Management:** Observe consumer groups, their offsets, and lag.
- **Cluster Overview:** Get insights into the cluster's health, brokers, and node details.
- **Schema Registry:** View schemas in the Confluent Schema Registry.
- **Kafka Connectors Management:** View information about connector configurations.
- **Data Exploration:** Browse data within topics, filter messages, and even produce new messages to topics.

## Official Documentation

https://akhq.io/docs/

## Running AKHQ Locally

You can run AKHQ locally with dev Kakfa cluster using following cmd.
```
docker-compose up --build -d
```

This setup does not use Okta login. All the configurations are from application-dev.yml file instead of env variables from terraform. You can login using basic auth creds: `poweruser/AKHQ_ADMIN_PASSWORD_HASH` or `regularuser/AKHQ_ADMIN_PASSWORD_HASH`. This is configured in application-dev.yml > basic-auth section.



## Accessing AKHQ for QA/Prod

We use Okta for authentication. If you don't see AKHQ at [Okta home page](https://theorchard.okta.com/app/UserHome), please reach out to tech support.
These are the direct links to AKHQ webbsite.
- https://qa-akhq.theorchard.io/ui/ui
- https://prod-akhq.theorchard.io/ui


## AKHQ Configuration

All instances of AKHQ are terraformed. The settings are provided in `yml` configuration via `AKHQ_CONFIGURATION` env variable (see example [here](https://github.com/theorchard/terraform-infra/blob/master/qa/kafka-infra/akhq/main.tf#L58))

For local environment you can edit the application-dev.yml file in this folder. That is used for configuration.

## Data Masking

AKHQ has a data masking feature that allows you to mask sensitive data in the messages.

This feature is optional and can be enabled by setting the `akhq.data-masking` configuration in the `yml` configuration. The masking is based on regex patterns and once configured it's applied to all topics.
Masking is applied to the message value and key but not to the headers. Search feature is working on top of the masked data, so you can't search for the original data.

### Examples

General string masking
```yaml
akhq:
  security:
    data-masking:
      filters:
        - description: "Masks email addresses"
          search-regex: '([a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,6})'
          replacement: '[EMAIL MASKED]'
```

Partial value masking
```yaml
akhq:
  security:
    data-masking:
      filters:
        - description: "Partially masks phone numbers"
          search-regex: '"([\+]?[(]?[0-9]{3}[)]?[-\s\.]?[0-9]{3}[-\s\.]?)[0-9]{4,6}"'
          replacement: '"$1xxxx"'
```

JSON property masking
```yaml
akhq:
  security:
    data-masking:
      filters:
        - description: "Masks certain field in JSON docs"
          search-regex: '"dateOfBirth":".*"'
          replacement: '"dateOfBirth":"[DATE MASKED]"'
```