feat: add TLS #121

hugz6 · 2025-10-03T12:19:56Z

Add TLS support

Adds TLS/SSL configuration for connecting to Kafka clusters.

Changes

Basic TLS support with enabled and insecureSkipVerify options
Custom root CA support via rootCAFile for private certificate authorities
mTLS support via clientCertFile and clientKeyFile
TLS for AWS MSK IAM authentication

Configuration

tlsConfig:
  enabled: true
  insecureSkipVerify: false
  rootCAFile: ~/certs/ca.crt
  clientCertFile: ~/certs/client.crt
  clientKeyFile: ~/certs/client.key

TLS is automatically enabled when using authentication: aws_msk_iam.

Testing

Tested with:

Plaintext connections
TLS with insecureSkipVerify
TLS with custom CA validation

mTLS implementation is included but not tested.

gemini-code-assist · 2025-10-03T12:20:19Z

Summary of Changes

Hello @hugz6, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances Kplay's security posture by integrating robust TLS support for Kafka connections. Users can now define TLS settings directly within their Kplay profiles, enabling encrypted communication with Kafka brokers. This feature includes options for enabling TLS and controlling certificate verification, making Kplay more adaptable to various secure Kafka environments, from production to development setups.

Highlights

TLS Configuration: Introduced new "tlsConfig" options in Kplay profiles to enable secure communication with Kafka brokers.
Certificate Verification Control: Added "insecureSkipVerify" option within "tlsConfig" for flexible certificate validation, useful for development or self-signed certificates.
Kafka Client Integration: Updated the internal Kafka client builder to dynamically apply TLS settings, ensuring secure connections are established when configured.
Documentation & Examples: Provided clear documentation in README.md and updated sample-config.yml with examples for enabling TLS.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces TLS support, which is a great security enhancement. The implementation is mostly solid, but I've found a critical regression related to AWS MSK IAM authentication where TLS is no longer automatically enabled, which would break existing user configurations. I've provided a code suggestion to fix this. Additionally, I've noted that the documentation in the README regarding this is now incorrect. Finally, I've suggested an improvement to make the TLS configuration more robust by allowing custom CAs and client certificates for production environments. Overall, good work on adding this important feature.

gemini-code-assist · 2025-10-03T12:22:07Z

README.md

+  insecureSkipVerify: false    # Skip certificate verification (default: false, use true for self-signed certs in dev)
 ```

+**Note:** When using AWS MSK IAM authentication, TLS is automatically enabled and configured.


This note is currently incorrect. The changes in this pull request have introduced a regression where TLS is no longer automatically enabled for AWS MSK IAM authentication. This will break existing configurations for users relying on this implicit behavior. To align the documentation with the intended (and previous) behavior, the implementation should be fixed to automatically enable TLS when authentication: aws_msk_iam is used.

gemini-code-assist · 2025-10-03T12:22:07Z

internal/cmd/config.go

+		if pr.TLSConfig != nil && pr.TLSConfig.Enabled {
+			tlsCfg = &t.TLSConfig{
+				Enabled:            true,
+				InsecureSkipVerify: pr.TLSConfig.InsecureSkipVerify,
+			}
+		}


There's a regression here that breaks existing functionality. AWS MSK IAM requires TLS, but this logic no longer enables it automatically if tlsConfig isn't explicitly defined in the profile. Previously, TLS was implicitly enabled for MSK IAM. This change will break existing configurations that rely on this behavior.

To fix this, you should ensure TLS is enabled whenever auth == t.AWSMSKIAM, while still respecting any user-provided tlsConfig settings.

if (pr.TLSConfig != nil && pr.TLSConfig.Enabled) || auth == t.AWSMSKIAM { // TLS is required for AWS MSK IAM and is now being enabled automatically. tlsCfg = &t.TLSConfig{ Enabled: true, } if pr.TLSConfig != nil { tlsCfg.InsecureSkipVerify = pr.TLSConfig.InsecureSkipVerify } }

gemini-code-assist · 2025-10-03T12:22:07Z

internal/kafka/client.go

+	cfg := &tls.Config{
+		InsecureSkipVerify: tlsConfig.InsecureSkipVerify,
+	}


The current TLS implementation is a good first step, but it's limited as it only allows configuring InsecureSkipVerify. To make TLS support more robust and production-ready, consider extending tlsConfig and this function to support:

Custom Root CAs (RootCAs in tls.Config) for verifying server certificates signed by a private CA.

Client certificates (Certificates in tls.Config) for mutual TLS (mTLS) authentication.

This would greatly increase the security and flexibility of connecting to various Kafka setups.

dhth · 2025-10-04T12:56:38Z

@hugz6 Thanks for your contribution.

I'll wait for you to mark the PR as ready for review before taking a look.
Could you also add a brief summary of the scenarios this change helps with?
And feel free to take the Gemini review with a grain of salt — as with most LLM-generated feedback.

hugz6 · 2025-11-24T00:36:53Z

@hugz6 Thanks for your contribution.

I'll wait for you to mark the PR as ready for review before taking a look. Could you also add a brief summary of the scenarios this change helps with? And feel free to take the Gemini review with a grain of salt — as with most LLM-generated feedback.

Hi, sorry it took me a bit to come back to this PR, I was very busy. I tried to make it look clean even though I'm not very used to it. I hope it's okay. The goal of this PR is to allow the Kplay tool to work with TLS-secured Kafka clusters, which is very common in production. I'll let you review it, feel free to reach out if you have any questions.

dhth · 2025-11-26T12:30:48Z

Hi, sorry it took me a bit to come back to this PR, I was very busy. I tried to make it look clean even though I'm not very used to it. I hope it's okay. The goal of this PR is to allow the Kplay tool to work with TLS-secured Kafka clusters, which is very common in production. I'll let you review it, feel free to reach out if you have any questions.

Thanks @hugz6. I will try to take a look at your changes on the weekend.

feat: add TLS

1723d6b

gemini-code-assist bot reviewed Oct 3, 2025

View reviewed changes

hugz6 marked this pull request as draft October 3, 2025 12:38

feat: add TLS certificate support + fix regression

9acf2b7

hugz6 marked this pull request as ready for review November 24, 2025 00:37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: add TLS #121

feat: add TLS #121

Uh oh!

hugz6 commented Oct 3, 2025 •

edited

Loading

Uh oh!

gemini-code-assist bot commented Oct 3, 2025

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Oct 3, 2025

Uh oh!

gemini-code-assist bot Oct 3, 2025

Uh oh!

gemini-code-assist bot Oct 3, 2025

Uh oh!

dhth commented Oct 4, 2025

Uh oh!

hugz6 commented Nov 24, 2025 •

edited

Loading

Uh oh!

dhth commented Nov 26, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

feat: add TLS #121

Are you sure you want to change the base?

feat: add TLS #121

Uh oh!

Conversation

hugz6 commented Oct 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Add TLS support

Changes

Configuration

Testing

Uh oh!

gemini-code-assist bot commented Oct 3, 2025

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Oct 3, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Oct 3, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Oct 3, 2025

Choose a reason for hiding this comment

Uh oh!

dhth commented Oct 4, 2025

Uh oh!

hugz6 commented Nov 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dhth commented Nov 26, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

hugz6 commented Oct 3, 2025 •

edited

Loading

hugz6 commented Nov 24, 2025 •

edited

Loading