Deploy with confidence.

Install BetterKafka

BetterKafka 0.9 is an ASP.NET Core 8 application distributed as a container image and Helm chart. It requires a valid signed licence before it opens Kafka clients.

1. Create the licence Secret

For online activation, obtain a one-time key through the customer process, save it to a local file, and create an operator-managed Secret. Do not put keys in Helm values or source control.

kubectl --namespace monitoring create secret generic better-kafka-license \
  --from-file=activation-key=./activation-key

2. Install the chart

Paste the pinned chart reference delivered with the activation key, then replace the reserved demonstration Kafka endpoint with your deployment-owned address.

helm upgrade --install better-kafka <PINNED_CHART_REFERENCE> \
  --namespace monitoring --create-namespace \
  --set kafka.bootstrapServers=kafka-eu.demo.invalid:9093 \
  --set license.mode=online \
  --set license.authorityUrl=https://licensing.betterkafka.com \
  --set license.materialSecret=better-kafka-license

Start with read access. Enable mutation features only after authentication, role mapping, Kafka ACLs and Kubernetes RBAC have been reviewed.

3. Configure a fleet

Use stable DNS-style IDs for up to 20 server-configured entries. The browser never supplies an arbitrary bootstrap address.

clusters:
  defaultClusterId: eu-production
  entries:
    - id: eu-production
      displayName: EU Production
      bootstrapServers: kafka-eu.demo.invalid:9093
      provider: strimzi
      readOnly: true
      mutationsEnabled: false

Message Explorer

Configure scan/result bounds and optional response masking before broad access. Search remains bounded; live tail does not commit consumer offsets.

Flight Deck

Enable topology collection and configure application overlays only for relationships you can defend. Offset-derived rates and sampling coverage remain visible in the UI.

Authentication

Without an external proxy, the chart provisions a secure local administrator. With OAuth2 Proxy, local auth is disabled and BetterKafka validates the proxy session through a fixed internal endpoint. Kubernetes SubjectAccessReview is optional authorization, not authentication.