Apache Kafka, One KRaft Node Proven By A Round Trip
Apache Kafka 4 (SHA-512 pinned) on Java 21, one KRaft node on EL 10 from the upstream release, as a hardened systemd service on loopback; the live test creates a topic, produces one message, consumes it back and reads the metadata quorum; the metadata log is formatted once as the service user and the root-owned release tree is run in place. Original role, live-tested on Rocky Linux 10.
Verification
Live-testedReally deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.
Conformance
- Static validation (yamllint · ansible-lint)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-09-21 · podman 4.9.3 · ansible 2.21.4 · how we verify
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/ansible-kafka?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Ansible role 1.0.0, live-tested on IaC Bazaar: [Apache Kafka, One KRaft Node Proven By A Round Trip](https://www.iac-bazaar.com/catalog/ansible-kafka?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```yaml
# Apache Kafka, One KRaft Node Proven By A Round Trip: https://www.iac-bazaar.com/catalog/ansible-kafka (download from your IaC Bazaar account)
```Preview:
Documentation
kafka
Apache Kafka from the upstream release (SHA-512 pinned as the vendor prints it), one KRaft node (broker and controller) on Java 21 from AppStream, the release tree root-owned and read-only to the service, as a hardened system service on loopback. Original role for EL 10, live-tested with podman on Rocky Linux 10.
No package, and the release is run in place. EL 10 carries no
Kafka; Apache publishes a .sha512 in gpg --print-md form, which
Ansible's get_url cannot match, so this role pins that same SHA-512 as
one string beside the version and has get_url refuse the asset unless
it matches. The tree is unpacked under /usr/local/src, root-owned, and
the unit runs bin/kafka-server-start.sh from inside it (the launcher
scripts find the tree by their own path). A new release is a new pair,
on purpose.
A service account, a hardened unit, a loopback listener. kafka
is a system user with no shell that owns the data directory and nothing
else; the unit runs with NoNewPrivileges, PrivateTmp, ProtectHome and
ProtectSystem=strict. The listener is 127.0.0.1 by default,
for a proxy that authenticates or a client on the same host; the live test
reads the listening sockets and expects loopback only.
Proven by a message that went round. The live test creates a topic,
lists it, produces one message with the console producer, consumes it
back from the beginning with the console consumer, and reads the
metadata quorum (LeaderId: 1). The metadata log is formatted once, as
the service user, with a generated cluster id (or kafka_cluster_id);
meta.properties is the marker, so a second run formats nothing.
The broker's own logs go to /var/log/kafka. LOG_DIR is set in the
unit; the launcher would otherwise write them into the read-only tree.
License
Commercial - IaC Bazaar EULA. (c) IaC Bazaar.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Variables
- Test
Related modules
ansible-gotify
Gotify on EL 10 from the vendor's release, pinned by a SHA-256 the role carries (the vendor publishes no checksum file), as a hardened systemd service on loopback with its settings in an EnvironmentFile; the live test creates an application, pushes a message with its token, reads it back as the admin, and sees a wrong password and a bad token refused. Original role, live-tested on Rocky Linux 10.
ansible-mosquitto-broker
Mosquitto (MQTT) with accounts: the package starts in local-only mode with anonymous clients allowed, no persistence directory and no packet-size limit. This role writes a listener that refuses anonymous and wrong-password clients (proved live), keeps retained messages across restarts, caps packets at 1 MiB, and renders topic ACLs from a list. Original role, live-tested on Rocky Linux 10.
ansible-nats
nats on EL 10 from the GitHub release; get_url refuses it unless its SHA-256 is in the vendor's checksums file, and the live test re-checks it, then saves a context under a throwaway config home, reads it back, and runs server check connection against a dead port expecting exit 2 and CRITICAL. Pinned. Original role, live-tested on Rocky Linux 10.
ansible-nats-server
NATS server from the upstream release (sha256-verified) as a hardened system service on loopback with JetStream under its own data directory and the configuration checked by nats-server -t before it lands. No client is installed, so the live test speaks the protocol itself: one session subscribes, publishes and reads its own message back. Original role, live-tested on Rocky Linux 10.
ansible-postfix-null-client
Postfix as a send-only relay: no local delivery (a stock install spools root's mail on the box), one smarthost, TLS required rather than opportunistic, SASL credentials in a root-only lmdb map, local recipients rewritten to a real mailbox. Original role, live-tested on Rocky Linux 10.
ansible-kafka-exporter
kafka_exporter (SHA-256 pinned per architecture) on EL 10 from the upstream release, as a hardened systemd service on loopback; the live test brings up a KRaft broker first (the exporter exits without one), sees kafka_brokers 1, creates a topic, produces three messages and reads the partition's offset at 3. Original role, live-tested on Rocky Linux 10.