klamm

Documentation · Operations

Limitations

What Klamm does not implement yet. Pre-release scope, tracked gaps, and deferred work.

Klamm is pre-release software. The list below documents the gaps that matter for production evaluation. The repository’s TODO.md carries the complete issue inventory.

SASL mechanisms

SASL/PLAIN, SCRAM-SHA-256, and SCRAM-SHA-512 are supported. OAUTHBEARER and GSSAPI are not implemented. OAUTHBEARER is on the roadmap; GSSAPI is not.

Upstream TLS is server-auth only

Broker TLS is supported with a configured CA bundle. Mutual TLS to the broker and explicit per-broker server-name overrides are not implemented.

WriteTxnMarkers is unsupported

Client transactional producer commit, abort, and offset-commit flows are virtualized, and non-transactional idempotent producers are covered. Coordinator-to-leader marker writes, and Java Admin abortTransaction-style producer-id operations, remain outside the tenant model.

KIP-848 regex subscriptions are unsupported

ConsumerGroupHeartbeat and ConsumerGroupDescribe are virtualized for explicit topic-name subscriptions in codec-supported versions. Regex subscription virtualization is not designed yet.

No upstream connection pooling

N client connections produce N upstream connections. A pooling redesign is deferred until the project takes on that scope.

Per-pod limits

Per-tenant connection and in-flight limits are enforced per Klamm process. They are not distributed across multiple Klamm instances.

Client compatibility

Compatibility lanes run each upstream client’s own CI fixture directly against Kafka, then again through Klamm:

  • franz-go — go test -timeout 5m ./...
  • kafka-go — Kafka 2.7.0, 2.8.1, and 3.7.0 upstream fixtures
  • kafka-python — Kafka 4.0.0, 3.9.0, and 2.8.2 fixtures, PLAIN / SCRAM-SHA-256 / SCRAM-SHA-512
  • librdkafka — run-test.sh -Q -E -L with trivup KafkaCluster fixtures
  • KafkaJS — broker Jest group against a Kafka 2.4 three-broker compose fixture

Active direct-pass / proxy-fail cases remain visible as failing compatibility tests until fixed. Direct-only upstream flakes are tracked before being excluded from the default signal lane. Per-client status is kept in docs/client-compatibility-failure-tracking.md.

Evaluating Klamm If a limitation above blocks a production deployment, open an issue describing the use case. Several of these gaps are already on the roadmap.