Confluent Cloud Customer Success Engineering

🧠 Free Recall ❓ Quiz 🔍 Cues 🔮 Simulation 🥷 ShadowBox 📐 Encode Cards

Levels of Abstractions on Confluent Cloud

Organization
Highest level of abstraction 
Access to 
Billing
Support
SSO
User Management
Service Accounts
Environments and Clusters

Environment
Belongs to an organization
Logical separation of environments + region
Schema Registry works on Environment level

Cluster
Belongs to an environment
Where IP exists
Partitions/Topics
Connectors
ksqlDB
Consumer Groups
API Keys work on a cluster level
ACLs work on a cluster level

Clusters

Considerations
Are there naming standards for organization
What will consumers/consumer groups look like
What is my desired throughput
Will I be running ksql or Streams application on this data
What are my data quality requirements
How long do I want to retain data
Do I have compliance / audit requirements
Is there a need for batch or replay of data
What is the size of the payloads?

Basic
For development use cases
99.5 uptime SLA
Up to 100MB/s throughput and 5 TB of storage
No base cluster price
Only pay for ingress, egress, and storage.

Standard
Production ready features
99.95 uptime SLA
Up to 100MB/s and 5 TB storage
multi-zone availability
Unlimited Connect tasks per connector
Charged an hourly base price + ingress,egress, storage

Dedicated
Critical production workloads with high traffic or private networking requirements
Single tenant 
99.95 uptime SLA
Multi-zone availability
Unlimted Connect tasks with no capacity limits
Can be scaled to achieve gigabytes per second ingress
Scalable and Expansive

Connectors

Fully Managed
List of fully managed connectors
Set up in minutes
Elastic scaling with no infrastructure to manage
Limited networking options
limited configuration options

Self Managed
More complex
More flexibility with networking and comnfiguration
Manage nodes/workers lifecycle

ksqlDB

Fully Managed
Easy to use
Deploy in minutes
no lifecycle management
Limited networking options

Self Managed
More control over networking/security
Have to manage ksqlDB cluster lifecycle
Kstreams

Consumer Groups
A view of all active consumer groups
Can monitor consumer group lag from this view
Can monitor consumer group membership statistics
Consumer groups generally correlate to consumer applications, and should be named as such
Consumer groups can subscribe to multiple topics
Consumer groups maintain their own set of consumer offsets for a given partition of a topic

Levels of Interactions

CLI

Producer/Consumer Configs
Available under clients. Confluent Cloud has the appropriate configurations based on the supported languages
Key items for cloud
ssl.endpoint.identifcation.algorithm - for SSL encryption
sasl.mechanism - Simple Authentication and Security Layer
sasl.jaas.config - java authentication authorization service
AdminClientConfig - supports managing and inspecting topics, brokers, acls, and other Kafka objects.

Authorization/Authentication

Restricting Access
Anyone with access to Confluent Cloud UI Is a super user. They have full access to all the resources. 
If you want to restrict access to a user, do not create a login/password for this user on Confluent Cloud UI but instead an API key/secret pair in the UI or CLI
They won't have access to UI but can access resources using CLI
A restricted user will be able to create, read, and delete topics. For more granular controls, you need to set up ACLs

API Keys and Secrets
Managed in the UI or CLI
Authentication mechanism for clients (consumer, producer, Connect, REST Proxy, etc.)
Should be rotated regularly
Schema Registry uses different set of Keys/Secrets

Service Accounts
Represents an application
ACLs are bound to Service Accounts
API Keys are assigned to Service Accounts
By default Service Accounts have ZERO permissions
100 Service Account Limit per cloud organization

Monitoring

see monitoring

Schema Registry
Works on an Environment (Prod, Dev, Staging)
Single endpoint
1000 distinct schema limit
Separate API Key/Secret Pair
Basic Auth with TLS encryption over the wire
No RBAC/ACLs for schemas

Automation

SSO

Unstarred

Dunk (exclude from study)

Confluent Cloud Customer Success Engineering

Review Questions

Todos

Sensemaker