Behavioral Changes in Streams Replication Manager

Functional adjustments and behavioral updates for Streams Replication Manager are introduced in Cloudera Runtime 7.3.2, its service packs, and cumulative hotfixes.

Cloudera Runtime 7.3.2.10000 SP1

Legacy TLS protocol and cipher settings replaced when TLS advanced control is enabled: Previous behavior:
You configured TLS protocol versions and cipher suites for the Streams Replication Manager Service role using streams.replication.manager.ssl.supportedProtocols, streams.replication.manager.ssl.excludedProtocols, streams.replication.manager.ssl.supportedCipherSuites, and streams.replication.manager.ssl.excludedCipherSuites properties in Cloudera Manager.; New behavior:
When you enable the TLS_ADVANCED_CONTROL feature flag, Cloudera Manager hides the legacy supported and excluded properties for the Streams Replication Manager Service role and replaces them with streams.replication.manager.ssl.allowedProtocols and streams.replication.manager.ssl.allowedCipherSuites. These properties default to the centralized Cloudera Manager TLS settings. Custom exclude lists no longer apply when the flag is enabled. Cloudera Manager does not automatically migrate custom values.
Metrics reporter SSL enabled by default when Encrypt All Ports is on: Previous behavior:
The default value of SSL Encryption for the Metrics Reporter (metrics.jetty.server.ssl.enabled) on the Streams Replication Manager Driver role and SSL Encryption For HTTP Metric Reporter (streams.replication.manager.service.metric.ssl.enabled) on the Streams Replication Manager Service role was false.; New behavior:
When you enable the ENCRYPT_ALL_PORTS feature flag, the effective default for both properties becomes true if you have not customized them. If you previously set custom values, your settings are preserved.

Cloudera Runtime 7.3.2.100 CHF 1

There are no behavioral changes in this release.

Cloudera Runtime 7.3.2

Component-level custom Java home configuration removed

Previous behavior:

You could configure a component-specific Java home for Streams Replication Manager.

New behavior:

The component-level custom Java home configuration options are removed. Streams Replication Manager now uses the host-level java_home configuration. If you previously set a component-specific Java home for this service, verify the host-level java_home setting after upgrading.

Default JMX settings changed to restrict connections to localhost

Previous behavior:

The default value of the SRM_JMX_OPTS Cloudera Manager configuration option was -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false, which allowed unrestricted, unauthenticated JMX connections.

New behavior:

The default value of SRM_JMX_OPTS has been changed to restrict JMX connections to localhost only and enable SSL. If you previously customized SRM_JMX_OPTS, your custom value is preserved on upgrade. To revert to open JMX, update SRM_JMX_OPTS in Cloudera Manager.

Public Kafka Connect endpoints removed from SRM REST server

The public Kafka Connect endpoints are removed from the SRM REST server. Previously, these endpoints allowed users to interact with the internal Kafka Connect cluster inside the SRM instance, including starting arbitrary connectors and modifying internal connectors. These endpoints were undocumented and not part of the official SRM API. They are no longer available.

Streams Replication Manager now defaults to IPv4-only communication

A new argument was added to SRM_JVM_PERF_OPTS that sets the IP protocol to IPv4 by default.

If you changed the default value of this parameter before upgrading, the new default value is not applied on upgrade. You can apply it manually after the upgrade.

Change in internal topic filtering logic

Summary:

The logic that identifies and filters internal topics in Streams Replication Manager has changed. This enables the replication of topics that appear to be internal but are not truly internal to Kafka and Streams Replication Manager, reducing the risk of unintentionally excluding user topics from replication.

Previous behavior:

Topics were filtered from replication by the DefaultReplicationPolicy and IdentityReplicationPolicy policies if the topic name ended with [***SEPARATOR***]internal. For example, .internal. In addition, the default deny list regex pattern was the following:

.*[\\-\\.]internal, .*\\.replica, __.*

New behavior:

Topics are now filtered from replication by the DefaultReplicationPolicy and IdentityReplicationPolicy policies if:

Name starts with mm2 and ends with [***SEPARATOR***]internal
Name ends with [***SEPARATOR***]checkpoints[***SEPARATOR***]internal

In addition, the default deny list regex pattern is now the following:

mm2.*\\.internal, .*\\.replica, __.*

Internal Kafka topics that start with a dot (.) or two underscores (__) are continued to be filtered from replication by default.