Removed Interceptors

Documentation for Gateway Interceptors that have been removed in recent versions. For users running older Gateway versions.

The Interceptors on this page have been removed from Gateway. They are no longer available in the versions listed below. If you are running an older version of Gateway, this page preserves the documentation that was previously available.

This page gathers documentation for Interceptors that have been removed from the Gateway codebase. Each section notes the Gateway version in which the Interceptor was removed.

If you’re looking for current Interceptors, see the Interceptor list.

JSONata transformer - produce (ProduceJsonataPlugin)

Removed in Gateway v3.19.0. Deprecated since Gateway v3.16.0.

Full plugin name: io.conduktor.gateway.interceptor.ProduceJsonataPlugin

Transformed message data on produce using JSONata expressions. Applied JSONata transformations to records before they were written to Kafka.

Configuration

{
  "pluginClass": "io.conduktor.gateway.interceptor.ProduceJsonataPlugin",
  "priority": 100,
  "config": {
    "topic": ".*",
    "expression": "$sift($, function($v, $k) {$k != 'password' and $k != 'visa'})",
    "schemaRegistryConfig": {
      "host": "http://schema-registry:8081"
    },
    "jsonataConfig": {
      "cacheSize": 100,
      "timeoutMs": 60000,
      "maxDepth": 1000
    }
  }
}

Configuration properties

Property	Type	Default	Description
topic	String	.*	Topics matching this regex have the Interceptor applied.
expression	String		The JSONata expression for transformation.
schemaRegistryConfig	Object		Schema registry configuration.
jsonataConfig.cacheSize	Integer	100	Cache size for JSONata expressions.
jsonataConfig.timeoutMs	Long	60000	Max execution time in milliseconds.
jsonataConfig.maxDepth	Integer	1000	Limit for the number of recursive calls.

JSONata transformer - fetch (FetchJsonataPlugin)

Removed in Gateway v3.19.0. Deprecated since Gateway v3.16.0.

Full plugin name: io.conduktor.gateway.interceptor.FetchJsonataPlugin

Transformed message data on fetch/consume using JSONata expressions. Applied JSONata transformations to records as consumers read them through Gateway.

Configuration

{
  "pluginClass": "io.conduktor.gateway.interceptor.FetchJsonataPlugin",
  "priority": 100,
  "config": {
    "topic": ".*",
    "expression": "$sift($, function($v, $k) {$k != 'password' and $k != 'visa'})",
    "schemaRegistryConfig": {
      "host": "http://schema-registry:8081"
    },
    "jsonataConfig": {
      "cacheSize": 100,
      "timeoutMs": 60000,
      "maxDepth": 1000
    }
  }
}

Configuration properties

Property	Type	Default	Description
topic	String	.*	Topics matching this regex have the Interceptor applied.
expression	String		The JSONata expression for transformation.
schemaRegistryConfig	Object		Schema registry configuration.
jsonataConfig.cacheSize	Integer	100	Cache size for JSONata expressions.
jsonataConfig.timeoutMs	Long	60000	Max execution time in milliseconds.
jsonataConfig.maxDepth	Integer	1000	Limit for the number of recursive calls.

Encrypt on consume (FetchEncryptPlugin)

Removed in Gateway v3.19.0. Deprecated since Gateway v3.16.0.

Full plugin name: io.conduktor.gateway.interceptor.FetchEncryptPlugin

Encrypted specific record fields or the entire payload during fetch/consume operations. Data stored in Kafka remained unencrypted — encryption was applied only when consumers read through Gateway.

The configuration properties were the same as the list-based EncryptPlugin.

Recommended alternative: Use data masking policies or EncryptPlugin (on produce) instead.

List-based encryption on consume

curl

curl \
  --request PUT \
  --url 'http://localhost:8888/gateway/v2/interceptor' \
  --header 'Authorization: Basic YWRtaW46Y29uZHVrdG9y' \
  --header 'Content-Type: application/json' \
  --data-raw '{
  "kind": "Interceptor",
  "apiVersion": "gateway/v2",
  "metadata": {
    "name": "myEncryptPlugin"
  },
  "spec": {
    "pluginClass": "io.conduktor.gateway.interceptor.FetchEncryptPlugin",
    "priority": 100,
    "config": {
      "topic": ".*",
      "schemaRegistryConfig": {
        "host": "http://schema-registry:8081"
      },
      "kmsConfig": {
        "vault": {
          "uri": "http://vault:8200",
          "token": "vault-plaintext-root-token",
          "version": 1
        }
      },
      "recordValue": {
        "fields": [
          {
            "fieldName": "password",
            "keySecretId": "vault-kms://vault:8200/transit/keys/password-secret",
            "algorithm": "AES128_GCM"
          },
          {
            "fieldName": "visa",
            "keySecretId": "vault-kms://vault:8200/transit/keys/{{record.header.test-header}}-visa-secret-{{record.key}}-{{record.value.username}}-{{record.value.education.account.accountId}}",
            "algorithm": "AES128_GCM"
          },
          {
            "fieldName": "education.account.username",
            "keySecretId": "vault-kms://vault:8200/transit/keys/{{record.header.test-header}}-secret-key-account-username-{{record.topic}}",
            "algorithm": "AES128_GCM"
          }
        ]
      }
    }
  }
}'

Conduktor CLI

apiVersion: gateway/v2
kind: Interceptor
metadata:
  name: myEncryptPlugin
  scope:
    vCluster: passthrough
spec:
  pluginClass: io.conduktor.gateway.interceptor.FetchEncryptPlugin
  priority: 100
  config:
    topic: ".*"
    schemaRegistryConfig:
      host: http://schema-registry:8081
    kmsConfig:
      vault:
        uri: http://vault:8200
        token: vault-plaintext-root-token
        version: 1
    recordValue:
      fields:
        - fieldName: password
          keySecretId: vault-kms://vault:8200/transit/keys/password-secret
          algorithm: AES128_GCM
        - fieldName: visa
          keySecretId: vault-kms://vault:8200/transit/keys/{{record.header.test-header}}-visa-secret-{{record.key}}-{{record.value.username}}-{{record.value.education.account.accountId}}
          algorithm: AES128_GCM
        - fieldName: education.account.username
          keySecretId: vault-kms://vault:8200/transit/keys/{{record.header.test-header}}-secret-key-account-username-{{record.topic}}
          algorithm: AES128_GCM

Apply with:

conduktor apply -f encrypt-on-consume.yaml

List-based encryption on consume with secured template

curl

curl \
  --request PUT \
  --url 'http://localhost:8888/gateway/v2/interceptor' \
  --header 'Authorization: Basic YWRtaW46Y29uZHVrdG9y' \
  --header 'Content-Type: application/json' \
  --data-raw '{
  "kind": "Interceptor",
  "apiVersion": "gateway/v2",
  "metadata": {
    "name": "myEncryptPlugin"
  },
  "spec": {
    "pluginClass": "io.conduktor.gateway.interceptor.FetchEncryptPlugin",
    "priority": 100,
    "config": {
      "topic": ".*",
      "schemaRegistryConfig": {
        "host": "http://schema-registry:8081",
        "additionalConfigs": {
          "schema.registry.url": "${SR_URL}",
          "basic.auth.credentials.source": "${SR_BASIC_AUTH_CRED_SRC}",
          "basic.auth.user.info": "${SR_BASIC_AUTH_USER_INFO}"
        }
      },
      "kmsConfig": {
        "vault": {
          "uri": "https://vault:8200",
          "token": "${VAULT_TOKEN}",
          "trustStore": {
            "trustStorePath": "/security/truststore.jks"
          }
        }
      },
      "recordValue": {
        "fields": [
          {
            "fieldName": "password",
            "keySecretId": "vault-kms://vault:8200/transit/keys/password-secret",
            "algorithm": "AES128_GCM"
          },
          {
            "fieldName": "visa",
            "keySecretId": "vault-kms://vault:8200/transit/keys/{{record.header.test-header}}-visa-secret-{{record.key}}-{{record.value.username}}-{{record.value.education.account.accountId}}",
            "algorithm": "AES128_GCM"
          },
          {
            "fieldName": "education.account.username",
            "keySecretId": "vault-kms://vault:8200/transit/keys/{{record.header.test-header}}-secret-key-account-username-{{record.topic}}",
            "algorithm": "AES128_GCM"
          }
        ]
      }
    }
  }
}'

Conduktor CLI

apiVersion: gateway/v2
kind: Interceptor
metadata:
  name: myEncryptPlugin
  scope:
    vCluster: passthrough
spec:
  pluginClass: io.conduktor.gateway.interceptor.FetchEncryptPlugin
  priority: 100
  config:
    topic: ".*"
    schemaRegistryConfig:
      host: http://schema-registry:8081
      additionalConfigs:
        schema.registry.url: $${SR_URL}
        basic.auth.credentials.source: $${SR_BASIC_AUTH_CRED_SRC}
        basic.auth.user.info: $${SR_BASIC_AUTH_USER_INFO}
    kmsConfig:
      vault:
        uri: http://vault:8200
        token: $${VAULT_TOKEN}
        version: 1
    recordValue:
      fields:
        - fieldName: password
          keySecretId: vault-kms://vault:8200/transit/keys/password-secret
          algorithm: AES128_GCM
        - fieldName: visa
          keySecretId: vault-kms://vault:8200/transit/keys/{{record.header.test-header}}-visa-secret-{{record.key}}-{{record.value.username}}-{{record.value.education.account.accountId}}
          algorithm: AES128_GCM
        - fieldName: education.account.username
          keySecretId: vault-kms://vault:8200/transit/keys/{{record.header.test-header}}-secret-key-account-username-{{record.topic}}
          algorithm: AES128_GCM

Apply with:

conduktor apply -f encrypt-on-consume-secured-template.yaml

Encrypt on consume - schema based (FetchEncryptSchemaBasedPlugin)

Removed in Gateway v3.19.0. Deprecated since Gateway v3.16.0.

Full plugin name: io.conduktor.gateway.interceptor.FetchEncryptSchemaBasedPlugin

Encrypted fields tagged in a specified schema during fetch/consume operations. Data stored in Kafka remained unencrypted — encryption was applied only when consumers read through Gateway.

The configuration properties were the same as the schema-based EncryptSchemaBasedPlugin.

Recommended alternative: Use data masking policies or EncryptSchemaBasedPlugin (on produce) instead.

Schema-based encryption on consume

curl

curl \
  --request PUT \
  --url 'http://localhost:8888/gateway/v2/interceptor' \
  --header 'Authorization: Basic YWRtaW46Y29uZHVrdG9y' \
  --header 'Content-Type: application/json' \
  --data-raw '{
  "kind": "Interceptor",
  "apiVersion": "gateway/v2",
  "metadata": {
    "name": "mySchemaBasedEncryptPlugin"
  },
  "spec": {
    "pluginClass": "io.conduktor.gateway.interceptor.FetchEncryptSchemaBasedPlugin",
    "priority": 100,
    "config": {
      "topic": ".*",
      "schemaRegistryConfig": {
        "host": "http://schema-registry:8081"
      },
      "kmsConfig": {
        "vault": {
          "uri": "https://vault:8200",
          "token": "vault-plaintext-root-token",
          "trustStore": {
            "trustStorePath": "/security/truststore.jks"
          }
        }
      },
      "defaultKeySecretId": "vault-kms://vault:8200/transit/keys/myDefaultKeySecret",
      "defaultAlgorithm": "AES128_EAX",
      "tags": [
        "PII",
        "ENCRYPTION"
      ],
      "namespace": "conduktor."
    }
  }
}'

Conduktor CLI

apiVersion: gateway/v2
kind: Interceptor
metadata:
  name: mySchemaBasedEncryptPlugin
  scope:
    vCluster: passthrough
spec:
  pluginClass: io.conduktor.gateway.interceptor.FetchEncryptSchemaBasedPlugin
  priority: 100
  config:
    topic: ".*"
    schemaRegistryConfig:
      host: http://schema-registry:8081
    kmsConfig:
      vault:
        uri: http://vault:8200
        token: vault-plaintext-root-token
        version: 1
    defaultKeySecretId: vault-kms://vault:8200/transit/keys/myDefaultKeySecret
    defaultAlgorithm: AES128_EAX
    tags:
      - PII
      - ENCRYPTION
    namespace: conduktor.

Apply with:

conduktor apply -f schema-based-encrypt-on-consume.yaml

Large batch handling (LargeBatchHandlingPlugin)

Removed in Gateway v3.21.0. Deprecated since Gateway v3.18.0.

Full plugin name: io.conduktor.gateway.interceptor.LargeBatchHandlingPlugin

Saved each record batch above the minimumSizeInBytes threshold as a single file in cloud storage (Amazon S3 or Azure Blob Storage), replacing the batch payload in Kafka with a reference and reassembling it transparently on consume.

Recommended alternative: Use large message handling instead — it offloads individual messages above the size threshold.

Configuration

Each batch that’s above the minimumSizeInBytes threshold will be saved in one file on Amazon S3, with credentials defaulting to managed identity:

curl

curl \
  --request PUT \
  --url 'http://localhost:8888/gateway/v2/interceptor' \
  --header 'Authorization: Basic YWRtaW46Y29uZHVrdG9y' \
  --header 'Content-Type: application/json' \
  --data-raw '{
  "kind": "Interceptor",
  "apiVersion": "gateway/v2",
  "metadata": {
    "name": "myLargeBatchHandlingPlugin"
  },
  "spec": {
    "pluginClass": "io.conduktor.gateway.interceptor.LargeBatchHandlingPlugin",
    "priority": 100,
    "config": {
      "topic": "topic.*",
      "minimumSizeInBytes": 1024,
      "localDiskDirectory": "myStorage/",
      "s3Config": {
        "bucketName": "myBucketName",
        "uri": "http://myexampleuri",
        "region": "us-east-1"
      }
    }
  }
}'

Conduktor CLI

apiVersion: gateway/v2
kind: Interceptor
metadata:
  name: myLargeBatchHandlingPlugin
  scope:
    vCluster: passthrough
spec:
  pluginClass: io.conduktor.gateway.interceptor.LargeBatchHandlingPlugin
  priority: 100
  config:
    topic: topic.*
    minimumSizeInBytes: 1024
    localDiskDirectory: myStorage/
    s3Config:
      bucketName: myBucketName
      uri: http://myexampleuri
      region: us-east-1

Apply with:

conduktor apply -f large-batch-handling-interceptor.yaml

With basic credentials:

curl

curl \
  --request PUT \
  --url 'http://localhost:8888/gateway/v2/interceptor' \
  --header 'Authorization: Basic YWRtaW46Y29uZHVrdG9y' \
  --header 'Content-Type: application/json' \
  --data-raw '{
  "kind": "Interceptor",
  "apiVersion": "gateway/v2",
  "metadata": {
    "name": "myLargeBatchHandlingPlugin"
  },
  "spec": {
    "pluginClass": "io.conduktor.gateway.interceptor.LargeBatchHandlingPlugin",
    "priority": 100,
    "config": {
      "topic": "topic.*",
      "minimumSizeInBytes": 1024,
      "localDiskDirectory": "myStorage/",
      "s3Config": {
        "accessKey": "myAccessKey",
        "secretKey": "mySecretKey",
        "bucketName": "myBucketName",
        "uri": "http://myexampleuri",
        "region": "us-east-1"
      }
    }
  }
}'

Conduktor CLI

apiVersion: gateway/v2
kind: Interceptor
metadata:
  name: myLargeBatchHandlingPlugin
  scope:
    vCluster: passthrough
spec:
  pluginClass: io.conduktor.gateway.interceptor.LargeBatchHandlingPlugin
  priority: 100
  config:
    topic: topic.*
    minimumSizeInBytes: 1024
    localDiskDirectory: myStorage/
    s3Config:
      accessKey: myAccessKey
      secretKey: mySecretKey
      bucketName: myBucketName
      uri: http://myexampleuri
      region: us-east-1

Apply with:

conduktor apply -f large-batch-handling-basic-creds-interceptor.yaml

With session credentials:

curl

curl \
  --request PUT \
  --url 'http://localhost:8888/gateway/v2/interceptor' \
  --header 'Authorization: Basic YWRtaW46Y29uZHVrdG9y' \
  --header 'Content-Type: application/json' \
  --data-raw '{
  "kind": "Interceptor",
  "apiVersion": "gateway/v2",
  "metadata": {
    "name": "myLargeBatchHandlingPlugin"
  },
  "spec": {
    "pluginClass": "io.conduktor.gateway.interceptor.LargeBatchHandlingPlugin",
    "priority": 100,
    "config": {
      "topic": "topic.*",
      "minimumSizeInBytes": 1024,
      "localDiskDirectory": "myStorage/",
      "s3Config": {
        "accessKey": "myAccessKey",
        "secretKey": "mySecretKey",
        "sessionToken": "mySessionToken",
        "bucketName": "myBucketName",
        "uri": "http://myexampleuri",
        "region": "us-east-1"
      }
    }
  }
}'

Conduktor CLI

apiVersion: gateway/v2
kind: Interceptor
metadata:
  name: myLargeBatchHandlingPlugin
  scope:
    vCluster: passthrough
spec:
  pluginClass: io.conduktor.gateway.interceptor.LargeBatchHandlingPlugin
  priority: 100
  config:
    topic: topic.*
    minimumSizeInBytes: 1024
    localDiskDirectory: myStorage/
    s3Config:
      accessKey: myAccessKey
      secretKey: mySecretKey
      sessionToken: mySessionToken
      bucketName: myBucketName
      uri: http://myexampleuri
      region: us-east-1

Apply with:

conduktor apply -f large-batch-handling-session-creds-interceptor.yaml