This version is still in development and is not considered stable yet. For the latest stable version, please use Korvet 0.19!

Web UI

Korvet includes a web-based administration console for managing topics, monitoring consumer groups, and inspecting storage health.

Accessing the Web UI

The web UI is available at http://localhost:8080 by default.

# Start the server
korvet server

# Open http://localhost:8080 in your browser
# (macOS: open, Linux: xdg-open)
open http://localhost:8080

Browser and viewport support

The control-plane UI supports current Chromium-based browsers at viewport widths of 360 pixels and wider. At narrow widths, the navigation sidebar collapses automatically and wide data tables scroll horizontally within their table cards. App-bar actions remain available without scrolling the whole page.

Authentication

The web UI uses session-based authentication: the login screen posts credentials to POST /api/v1/auth/login, which sets a signed, HttpOnly session cookie (korvet-admin-session, 8 hours by default via korvet.admin.jwt.expiry). Logging out revokes the session server-side, so a copied cookie stops working immediately. Repeated failed logins for the same username and client IP are throttled (korvet.admin.login-throttle.*).

On a fresh install with no admin users, the UI offers a one-time first-run setup screen that creates the first admin account. Alternatively, configure bootstrap credentials:

korvet:
  admin:
    username: admin
    password: admin
    bootstrap: true

When bootstrap is true (the default), Korvet creates the configured admin user on startup if it does not already exist. Set it to false once you manage admin credentials yourself.

Change the default password before exposing the UI outside a local development environment. Users changing their own password must confirm their current one; admins can reset other accounts directly.

Single Sign-On

With korvet.admin.oauth.enabled=true, the login screen leads with a Sign in with … button that sends the browser through the configured OIDC identity provider (authorization code
PKCE); the password form remains available as a collapsed break-glass option. After the IdP round trip the console issues the same session cookie as a password login, and the federated username appears in the top-bar user menu. The user’s role comes from the IdP groups claim (korvet.admin.oauth.roles.*); a user matching no configured group cannot sign in. See Console Single Sign-On for configuration and a Keycloak walkthrough.

Roles

Each console user is an ADMIN (full read-write, the default) or a VIEWER (read-only). Viewers can browse every page, but the UI hides mutating actions for them — creating, editing, or deleting topics, resetting consumer group offsets, registering schemas or changing compatibility, changing log levels, and all write actions on the Security tabs. The server enforces the same rule (mutations return 403 Forbidden), so the UI gating is a convenience, not the security boundary. The signed-in role is shown in the user menu in the top bar, and the Users tab shows each account’s role with a role picker on create and edit. The last remaining admin cannot be deleted or demoted.

HTTP Basic authentication (against the same admin users) applies only to the Swagger UI / OpenAPI endpoints and to the actuator endpoints other than health probes — not to the web UI or the REST API.

For local demos and development, you can disable authentication:

korvet server --korvet.admin.security-enabled=false

When authentication is disabled, the UI skips the login screen and all API endpoints are publicly accessible.

Only disable authentication in trusted local environments. The korvet demo command uses this mode but binds to loopback (127.0.0.1) to keep the unauthenticated UI and broker accessible only locally.

Dashboard Pages

Overview

The main dashboard provides real-time operational visibility with key performance indicators:

  • Message throughput: Current messages per second

  • Active connections: Current client connection count

  • Backpressure connections: Connections experiencing flow control, with warning banner when active

  • Topic and consumer group counts: Quick inventory of managed resources

  • Request latency: Aggregated p50/p95/p99 percentiles across all Kafka API requests

The overview KPI tiles show current values only; trend sparklines appear on the Brokers and Topics pages instead.

Topics

Browse and manage Kafka topics:

  • List all topics with partition counts and real-time rates

  • Per-topic produce/fetch throughput (records/s, bytes/s, requests/s)

  • Per-topic latency percentiles (p50/p95/p99)

  • Produce-rate trend sparklines backed by in-memory history (default 1-hour retention, 15-second samples). History is process-local and starts empty on restart.

  • View topic configuration (retention policies, segment settings)

  • Inspect messages and their content

  • Monitor topic metrics and throughput

Browsing messages

The Messages page (and each topic’s Messages tab) browses stored records without mutating consumer state. Filters cover partition, seek position (earliest, a specific offset, or a timestamp), page size, and payload decoding.

The Order select chooses the browse direction: Oldest first (the default) reads forward from the seek position, while Newest first reads backward, so seeking from earliest with Newest first shows the whole topic newest-first.

The Decode as select renders payloads as raw base64, UTF-8, best-effort JSON, or Schema registry: records in the Confluent wire format (magic byte plus schema id) are decoded through the embedded schema registry using the record’s Avro, Protobuf, or JSON schema. Each key and value carries a decode-status badge:

  • decoded — the payload was decoded with its registered schema.

  • raw — the payload was rendered as-is (no schema decoding attempted).

  • schema-not-found — the record’s schema id was never registered; the payload falls back to raw base64 rendering. Deleting a schema subject or version does not cause this: schema ids stay resolvable after a delete, so old records keep decoding.

  • decode-error — the schema was found but decoding failed; the payload falls back to raw base64 rendering, and the badge tooltip carries the error reason.

A decode failure never fails the page — the affected record falls back to raw rendering while the rest of the page decodes normally.

Consumer Groups

Monitor consumer group health and activity:

  • List all consumer groups

  • Aggregate consumer lag metrics (total lag, max lag per group)

  • View group members and their partition assignments

  • Track committed offsets and undelivered-message lag. Lag excludes delivered-but-uncommitted pending messages.

  • Monitor consumption progress per partition

  • Last commit timestamp per group

  • Reset a group’s offsets. The confirmation dialog previews, per partition, the committed offset and delivery state the reset would clear (a dry run — nothing changes until confirmed). After the reset, consumers restart according to their own auto.offset.reset policy.

Brokers

View broker health and configuration:

  • Broker status and connectivity

  • Broker-scoped tiles with sparklines showing recent throughput and connection trends from in-memory history

  • Kafka listener addresses

  • Version and build information

  • Cluster metadata

Storage

The Storage Control Plane provides comprehensive visibility into tiered storage health and operations across four tabs:

Redis Streams (Local Tier)

Monitor the local Redis Streams storage:

  • Redis connectivity, latency, and health metrics

  • Total key count and memory usage

  • Per-topic/partition stream health, including each stream’s measured physical Redis memory (via the Redis MEMORY USAGE command), helping identify memory-heavy topics and partitions

  • Write circuit-breaker state (disabled, closed, open, half-open), with the reopen deadline while the breaker is open

  • Latency breakdown by Redis command

  • Connection pool statistics

Remote Storage

Track the Iceberg cold-tier archival:

  • Remote storage enabled status

  • Topics using remote tier

  • Offload throughput and backlog

  • Backlog age (time since oldest un-archived segment was sealed)

  • Archive latency percentiles (p50/p95/p99)

  • Archive failure summary by error type

  • Per-topic archival statistics

The offload throughput rates (segments per minute and bytes per minute) are computed from a 60-second rolling window of samples, so readings stay stable regardless of how frequently the UI or concurrent API callers poll. Backlog age is null until the storage worker reports lag, distinguishing an empty backlog (0 seconds) from "unknown".

Segments & Retention

Review retention policies and segment management:

  • Local and total retention policies per topic (time and size)

  • Segment rolling configuration (segment.ms, segment.bytes)

  • Policy inheritance and overrides

Offload Jobs

Monitor and control segment archival jobs:

  • Job inventory with status (pending, running, done, failed, cancelled), attempts against the configured attempt budget, start time, duration, and the failure message of the last attempt

  • Status filter chips and per-status summary cards with cluster-wide counts

  • Retry re-enables a failed or cancelled job so the storage worker’s next scan offloads the segment again (failed jobs also retry automatically until their attempt budget is exhausted)

  • Cancel suspends a pending or failed job; the segment’s local data is kept and the worker skips it until the job is retried

Both actions ask for confirmation and are only available to administrators; viewer sessions see a read-only table.

Security

Manage console users, broker ACLs, and Kafka SASL credentials:

  • Console users with roles (admin or read-only viewer), password resets, and a last-admin guard

  • ACL rules for topics and consumer groups, with exact, prefix*, or * resource matching

  • Create, update, and delete SASL credentials (SCRAM-SHA-256 and PLAIN)

  • Credential rotation and password management

Configuration

Customize the web UI port and binding:

server:
  port: 8080
  address: 0.0.0.0  # Bind to all interfaces (use 127.0.0.1 for local-only)

korvet:
  admin:
    security-enabled: true  # Set to false to disable authentication

Next Steps