Almost Perfect Kafka

Browse Kafka topics and round-trip encrypted Avro messages without leaving VS Code.

Built for clusters that are not plain: mutual TLS from a trust file and an identity file, a Schema Registry over HTTPS, and message values that are encrypted before they are ever written to a topic. Point it at your own cluster and describe how your payloads are wrapped — the decoding chain is configuration, not a hardcoded recipe.

Features

Three views, and as many environments connected as you like. Environments lists every environment you have configured and whether each one is connected. Topics and Schemas show one group per connected environment, and hide that group when only one is connected, so the usual case is a flat list. Hold dev and test open together and read the same subject in both.

Connecting is one probe, not a held-open session. Connect reads the broker's metadata and the registry's subject list, then closes everything. Nothing stays open between clicks, so a laptop that sleeps does not leave a socket behind. If the registry is unreachable the environment still connects and says so; only the broker decides whether you are connected.

Producer and consumer tabs. Open either from a topic. Each becomes a real editor tab, so several topics can be open side by side and VS Code owns the layout. Every tab is titled with the environment first — dev · Produce: orders — and a producer tab names the cluster and brokers it will write to above the payload, because sending to the wrong cluster is the one thing here you cannot take back.

A producer tab that knows the shape you have to send. The value box opens pre-filled with a skeleton built from the topic's schema — every field present, defaults kept, one element shown for a list. Send checks what you typed against that schema and names the field that is wrong, so a typo fails in front of you instead of at the broker. Free paste turns the check off when you want to send something the schema does not describe. Payloads you send often can be named and reloaded, per topic.

Search a whole topic without holding it. The search box filters the rows a consume tab already holds as you type. Press Enter, or Search topic, and the extension walks the topic from its newest record backward in chunks, decodes each through the chain, and streams only the matches into the same list, newest first, with a running count and a Cancel. It hands over apk.consumer.maxMessages matches at a time and pauses for More matches, so a topic of any size is searched in bounded memory.

Reads without joining a consumer group. Partitions are assigned directly. No offsets are committed, no rebalance is triggered, and the read is invisible in your cluster's group listings — safe to point at a production topic that other consumers are already reading.

Avro against the registry. Encode and decode against latest or a pinned version. The subject defaults to <topic>-value and any registry subject can be chosen instead. Schemas are never registered — the extension only reads. A long or int carrying a timestamp-millis, timestamp-micros, local-timestamp-millis, local-timestamp-micros, date, time-millis or time-micros logical type is written and read as java.time text — 2027-07-07T14:00:00.123Z for an instant — and the epoch number is still taken.

A payload chain you configure. Steps are ordered by you and reversed automatically when consuming, so producing and consuming stay symmetric. Nothing is pre-configured — a new environment has no chain and shows raw bytes until you build one, so a topic of plain JSON is readable on day one. base64 → AES-256-GCM → Avro is a common shape, not a default. A cipher step starts at AES-256-GCM with a hex key, a 12-byte IV in front and a trailing 16-byte auth tag; algorithm, key encoding, IV length, auth-tag length and the frame — the order the IV, ciphertext and auth tag sit in on the wire — are all settings, so a platform that appends its IV is configured rather than coded. An authenticated cipher step can also bind additional authenticated data — a value you type, or the name of the topic — for platforms that authenticate more than they transmit. The algorithm list comes from your Node build, not a hardcoded list.

mTLS from the files you already have. JKS, PKCS#12 or PEM — one file picker for trust, one for identity. No folder scanning and no naming conventions.

Passwords in the OS keychain. Keystore and truststore passwords and encryption keys go to VS Code's secret storage, which is macOS Keychain, Windows DPAPI or Linux libsecret. Everything else stays in readable JSON.

Getting started

1. Open the Almost Perfect Kafka container from the activity bar.
2. Add Environment in the Environments title bar. Give it bootstrap servers and, if you have one, a Schema Registry URL. Both take a comma-separated list; the registry addresses are tried in order, and a refused or unresolved one falls through to the next.
3. For a TLS cluster, pick a trust file and an identity file and enter their passwords. A Schema Registry that asks for HTTP Basic authentication takes its username and password under Schema Registry login on the same step; a URL with a login typed into it is refused, so the password never sits in the URL.
4. The new environment connects on save. Add another and connect it too, from the plug beside its name.
5. In Topics, right-click a topic and choose Open Consumer or Open Producer.
6. If your values are wrapped — encrypted, base64-wrapped, Avro — build the payload chain in that tab. Until you do, values are shown as raw bytes.

Whatever you had connected comes back when VS Code reopens, re-checked rather than assumed, so a broker that has gone away shows as failed instead of as an empty list.

Environment settings live in kafka-config.json in the extension's global storage. Passwords and encryption keys never go in it.

Settings

Three numbers are yours to change, under Almost Perfect Kafka in VS Code's settings.

• apk.consumer.maxMessages — the most messages a tail keeps, and the most matches a topic search hands over before it pauses for more, 500 by default. Older tail rows fall off the top once a tab is full, and the tab counts them beside its status.
• apk.consumer.readCount — how many messages a consume tab reads when it opens in Last N mode, 100 by default. A tab never opens on more messages than it is allowed to keep.
• apk.schemaRegistry.requestTimeout — milliseconds a Schema Registry request waits before giving up, 15000 by default.

Everything about an environment — brokers, registry URL, certificate paths, the payload chain — is per environment and lives in the extension's own storage instead, so nothing in a folder you opened can aim this extension at a cluster you did not choose.

Requirements

• A Kafka cluster reachable from your machine, plaintext or TLS.
• A Confluent-compatible Schema Registry, if your topics carry Avro.

No broker-side plugin, no CLI, and no native binary to compile — the extension talks to Kafka and the registry over their own protocols.

Status

Early preview, developed in the open. Producing and consuming, mTLS, the Schema Registry client and the payload chain are built; expect rough edges at the connection and error surface. On a high-throughput topic a consume tab keeps only the most recent apk.consumer.maxMessages rows, and says how many it never showed you.

Deliberately out of scope for now: consumer group and lag listings, creating or deleting topics, registering or evolving schemas, SASL authentication, and Confluent's field-level encryption. The extension reads the registry and never writes to it, and it has no topic administration commands at all.

Questions, bug reports and feature requests: the Q & A tab on this extension's Marketplace page, or dev.almostperfect+kafka@gmail.com.

License

MIT, in the LICENSE file shipped with the extension. The licences of the open-source code bundled into it are in THIRD_PARTY_NOTICES.txt, shipped alongside.