Kafbat UI

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point, and the image is tuned for it. Choose a larger size for bigger clusters or heavier browsing.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the console. Kafbat UI serves plain HTTP on port 80, so for production terminate TLS in front of it with your own domain. The bundled Kafka broker listens on 127.0.0.1 only, so ports 9092 and 9093 stay off the network.

Step 1 - Deploy the image

Option A: Azure portal

• In the Azure portal, open Create a resource and search for Kafbat UI for Apache Kafka on Ubuntu 24.04 LTS by SecureAnyCloud.
• Select the plan and click Create.
• On the Basics tab, choose your subscription, resource group and region, name the VM, and select Standard_B2s.
• Set Authentication type to SSH public key, enter azureuser as the username, and provide your public key.
• On the Networking tab, allow inbound 22/tcp (from your IP) and 80/tcp.
• Review and create the VM. When deployment completes, note the VM's public IP address.

Option B: Azure CLI

az vm image terms accept --urn sac1647283583153:kafbat-ui-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-kafbat-rg \
  --name kafbat-ui \
  --image sac1647283583153:kafbat-ui-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 to reach the console. Port 22 is needed for SSH:

az vm open-port --resource-group my-kafbat-rg --name kafbat-ui --port 80 --priority 900

Step 2 - Confirm the services are running

SSH in as azureuser and confirm that the three systemd units are active. kafka.service is the bundled broker, kafbat-ui.service is the web console, and nginx.service is the reverse proxy on port 80.

systemctl is-active kafka kafbat-ui nginx

Expect this output:

active active active

The web console reports readiness on an unauthenticated health endpoint, which Azure Load Balancer probes can use:

curl -s http://127.0.0.1/actuator/health

{"status":"UP"}

The bundled broker and the console bind to the loopback interface only. nginx on port 80 is the only external surface. Confirm the listening sockets:

ss -tln | grep -E ':80 |:8080 |:9092 |:9093 '

Step 3 - Retrieve the per-VM administrator password

Kafbat UI ships with authentication switched on. There is no default or shared password. On the first boot of every VM, a one-shot service generates a random administrator password that is unique to that instance and writes it to a root-only file. Read it with sudo:

sudo cat /root/kafbat-ui-credentials.txt

The file records the console URL, the administrator username admin and the generated password:

# Kafbat UI for Apache Kafka - Per-VM Credentials KAFBAT_UI_URL=http://YOUR_VM_IP/ KAFBAT_ADMIN_USER=admin KAFBAT_ADMIN_PASSWORD=<KAFBAT_ADMIN_PASSWORD>

The file is 0600 root:root, so only the root user can read it. Keep this password safe. It is the single administrator credential for the console.

Step 4 - Sign in to the console

Open http://YOUR_VM_IP/ in your browser. Kafbat UI shows its login form because authentication is enabled.

Enter the username admin and the password from /root/kafbat-ui-credentials.txt, then click Log in. Any request to the console or its API without a sign-in is redirected to the login page, so the console is never served anonymously.

Step 5 - Explore the cluster

After you sign in, open Brokers to see the bundled cluster. This is a single-node KRaft deployment: one broker that is also the active controller, so there is no separate ZooKeeper to run.

The dashboard shows the broker count, the active controller and the controller type (KRaft). It also shows the online, in-sync and out-of-sync partition counts across the cluster.

Step 6 - Browse topics

Open Topics to list the topics on the broker. The image seeds three demo topics on first boot so the console has real data to explore: demo-orders (3 partitions), demo-payments and demo-users.

Each row shows the partition count, replication factor, message count and on-disk size. The internal __consumer_offsets topic, which Kafka uses to track consumer progress, is listed too. From here you can create, configure, purge or delete topics, and click any topic for its details.

Step 7 - Read live messages

Click a topic and open its Messages tab to read what is on it. The demo-orders topic shows its seeded order events. Each message has an offset, a partition, a timestamp, a key (for example order-028) and a JSON value preview.

You can change the ordering, filter by partition, choose a key or value deserializer, and search. This is how you inspect what producers are actually writing.

Step 8 - Monitor consumer groups

Open Consumers to see consumer groups and their lag. The seeded demo-consumer group has read part of demo-orders and committed its offsets. A few more messages were produced afterwards, so the group shows a small non-zero lag.

Consumer lag is the gap between the latest offset and the last committed offset. It is the key signal that a consumer is keeping up with its topics.

Step 9 - Work with the bundled Kafka broker from the command line

The bundled broker is a full Apache Kafka install under /opt/kafka, so the standard Kafka command-line tools are available on the VM. The broker listens on 127.0.0.1:9092. List the topics:

/opt/kafka/bin/kafka-topics.sh --bootstrap-server 127.0.0.1:9092 --list

__consumer_offsets demo-orders demo-payments demo-users

Describe a topic to see its partitions and configuration:

/opt/kafka/bin/kafka-topics.sh --bootstrap-server 127.0.0.1:9092 --describe --topic demo-orders

Inspect the demo consumer group's committed offsets and lag from the command line. This is the same data the Consumers view shows:

/opt/kafka/bin/kafka-consumer-groups.sh --bootstrap-server 127.0.0.1:9092 --describe --group demo-consumer

You can also produce and consume your own messages. Create a topic, produce two records, then read them back:

/opt/kafka/bin/kafka-topics.sh --bootstrap-server 127.0.0.1:9092 --create --if-not-exists --topic my-events --partitions 1 --replication-factor 1 printf 'hello\nworld\n' | /opt/kafka/bin/kafka-console-producer.sh --bootstrap-server 127.0.0.1:9092 --topic my-events /opt/kafka/bin/kafka-console-consumer.sh --bootstrap-server 127.0.0.1:9092 --topic my-events --from-beginning --timeout-ms 8000 2>/dev/null

Refresh the Topics view in the browser. Your new my-events topic appears alongside the demo topics.

Step 10 - Security model

This image is secure by default. Kafbat UI ships with no authentication, so SecureAnyCloud switches on its login form and sets a per-VM administrator password at first boot. The shipped image never carries a usable credential.

You can verify the login wall directly. An unauthenticated API request is redirected to the login page. A request with the correct password is served. A request with the wrong password is not served.

PW=$(sudo grep '^KAFBAT_ADMIN_PASSWORD=' /root/kafbat-ui-credentials.txt | cut -d= -f2-)
echo "no auth -> $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1/api/clusters)"
CJ=$(mktemp); curl -s -o /dev/null -c "$CJ" --data-urlencode username=admin --data-urlencode "password=$PW" http://127.0.0.1/login echo "admin -> $(curl -s -o /dev/null -w '%{http_code}' -b "$CJ" http://127.0.0.1/api/clusters)" rm -f "$CJ"

no auth -> 302 admin -> 200

The 302 is the redirect to the login page. The 200 is the authenticated request being served. The bundled Kafka broker is bound to loopback only, so it is never reachable from the network, and the NSG needs to open only ports 22 and 80.

Step 11 - Base image and versions

The base is a hardened Ubuntu 24.04 LTS, patched at build time, with unattended security upgrades enabled. Your VMs keep receiving security updates. Confirm the bundled software versions:

echo "kernel: $(uname -r)"
echo "kafka: $(ls -d /opt/kafka_*/ | sed 's#.*/opt/##;s#/##')" /opt/kafbat-ui/jre/bin/java -version 2>&1 | head -1

Apache Kafka runs on the system OpenJDK 17. Kafbat UI runs on a bundled Eclipse Temurin 25 JRE, because Kafbat UI 1.5.0 requires Java 25.

A first-boot service formats the KRaft storage and sets the per-VM administrator password before the broker and console start. Startup order is therefore the same on every boot.

Managing the services

Restart the console, the broker or the proxy with systemd:

sudo systemctl restart kafbat-ui
sudo systemctl restart kafka
sudo systemctl restart nginx

The Kafka broker keeps its log and metadata directories under /var/lib/kafka/data. The console reads its configuration from /etc/default/kafbat-ui and connects to the broker at 127.0.0.1:9092.

Support

Every SecureAnyCloud image is backed by 24/7 support. For questions about this deployment, contact the SecureAnyCloud team at sales@secureanycloud.com.

Deploy on Azure

Launch Kafbat UI for Apache Kafka on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com