You can edit a Google Cloud Managed Service for Apache Kafka cluster to update properties such as the cluster size, including vCPU count and memory, the list of connected subnets, the allowed source IP ranges for public clusters, the automatic rebalancing configuration, and the mTLS configuration.
To edit a cluster, you can use the Google Cloud console, the Google Cloud CLI, the client library, or the Managed Kafka API. You can't use the open source Apache Kafka API to update a cluster.
Updating certain properties, such as vCPU count and memory, might require the service to restart the cluster. The service restarts the cluster one broker at a time. During this process, requests to individual brokers might fail, but these failures are transient. Commonly used client libraries automatically handle these errors.
Required roles and permissions
To get the permissions that
you need to update a cluster,
ask your administrator to grant you the
Managed Kafka Cluster Editor (roles/managedkafka.clusterEditor) IAM role on your project.
For more information about granting roles, see Manage access to projects, folders, and organizations.
This predefined role contains the permissions required to update a cluster. To see the exact permissions that are required, expand the Required permissions section:
Required permissions
The following permissions are required to update a cluster:
-
Edit a cluster:
managedkafka.clusters.update
You might also be able to get these permissions with custom roles or other predefined roles.
Resize a cluster
If you update a cluster's vCPU count or memory, the following rules apply:
The cluster's overall vCPU-to-memory ratio must always remain between 1:1 and 1:8.
There must be at least 1 vCPU and 1 GiB of memory for each existing broker. The number of brokers never decreases.
If the cluster has a custom disk configuration, the update must meet the disk configuration requirements for local storage.
If you upscale, the average vCPU and memory per broker can't decrease by more than 10% compared to the averages before the update. For example, if you try to upscale a cluster from 45 vCPUs (3 brokers) to 48 vCPUs (4 brokers), the average vCPU per broker decreases from 15 to 12, which is a 20% reduction, exceeding the 10% limit.
If you need to decrease the vCPU count by more than 10%, we recommend reducing it in several stages. After each update, monitor resource utilization, and rebalance partitions if needed.
However, if you are confident that your brokers will have enough capacity after the update, you can disable this check by running the
gcloud managed-kafka clusters updatecommand with theallow_broker_downscale_on_cluster_upscale=trueflag. This flag signals that you accept the potential performance risk.
For more information, see Update the cluster size.
Public cluster configuration
You can enable or disable public access for an existing cluster, as well as add or remove allowed source IP ranges. For more information about the requirements and rules for allowed source IP ranges, see Public clusters.
Managed Service for Apache Kafka uses Cloud Next Generation Firewall to restrict access to public clusters. Removing allowed source IP ranges or disabling public access applies only to new connections. For more information, see effects on existing traffic.
Edit a cluster
To edit a cluster, follow these steps:
Console
- In the Google Cloud console, go to the Clusters page.
- From the list of clusters, click the cluster whose properties you want to edit.
The console displays the cluster details page.
On the cluster details page, click Edit.
Edit the properties as required. You can edit the following properties of a cluster from the console:
- Memory
- vCPUs
- Subnet
- Rebalancing configuration
- mTLS configuration
- Labels
Click Save.
gcloud
-
In the Google Cloud console, activate Cloud Shell.
At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.
-
Before using any of the command data below, make the following replacements:
-
PROJECT_ID: the project ID. -
LOCATION: the location of the cluster. -
CLUSTER_ID: the ID of the cluster. -
CPU_COUNT: the number of vCPUs for the cluster. -
MEMORY: the amount of memory for the cluster. Example:10GiB. -
SUBNET_ID: the subnet ID of the subnet to connect to. Example:default. -
LABELS: the labels to associate with the cluster. -
ALLOWED_SOURCE_IP_RANGES: the allowed source IPv4 CIDR ranges for public cluster internet access.
Execute the following command:
Linux, macOS, or Cloud Shell
gcloud managed-kafka clusters update CLUSTER_ID \ --location=LOCATION \ --cpu=CPU_COUNT \ --memory=MEMORY \ --subnets=projects/PROJECT_ID/regions/LOCATION/subnetworks/SUBNET_ID \ --auto-rebalance \ --labels=LABELS \ --public-cluster \ --allowed-source-ip-ranges=ALLOWED_SOURCE_IP_RANGES
Windows (PowerShell)
gcloud managed-kafka clusters update CLUSTER_ID ` --location=LOCATION ` --cpu=CPU_COUNT ` --memory=MEMORY ` --subnets=projects/PROJECT_ID/regions/LOCATION/subnetworks/SUBNET_ID ` --auto-rebalance ` --labels=LABELS ` --public-cluster ` --allowed-source-ip-ranges=ALLOWED_SOURCE_IP_RANGES
Windows (cmd.exe)
gcloud managed-kafka clusters update CLUSTER_ID ^ --location=LOCATION ^ --cpu=CPU_COUNT ^ --memory=MEMORY ^ --subnets=projects/PROJECT_ID/regions/LOCATION/subnetworks/SUBNET_ID ^ --auto-rebalance ^ --labels=LABELS ^ --public-cluster ^ --allowed-source-ip-ranges=ALLOWED_SOURCE_IP_RANGES
You should receive a response similar to the following:
done: false metadata: '@type': type.googleapis.com/google.cloud.managedkafka.v1.OperationMetadata apiVersion: v1 createTime: 'CREATE_TIME' requestedCancellation: false target: projects/PROJECT_ID/locations/LOCATION/clusters/CLUSTER_ID verb: update name: projects/PROJECT_ID/locations/LOCATION/operations/OPERATION_ID
- To disable public access, use the
--no-public-clusterflag. - If you use the
--asyncflag with your command, the system sends the update request and immediately returns a response, without waiting for the operation to complete. With the--asyncflag, you can continue with other tasks while the cluster update happens in the background. If you don't use the--asyncflag, the system waits for the operation to complete before returning a response. You must wait until the cluster is fully updated before you can continue with other tasks.
-
REST
Before using any of the request data, make the following replacements:
-
PROJECT_ID: your Google Cloud project ID -
LOCATION: the location of the cluster. -
CLUSTER_ID: the ID of the cluster. -
UPDATE_MASK: which fields to update, as a comma-separated list of fully qualified names. Example:capacityConfig.vcpuCount,capacityConfig.memoryBytes -
CPU_COUNT: the number of vCPUs for the cluster. -
MEMORY: the amount of memory for the cluster, in bytes. Example:3221225472. -
SUBNET_ID: subnet ID of the subnet to connect to. Example:default.
HTTP method and URL:
PATCH https://managedkafka.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/clusters/CLUSTER_ID?updateMask=UPDATE_MASK
Request JSON body:
{
"capacityConfig": {
"vcpuCount": CPU_COUNT,
"memoryBytes": MEMORY
},
"gcpConfig": {
"accessConfig": {
"networkConfigs": [
{
"subnet": "projects/PROJECT_ID/regions/LOCATION/subnetworks/SUBNET_ID"
}
]
}
}
}
To send your request, expand one of these options:
You should receive a JSON response similar to the following:
{
"name": "projects/PROJECT_ID/locations/LOCATION/operations/OPERATION_ID",
"metadata": {
"@type": "type.googleapis.com/google.cloud.managedkafka.v1.OperationMetadata",
"createTime": "CREATE_TIME",
"target": "projects/PROJECT_ID/locations/LOCATION/clusters/CLUSTER_ID",
"verb": "update",
"requestedCancellation": false,
"apiVersion": "v1"
},
"done": false
}
In the request body, include only the fields that you are updating, as specified in the UPDATE_MASK query parameter.
- To add a subnet, append a new entry to
networkConfigsin the following format:projects/PROJECT_ID/regions/LOCATION/subnetworks/SUBNET_ID. Example:projects/sample-project/regions/us-central1/subnetworks/default. To enable public access or update the allowed source IP ranges, include
gcpConfig.accessConfig.publicClusterConfigin the UPDATE_MASK query parameter and specify theallowedSourceIpRangesarray in the request body. Example request body:{ "gcpConfig": { "accessConfig": { "publicClusterConfig": { "allowedSourceIpRanges": [ "203.0.113.0/24" ] } } } }To disable public access, include
gcpConfig.accessConfig.publicClusterConfigin the UPDATE_MASK query parameter and pass an empty JSON object{}in the request body (or omitpublicClusterConfig). Example request body:{}
Go
Before trying this sample, follow the Go setup instructions in Install the client libraries. For more information, see the Managed Service for Apache Kafka Go API reference documentation.
To authenticate to Managed Service for Apache Kafka, set up Application Default Credentials(ADC). For more information, see Set up ADC for a local development environment.
Java
Before trying this sample, follow the Java setup instructions in Install the client libraries. For more information, see the Managed Service for Apache Kafka Java API reference documentation.
To authenticate to Managed Service for Apache Kafka, set up Application Default Credentials. For more information, see Set up ADC for a local development environment.
Python
Before trying this sample, follow the Python setup instructions in Install the client libraries. For more information, see the Managed Service for Apache Kafka Python API reference documentation.
To authenticate to Managed Service for Apache Kafka, set up Application Default Credentials. For more information, see Set up ADC for a local development environment.
Limitations
After you create a Managed Service for Apache Kafka cluster, you can't update the following properties:
- The cluster name
- The cluster location
- The encryption type
Although you can't change the encryption type, you can rotate encryption keys.