Connecting
Point the tab at a cluster, connect, and pick a topic.
Bootstrap servers
One or more host:port entries, separated by commas. These are seed brokers: the client discovers the rest of the cluster from them.
localhost:9092
broker-1:9092,broker-2:9092,broker-3:9092
No scheme. This is an HTTP client by habit, so a pastedhttp:// orhttps://, and any trailing path, is reduced to host:port the moment you connect, where you can see it happen. Kafka has no scheme to give.
A {{variable}} works here too, handy when the address differs between a laptop and a build machine.
Which variables. A Kafka tab reads theglobal environment, and only that one. A project's own environment belongs to that project's endpoints, and a Kafka tab is not one of them, so a variable defined only inside a project will not resolve here. This is true everywhere a variable is accepted in a Kafka tab: the address, the security fields, and the message you compose.
Connecting, and what the button says
Connecting proves the broker is actually there: a metadata request has to come back before the tab says connected. If it fails, the state turns to error with the reason: an unreachable broker, a wrong password and an untrusted certificate are told apart, not lumped into "could not connect".
What the cluster sees you as
Every Kafka client sends a name with its requests, and brokers log it. This one sends the product, its version, and six random characters belonging to this tab, so an operator looking at a broker log can tell which tool connected and which tab did it. The six characters are shown at the right of the consumer's status bar, which is where to read them off when someone asks you to point out your connection.
They are minted once and kept while the tab is open, so reconnecting looks like the same client rather than a new one. They are random rather than derived from your machine: identifying the tab is the job, and telling someone else's cluster your hostname is not.
Choosing a topic
The topic selector fills the moment you connect. Type to narrow the list: plain case-insensitive substring matching, so a dot is a dot, not a wildcard. The foot of the list carries a Refresh, to pull in topics created since as someone else may add one while the tab stays open, and a+ Add New; a three-dot menu beside the selector describes, edits or deletes the chosen topic. Those live under Topic Management.
Both producing and consuming need a topic selected and a live connection. Until then their actions stay disabled.
The padlock
Beside the address, the padlock says at a glance how the connection is secured, and opens the Security settings when clicked.
Open
PLAINTEXT: nothing encrypted, nobody proven.
Closed
Encrypted, with the certificate and hostname both checked.
Weakened
Encrypted, but verification was lowered. It is its own state, not a closed lock, because a connection that does not check who answered is not protected.