Kockpit is an engineering platform for Spring Boot systems: it audits every call in and out, flips features and configuration without a redeploy, and gives you one console to watch it all happen — backed by OpenSearch and shippable to your own filesystem, Azure, or AWS.
Starting with kockpit 2.0.0, the platform targets Spring Boot 4 only (Spring Framework 7,
Jakarta EE 11, Spring AI 2.x) and requires Java 21 minimum for both build and runtime — including
projects consuming kockpit-rules-maven-plugin. Teams still on Spring Boot 3.x should stay
on the kockpit 1.x line.
Kockpit isn't a monolith bolted onto your services. Your applications embed a few Spring Boot starters; a backend, a stream and a web console run beside them. Pick a module to see what it is made of.
The libraries your applications embed to record what they do: incoming and outgoing calls, HTTP exchanges and key-value events, for APIs and batch jobs alike. Audits are published as messages and end up indexed in OpenSearch, searchable from the console.
@Audited and AuditCommandLineRunner, to audit methods and batch jobs.RestTemplate, RestClient and WebClient, with Kafka and Event Hub starters.Note: kockpit-audit-web is deprecated; use kockpit-features-audit instead.
Runtime features your applications pick up from a starter, and that the console drives through the backend. Each feature comes in two halves: an application side, embedded in your service, and a backend side, which serves it to the console.
A rule engine with its own DSL. Rules are defined once, generated from a JSON file at build time, and executed and audited at run time.
Versions: the 2.x starter and plugin need Spring Boot 4 and Java 21; stay on 1.x for Spring Boot 3.
The plumbing every other module sits on: a publish/consume messaging abstraction between your applications and the Kockpit backend, with one implementation per storage. Changing storage means changing a dependency, not your code.
Publisher / Consumer message API.The Spring Boot application behind the console. It assembles the backend services and the backend side of every feature, and ships as one Docker image per storage.
kockpit-backend-application-filesystem, -aws, -azure and -azure-eventhub.The audit stream carries audits from your services into OpenSearch as they arrive, rather than in a batch job. See how it reads each source.
kockpit-audit-stream-application-kafka, -aws and -aws-efo; kockpit-kinesis-s3-application.A React web console over the backend API: one place to search audits, open them end to end, and operate the features running in your applications. See its pages and what it looks like.
An MCP server built on Spring AI that exposes audit search to AI agents, so an assistant can ask what your systems have been doing without a custom integration.
Samples: kockpit-samples/kockpit-sample-all
wires the audit and feature starters into one runnable application; the Azure, filesystem and Kubernetes stacks run it.
Each page of the web console, backed by the Kockpit backend API. Every page works on one domain and environment at a time, picked from the console's header. Pick a page to see what you can do there.
The landing page: a dashboard built from the audits of the selected domain and environment.
Every input and output call, HTTP exchange and key-value event your services emit, indexed in OpenSearch and searchable from one place, for APIs and batch jobs alike. See the screenshot.
One audit opened end to end, with a tab per view. See every view, with screenshots.
Turn features on and off in running services: no build, no redeploy, no restart window to coordinate. See the screenshot.
Change configuration values of live applications the same way: at runtime, without shipping a new artifact. See the screenshot.
The caches of each service, as reported by the services themselves.
Every instance of your services sends a heartbeat; this page shows how recent each one is.
Manifests declare your domains, environments and services; the console builds its menus from them. Settings keep your own preferences, in the browser.
The Kockpit web console — audit search, dynamic configuration, and feature flipping, all driven by the same manifest.
Full-text and field search across audit events — request ID, path, method, status, or any custom field — plus saved filters declared in the manifest, here the sample application's failed calls. Each team or platform gets its own manifest file, browsable from the same console without standing up a separate deployment.
Dynamic configuration keys with live sync status — configured, synced, or pending a save — editable inline without shipping a new build.
Feature keys with on/off toggles and optional expiry dates, plus a history tab for tracking who changed what and when — flipped live, without a redeploy.
Open any audit from the list to see everything the service recorded about that one request: the inbound
exchange, every outgoing call it made, the business rules it ran, and the values indexed for search.
The screens below follow a single POST /api/orders from the sample application.
The one-screen summary of the request, and the way into every other view.
The inbound exchange exactly as the service received and answered it.
Every outgoing call the service made while handling the request.
What the Kockpit rule engine decided for this request, flow by flow.
The business values the service attached to the audit, indexed for search.
The raw audit document, for anything the other views don't show.
Your services talk to Kockpit on two channels. Audits go through a stream into OpenSearch, where the backend searches them. Features (flags, configuration, caches, heartbeats) go both ways as messages on a shared storage. The backend ships in one image per storage; pick one to see how it is wired.
Everything on one machine or one shared volume: the right default for development, on-premises and single-node setups.
kockpit-core-communication-filesystem for feature messages, manifests read from the same folder.kockpit-audit-stream-application-kafka, from Kafka into OpenSearch.filesystem, active by default.Feature messages and manifests on an Azure Storage account; audits on Kafka.
kockpit-core-communication-storageaccount for feature messages, manifests on the same account.kockpit-audit-stream-application-kafka, from Kafka into OpenSearch.kockpit-features-audit-starters-kafka.azure.The Azure backend, with its audits sent through the native Event Hubs client instead of Kafka.
kockpit-core-communication-storageaccount, as for Azure.kockpit-features-audit-starters-eventhub.eventhub Spring profile, on Event Hubs' Kafka endpoint.azure-eventhub.Feature messages and manifests on S3, audits on Kinesis, and Amazon OpenSearch Service with signed requests. The audit stream archives every batch of audits to S3 before indexing it.
kockpit-core-communication-s3 for feature messages, manifests on S3.kockpit-core-communication-legacy keeps applications on the older S3 message format working.kockpit-audit-stream-application-aws, or -aws-efo for Kinesis enhanced fan-out.audits-<env> bucket; each indexed audit points to its S3 object.kockpit-kinesis-s3-application bridges feature messages published on Kinesis to the S3 layout the backend reads.kockpit-audit-notification-kinesis.kockpit-aws-opensearch-request-signing.aws.The audit stream reads audits off your broker and indexes them into OpenSearch as they arrive, in batches. One application, built per source; pick a source to see how it reads.
Your services publish their audits on a Kafka topic; the audit stream consumes it and indexes every batch into OpenSearch.
audits topic by default (kockpit.audit.stream.kafka.topics).kockpit-audit-stream-starter-kafka and -starter-opensearch.kafka, active by default.Event Hubs exposes a Kafka endpoint, so the Kafka image reads it as is: the eventhub
Spring profile only switches the Kafka client to SASL_SSL.
SPRING_PROFILES_ACTIVE=eventhub.BOOTSTRAP_SERVERS on the namespace's Kafka endpoint, and the SASL login (with the connection string) in SASL_JAAS_CONFIG.kockpit-features-audit-starters-eventhub).The AWS build reads a Kinesis stream and, before indexing, archives every batch of audits to S3: each indexed audit keeps a pointer to its S3 object.
KINESIS_STREAM_NAME; shards are shared between instances through leases in DynamoDB.audits-<env> bucket; the index keeps each audit's S3 URI, offset and size.aws.The same AWS build, registered as an enhanced fan-out consumer: Kinesis pushes the records to it, with throughput of its own instead of sharing the stream's read limit with other consumers.
KINESIS_CONSUMER_NAME, the application name by default.kockpit-audit-stream-starter-kinesis-efo and -starter-opensearch-s3.aws-efo.<domain>-<index>-<env>-ttl<N>d-<date>-00001.<domain>-<index>-<env>-read spans every index of an environment: that is what the backend searches.Each provider has a ready-made Docker Compose stack in the repository's docker/
folder, and a Helm chart deploys the same stack on Kubernetes. Images come from ghcr.io/mahieddine-ichir/kockpit with their latest tag.
Prerequisites: Docker with Compose v2.20+ (the stacks use include),
about 4 GB of memory for Docker, and a clone of the repository:
git clone https://github.com/mahieddine-ichir/kockpit.git && cd kockpit.
The stacks share container names and ports, so run one at a time.
docker/kafka/docker-compose-full.yml starts Kafka, OpenSearch and OpenSearch Dashboards,
plus the audit stream, the backend (filesystem storage) and the console. The backend reads manifests and audit
payloads from the repository's data/ folder, or from KOCKPIT_DATA_DIR if you set it.
mkdir -p data/manifests && cp docker/manifests/*.json data/manifests/up, so you always run the latest build.
cd docker/kafka
docker compose -f docker-compose-full.yml up -ddocker exec -w /init-data opensearch bash init-data.shhttp://localhost:3000. Audits your own services send to the audits topic
on localhost:29092 show up as the stream indexes them.Stop: docker compose -f docker-compose-full.yml down from docker/kafka.
Infrastructure only, to run the apps from your IDE: docker compose up -d in the same folder.
docker/azure/docker-compose-full.yml starts Azurite (the Azure Storage emulator), Kafka,
OpenSearch and Dashboards, plus the audit stream, the backend (Azure Storage), the console and a sample application.
No Azure account is needed: the blob containers are created in Azurite and the sample manifest is uploaded on startup.
cd docker/azure
docker compose -f docker-compose-full.yml up -dcreateMessage and the
DELETE fail on purpose part of the time, to give you some errors to look at.
curl http://localhost:8082/sample-app/api/sayHello/kockpit
curl http://localhost:8082/sample-app/api/facts
curl -X POST http://localhost:8082/sample-app/api/createMessage \
-H 'Content-Type: application/json' -d '{"message":"hello"}'
curl -X DELETE http://localhost:8082/sample-app/api/sayHelloaudit-data index, so pass its name.
docker exec -w /init-data -e INDEX_NAME=audit-data opensearch bash init-data.shhttp://localhost:3000 and pick the kockpit / local manifest. Its saved
filters show the sample app's successful and failed calls.Real storage account: cp .env.azure .env in docker/azure, fill in the
STORAGE_* and MANIFESTS_STORAGE_* values, then start the stack the same way.
Manifests: the files in docker/manifests are uploaded on every up and overwrite the copies in
Azurite, so edit them there rather than from the console.
Stop: docker compose -f docker-compose-full.yml down (add -v to also delete the Azurite and OpenSearch data).
docker/aws/docker-compose.yml starts LocalStack and OpenSearch. On startup, LocalStack's
init scripts create the S3 buckets (with the sample manifest), SQS queues, SNS topics, Kinesis streams and DynamoDB
tables. This stack provides the AWS infrastructure only: the Kockpit applications are run from your IDE against it.
LOCALSTACK_AUTH_TOKEN first.
cd docker/aws
docker compose up -dlocalhost:4566, region eu-west-1.
docker exec localstack_console_services awslocal s3 ls
docker exec localstack_console_services awslocal kinesis list-streamsaws Maven profile and run the backend and the audit stream
from your IDE, pointing them at http://localhost:4566 and http://localhost:9200.Stop: docker compose down from docker/aws.
The deployments/kubernetes/kockpit chart deploys the Kafka stack on a single-node cluster:
Kafka, OpenSearch, the audit stream, the backend (filesystem storage), the console and the sample application.
It needs kubectl, Helm 3 or later and about 6 GB of memory for the cluster.
kind create cluster --name kockpithelm install kockpit deployments/kubernetes/kockpit --namespace kockpit --create-namespace
kubectl -n kockpit get pods -wkubectl -n kockpit port-forward svc/kockpit-console 3000:80 &
kubectl -n kockpit port-forward svc/kockpit-sample-app 8082:8082 &
curl http://localhost:8082/sample-app/api/sayHello/kockpitValues: use your own Kafka or OpenSearch with kafka.enabled=false /
opensearch.enabled=false, enable Dashboards with dashboards.enabled=true or an ingress with
ingress.enabled=true. See the chart's README.md for all of them.
Manifests: the chart's files/manifests are copied into the backend's storage on every start,
overwriting the stored copies.
Uninstall: helm uninstall kockpit -n kockpit, then kind delete cluster --name kockpit.
The full kockpit suite — audit, rules, backends, console, and samples — under the Apache-2.0 license.
github.com/mahieddine-ichir/kockpitModule composition, configuration properties, and environment variables for every package.
README.md · replace with your docs siteThe people building kockpit, and the commit history behind each module.
contributors · replace with your team page