{
    "properties": {
        "kafka": {
            "description": "Rest proxy kafka service configuration",
            "properties": {
                "bootstrap_servers": {
                    "default": "broker.confluent-kafka.l4lb.thisdcos.directory:9092",
                    "description": "The name of the kafka bootstrapserver. Broker vip (for TLS it is broker-tls.confluent-kafka.l4lb.thisdcos.directory:9093) or comma separated list of broker dns names (like in the kerberos case). Note slahes in a kafka service name have to be removed.",
                    "title": "Kafka bootstrap servers",
                    "type": "string"
                },
                "client_sasl_kerberos_service_name": {
                    "default": "kafka",
                    "description": "The Kerberos principal name that Kafka runs as. This can be defined either in Kafka's JAAS config or in Kafka's config.",
                    "title": "Kafka client sasl kerberos service name",
                    "type": "string"
                },
                "client_sasl_mechanism": {
                    "default": "GSSAPI",
                    "description": "SASL mechanism used for client connections. This may be any mechanism for which a security provider is available. GSSAPI is the default mechanism.",
                    "title": "Kafka client sasl mechanism",
                    "type": "string"
                },
                "client_security_protocol": {
                    "default": "PLAINTEXT",
                    "description": "Protocol used to communicate with brokers. Valid values are: PLAINTEXT, SSL, SASL_PLAINTEXT, SASL_SSL",
                    "title": "Kafka client security protocol",
                    "type": "string"
                },
                "kerberos_enabled": {
                    "default": false,
                    "description": "Enable kerberos",
                    "type": "boolean"
                },
                "kerberos_jaas_secret": {
                    "default": "jaas",
                    "description": "Kerberos jaas secret containing jaas config",
                    "title": "Kerberos jaas secret",
                    "type": "string"
                },
                "kerberos_keytab_secret": {
                    "default": "__dcos_base64___keytab",
                    "description": "Kerberos keytab secret containing keytab",
                    "title": "Kerberos keytab secret",
                    "type": "string"
                },
                "kerberos_krb5_secret": {
                    "default": "krb5",
                    "description": "Kerberos krb5 secret containing krb5 config",
                    "title": "Kerberos krb5 secret",
                    "type": "string"
                },
                "zookeeper_connect": {
                    "default": "master.mesos:2181/dcos-service-confluent-kafka",
                    "description": "... . Note slahes in a kafka service name have to be removed, all excpet the first get replaced by two underscores.",
                    "title": "Zookeeper connect",
                    "type": "string"
                }
            },
            "required": [
                "bootstrap_servers",
                "zookeeper_connect"
            ],
            "type": "object"
        },
        "rest-proxy": {
            "description": "Rest proxy service configuration properties",
            "properties": {
                "access-control-allow-methods": {
                    "default": "",
                    "description": "Set value to Jetty Access-Control-Allow-Origin header for specified methods",
                    "type": "string"
                },
                "access-control-allow-origin": {
                    "default": "",
                    "description": "Set value for Jetty Access-Control-Allow-Origin header",
                    "type": "string"
                },
                "ciphers": {
                    "default": "TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
                    "description": "Comma-separated list of JSSE Cipher Suite Names",
                    "type": "string"
                },
                "cpus": {
                    "default": 2,
                    "description": "CPU shares to allocate to each rest-proxy instance.",
                    "minimum": 2,
                    "type": "number"
                },
                "heap": {
                    "default": 768,
                    "description": "JVM heap allocation (in MB) for rest-proxy task; should be ~256MB less than total memory for the instance.",
                    "minimum": 256,
                    "type": "number"
                },
                "instances": {
                    "default": 1,
                    "description": "Number of instances to run.",
                    "minimum": 1,
                    "type": "integer"
                },
                "keystore_secret": {
                    "default": "",
                    "description": "Keystore secret.",
                    "title": "Keystore secret",
                    "type": "string"
                },
                "listener_protocol": {
                    "default": "http",
                    "description": "Rest proxy listener protocol, http or https.",
                    "title": "Rest proxy listener protocol",
                    "type": "string"
                },
                "mem": {
                    "default": 1024,
                    "description": "Memory (MB) to allocate to each rest-proxy instance.",
                    "minimum": 512,
                    "type": "number"
                },
                "name": {
                    "default": "rest-proxy",
                    "description": "The name of the rest proxy service instance",
                    "title": "Rest proxy service name",
                    "type": "string"
                },
                "role": {
                    "default": "*",
                    "description": "Deploy rest-proxy only on nodes with this role.",
                    "type": "string"
                },
                "ssl_client_auth": {
                    "default": false,
                    "description": "Used for HTTPS. Whether or not to require the HTTPS client to authenticate via the server's trust store.",
                    "type": "boolean"
                },
                "virtual_network_enabled": {
                    "default": false,
                    "description": "Enable virtual networking",
                    "type": "boolean"
                },
                "virtual_network_name": {
                    "default": "dcos",
                    "description": "The name of the virtual network to join",
                    "type": "string"
                }
            },
            "required": [
                "name",
                "cpus",
                "mem",
                "instances"
            ],
            "type": "object"
        },
        "schema-registry": {
            "description": "Rest proxy schema registry configuration",
            "properties": {
                "url": {
                    "default": "http://schema-registry.marathon.l4lb.thisdcos.directory:8081",
                    "description": "The base URL for the schema registry that should be used by the Avro serializer.",
                    "title": "Schema registry url",
                    "type": "string"
                }
            },
            "required": [
                "url"
            ],
            "type": "object"
        }
    },
    "type": "object"
}