feat(gateways): iggy gateway for kafka listener

.github/actions/rust/pre-merge/action.yml

@@ -249,6 +249,20 @@ runs:
         compile_duration=$((compile_end - compile_start))
         echo "::notice::Tests compiled in ${compile_duration}s ($(date -ud @${compile_duration} +'%M:%S'))"
 
+        # decode_validation_tests need gitignored wire fixtures. Generate when
+        # iggy-gateway-kafka is in the DAG test scope (rust-gateway job or parent
+        # rust job — both run gateway tests when gateways/** changes).
+        NEEDS_KAFKA_FIXTURES=false
+        if [[ -z "$NEXTEST_FILTER" ]]; then
+          NEEDS_KAFKA_FIXTURES=true
+        elif grep -q 'package(iggy-gateway-kafka)' <<< "$NEXTEST_FILTER"; then
+          NEEDS_KAFKA_FIXTURES=true
+        fi
+        if [[ "$NEEDS_KAFKA_FIXTURES" == true ]]; then
+          ./gateways/kafka/scripts/ci-wire-fixtures.sh generate
+          trap './gateways/kafka/scripts/ci-wire-fixtures.sh cleanup' EXIT
+        fi
+
         # Start D-Bus and unlock keyring right before test execution to avoid
         # gnome-keyring auto-locking the collection during the build phase.
         # Previously this ran before `cargo build`, leaving a 7+ minute idle

.github/config/components.yml

@@ -146,6 +146,7 @@ components:
       - "rust-connectors"
       - "rust-mcp"
       - "rust-integration"
+      - "rust-gateway"
       - "ci-infrastructure"
     paths:
       - "Dockerfile*"
@@ -484,3 +485,20 @@ components:
       - ".github/actions/**/*.yml"
       - ".github/ci/**/*.yml"
     tasks: ["validate"] # Could run workflow validation
+
+  # gateways are not Rust components, but we want to run them in CI
+  rust-gateway:
+    depends_on:
+      - "rust-sdk"
+      - "rust-workspace"
+      - "ci-infrastructure"
+    paths:
+      - "gateways/**"
+    tasks:
+      - "check"
+      - "fmt"
+      - "clippy"
+      - "sort"
+      - "test-1"
+      - "test-2"
+      - "machete"

.github/workflows/pr-title.yml

@@ -95,3 +95,4 @@ jobs:
             storage
             simulator
             configs
+            gateways

.gitignore

@@ -42,3 +42,4 @@ go.work
 core/bench/dashboard/frontend/dist
 LICENSE-binary
 **/LICENSE-binary
+gateways/kafka/tools/kafka-tool/kafka_messages/

Cargo.toml

@@ -62,6 +62,8 @@ members = [
     "core/simulator",
     "core/tools",
     "examples/rust",
+    "gateways/kafka",
+    "gateways/kafka/tools/kafka-tool",
 ]
 exclude = ["foreign/cpp", "foreign/php", "foreign/python"]
 resolver = "2"

gateways/README.md

@@ -0,0 +1,9 @@
+# Apache Iggy Gateways
+
+Protocol gateways that let existing clients talk to Iggy without changing the core server wire surface.
+
+| Gateway | Issue | Description |
+| --------- | ------- | ------------- |
+| [kafka](kafka/) | [#3421](https://github.com/apache/iggy/issues/3421) | Kafka wire protocol TCP listener (port 9093) |
+
+Each gateway is a separate workspace crate under `gateways/<name>/`.

gateways/kafka/Cargo.toml

@@ -0,0 +1,58 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+[package]
+name = "iggy-gateway-kafka"
+version = "0.1.0"
+description = "Kafka wire protocol gateway foundation for Apache Iggy"
+edition = "2024"
+license = "Apache-2.0"
+keywords = ["iggy", "kafka", "gateway", "streaming"]
+homepage = "https://iggy.apache.org"
+documentation = "https://iggy.apache.org/docs"
+repository = "https://github.com/apache/iggy"
+readme = "README.md"
+publish = false
+
+[[bin]]
+name = "iggy-gateway-kafka"
+path = "src/main.rs"
+
+[dependencies]
+bytes = { workspace = true }
+thiserror = { workspace = true }
+tokio = { workspace = true, features = [
+    "rt-multi-thread",
+    "macros",
+    "net",
+    "io-util",
+    "time",
+    "sync",
+    "signal",
+] }
+tokio-util = { workspace = true, features = ["rt"] }
+tracing = { workspace = true }
+tracing-subscriber = { workspace = true }
+
+[dev-dependencies]
+tokio = { workspace = true, features = ["rt-multi-thread", "macros", "net", "io-util", "time"] }
+
+[lints.clippy]
+enum_glob_use = "deny"
+#Ported Kafka wire codec; pedantic cleanup tracked for a follow-up PR.
+pedantic = "warn"
+nursery = "warn"

gateways/kafka/README.md

@@ -0,0 +1,55 @@
+# Kafka gateway (`iggy-gateway-kafka`)
+
+Foundation layer for [apache/iggy#3421](https://github.com/apache/iggy/issues/3421): a TCP listener on the Kafka wire port that decodes requests, validates scoped API keys and versions, and returns stub responses.
+
+## Run
+
+```bash
+cargo run -p iggy-gateway-kafka
+```
+
+Default bind: `127.0.0.1:9093`. Environment variables:
+
+| Variable | Default | Description |
+| --- | --- | --- |
+| `KAFKA_BIND_ADDR` | `127.0.0.1:9093` | TCP address to listen on |
+| `KAFKA_ADVERTISED_HOST` | bind IP | Hostname/IP clients use to reach this broker (required when binding to `0.0.0.0`/`::`) |
+| `KAFKA_ADVERTISED_PORT` | bind port | Port advertised in Metadata responses |
+
+## Test
+
+```bash
+cargo test -p iggy-gateway-kafka
+```
+
+103 regression tests across 12 suites — see [docs/TEST_SUITE.md](docs/TEST_SUITE.md) for the full catalog.
+
+`decode_validation_tests` require wire fixtures under `tools/kafka-tool/kafka_messages/` (gitignored locally; CI generates them via `scripts/ci-wire-fixtures.sh`):
+
+```bash
+./gateways/kafka/scripts/ci-wire-fixtures.sh generate
+cargo test -p iggy-gateway-kafka
+./gateways/kafka/scripts/ci-wire-fixtures.sh cleanup   # optional
+```
+
+Or generate only the keys the tests need:
+
+```bash
+for key in 0 1 2 19; do
+  cargo run -p kafka-message-gen -- generate \
+    --output gateways/kafka/tools/kafka-tool/kafka_messages \
+    --api-key "$key"
+done
+```
+
+## Manual testing
+
+Before check-in, run the procedure in [docs/MANUAL_TESTING.md](docs/MANUAL_TESTING.md) (smoke, version firewall, kcat, adversarial cases).
+
+## Scoped APIs
+
+See [docs/SCOPE.md](docs/SCOPE.md) for [#3421](https://github.com/apache/iggy/issues/3421) deliverables, supported API key/version table, and post-foundation TODO backlog.
+
+## Wire fixture tool
+
+See [tools/kafka-tool/README.md](tools/kafka-tool/README.md).