diff --git a/salt/docker/defaults.yaml b/salt/docker/defaults.yaml
index 82ad3b6ea..161dde485 100644
--- a/salt/docker/defaults.yaml
+++ b/salt/docker/defaults.yaml
@@ -192,6 +192,7 @@ docker:
       port_bindings:
         - 0.0.0.0:9092:9092
         - 0.0.0.0:9093:9093
+        - 0.0.0.0:8778:8778
       custom_bind_mounts: []
       extra_hosts: []
       extra_env: []
diff --git a/salt/kafka/enabled.sls b/salt/kafka/enabled.sls
index 9275eca91..b01e6f2a8 100644
--- a/salt/kafka/enabled.sls
+++ b/salt/kafka/enabled.sls
@@ -25,7 +25,8 @@ so-kafka:
         - ipv4_address: {{ DOCKER.containers['so-kafka'].ip }}
     - user: kafka
     - environment:
-      - KAFKA_HEAP_OPTS=-Xmx2G -Xms1G
+        KAFKA_HEAP_OPTS: -Xmx2G -Xms1G
+        KAFKA_OPTS: -javaagent:/jolokia/agents/jolokia-agent-jvm-javaagent.jar=port=8778,host={{ DOCKER.containers['so-kafka'].ip }},policyLocation=file:/jolokia/jolokia.xml
     - extra_hosts:
       {% for node in KAFKANODES %}
       - {{ node }}:{{ KAFKANODES[node].ip }}
@@ -40,10 +41,10 @@ so-kafka:
       - {{ BINDING }}
       {% endfor %}
     - binds:
-      - /etc/pki/kafka.p12:/etc/pki/kafka.p12
-      - /opt/so/conf/ca/cacerts:/etc/pki/java/sos/cacerts
+      - /etc/pki/kafka.p12:/etc/pki/kafka.p12:ro
+      - /opt/so/conf/ca/cacerts:/etc/pki/java/sos/cacerts:ro
       - /nsm/kafka/data/:/nsm/kafka/data/:rw
-      - /opt/so/conf/kafka/server.properties:/kafka/config/kraft/server.properties
+      - /opt/so/conf/kafka/server.properties:/kafka/config/kraft/server.properties:ro
       {% if GLOBALS.is_manager %}
       - /opt/so/conf/kafka/client.properties:/kafka/config/kraft/client.properties
       {% endif %}
diff --git a/salt/telegraf/etc/telegraf.conf b/salt/telegraf/etc/telegraf.conf
index 1c5801645..42a8d43bf 100644
--- a/salt/telegraf/etc/telegraf.conf
+++ b/salt/telegraf/etc/telegraf.conf
@@ -243,6 +243,23 @@
   password = "{{ salt['pillar.get']('elasticsearch:auth:users:so_logstash_user:pass') }}"
 {%- endif %}
 
+{% if grains.role in ['so-manager','so-managersearch','so-standalone','so-receiver'] -%}
+[[inputs.jolokia2_agent]]
+  name_prefix= "kafka_"
+  urls = ["http://localhost:8778/jolokia"]
+
+[[inputs.jolokia2_agent.metric]]
+  name         = "topics"
+  mbean        = "kafka.server:name=*,type=BrokerTopicMetrics"
+  field_prefix = "$1."
+
+[[inputs.jolokia2_agent.metric]]
+  name         = "topic"
+  mbean        = "kafka.server:name=*,topic=*,type=BrokerTopicMetrics"
+  field_prefix = "$1."
+  tag_keys     = ["topic"]
+
+{%- endif %}
 # # Read metrics from one or more commands that can output to stdout
 {%- if 'sostatus.sh' in TELEGRAFMERGED.scripts[GLOBALS.role.split('-')[1]] %}
 {%-   do TELEGRAFMERGED.scripts[GLOBALS.role.split('-')[1]].remove('sostatus.sh') %}