Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: kafkas.kafka.strimzi.io
labels:
app: strimzi
strimzi.io/crd-install: "true"
spec:
group: kafka.strimzi.io
names:
kind: Kafka
listKind: KafkaList
singular: kafka
plural: kafkas
shortNames:
- k
categories:
- strimzi
scope: Namespaced
additionalPrinterColumns:
- name: Desired Kafka replicas
description: The desired number of Kafka replicas in the cluster
JSONPath: .spec.kafka.replicas
type: integer
- name: Desired ZK replicas
description: The desired number of ZooKeeper replicas in the cluster
JSONPath: .spec.zookeeper.replicas
type: integer
- name: Ready
description: The state of the custom resource
JSONPath: .status.conditions[?(@.type=="Ready")].status
type: string
- name: Warnings
description: Warnings related to the custom resource
JSONPath: .status.conditions[?(@.type=="Warning")].status
type: string
subresources:
status: {}
conversion:
strategy: None
versions:
- name: v1beta1
served: true
storage: true
- name: v1alpha1
served: true
storage: false
version: v1beta1
validation:
openAPIV3Schema:
properties:
spec:
type: object
properties:
kafka:
type: object
properties:
replicas:
type: integer
minimum: 1
description: The number of pods in the cluster.
image:
type: string
description: The docker image for the pods. The default value depends
on the configured `Kafka.spec.kafka.version`.
storage:
type: object
properties:
class:
type: string
description: The storage class to use for dynamic volume allocation.
deleteClaim:
type: boolean
description: Specifies if the persistent volume claim has to
be deleted when the cluster is un-deployed.
id:
type: integer
minimum: 0
description: Storage identification number. It is mandatory
only for storage volumes defined in a storage of type 'jbod'.
overrides:
type: array
items:
type: object
properties:
class:
type: string
description: The storage class to use for dynamic volume
allocation for this broker.
broker:
type: integer
description: Id of the kafka broker (broker identifier).
description: Overrides for individual brokers. The `overrides`
field allows to specify a different configuration for different
brokers.
selector:
type: object
description: Specifies a specific persistent volume to use.
It contains key:value pairs representing labels for selecting
such a volume.
size:
type: string
description: When type=persistent-claim, defines the size of
the persistent volume claim (i.e 1Gi). Mandatory when type=persistent-claim.
sizeLimit:
type: string
pattern: ^([0-9.]+)([eEinumkKMGTP]*[-+]?[0-9]*)$
description: When type=ephemeral, defines the total amount of
local storage required for this EmptyDir volume (for example
1Gi).
type:
type: string
enum:
- ephemeral
- persistent-claim
- jbod
description: Storage type, must be either 'ephemeral', 'persistent-claim',
or 'jbod'.
volumes:
type: array
items:
type: object
properties:
class:
type: string
description: The storage class to use for dynamic volume
allocation.
deleteClaim:
type: boolean
description: Specifies if the persistent volume claim
has to be deleted when the cluster is un-deployed.
id:
type: integer
minimum: 0
description: Storage identification number. It is mandatory
only for storage volumes defined in a storage of type
'jbod'.
overrides:
type: array
items:
type: object
properties:
class:
type: string
description: The storage class to use for dynamic
volume allocation for this broker.
broker:
type: integer
description: Id of the kafka broker (broker identifier).
description: Overrides for individual brokers. The `overrides`
field allows to specify a different configuration for
different brokers.
selector:
type: object
description: Specifies a specific persistent volume to
use. It contains key:value pairs representing labels
for selecting such a volume.
size:
type: string
description: When type=persistent-claim, defines the size
of the persistent volume claim (i.e 1Gi). Mandatory
when type=persistent-claim.
sizeLimit:
type: string
pattern: ^([0-9.]+)([eEinumkKMGTP]*[-+]?[0-9]*)$
description: When type=ephemeral, defines the total amount
of local storage required for this EmptyDir volume (for
example 1Gi).
type:
type: string
enum:
- ephemeral
- persistent-claim
description: Storage type, must be either 'ephemeral'
or 'persistent-claim'.
required:
- type
description: List of volumes as Storage objects representing
the JBOD disks array.
required:
- type
description: Storage configuration (disk). Cannot be updated.
listeners:
oneOf:
- type: array
minItems: 1
items:
type: object
properties:
name:
type: string
pattern: ^[a-z0-9]{1,11}$
description: Name of the listener. The name will be used
to identify the listener and the related Kubernetes objects.
The name has to be unique within given a Kafka cluster.
The name can consist of lowercase characters and numbers
and be up to 11 characters long.
port:
type: integer
minimum: 9092
description: Port number used by the listener inside Kafka.
The port number has to be unique within a given Kafka
cluster. Allowed port numbers are 9092 and higher with
the exception of ports 9404 and 9999, which are already
used for Prometheus and JMX. Depending on the listener
type, the port number might not be the same as the port
number that connects Kafka clients.
type:
type: string
enum:
- internal
- route
- loadbalancer
- nodeport
- ingress
description: "Type of the listener. Currently the supported\
\ types are `internal`, `route`, `loadbalancer`, `nodeport`\
\ and `ingress`. \n\n* `internal` type exposes Kafka internally\
\ only within the Kubernetes cluster.\n* `route` type\
\ uses OpenShift Routes to expose Kafka.\n* `loadbalancer`\
\ type uses LoadBalancer type services to expose Kafka.\n\
* `nodeport` type uses NodePort type services to expose\
\ Kafka.\n* `ingress` type uses Kubernetes Nginx Ingress\
\ to expose Kafka.\n."
tls:
type: boolean
description: Enables TLS encryption on the listener. This
is a required property.
authentication:
type: object
properties:
accessTokenIsJwt:
type: boolean
description: Configure whether the access token is treated
as JWT. This must be set to `false` if the authorization
server returns opaque tokens. Defaults to `true`.
checkAccessTokenType:
type: boolean
description: Configure whether the access token type
check is performed or not. This should be set to `false`
if the authorization server does not include 'typ'
claim in JWT token. Defaults to `true`.
checkIssuer:
type: boolean
description: Enable or disable issuer checking. By default
issuer is checked using the value configured by `validIssuerUri`.
Default value is `true`.
clientId:
type: string
description: OAuth Client ID which the Kafka broker
can use to authenticate against the authorization
server and use the introspect endpoint URI.
clientSecret:
type: object
properties:
key:
type: string
description: The key under which the secret value
is stored in the Kubernetes Secret.
secretName:
type: string
description: The name of the Kubernetes Secret containing
the secret value.
required:
- key
- secretName
description: Link to Kubernetes Secret containing the
OAuth client secret which the Kafka broker can use
to authenticate against the authorization server and
use the introspect endpoint URI.
disableTlsHostnameVerification:
type: boolean
description: Enable or disable TLS hostname verification.
Default value is `false`.
enableECDSA:
type: boolean
description: Enable or disable ECDSA support by installing
BouncyCastle crypto provider. Default value is `false`.
fallbackUserNameClaim:
type: string
description: The fallback username claim to be used
for the user id if the claim specified by `userNameClaim`
is not present. This is useful when `client_credentials`
authentication only results in the client id being
provided in another claim. It only takes effect if
`userNameClaim` is set.
fallbackUserNamePrefix:
type: string
description: The prefix to use with the value of `fallbackUserNameClaim`
to construct the user id. This only takes effect if
`fallbackUserNameClaim` is true, and the value is
present for the claim. Mapping usernames and client
ids into the same user id space is useful in preventing
name collisions.
introspectionEndpointUri:
type: string
description: URI of the token introspection endpoint
which can be used to validate opaque non-JWT tokens.
jwksEndpointUri:
type: string
description: URI of the JWKS certificate endpoint, which
can be used for local JWT validation.
jwksExpirySeconds:
type: integer
minimum: 1
description: Configures how often are the JWKS certificates
considered valid. The expiry interval has to be at
least 60 seconds longer then the refresh interval
specified in `jwksRefreshSeconds`. Defaults to 360
seconds.
jwksMinRefreshPauseSeconds:
type: integer
minimum: 0
description: The minimum pause between two consecutive
refreshes. When an unknown signing key is encountered
the refresh is scheduled immediately, but will always
wait for this minimum pause. Defaults to 1 second.
jwksRefreshSeconds:
type: integer
minimum: 1
description: Configures how often are the JWKS certificates
refreshed. The refresh interval has to be at least
60 seconds shorter then the expiry interval specified
in `jwksExpirySeconds`. Defaults to 300 seconds.
maxSecondsWithoutReauthentication:
type: integer
description: Maximum number of seconds the authenticated
session remains valid without re-authentication. This
enables Apache Kafka re-authentication feature, and
causes sessions to expire when the access token expires.
If the access token expires before max time or if
max time is reached, the client has to re-authenticate,
otherwise the server will drop the connection. Not
set by default - the authenticated session does not
expire when the access token expires.
tlsTrustedCertificates:
type: array
items:
type: object
properties:
certificate:
type: string
description: The name of the file certificate
in the Secret.
secretName:
type: string
description: The name of the Secret containing
the certificate.
required:
- certificate
- secretName
description: Trusted certificates for TLS connection
to the OAuth server.
type:
type: string
enum:
- tls
- scram-sha-512
- oauth
description: Authentication type. `oauth` type uses
SASL OAUTHBEARER Authentication. `scram-sha-512` type
uses SASL SCRAM-SHA-512 Authentication. `tls` type
uses TLS Client Authentication. `tls` type is supported
only on TLS listeners.
userInfoEndpointUri:
type: string
description: 'URI of the User Info Endpoint to use as
a fallback to obtaining the user id when the Introspection
Endpoint does not return information that can be used
for the user id. '
userNameClaim:
type: string
description: Name of the claim from the JWT authentication
token, Introspection Endpoint response or User Info
Endpoint response which will be used to extract the
user id. Defaults to `sub`.
validIssuerUri:
type: string
description: URI of the token issuer used for authentication.
validTokenType:
type: string
description: Valid value for the `token_type` attribute
returned by the Introspection Endpoint. No default
value, and not checked by default.
required:
- type
description: Authentication configuration for this listener.
configuration:
type: object
properties:
brokerCertChainAndKey:
type: object
properties:
certificate:
type: string
description: The name of the file certificate in
the Secret.
key:
type: string
description: The name of the private key in the
Secret.
secretName:
type: string
description: The name of the Secret containing the
certificate.
required:
- certificate
- key
- secretName
description: Reference to the `Secret` which holds the
certificate and private key pair which will be used
for this listener. The certificate can optionally
contain the whole chain. This field can be used only
with listeners with enabled TLS encryption.
externalTrafficPolicy:
type: string
enum:
- Local
- Cluster
description: Specifies whether the service routes external
traffic to node-local or cluster-wide endpoints. `Cluster`
may cause a second hop to another node and obscures
the client source IP. `Local` avoids a second hop
for LoadBalancer and Nodeport type services and preserves
the client source IP (when supported by the infrastructure).
If unspecified, Kubernetes will use `Cluster` as the
default.This field can be used only with `loadbalancer`
or `nodeport` type listener.
loadBalancerSourceRanges:
type: array
items:
type: string
description: A list of CIDR ranges (for example `10.0.0.0/8`
or `130.211.204.1/32`) from which clients can connect
to load balancer type listeners. If supported by the
platform, traffic through the loadbalancer is restricted
to the specified CIDR ranges. This field is applicable
only for loadbalancer type services and is ignored
if the cloud provider does not support the feature.
For more information, see https://v1-17.docs.kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/.
This field can be used only with `loadbalancer` type
listener.
bootstrap:
type: object
properties:
alternativeNames:
type: array
items:
type: string
description: Additional alternative names for the
bootstrap service. The alternative names will
be added to the list of subject alternative names
of the TLS certificates.
host:
type: string
description: The bootstrap host. This field will
be used in the Ingress resource or in the Route
resource to specify the desired hostname. This
field can be used only with `route` (optional)
or `ingress` (required) type listeners.
nodePort:
type: integer
description: Node port for the bootstrap service.
This field can be used only with `nodeport` type
listener.
loadBalancerIP:
type: string
description: The loadbalancer is requested with
the IP address specified in this field. This feature
depends on whether the underlying cloud provider
supports specifying the `loadBalancerIP` when
a load balancer is created. This field is ignored
if the cloud provider does not support the feature.This
field can be used only with `loadbalancer` type
listener.
annotations:
type: object
description: Annotations that will be added to the
`Ingress` or `Service` resource. You can use this
field to configure DNS providers such as External
DNS. This field can be used only with `loadbalancer`,
`nodeport`, or `ingress` type listeners.
description: Bootstrap configuration.
brokers:
type: array
items:
type: object
properties:
broker:
type: integer
description: ID of the kafka broker (broker identifier).
Broker IDs start from 0 and correspond to the
number of broker replicas.
advertisedHost:
type: string
description: The host name which will be used
in the brokers' `advertised.brokers`.
advertisedPort:
type: integer
description: The port number which will be used
in the brokers' `advertised.brokers`.
host:
type: string
description: The broker host. This field will
be used in the Ingress resource or in the Route
resource to specify the desired hostname. This
field can be used only with `route` (optional)
or `ingress` (required) type listeners.
nodePort:
type: integer
description: Node port for the per-broker service.
This field can be used only with `nodeport`
type listener.
loadBalancerIP:
type: string
description: The loadbalancer is requested with
the IP address specified in this field. This
feature depends on whether the underlying cloud
provider supports specifying the `loadBalancerIP`
when a load balancer is created. This field
is ignored if the cloud provider does not support
the feature.This field can be used only with
`loadbalancer` type listener.
annotations:
type: object
description: Annotations that will be added to
the `Ingress` or `Service` resource. You can
use this field to configure DNS providers such
as External DNS. This field can be used only
with `loadbalancer`, `nodeport`, or `ingress`
type listeners.
required:
- broker
description: Per-broker configurations.
class:
type: string
description: Configures the `Ingress` class that defines
which `Ingress` controller will be used. If not set,
the `Ingress` class is set to `nginx`. This field
can be used only with `ingress` type listener.
preferredNodePortAddressType:
type: string
enum:
- ExternalIP
- ExternalDNS
- InternalIP
- InternalDNS
- Hostname
description: |-
Defines which address type should be used as the node address. Available types are: `ExternalDNS`, `ExternalIP`, `InternalDNS`, `InternalIP` and `Hostname`. By default, the addresses will be used in the following order (the first one found will be used):
* `ExternalDNS`
* `ExternalIP`
* `InternalDNS`
* `InternalIP`
* `Hostname`
This field can be used to select the address type which will be used as the preferred type and checked first. In case no address will be found for this address type, the other types will be used in the default order.This field can be used only with `nodeport` type listener..
useServiceDnsDomain:
type: boolean
description: Configures whether the Kubernetes service
DNS domain should be used or not. If set to `true`,
the generated addresses will contain the service DNS
domain suffix (by default `.cluster.local`, can be
configured using environment variable `KUBERNETES_SERVICE_DNS_DOMAIN`).
Defaults to `false`.This field can be used only with
`internal` type listener.
description: Additional listener configuration.
networkPolicyPeers:
type: array
items:
type: object
properties:
ipBlock:
type: object
properties:
cidr:
type: string
except:
type: array
items:
type: string
namespaceSelector:
type: object
properties:
matchExpressions:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
matchLabels:
type: object
podSelector:
type: object
properties:
matchExpressions:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
matchLabels:
type: object
description: List of peers which should be able to connect
to this listener. Peers in this list are combined using
a logical OR operation. If this field is empty or missing,
all connections will be allowed for this listener. If
this field is present and contains at least one item,
the listener only allows the traffic which matches at
least one item in this list.
required:
- name
- port
- type
- tls
- type: object
properties:
plain:
type: object
properties:
authentication:
type: object
properties:
accessTokenIsJwt:
type: boolean
description: Configure whether the access token is
treated as JWT. This must be set to `false` if the
authorization server returns opaque tokens. Defaults
to `true`.
checkAccessTokenType:
type: boolean
description: Configure whether the access token type
check is performed or not. This should be set to
`false` if the authorization server does not include
'typ' claim in JWT token. Defaults to `true`.
checkIssuer:
type: boolean
description: Enable or disable issuer checking. By
default issuer is checked using the value configured
by `validIssuerUri`. Default value is `true`.
clientId:
type: string
description: OAuth Client ID which the Kafka broker
can use to authenticate against the authorization
server and use the introspect endpoint URI.
clientSecret:
type: object
properties:
key:
type: string
description: The key under which the secret value
is stored in the Kubernetes Secret.
secretName:
type: string
description: The name of the Kubernetes Secret
containing the secret value.
required:
- key
- secretName
description: Link to Kubernetes Secret containing
the OAuth client secret which the Kafka broker can
use to authenticate against the authorization server
and use the introspect endpoint URI.
disableTlsHostnameVerification:
type: boolean
description: Enable or disable TLS hostname verification.
Default value is `false`.
enableECDSA:
type: boolean
description: Enable or disable ECDSA support by installing
BouncyCastle crypto provider. Default value is `false`.
fallbackUserNameClaim:
type: string
description: The fallback username claim to be used
for the user id if the claim specified by `userNameClaim`
is not present. This is useful when `client_credentials`
authentication only results in the client id being
provided in another claim. It only takes effect
if `userNameClaim` is set.
fallbackUserNamePrefix:
type: string
description: The prefix to use with the value of `fallbackUserNameClaim`
to construct the user id. This only takes effect
if `fallbackUserNameClaim` is true, and the value
is present for the claim. Mapping usernames and
client ids into the same user id space is useful
in preventing name collisions.
introspectionEndpointUri:
type: string
description: URI of the token introspection endpoint
which can be used to validate opaque non-JWT tokens.
jwksEndpointUri:
type: string
description: URI of the JWKS certificate endpoint,
which can be used for local JWT validation.
jwksExpirySeconds:
type: integer
minimum: 1
description: Configures how often are the JWKS certificates
considered valid. The expiry interval has to be
at least 60 seconds longer then the refresh interval
specified in `jwksRefreshSeconds`. Defaults to 360
seconds.
jwksMinRefreshPauseSeconds:
type: integer
minimum: 0
description: The minimum pause between two consecutive
refreshes. When an unknown signing key is encountered
the refresh is scheduled immediately, but will always
wait for this minimum pause. Defaults to 1 second.
jwksRefreshSeconds:
type: integer
minimum: 1
description: Configures how often are the JWKS certificates
refreshed. The refresh interval has to be at least
60 seconds shorter then the expiry interval specified
in `jwksExpirySeconds`. Defaults to 300 seconds.
maxSecondsWithoutReauthentication:
type: integer
description: Maximum number of seconds the authenticated
session remains valid without re-authentication.
This enables Apache Kafka re-authentication feature,
and causes sessions to expire when the access token
expires. If the access token expires before max
time or if max time is reached, the client has to
re-authenticate, otherwise the server will drop
the connection. Not set by default - the authenticated
session does not expire when the access token expires.
tlsTrustedCertificates:
type: array
items:
type: object
properties:
certificate:
type: string
description: The name of the file certificate
in the Secret.
secretName:
type: string
description: The name of the Secret containing
the certificate.
required:
- certificate
- secretName
description: Trusted certificates for TLS connection
to the OAuth server.
type:
type: string
enum:
- tls
- scram-sha-512
- oauth
description: Authentication type. `oauth` type uses
SASL OAUTHBEARER Authentication. `scram-sha-512`
type uses SASL SCRAM-SHA-512 Authentication. `tls`
type uses TLS Client Authentication. `tls` type
is supported only on TLS listeners.
userInfoEndpointUri:
type: string
description: 'URI of the User Info Endpoint to use
as a fallback to obtaining the user id when the
Introspection Endpoint does not return information
that can be used for the user id. '
userNameClaim:
type: string
description: Name of the claim from the JWT authentication
token, Introspection Endpoint response or User Info
Endpoint response which will be used to extract
the user id. Defaults to `sub`.
validIssuerUri:
type: string
description: URI of the token issuer used for authentication.
validTokenType:
type: string
description: Valid value for the `token_type` attribute
returned by the Introspection Endpoint. No default
value, and not checked by default.
required:
- type
description: 'Authentication configuration for this listener.
Since this listener does not use TLS transport you cannot
configure an authentication with `type: tls`.'
networkPolicyPeers:
type: array
items:
type: object
properties:
ipBlock:
type: object
properties:
cidr:
type: string
except:
type: array
items:
type: string
namespaceSelector:
type: object
properties:
matchExpressions:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
matchLabels:
type: object
podSelector:
type: object
properties:
matchExpressions:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
matchLabels:
type: object
description: List of peers which should be able to connect
to this listener. Peers in this list are combined using
a logical OR operation. If this field is empty or missing,
all connections will be allowed for this listener. If
this field is present and contains at least one item,
the listener only allows the traffic which matches at
least one item in this list.
description: Configures plain listener on port 9092.
tls:
type: object
properties:
authentication:
type: object
properties:
accessTokenIsJwt:
type: boolean
description: Configure whether the access token is
treated as JWT. This must be set to `false` if the
authorization server returns opaque tokens. Defaults
to `true`.
checkAccessTokenType:
type: boolean
description: Configure whether the access token type
check is performed or not. This should be set to
`false` if the authorization server does not include
'typ' claim in JWT token. Defaults to `true`.
checkIssuer:
type: boolean
description: Enable or disable issuer checking. By
default issuer is checked using the value configured
by `validIssuerUri`. Default value is `true`.
clientId:
type: string
description: OAuth Client ID which the Kafka broker
can use to authenticate against the authorization
server and use the introspect endpoint URI.
clientSecret:
type: object
properties:
key:
type: string
description: The key under which the secret value
is stored in the Kubernetes Secret.
secretName:
type: string
description: The name of the Kubernetes Secret
containing the secret value.
required:
- key
- secretName
description: Link to Kubernetes Secret containing
the OAuth client secret which the Kafka broker can
use to authenticate against the authorization server
and use the introspect endpoint URI.
disableTlsHostnameVerification:
type: boolean
description: Enable or disable TLS hostname verification.
Default value is `false`.
enableECDSA:
type: boolean
description: Enable or disable ECDSA support by installing
BouncyCastle crypto provider. Default value is `false`.
fallbackUserNameClaim:
type: string
description: The fallback username claim to be used
for the user id if the claim specified by `userNameClaim`
is not present. This is useful when `client_credentials`
authentication only results in the client id being
provided in another claim. It only takes effect
if `userNameClaim` is set.
fallbackUserNamePrefix:
type: string
description: The prefix to use with the value of `fallbackUserNameClaim`
to construct the user id. This only takes effect
if `fallbackUserNameClaim` is true, and the value
is present for the claim. Mapping usernames and
client ids into the same user id space is useful
in preventing name collisions.
introspectionEndpointUri:
type: string
description: URI of the token introspection endpoint
which can be used to validate opaque non-JWT tokens.
jwksEndpointUri:
type: string
description: URI of the JWKS certificate endpoint,
which can be used for local JWT validation.
jwksExpirySeconds:
type: integer
minimum: 1
description: Configures how often are the JWKS certificates
considered valid. The expiry interval has to be
at least 60 seconds longer then the refresh interval
specified in `jwksRefreshSeconds`. Defaults to 360
seconds.
jwksMinRefreshPauseSeconds:
type: integer
minimum: 0
description: The minimum pause between two consecutive
refreshes. When an unknown signing key is encountered
the refresh is scheduled immediately, but will always
wait for this minimum pause. Defaults to 1 second.
jwksRefreshSeconds:
type: integer
minimum: 1
description: Configures how often are the JWKS certificates
refreshed. The refresh interval has to be at least
60 seconds shorter then the expiry interval specified
in `jwksExpirySeconds`. Defaults to 300 seconds.
maxSecondsWithoutReauthentication:
type: integer
description: Maximum number of seconds the authenticated
session remains valid without re-authentication.
This enables Apache Kafka re-authentication feature,
and causes sessions to expire when the access token
expires. If the access token expires before max
time or if max time is reached, the client has to
re-authenticate, otherwise the server will drop
the connection. Not set by default - the authenticated
session does not expire when the access token expires.
tlsTrustedCertificates:
type: array
items:
type: object
properties:
certificate:
type: string
description: The name of the file certificate
in the Secret.
secretName:
type: string
description: The name of the Secret containing
the certificate.
required:
- certificate
- secretName
description: Trusted certificates for TLS connection
to the OAuth server.
type:
type: string
enum:
- tls
- scram-sha-512
- oauth
description: Authentication type. `oauth` type uses
SASL OAUTHBEARER Authentication. `scram-sha-512`
type uses SASL SCRAM-SHA-512 Authentication. `tls`
type uses TLS Client Authentication. `tls` type
is supported only on TLS listeners.
userInfoEndpointUri:
type: string
description: 'URI of the User Info Endpoint to use
as a fallback to obtaining the user id when the
Introspection Endpoint does not return information
that can be used for the user id. '
userNameClaim:
type: string
description: Name of the claim from the JWT authentication
token, Introspection Endpoint response or User Info
Endpoint response which will be used to extract
the user id. Defaults to `sub`.
validIssuerUri:
type: string
description: URI of the token issuer used for authentication.
validTokenType:
type: string
description: Valid value for the `token_type` attribute
returned by the Introspection Endpoint. No default
value, and not checked by default.
required:
- type
description: Authentication configuration for this listener.
configuration:
type: object
properties:
brokerCertChainAndKey:
type: object
properties:
certificate:
type: string
description: The name of the file certificate
in the Secret.
key:
type: string
description: The name of the private key in the
Secret.
secretName:
type: string
description: The name of the Secret containing
the certificate.
required:
- certificate
- key
- secretName
description: Reference to the `Secret` which holds
the certificate and private key pair. The certificate
can optionally contain the whole chain.
description: Configuration of TLS listener.
networkPolicyPeers:
type: array
items:
type: object
properties:
ipBlock:
type: object
properties:
cidr:
type: string
except:
type: array
items:
type: string
namespaceSelector:
type: object
properties:
matchExpressions:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
matchLabels:
type: object
podSelector:
type: object
properties:
matchExpressions:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
matchLabels:
type: object
description: List of peers which should be able to connect
to this listener. Peers in this list are combined using
a logical OR operation. If this field is empty or missing,
all connections will be allowed for this listener. If
this field is present and contains at least one item,
the listener only allows the traffic which matches at
least one item in this list.
description: Configures TLS listener on port 9093.
external:
type: object
properties:
authentication:
type: object
properties:
accessTokenIsJwt:
type: boolean
description: Configure whether the access token is
treated as JWT. This must be set to `false` if the
authorization server returns opaque tokens. Defaults
to `true`.
checkAccessTokenType:
type: boolean
description: Configure whether the access token type
check is performed or not. This should be set to
`false` if the authorization server does not include
'typ' claim in JWT token. Defaults to `true`.
checkIssuer:
type: boolean
description: Enable or disable issuer checking. By
default issuer is checked using the value configured
by `validIssuerUri`. Default value is `true`.
clientId:
type: string
description: OAuth Client ID which the Kafka broker
can use to authenticate against the authorization
server and use the introspect endpoint URI.
clientSecret:
type: object
properties:
key:
type: string
description: The key under which the secret value
is stored in the Kubernetes Secret.
secretName:
type: string
description: The name of the Kubernetes Secret
containing the secret value.
required:
- key
- secretName
description: Link to Kubernetes Secret containing
the OAuth client secret which the Kafka broker can
use to authenticate against the authorization server
and use the introspect endpoint URI.
disableTlsHostnameVerification:
type: boolean
description: Enable or disable TLS hostname verification.
Default value is `false`.
enableECDSA:
type: boolean
description: Enable or disable ECDSA support by installing
BouncyCastle crypto provider. Default value is `false`.
fallbackUserNameClaim:
type: string
description: The fallback username claim to be used
for the user id if the claim specified by `userNameClaim`
is not present. This is useful when `client_credentials`
authentication only results in the client id being
provided in another claim. It only takes effect
if `userNameClaim` is set.
fallbackUserNamePrefix:
type: string
description: The prefix to use with the value of `fallbackUserNameClaim`
to construct the user id. This only takes effect
if `fallbackUserNameClaim` is true, and the value
is present for the claim. Mapping usernames and
client ids into the same user id space is useful
in preventing name collisions.
introspectionEndpointUri:
type: string
description: URI of the token introspection endpoint
which can be used to validate opaque non-JWT tokens.
jwksEndpointUri:
type: string
description: URI of the JWKS certificate endpoint,
which can be used for local JWT validation.
jwksExpirySeconds:
type: integer
minimum: 1
description: Configures how often are the JWKS certificates
considered valid. The expiry interval has to be
at least 60 seconds longer then the refresh interval
specified in `jwksRefreshSeconds`. Defaults to 360
seconds.
jwksMinRefreshPauseSeconds:
type: integer
minimum: 0
description: The minimum pause between two consecutive
refreshes. When an unknown signing key is encountered
the refresh is scheduled immediately, but will always
wait for this minimum pause. Defaults to 1 second.
jwksRefreshSeconds:
type: integer
minimum: 1
description: Configures how often are the JWKS certificates
refreshed. The refresh interval has to be at least
60 seconds shorter then the expiry interval specified
in `jwksExpirySeconds`. Defaults to 300 seconds.
maxSecondsWithoutReauthentication:
type: integer
description: Maximum number of seconds the authenticated
session remains valid without re-authentication.
This enables Apache Kafka re-authentication feature,
and causes sessions to expire when the access token
expires. If the access token expires before max
time or if max time is reached, the client has to
re-authenticate, otherwise the server will drop
the connection. Not set by default - the authenticated
session does not expire when the access token expires.
tlsTrustedCertificates:
type: array
items:
type: object
properties:
certificate:
type: string
description: The name of the file certificate
in the Secret.
secretName:
type: string
description: The name of the Secret containing
the certificate.
required:
- certificate
- secretName
description: Trusted certificates for TLS connection
to the OAuth server.
type:
type: string
enum:
- tls
- scram-sha-512
- oauth
description: Authentication type. `oauth` type uses
SASL OAUTHBEARER Authentication. `scram-sha-512`
type uses SASL SCRAM-SHA-512 Authentication. `tls`
type uses TLS Client Authentication. `tls` type
is supported only on TLS listeners.
userInfoEndpointUri:
type: string
description: 'URI of the User Info Endpoint to use
as a fallback to obtaining the user id when the
Introspection Endpoint does not return information
that can be used for the user id. '
userNameClaim:
type: string
description: Name of the claim from the JWT authentication
token, Introspection Endpoint response or User Info
Endpoint response which will be used to extract
the user id. Defaults to `sub`.
validIssuerUri:
type: string
description: URI of the token issuer used for authentication.
validTokenType:
type: string
description: Valid value for the `token_type` attribute
returned by the Introspection Endpoint. No default
value, and not checked by default.
required:
- type
description: Authentication configuration for Kafka brokers.
class:
type: string
description: Configures the `Ingress` class that defines
which `Ingress` controller will be used. If not set,
the `Ingress` class is set to `nginx`.
configuration:
type: object
properties:
bootstrap:
type: object
properties:
address:
type: string
description: Additional address name for the bootstrap
service. The address will be added to the list
of subject alternative names of the TLS certificates.
dnsAnnotations:
type: object
description: Annotations that will be added to
the `Ingress` resource. You can use this field
to configure DNS providers such as External
DNS.
host:
type: string
description: Host for the bootstrap route. This
field will be used in the Ingress resource.
required:
- host
description: External bootstrap ingress configuration.
brokers:
type: array
items:
type: object
properties:
broker:
type: integer
description: Id of the kafka broker (broker
identifier).
advertisedHost:
type: string
description: The host name which will be used
in the brokers' `advertised.brokers`.
advertisedPort:
type: integer
description: The port number which will be used
in the brokers' `advertised.brokers`.
host:
type: string
description: Host for the broker ingress. This
field will be used in the Ingress resource.
dnsAnnotations:
type: object
description: Annotations that will be added
to the `Ingress` resources for individual
brokers. You can use this field to configure
DNS providers such as External DNS.
required:
- host
description: External broker ingress configuration.
brokerCertChainAndKey:
type: object
properties:
certificate:
type: string
description: The name of the file certificate
in the Secret.
key:
type: string
description: The name of the private key in the
Secret.
secretName:
type: string
description: The name of the Secret containing
the certificate.
required:
- certificate
- key
- secretName
description: Reference to the `Secret` which holds
the certificate and private key pair. The certificate
can optionally contain the whole chain.
description: External listener configuration.
networkPolicyPeers:
type: array
items:
type: object
properties:
ipBlock:
type: object
properties:
cidr:
type: string
except:
type: array
items:
type: string
namespaceSelector:
type: object
properties:
matchExpressions:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
matchLabels:
type: object
podSelector:
type: object
properties:
matchExpressions:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
matchLabels:
type: object
description: List of peers which should be able to connect
to this listener. Peers in this list are combined using
a logical OR operation. If this field is empty or missing,
all connections will be allowed for this listener. If
this field is present and contains at least one item,
the listener only allows the traffic which matches at
least one item in this list.
overrides:
type: object
properties:
bootstrap:
type: object
properties:
address:
type: string
description: Additional address name for the bootstrap
service. The address will be added to the list
of subject alternative names of the TLS certificates.
dnsAnnotations:
type: object
description: Annotations that will be added to
the `Service` resource. You can use this field
to configure DNS providers such as External
DNS.
nodePort:
type: integer
description: Node port for the bootstrap service.
description: External bootstrap service configuration.
brokers:
type: array
items:
type: object
properties:
broker:
type: integer
description: Id of the kafka broker (broker
identifier).
advertisedHost:
type: string
description: The host name which will be used
in the brokers' `advertised.brokers`.
advertisedPort:
type: integer
description: The port number which will be used
in the brokers' `advertised.brokers`.
nodePort:
type: integer
description: Node port for the broker service.
dnsAnnotations:
type: object
description: Annotations that will be added
to the `Service` resources for individual
brokers. You can use this field to configure
DNS providers such as External DNS.
description: External broker services configuration.
description: Overrides for external bootstrap and broker
services and externally advertised addresses.
tls:
type: boolean
description: Enables TLS encryption on the listener. By
default set to `true` for enabled TLS encryption.
type:
type: string
enum:
- route
- loadbalancer
- nodeport
- ingress
description: "Type of the external listener. Currently\
\ the supported types are `route`, `loadbalancer`, and\
\ `nodeport`. \n\n* `route` type uses OpenShift Routes\
\ to expose Kafka.* `loadbalancer` type uses LoadBalancer\
\ type services to expose Kafka.* `nodeport` type uses\
\ NodePort type services to expose Kafka.."
required:
- type
description: Configures external listener on port 9094.
authorization:
type: object
properties:
allowOnError:
type: boolean
description: Defines whether a Kafka client should be allowed
or denied by default when the authorizer fails to query the
Open Policy Agent, for example, when it is temporarily unavailable).
Defaults to `false` - all actions will be denied.
clientId:
type: string
description: OAuth Client ID which the Kafka client can use
to authenticate against the OAuth server and use the token
endpoint URI.
delegateToKafkaAcls:
type: boolean
description: Whether authorization decision should be delegated
to the 'Simple' authorizer if DENIED by Keycloak Authorization
Services policies. Default value is `false`.
disableTlsHostnameVerification:
type: boolean
description: Enable or disable TLS hostname verification. Default
value is `false`.
expireAfterMs:
type: integer
description: The expiration of the records kept in the local
cache to avoid querying the Open Policy Agent for every request.
Defines how often the cached authorization decisions are reloaded
from the Open Policy Agent server. In milliseconds. Defaults
to `3600000`.
grantsRefreshPeriodSeconds:
type: integer
minimum: 0
description: The time between two consecutive grants refresh
runs in seconds. The default value is 60.
grantsRefreshPoolSize:
type: integer
minimum: 1
description: The number of threads to use to refresh grants
for active sessions. The more threads, the more parallelism,
so the sooner the job completes. However, using more threads
places a heavier load on the authorization server. The default
value is 5.
initialCacheCapacity:
type: integer
description: Initial capacity of the local cache used by the
authorizer to avoid querying the Open Policy Agent for every
request Defaults to `5000`.
maximumCacheSize:
type: integer
description: Maximum capacity of the local cache used by the
authorizer to avoid querying the Open Policy Agent for every
request. Defaults to `50000`.
superUsers:
type: array
items:
type: string
description: List of super users. Should contain list of user
principals which should get unlimited access rights.
tlsTrustedCertificates:
type: array
items:
type: object
properties:
certificate:
type: string
description: The name of the file certificate in the Secret.
secretName:
type: string
description: The name of the Secret containing the certificate.
required:
- certificate
- secretName
description: Trusted certificates for TLS connection to the
OAuth server.
tokenEndpointUri:
type: string
description: Authorization server token endpoint URI.
type:
type: string
enum:
- simple
- opa
- keycloak
description: Authorization type. Currently, the supported types
are `simple`, `keycloak`, and `opa`. `simple` authorization
type uses Kafka's `kafka.security.authorizer.AclAuthorizer`
class for authorization. `keycloak` authorization type uses
Keycloak Authorization Services for authorization. `opa` authorization
type uses Open Policy Agent based authorization.
url:
type: string
example: http://opa:8181/v1/data/kafka/authz/allow
description: The URL used to connect to the Open Policy Agent
server. The URL has to include the policy which will be queried
by the authorizer. This option is required.
required:
- type
description: Authorization configuration for Kafka brokers.
config:
type: object
description: 'Kafka broker config properties with the following
prefixes cannot be set: listeners, advertised., broker., listener.,
host.name, port, inter.broker.listener.name, sasl., ssl., security.,
password., principal.builder.class, log.dir, zookeeper.connect,
zookeeper.set.acl, zookeeper.ssl, zookeeper.clientCnxnSocket,
authorizer., super.user, cruise.control.metrics.topic, cruise.control.metrics.reporter.bootstrap.servers
(with the exception of: zookeeper.connection.timeout.ms, ssl.cipher.suites,
ssl.protocol, ssl.enabled.protocols,cruise.control.metrics.topic.num.partitions,
cruise.control.metrics.topic.replication.factor, cruise.control.metrics.topic.retention.ms,cruise.control.metrics.topic.auto.create.retries,
cruise.control.metrics.topic.auto.create.timeout.ms,cruise.control.metrics.topic.min.insync.replicas).'
rack:
type: object
properties:
topologyKey:
type: string
example: topology.kubernetes.io/zone
description: A key that matches labels assigned to the Kubernetes
cluster nodes. The value of the label is used to set the broker's
`broker.rack` config and `client.rack` in Kafka Connect.
required:
- topologyKey
description: Configuration of the `broker.rack` broker config.
brokerRackInitImage:
type: string
description: The image of the init container used for initializing
the `broker.rack`.
affinity:
type: object
properties:
nodeAffinity:
type: object
properties:
preferredDuringSchedulingIgnoredDuringExecution:
type: array
items:
type: object
properties:
preference:
type: object
properties:
matchExpressions:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
matchFields:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
weight:
type: integer
requiredDuringSchedulingIgnoredDuringExecution:
type: object
properties:
nodeSelectorTerms:
type: array
items:
type: object
properties:
matchExpressions:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
matchFields:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
podAffinity:
type: object
properties:
preferredDuringSchedulingIgnoredDuringExecution:
type: array
items:
type: object
properties:
podAffinityTerm:
type: object
properties:
labelSelector:
type: object
properties:
matchExpressions:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
matchLabels:
type: object
namespaces:
type: array
items:
type: string
topologyKey:
type: string
weight:
type: integer
requiredDuringSchedulingIgnoredDuringExecution:
type: array
items:
type: object
properties:
labelSelector:
type: object
properties:
matchExpressions:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
matchLabels:
type: object
namespaces:
type: array
items:
type: string
topologyKey:
type: string
podAntiAffinity:
type: object
properties:
preferredDuringSchedulingIgnoredDuringExecution:
type: array
items:
type: object
properties:
podAffinityTerm:
type: object
properties:
labelSelector:
type: object
properties:
matchExpressions:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
matchLabels:
type: object
namespaces:
type: array
items:
type: string
topologyKey:
type: string
weight:
type: integer
requiredDuringSchedulingIgnoredDuringExecution:
type: array
items:
type: object
properties:
labelSelector:
type: object
properties:
matchExpressions:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
matchLabels:
type: object
namespaces:
type: array
items:
type: string
topologyKey:
type: string
description: The pod's affinity rules.
tolerations:
type: array
items:
type: object
properties:
effect:
type: string
key:
type: string
operator:
type: string
tolerationSeconds:
type: integer
value:
type: string
description: The pod's tolerations.
livenessProbe:
type: object
properties:
failureThreshold:
type: integer
minimum: 1
description: Minimum consecutive failures for the probe to be
considered failed after having succeeded. Defaults to 3. Minimum
value is 1.
initialDelaySeconds:
type: integer
minimum: 0
description: The initial delay before first the health is first
checked. Default to 15 seconds. Minimum value is 0.
periodSeconds:
type: integer
minimum: 1
description: How often (in seconds) to perform the probe. Default
to 10 seconds. Minimum value is 1.
successThreshold:
type: integer
minimum: 1
description: Minimum consecutive successes for the probe to
be considered successful after having failed. Defaults to
1. Must be 1 for liveness. Minimum value is 1.
timeoutSeconds:
type: integer
minimum: 1
description: The timeout for each attempted health check. Default
to 5 seconds. Minimum value is 1.
description: Pod liveness checking.
readinessProbe:
type: object
properties:
failureThreshold:
type: integer
minimum: 1
description: Minimum consecutive failures for the probe to be
considered failed after having succeeded. Defaults to 3. Minimum
value is 1.
initialDelaySeconds:
type: integer
minimum: 0
description: The initial delay before first the health is first
checked. Default to 15 seconds. Minimum value is 0.
periodSeconds:
type: integer
minimum: 1
description: How often (in seconds) to perform the probe. Default
to 10 seconds. Minimum value is 1.
successThreshold:
type: integer
minimum: 1
description: Minimum consecutive successes for the probe to
be considered successful after having failed. Defaults to
1. Must be 1 for liveness. Minimum value is 1.
timeoutSeconds:
type: integer
minimum: 1
description: The timeout for each attempted health check. Default
to 5 seconds. Minimum value is 1.
description: Pod readiness checking.
jvmOptions:
type: object
properties:
"-XX":
type: object
description: A map of -XX options to the JVM.
"-Xms":
type: string
pattern: '[0-9]+[mMgG]?'
description: -Xms option to to the JVM.
"-Xmx":
type: string
pattern: '[0-9]+[mMgG]?'
description: -Xmx option to to the JVM.
gcLoggingEnabled:
type: boolean
description: Specifies whether the Garbage Collection logging
is enabled. The default is false.
javaSystemProperties:
type: array
items:
type: object
properties:
name:
type: string
description: The system property name.
value:
type: string
description: The system property value.
description: A map of additional system properties which will
be passed using the `-D` option to the JVM.
description: JVM Options for pods.
jmxOptions:
type: object
properties:
authentication:
type: object
properties:
type:
type: string
enum:
- password
description: Authentication type. Currently the only supported
types are `password`.`password` type creates a username
and protected port with no TLS.
required:
- type
description: Authentication configuration for connecting to
the Kafka JMX port.
description: JMX Options for Kafka brokers.
resources:
type: object
properties:
limits:
type: object
requests:
type: object
description: CPU and memory resources to reserve.
metrics:
type: object
description: The Prometheus JMX Exporter configuration. See https://github.com/prometheus/jmx_exporter
for details of the structure of this configuration.
metricsConfig:
type: object
properties:
type:
type: string
enum:
- jmxPrometheusExporter
description: Metrics type. Only 'jmxPrometheusExporter' supported
currently.
valueFrom:
type: object
properties:
configMapKeyRef:
type: object
properties:
key:
type: string
name:
type: string
optional:
type: boolean
description: Reference to the key in the ConfigMap containing
the metrics configuration.
description: ConfigMap where the Prometheus JMX Exporter configuration
is stored. For details of the structure of this configuration,
see the {JMXExporter}.
required:
- type
- valueFrom
description: Metrics configuration.
logging:
type: object
properties:
loggers:
type: object
description: A Map from logger name to logger level.
name:
type: string
description: The name of the `ConfigMap` from which to get the
logging configuration.
type:
type: string
enum:
- inline
- external
description: Logging type, must be either 'inline' or 'external'.
required:
- type
description: Logging configuration for Kafka.
tlsSidecar:
type: object
properties:
image:
type: string
description: The docker image for the container.
livenessProbe:
type: object
properties:
failureThreshold:
type: integer
minimum: 1
description: Minimum consecutive failures for the probe
to be considered failed after having succeeded. Defaults
to 3. Minimum value is 1.
initialDelaySeconds:
type: integer
minimum: 0
description: The initial delay before first the health is
first checked. Default to 15 seconds. Minimum value is
0.
periodSeconds:
type: integer
minimum: 1
description: How often (in seconds) to perform the probe.
Default to 10 seconds. Minimum value is 1.
successThreshold:
type: integer
minimum: 1
description: Minimum consecutive successes for the probe
to be considered successful after having failed. Defaults
to 1. Must be 1 for liveness. Minimum value is 1.
timeoutSeconds:
type: integer
minimum: 1
description: The timeout for each attempted health check.
Default to 5 seconds. Minimum value is 1.
description: Pod liveness checking.
logLevel:
type: string
enum:
- emerg
- alert
- crit
- err
- warning
- notice
- info
- debug
description: The log level for the TLS sidecar. Default value
is `notice`.
readinessProbe:
type: object
properties:
failureThreshold:
type: integer
minimum: 1
description: Minimum consecutive failures for the probe
to be considered failed after having succeeded. Defaults
to 3. Minimum value is 1.
initialDelaySeconds:
type: integer
minimum: 0
description: The initial delay before first the health is
first checked. Default to 15 seconds. Minimum value is
0.
periodSeconds:
type: integer
minimum: 1
description: How often (in seconds) to perform the probe.
Default to 10 seconds. Minimum value is 1.
successThreshold:
type: integer
minimum: 1
description: Minimum consecutive successes for the probe
to be considered successful after having failed. Defaults
to 1. Must be 1 for liveness. Minimum value is 1.
timeoutSeconds:
type: integer
minimum: 1
description: The timeout for each attempted health check.
Default to 5 seconds. Minimum value is 1.
description: Pod readiness checking.
resources:
type: object
properties:
limits:
type: object
requests:
type: object
description: CPU and memory resources to reserve.
description: TLS sidecar configuration.
template:
type: object
properties:
statefulset:
type: object
properties:
metadata:
type: object
properties:
labels:
type: object
description: Labels added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
annotations:
type: object
description: Annotations added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
description: Metadata applied to the resource.
podManagementPolicy:
type: string
enum:
- OrderedReady
- Parallel
description: PodManagementPolicy which will be used for
this StatefulSet. Valid values are `Parallel` and `OrderedReady`.
Defaults to `Parallel`.
description: Template for Kafka `StatefulSet`.
pod:
type: object
properties:
metadata:
type: object
properties:
labels:
type: object
description: Labels added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
annotations:
type: object
description: Annotations added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
description: Metadata applied to the resource.
imagePullSecrets:
type: array
items:
type: object
properties:
name:
type: string
description: List of references to secrets in the same namespace
to use for pulling any of the images used by this Pod.
When the `STRIMZI_IMAGE_PULL_SECRETS` environment variable
in Cluster Operator and the `imagePullSecrets` option
are specified, only the `imagePullSecrets` variable is
used and the `STRIMZI_IMAGE_PULL_SECRETS` variable is
ignored.
securityContext:
type: object
properties:
fsGroup:
type: integer
fsGroupChangePolicy:
type: string
runAsGroup:
type: integer
runAsNonRoot:
type: boolean
runAsUser:
type: integer
seLinuxOptions:
type: object
properties:
level:
type: string
role:
type: string
type:
type: string
user:
type: string
seccompProfile:
type: object
properties:
localhostProfile:
type: string
type:
type: string
supplementalGroups:
type: array
items:
type: integer
sysctls:
type: array
items:
type: object
properties:
name:
type: string
value:
type: string
windowsOptions:
type: object
properties:
gmsaCredentialSpec:
type: string
gmsaCredentialSpecName:
type: string
runAsUserName:
type: string
description: Configures pod-level security attributes and
common container settings.
terminationGracePeriodSeconds:
type: integer
minimum: 0
description: The grace period is the duration in seconds
after the processes running in the pod are sent a termination
signal, and the time when the processes are forcibly halted
with a kill signal. Set this value to longer than the
expected cleanup time for your process. Value must be
a non-negative integer. A zero value indicates delete
immediately. You might need to increase the grace period
for very large Kafka clusters, so that the Kafka brokers
have enough time to transfer their work to another broker
before they are terminated. Defaults to 30 seconds.
affinity:
type: object
properties:
nodeAffinity:
type: object
properties:
preferredDuringSchedulingIgnoredDuringExecution:
type: array
items:
type: object
properties:
preference:
type: object
properties:
matchExpressions:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
matchFields:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
weight:
type: integer
requiredDuringSchedulingIgnoredDuringExecution:
type: object
properties:
nodeSelectorTerms:
type: array
items:
type: object
properties:
matchExpressions:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
matchFields:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
podAffinity:
type: object
properties:
preferredDuringSchedulingIgnoredDuringExecution:
type: array
items:
type: object
properties:
podAffinityTerm:
type: object
properties:
labelSelector:
type: object
properties:
matchExpressions:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
matchLabels:
type: object
namespaces:
type: array
items:
type: string
topologyKey:
type: string
weight:
type: integer
requiredDuringSchedulingIgnoredDuringExecution:
type: array
items:
type: object
properties:
labelSelector:
type: object
properties:
matchExpressions:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
matchLabels:
type: object
namespaces:
type: array
items:
type: string
topologyKey:
type: string
podAntiAffinity:
type: object
properties:
preferredDuringSchedulingIgnoredDuringExecution:
type: array
items:
type: object
properties:
podAffinityTerm:
type: object
properties:
labelSelector:
type: object
properties:
matchExpressions:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
matchLabels:
type: object
namespaces:
type: array
items:
type: string
topologyKey:
type: string
weight:
type: integer
requiredDuringSchedulingIgnoredDuringExecution:
type: array
items:
type: object
properties:
labelSelector:
type: object
properties:
matchExpressions:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
matchLabels:
type: object
namespaces:
type: array
items:
type: string
topologyKey:
type: string
description: The pod's affinity rules.
tolerations:
type: array
items:
type: object
properties:
effect:
type: string
key:
type: string
operator:
type: string
tolerationSeconds:
type: integer
value:
type: string
description: The pod's tolerations.
priorityClassName:
type: string
description: The name of the priority class used to assign
priority to the pods. For more information about priority
classes, see {K8sPriorityClass}.
schedulerName:
type: string
description: The name of the scheduler used to dispatch
this `Pod`. If not specified, the default scheduler will
be used.
hostAliases:
type: array
items:
type: object
properties:
hostnames:
type: array
items:
type: string
ip:
type: string
description: The pod's HostAliases. HostAliases is an optional
list of hosts and IPs that will be injected into the pod's
hosts file if specified.
topologySpreadConstraints:
type: array
items:
type: object
properties:
labelSelector:
type: object
properties:
matchExpressions:
type: array
items:
type: object
properties:
key:
type: string
operator:
type: string
values:
type: array
items:
type: string
matchLabels:
type: object
maxSkew:
type: integer
topologyKey:
type: string
whenUnsatisfiable:
type: string
description: The pod's topology spread constraints.
description: Template for Kafka `Pods`.
bootstrapService:
type: object
properties:
metadata:
type: object
properties:
labels:
type: object
description: Labels added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
annotations:
type: object
description: Annotations added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
description: Metadata applied to the resource.
description: Template for Kafka bootstrap `Service`.
brokersService:
type: object
properties:
metadata:
type: object
properties:
labels:
type: object
description: Labels added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
annotations:
type: object
description: Annotations added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
description: Metadata applied to the resource.
description: Template for Kafka broker `Service`.
externalBootstrapService:
type: object
properties:
metadata:
type: object
properties:
labels:
type: object
description: Labels added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
annotations:
type: object
description: Annotations added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
description: Metadata applied to the resource.
externalTrafficPolicy:
type: string
enum:
- Local
- Cluster
description: Specifies whether the service routes external
traffic to node-local or cluster-wide endpoints. `Cluster`
may cause a second hop to another node and obscures the
client source IP. `Local` avoids a second hop for LoadBalancer
and Nodeport type services and preserves the client source
IP (when supported by the infrastructure). If unspecified,
Kubernetes will use `Cluster` as the default.
loadBalancerSourceRanges:
type: array
items:
type: string
description: 'A list of CIDR ranges (for example `10.0.0.0/8`
or `130.211.204.1/32`) from which clients can connect
to load balancer type listeners. If supported by the platform,
traffic through the loadbalancer is restricted to the
specified CIDR ranges. This field is applicable only for
loadbalancer type services and is ignored if the cloud
provider does not support the feature. For more information,
see https://v1-17.docs.kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/. '
description: Template for Kafka external bootstrap `Service`.
perPodService:
type: object
properties:
metadata:
type: object
properties:
labels:
type: object
description: Labels added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
annotations:
type: object
description: Annotations added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
description: Metadata applied to the resource.
externalTrafficPolicy:
type: string
enum:
- Local
- Cluster
description: Specifies whether the service routes external
traffic to node-local or cluster-wide endpoints. `Cluster`
may cause a second hop to another node and obscures the
client source IP. `Local` avoids a second hop for LoadBalancer
and Nodeport type services and preserves the client source
IP (when supported by the infrastructure). If unspecified,
Kubernetes will use `Cluster` as the default.
loadBalancerSourceRanges:
type: array
items:
type: string
description: 'A list of CIDR ranges (for example `10.0.0.0/8`
or `130.211.204.1/32`) from which clients can connect
to load balancer type listeners. If supported by the platform,
traffic through the loadbalancer is restricted to the
specified CIDR ranges. This field is applicable only for
loadbalancer type services and is ignored if the cloud
provider does not support the feature. For more information,
see https://v1-17.docs.kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/. '
description: Template for Kafka per-pod `Services` used for
access from outside of Kubernetes.
externalBootstrapRoute:
type: object
properties:
metadata:
type: object
properties:
labels:
type: object
description: Labels added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
annotations:
type: object
description: Annotations added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
description: Metadata applied to the resource.
description: Template for Kafka external bootstrap `Route`.
perPodRoute:
type: object
properties:
metadata:
type: object
properties:
labels:
type: object
description: Labels added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
annotations:
type: object
description: Annotations added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
description: Metadata applied to the resource.
description: Template for Kafka per-pod `Routes` used for access
from outside of OpenShift.
externalBootstrapIngress:
type: object
properties:
metadata:
type: object
properties:
labels:
type: object
description: Labels added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
annotations:
type: object
description: Annotations added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
description: Metadata applied to the resource.
description: Template for Kafka external bootstrap `Ingress`.
perPodIngress:
type: object
properties:
metadata:
type: object
properties:
labels:
type: object
description: Labels added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
annotations:
type: object
description: Annotations added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
description: Metadata applied to the resource.
description: Template for Kafka per-pod `Ingress` used for access
from outside of Kubernetes.
persistentVolumeClaim:
type: object
properties:
metadata:
type: object
properties:
labels:
type: object
description: Labels added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
annotations:
type: object
description: Annotations added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
description: Metadata applied to the resource.
description: Template for all Kafka `PersistentVolumeClaims`.
podDisruptionBudget:
type: object
properties:
metadata:
type: object
properties:
labels:
type: object
description: Labels added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
annotations:
type: object
description: Annotations added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
description: Metadata to apply to the `PodDistruptionBugetTemplate`
resource.
maxUnavailable:
type: integer
minimum: 0
description: Maximum number of unavailable pods to allow
automatic Pod eviction. A Pod eviction is allowed when
the `maxUnavailable` number of pods or fewer are unavailable
after the eviction. Setting this value to 0 prevents all
voluntary evictions, so the pods must be evicted manually.
Defaults to 1.
description: Template for Kafka `PodDisruptionBudget`.
kafkaContainer:
type: object
properties:
env:
type: array
items:
type: object
properties:
name:
type: string
description: The environment variable key.
value:
type: string
description: The environment variable value.
description: Environment variables which should be applied
to the container.
securityContext:
type: object
properties:
allowPrivilegeEscalation:
type: boolean
capabilities:
type: object
properties:
add:
type: array
items:
type: string
drop:
type: array
items:
type: string
privileged:
type: boolean
procMount:
type: string
readOnlyRootFilesystem:
type: boolean
runAsGroup:
type: integer
runAsNonRoot:
type: boolean
runAsUser:
type: integer
seLinuxOptions:
type: object
properties:
level:
type: string
role:
type: string
type:
type: string
user:
type: string
seccompProfile:
type: object
properties:
localhostProfile:
type: string
type:
type: string
windowsOptions:
type: object
properties:
gmsaCredentialSpec:
type: string
gmsaCredentialSpecName:
type: string
runAsUserName:
type: string
description: Security context for the container.
description: Template for the Kafka broker container.
tlsSidecarContainer:
type: object
properties:
env:
type: array
items:
type: object
properties:
name:
type: string
description: The environment variable key.
value:
type: string
description: The environment variable value.
description: Environment variables which should be applied
to the container.
securityContext:
type: object
properties:
allowPrivilegeEscalation:
type: boolean
capabilities:
type: object
properties:
add:
type: array
items:
type: string
drop:
type: array
items:
type: string
privileged:
type: boolean
procMount:
type: string
readOnlyRootFilesystem:
type: boolean
runAsGroup:
type: integer
runAsNonRoot:
type: boolean
runAsUser:
type: integer
seLinuxOptions:
type: object
properties:
level:
type: string
role:
type: string
type:
type: string
user:
type: string
seccompProfile:
type: object
properties:
localhostProfile:
type: string
type:
type: string
windowsOptions:
type: object
properties:
gmsaCredentialSpec:
type: string
gmsaCredentialSpecName:
type: string
runAsUserName:
type: string
description: Security context for the container.
description: Template for the Kafka broker TLS sidecar container.
initContainer:
type: object
properties:
env:
type: array
items:
type: object
properties:
name:
type: string
description: The environment variable key.
value:
type: string
description: The environment variable value.
description: Environment variables which should be applied
to the container.
securityContext:
type: object
properties:
allowPrivilegeEscalation:
type: boolean
capabilities:
type: object
properties:
add:
type: array
items:
type: string
drop:
type: array
items:
type: string
privileged:
type: boolean
procMount:
type: string
readOnlyRootFilesystem:
type: boolean
runAsGroup:
type: integer
runAsNonRoot:
type: boolean
runAsUser:
type: integer
seLinuxOptions:
type: object
properties:
level:
type: string
role:
type: string
type:
type: string
user:
type: string
seccompProfile:
type: object
properties:
localhostProfile:
type: string
type:
type: string
windowsOptions:
type: object
properties:
gmsaCredentialSpec:
type: string
gmsaCredentialSpecName:
type: string
runAsUserName:
type: string
description: Security context for the container.
description: Template for the Kafka init container.
clusterCaCert:
type: object
properties:
metadata:
type: object
properties:
labels:
type: object
description: Labels added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
annotations:
type: object
description: Annotations added to the resource template.
Can be applied to different resources such as `StatefulSets`,
`Deployments`, `Pods`, and `Services`.
description: Metadata applied to the resource.
description: Template for Secret with Kafka Cluster certificate
public key.
description: Template for Kafka cluster resources. The template
allows users to specify how are the `StatefulSet`, `Pods` and
`Services` generated.
version:
type: string