Kafka
Expand a field to see its description, example, and default behavior. Nested fields are grouped under their parent.
Required fields must be present when their parent object exists. [] denotes an array item; {key} denotes a map value. status is written by the operator. Reconcile-time checks and runtime defaults can add requirements beyond the schema.
Examples are illustrative JSON values. Open “View JSON example” for an object or array. Adapt names, endpoints, and credentials to your cluster. Kubernetes applies schema defaults when the containing object exists. Runtime and omission notes describe operator behavior. Status examples show reported data.
Runtime notes and domain examples were reviewed against operator source at b409b56.
View the complete CRD manifest at 618d621Example manifest
This example includes the required spec fields. Adapt its values and create any referenced resources before applying it.
apiVersion: krabka.io/v1alpha1
kind: Kafka
metadata:
name: my-cluster
namespace: default
spec:
kafkaVersion: 4.0.0No fields match. Change the search or reset the filters.
krabka.io/v1alpha1
Complete OpenAPI schema (JSON)
{
"description": "Auto-generated derived type for KafkaSpec via `CustomResource`",
"properties": {
"spec": {
"description": "Krabka cluster spec. The spec carries only the version label. Sibling\n`KafkaNodePool`s labeled `krabka.io/cluster=<this name>` describe the\nbroker pods.",
"properties": {
"authorization": {
"description": "Cluster-level authorizer selection. When `None`, the broker uses the\ndefault `AllowAll` authorizer and makes no ACL checks. When `Some`, the\noperator renders the `[authorization]` TOML section, so the broker\nbuilds the matching `Arc<dyn Authorizer>`. That is\n`SimpleAclAuthorizer` for `type: simple`, and `OpaAuthorizer` for\n`type: opa`. With `simple` or `opa` selected, the operator's\ninter-broker principal MUST appear in `super_users`. There is no\nimplicit `ANONYMOUS` allow, and operators must opt in explicitly.",
"nullable": true,
"properties": {
"allowOnError": {
"type": "boolean"
},
"expireAfterMs": {
"minimum": 1000,
"type": "integer"
},
"initialCacheCapacity": {
"minimum": 0,
"type": "integer"
},
"maximumCacheSize": {
"minimum": 1,
"type": "integer"
},
"superUsers": {
"items": {
"type": "string"
},
"type": "array"
},
"type": {
"enum": [
"simple",
"opa"
],
"type": "string"
},
"url": {
"type": "string"
}
},
"required": [
"type"
],
"type": "object"
},
"brokerTuning": {
"description": "Validated broker operational policy rendered into `[runtime]`.",
"nullable": true,
"properties": {
"aclMaxPrincipal": {
"nullable": true,
"type": "string"
},
"aclMaxResourceName": {
"nullable": true,
"type": "string"
},
"auditEventQueueCapacity": {
"format": "uint",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"auditPartitionWaitTimeout": {
"nullable": true,
"type": "string"
},
"auditSpoolReplayInterval": {
"nullable": true,
"type": "string"
},
"auditStatsPollInterval": {
"nullable": true,
"type": "string"
},
"auditTailReadMax": {
"nullable": true,
"type": "string"
},
"auditTailWindowOffsets": {
"format": "int64",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"autoJoinRetryBackoff": {
"nullable": true,
"type": "string"
},
"autoJoinVoterRequestTimeout": {
"nullable": true,
"type": "string"
},
"classicGroupInitialRebalanceDelay": {
"nullable": true,
"type": "string"
},
"cleanerInterval": {
"nullable": true,
"type": "string"
},
"clientMetricsDefaultInterval": {
"nullable": true,
"type": "string"
},
"clientMetricsEvictionTick": {
"nullable": true,
"type": "string"
},
"clientMetricsOtlpQueueCapacity": {
"format": "uint",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"clientMetricsPromSnapshotTtl": {
"nullable": true,
"type": "string"
},
"clientMetricsStaleFloor": {
"nullable": true,
"type": "string"
},
"clientMetricsStalePushIntervals": {
"format": "uint32",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"clientMetricsTelemetryMax": {
"nullable": true,
"type": "string"
},
"connectionCreationThrottleMax": {
"nullable": true,
"type": "string"
},
"consumerGroupHeartbeatInterval": {
"nullable": true,
"type": "string"
},
"consumerGroupMaxHeartbeatInterval": {
"nullable": true,
"type": "string"
},
"consumerGroupMaxSessionTimeout": {
"nullable": true,
"type": "string"
},
"consumerGroupMaxSize": {
"format": "uint",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"consumerGroupMinHeartbeatInterval": {
"nullable": true,
"type": "string"
},
"consumerGroupMinSessionTimeout": {
"nullable": true,
"type": "string"
},
"consumerGroupSessionTimeout": {
"nullable": true,
"type": "string"
},
"controlledShutdownDrainTimeout": {
"nullable": true,
"type": "string"
},
"controllerElectionTimeout": {
"nullable": true,
"type": "string"
},
"controllerFetchMissLimit": {
"format": "uint32",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"controllerHeartbeatInterval": {
"nullable": true,
"type": "string"
},
"coordinatorActorMailboxCapacity": {
"format": "uint",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"coordinatorSessionExpiryTick": {
"nullable": true,
"type": "string"
},
"coordinatorShutdownAckTimeout": {
"nullable": true,
"type": "string"
},
"defaultMinInsyncReplicas": {
"format": "int32",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"delegationTokenDefaultRenewPeriod": {
"nullable": true,
"type": "string"
},
"delegationTokenExpiryCheckInterval": {
"nullable": true,
"type": "string"
},
"delegationTokenMaxLifetime": {
"nullable": true,
"type": "string"
},
"disklessWalFlushInterval": {
"nullable": true,
"type": "string"
},
"disklessWalFlushMaxSize": {
"nullable": true,
"type": "string"
},
"disklessWalIndexProjectionTimeout": {
"nullable": true,
"type": "string"
},
"disklessWalLocalReplicaCount": {
"format": "uint",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"disklessWalTrimSafetyLag": {
"format": "int64",
"minimum": 0,
"nullable": true,
"type": "integer"
},
"futureLogMoveReadChunk": {
"nullable": true,
"type": "string"
},
"futureLogMoveRetryBackoff": {
"nullable": true,
"type": "string"
},
"gaugePollInterval": {
"nullable": true,
"type": "string"
},
"heartbeatInterval": {
"nullable": true,
"type": "string"
},
"heartbeatTimeout": {
"nullable": true,
"type": "string"
},
"interBrokerServerName": {
"minLength": 1,
"nullable": true,
"type": "string"
},
"isrScanInterval": {
"nullable": true,
"type": "string"
},
"leaderImbalanceCheckInterval": {
"nullable": true,
"type": "string"
},
"leaderImbalancePerBroker": {
"nullable": true,
"type": "string"
},
"livenessTickInterval": {
"nullable": true,
"type": "string"
},
"logReadBufferCap": {
"nullable": true,
"type": "string"
},
"logTimestampScanWindow": {
"nullable": true,
"type": "string"
},
"maxConnections": {
"format": "uint",
"minimum": 0,
"nullable": true,
"type": "integer"
},
"maxConnectionsPerIp": {
"format": "uint",
"minimum": 0,
"nullable": true,
"type": "integer"
},
"maxIncrementalFetchSessionCacheSlots": {
"format": "uint",
"minimum": 0,
"nullable": true,
"type": "integer"
},
"maxProduceGroup": {
"format": "uint",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"metadataMaxBetweenSnapshots": {
"nullable": true,
"type": "string"
},
"metadataMaxSnapshotInterval": {
"nullable": true,
"type": "string"
},
"metadataRaftCommandQueueCapacity": {
"format": "uint",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"metadataRaftFetchMax": {
"nullable": true,
"type": "string"
},
"metadataSnapshotFetchMax": {
"nullable": true,
"type": "string"
},
"metadataSnapshotIntervalRecords": {
"format": "uint64",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"oauthJwksHttpTimeout": {
"nullable": true,
"type": "string"
},
"observerFetchMax": {
"nullable": true,
"type": "string"
},
"observerLagBound": {
"format": "uint64",
"minimum": 0,
"nullable": true,
"type": "integer"
},
"observerPollInterval": {
"nullable": true,
"type": "string"
},
"offsetsTopicMetadataWaitTimeout": {
"nullable": true,
"type": "string"
},
"opaHttpTimeout": {
"nullable": true,
"type": "string"
},
"operatorRecoveryDeadline": {
"nullable": true,
"type": "string"
},
"partitionDiskScanInterval": {
"nullable": true,
"type": "string"
},
"partitionWriterQueueDepth": {
"format": "uint",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"producerIdExpiration": {
"nullable": true,
"type": "string"
},
"producerIdExpirationScanInterval": {
"nullable": true,
"type": "string"
},
"quotaThrottleMax": {
"nullable": true,
"type": "string"
},
"recordDecompressionMaxRatio": {
"nullable": true,
"type": "string"
},
"recordDecompressionOutputCeiling": {
"nullable": true,
"type": "string"
},
"recordDecompressionOutputFloor": {
"nullable": true,
"type": "string"
},
"remoteLogManagerInterval": {
"nullable": true,
"type": "string"
},
"replicaLagTimeMax": {
"nullable": true,
"type": "string"
},
"replicationEpochFenceBackoff": {
"nullable": true,
"type": "string"
},
"replicationFetchMax": {
"nullable": true,
"type": "string"
},
"replicationFetchMaxWait": {
"nullable": true,
"type": "string"
},
"replicationFetchMin": {
"nullable": true,
"type": "string"
},
"replicationReconnectDelayCap": {
"nullable": true,
"type": "string"
},
"replicationReconnectInitialDelay": {
"nullable": true,
"type": "string"
},
"replicationSendErrorBackoff": {
"nullable": true,
"type": "string"
},
"replicationThrottleExhaustedBackoff": {
"nullable": true,
"type": "string"
},
"replicationUnexpectedErrorBackoff": {
"nullable": true,
"type": "string"
},
"replicationUnknownTopicRetryDelay": {
"nullable": true,
"type": "string"
},
"rlmmBootstrapBackoffInitial": {
"nullable": true,
"type": "string"
},
"rlmmBootstrapBackoffMax": {
"nullable": true,
"type": "string"
},
"rlmmReconcileTick": {
"nullable": true,
"type": "string"
},
"selfRegistrationBackoffMax": {
"nullable": true,
"type": "string"
},
"selfRegistrationBackoffMin": {
"nullable": true,
"type": "string"
},
"selfRegistrationMaxAttempts": {
"format": "uint32",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"sendfileMin": {
"nullable": true,
"type": "string"
},
"shareGroupEnable": {
"nullable": true,
"type": "boolean"
},
"shareGroupHeartbeatInterval": {
"nullable": true,
"type": "string"
},
"shareGroupIsolationLevel": {
"nullable": true,
"type": "string"
},
"shareGroupMaxDeliveryAttempts": {
"format": "int16",
"maximum": 32767,
"minimum": 1,
"nullable": true,
"type": "integer"
},
"shareGroupMaxInflightRecords": {
"format": "int32",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"shareGroupMaxSize": {
"format": "uint",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"shareGroupRecordLockDuration": {
"nullable": true,
"type": "string"
},
"shareGroupSessionTimeout": {
"nullable": true,
"type": "string"
},
"shareRecoveryReadMax": {
"nullable": true,
"type": "string"
},
"shareSessionCacheMaxWhenUnlimited": {
"format": "uint",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"shareStateNumPartitions": {
"format": "int32",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"shareStateReplicationFactor": {
"format": "int16",
"maximum": 32767,
"minimum": 1,
"nullable": true,
"type": "integer"
},
"socketReceiveBuffer": {
"nullable": true,
"type": "string"
},
"socketRequestMax": {
"nullable": true,
"type": "string"
},
"socketSendBuffer": {
"nullable": true,
"type": "string"
},
"startupLeaderWaitTimeout": {
"nullable": true,
"type": "string"
},
"streamsGroupAcceptableRecoveryLag": {
"format": "int64",
"minimum": 0,
"nullable": true,
"type": "integer"
},
"streamsGroupAssignor": {
"nullable": true,
"type": "string"
},
"streamsGroupEnable": {
"nullable": true,
"type": "boolean"
},
"streamsGroupHeartbeatInterval": {
"nullable": true,
"type": "string"
},
"streamsGroupMaxSize": {
"format": "uint",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"streamsGroupNumStandbyReplicas": {
"format": "int32",
"minimum": 0,
"nullable": true,
"type": "integer"
},
"streamsGroupNumWarmupReplicas": {
"format": "int32",
"minimum": 0,
"nullable": true,
"type": "integer"
},
"streamsGroupSessionTimeout": {
"nullable": true,
"type": "string"
},
"streamsGroupTaskOffsetInterval": {
"nullable": true,
"type": "string"
},
"streamsInternalTopicReplicationFactor": {
"format": "int16",
"maximum": 32767,
"minimum": 1,
"nullable": true,
"type": "integer"
},
"syncGroupFollowerWait": {
"nullable": true,
"type": "string"
},
"telemetryDecompressedOutputCeiling": {
"nullable": true,
"type": "string"
},
"telemetryDecompressedOutputFloor": {
"nullable": true,
"type": "string"
},
"telemetryMaxDecompressionRatio": {
"nullable": true,
"type": "string"
},
"tlsReloadInterval": {
"nullable": true,
"type": "string"
},
"transactionMaxTimeout": {
"nullable": true,
"type": "string"
},
"transactionMinTimeout": {
"nullable": true,
"type": "string"
},
"transactionRecoveryReadMax": {
"nullable": true,
"type": "string"
},
"transactionStateNumPartitions": {
"format": "int32",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"transactionStateReplicationFactor": {
"format": "int16",
"maximum": 32767,
"minimum": 1,
"nullable": true,
"type": "integer"
},
"txnAbortCleanupInterval": {
"nullable": true,
"type": "string"
},
"uncleanRecoveryAggressiveDeadline": {
"nullable": true,
"type": "string"
},
"uncleanRecoveryBalancedDeadline": {
"nullable": true,
"type": "string"
},
"uncleanRecoveryQueueCapacity": {
"format": "uint",
"minimum": 1,
"nullable": true,
"type": "integer"
}
},
"type": "object"
},
"clientsCa": {
"description": "Per-cluster CA that signs `KafkaUser` TLS certs. When absent, the\noperator uses a fully-defaulted `CertificateAuthority`.",
"nullable": true,
"properties": {
"generateCertificateAuthority": {
"default": true,
"description": "When `true`, which is the default, the operator generates and\nrenews this CA. When `false`, the cluster admin must create the CA\n`Secret` pair first, and the operator refuses to overwrite them.\nThe admin renews a BYO CA. The `CronJob` skips a BYO CA and emits\nan Event when the CA comes near its expiry.",
"type": "boolean"
},
"renewalDays": {
"default": 30,
"description": "Window in days before `notAfter` in which the renewal `CronJob`\nreissues the leaf certs. Default 30.",
"format": "uint32",
"minimum": 0,
"type": "integer"
},
"validityDays": {
"default": 365,
"description": "Cert validity in days. Default 365.",
"format": "uint32",
"minimum": 0,
"type": "integer"
}
},
"type": "object"
},
"clusterCa": {
"description": "Per-cluster CA for inter-broker mTLS and broker certs. When absent,\nthe operator uses a fully-defaulted `CertificateAuthority`, which it\ngenerates itself with 365/30 days.",
"nullable": true,
"properties": {
"generateCertificateAuthority": {
"default": true,
"description": "When `true`, which is the default, the operator generates and\nrenews this CA. When `false`, the cluster admin must create the CA\n`Secret` pair first, and the operator refuses to overwrite them.\nThe admin renews a BYO CA. The `CronJob` skips a BYO CA and emits\nan Event when the CA comes near its expiry.",
"type": "boolean"
},
"renewalDays": {
"default": 30,
"description": "Window in days before `notAfter` in which the renewal `CronJob`\nreissues the leaf certs. Default 30.",
"format": "uint32",
"minimum": 0,
"type": "integer"
},
"validityDays": {
"default": 365,
"description": "Cert validity in days. Default 365.",
"format": "uint32",
"minimum": 0,
"type": "integer"
}
},
"type": "object"
},
"config": {
"additionalProperties": {
"type": "string"
},
"description": "Opaque broker properties, in `server.properties`-style key and value\npairs. The operator passes them through to the broker's\n`[server_properties]` TOML table, and the broker treats them as inert\ntoday. Changes propagate through the config hash.",
"nullable": true,
"type": "object"
},
"delegationToken": {
"description": "Delegation-token master HMAC key source. When `None`, the broker\nrejects all KIP-48 delegation-token RPCs with err 61\n`DELEGATION_TOKEN_AUTH_DISABLED`. When `Some`, the operator injects\n`KRABKA_DELEGATION_TOKEN_SECRET_KEY` into each broker pod through a\n`valueFrom.secretKeyRef`. The key is then part of the rendered\n`StatefulSet`, so the SSA reconcile does not race with out-of-band\n`kubectl set env` patches.",
"nullable": true,
"properties": {
"secretKeyRef": {
"description": "Reference to a Kubernetes `Secret` in the same namespace as the\n`Kafka` CR. Its `data.<key>` value is the broker's master HMAC key for\nKIP-48 delegation tokens.",
"properties": {
"key": {
"description": "Key within the Secret's `data`. Defaults to `secret-key`.",
"nullable": true,
"type": "string"
},
"name": {
"description": "Secret name in the same namespace as the `Kafka` CR.",
"type": "string"
}
},
"required": [
"name"
],
"type": "object"
}
},
"required": [
"secretKeyRef"
],
"type": "object"
},
"interBrokerKerberos": {
"description": "Inter-broker Kerberos initiate config. It is required when\n`interBrokerListenerName` resolves to a `type: gssapi` listener. It\nsupplies the shared client principal and the KDC. The keytab comes from\nthat listener's `keytabSecretRef`.",
"nullable": true,
"properties": {
"clientPrincipal": {
"description": "Principal that every broker authenticates as when it dials peers, for\nexample `kafka@EXAMPLE.COM`. It must exist in the shared keytab.",
"type": "string"
},
"kdcUrl": {
"description": "KDC endpoint, for example `tcp://kdc:88`.",
"type": "string"
},
"serviceName": {
"description": "Target SPN primary. Defaults to `kafka`.",
"nullable": true,
"type": "string"
}
},
"required": [
"clientPrincipal",
"kdcUrl"
],
"type": "object"
},
"interBrokerListenerName": {
"description": "Name of the listener for inter-broker traffic. When `None`, the\noperator picks the first `internal` listener. When `listeners` is\nempty, the operator picks the synthesized default `\"PLAIN\"`.",
"nullable": true,
"type": "string"
},
"kafkaVersion": {
"description": "Krabka version label. The operator propagates it to all pool pods\nthrough the `app.kubernetes.io/version` label.",
"type": "string"
},
"krb5ConfSecretRef": {
"description": "Optional process-wide `krb5.conf`. The operator mounts it into the\nbroker pods and points `KRB5_CONFIG` at it. It serves both the accept\npath and the initiate path.",
"nullable": true,
"properties": {
"key": {
"description": "Key within the Secret whose value is the krb5.conf contents.",
"type": "string"
},
"secretName": {
"description": "Name of the Secret holding the krb5.conf.",
"type": "string"
}
},
"required": [
"key",
"secretName"
],
"type": "object"
},
"listeners": {
"description": "Named listeners. An empty or absent list synthesizes one internal\n`PLAIN` listener on port 9092.",
"items": {
"properties": {
"authentication": {
"description": "Per-listener authentication mechanism. Absent means anonymous, and no\nclient identity is required. When the field is `type: tls`, the\nlistener must also have `tls: true`. The reconcile enforces this\nrule.",
"nullable": true,
"properties": {
"accessTokenIsJwt": {
"type": "boolean"
},
"clientId": {
"minLength": 1,
"type": "string"
},
"clientSecret": {
"properties": {
"key": {
"minLength": 1,
"type": "string"
},
"secretName": {
"minLength": 1,
"type": "string"
}
},
"required": [
"key",
"secretName"
],
"type": "object"
},
"customClaimCheck": {
"minLength": 1,
"type": "string"
},
"enableOauthBearer": {
"type": "boolean"
},
"fallbackUserNameClaim": {
"minLength": 1,
"type": "string"
},
"fallbackUserNamePrefix": {
"minLength": 1,
"type": "string"
},
"groupsClaim": {
"minLength": 1,
"type": "string"
},
"groupsClaimDelimiter": {
"minLength": 1,
"type": "string"
},
"introspectionEndpointUri": {
"minLength": 1,
"type": "string"
},
"introspectionHttpTimeoutSeconds": {
"minimum": 1,
"type": "integer"
},
"jwksEndpointUri": {
"minLength": 1,
"type": "string"
},
"jwksExpirySeconds": {
"format": "int32",
"minimum": 1,
"type": "integer"
},
"jwksIgnoreKeyUse": {
"type": "boolean"
},
"jwksMinRefreshPauseSeconds": {
"format": "int32",
"minimum": 0,
"type": "integer"
},
"jwksRefreshSeconds": {
"minimum": 0,
"type": "integer"
},
"kdc": {
"minLength": 1,
"type": "string"
},
"keytabSecretRef": {
"properties": {
"key": {
"minLength": 1,
"type": "string"
},
"secretName": {
"minLength": 1,
"type": "string"
}
},
"required": [
"key",
"secretName"
],
"type": "object"
},
"maxClockSkewSeconds": {
"minimum": 0,
"type": "integer"
},
"maxSecondsWithoutReauthentication": {
"format": "int32",
"minimum": 1,
"type": "integer"
},
"maxTimeSkew": {
"minLength": 1,
"type": "string"
},
"principalToLocalRules": {
"items": {
"minLength": 1,
"type": "string"
},
"type": "array"
},
"realm": {
"minLength": 1,
"type": "string"
},
"serviceName": {
"minLength": 1,
"type": "string"
},
"tlsTrustedCertificates": {
"items": {
"properties": {
"certificate": {
"minLength": 1,
"type": "string"
},
"secretName": {
"minLength": 1,
"type": "string"
}
},
"required": [
"certificate",
"secretName"
],
"type": "object"
},
"type": "array"
},
"type": {
"enum": [
"tls",
"scram-sha-512",
"scram-sha-256",
"oauth",
"gssapi"
],
"type": "string"
},
"userInfoEndpointUri": {
"minLength": 1,
"type": "string"
},
"userNameClaim": {
"type": "string"
},
"validAudience": {
"type": "string"
},
"validIssuerUri": {
"minLength": 1,
"type": "string"
},
"validTokenType": {
"minLength": 1,
"type": "string"
}
},
"required": [
"type"
],
"type": "object"
},
"configuration": {
"description": "Optional listener-type-specific configuration.",
"nullable": true,
"properties": {
"bootstrap": {
"nullable": true,
"properties": {
"annotations": {
"additionalProperties": {
"type": "string"
},
"description": "Annotations to add to the bootstrap Service.",
"type": "object"
},
"host": {
"description": "`ingress` / `route` only: bootstrap hostname.",
"nullable": true,
"type": "string"
},
"labels": {
"additionalProperties": {
"type": "string"
},
"description": "Labels to add to the bootstrap Service.",
"type": "object"
},
"loadBalancerIP": {
"description": "`loadbalancer` only: pin the bootstrap LB IP.",
"nullable": true,
"type": "string"
},
"nodePort": {
"description": "`nodeport` only: pin the bootstrap `NodePort`.",
"format": "int32",
"nullable": true,
"type": "integer"
}
},
"type": "object"
},
"brokers": {
"items": {
"properties": {
"advertisedHost": {
"description": "Override the computed advertised host.",
"nullable": true,
"type": "string"
},
"advertisedPort": {
"description": "Override the computed advertised port.",
"format": "int32",
"nullable": true,
"type": "integer"
},
"broker": {
"description": "Broker id this override applies to (matches the node id).",
"format": "int32",
"type": "integer"
},
"host": {
"description": "`ingress` / `route` only: per-broker hostname.",
"nullable": true,
"type": "string"
},
"loadBalancerIP": {
"description": "`loadbalancer` only: pin this broker's `Service.spec.loadBalancerIP`.",
"nullable": true,
"type": "string"
},
"nodePort": {
"description": "`nodeport` only: pin this broker's `Service.spec.ports[0].nodePort`.",
"format": "int32",
"nullable": true,
"type": "integer"
}
},
"required": [
"broker"
],
"type": "object"
},
"type": "array"
},
"class": {
"description": "`ingress` only: the `spec.ingressClassName` that the operator sets on\nevery generated `Ingress`. This is the Strimzi-shaped\n`configuration.class`. It is inert for other listener types.",
"nullable": true,
"type": "string"
}
},
"type": "object"
},
"name": {
"description": "Unique within the cluster. Alphanumeric characters and `-`, ≤25\nchars. It is the Kafka listener name, and it appears in\n`bootstrap.servers`-style URLs.",
"type": "string"
},
"networkPolicyPeers": {
"description": "Per-listener peer allow-list. It is tri-state:\n- `None` gives no per-listener restriction, that is, allow-all on this\n port.\n- `Some(vec![])` gives deny-all on this listener port. The operator\n emits no per-listener rule, and the default-deny applies.\n- `Some(non_empty)` lets only the listed peers reach this port.\n\nThe operator reads this field only when `Kafka.spec.networkPolicy` is\nset. In any other case the field is inert. The operator auto-allow rule\nstill fires on this port for deny-all listeners, so that the operator\ncan manage the cluster.",
"items": {
"description": "Subset of `networking.k8s.io/v1.NetworkPolicyPeer`.\n\nThis struct omits `ipBlock` on purpose. Someone can add it later if\nexternal CIDR allow-lists become a real need.",
"properties": {
"namespaceSelector": {
"description": "A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.",
"nullable": true,
"properties": {
"matchExpressions": {
"description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
"items": {
"description": "A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.",
"properties": {
"key": {
"description": "key is the label key that the selector applies to.",
"type": "string"
},
"operator": {
"description": "operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.",
"type": "string"
},
"values": {
"description": "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.",
"items": {
"type": "string"
},
"type": "array"
}
},
"required": [
"key",
"operator"
],
"type": "object"
},
"type": "array"
},
"matchLabels": {
"additionalProperties": {
"type": "string"
},
"description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \"key\", the operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
"type": "object"
}
},
"type": "object"
},
"podSelector": {
"description": "A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.",
"nullable": true,
"properties": {
"matchExpressions": {
"description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
"items": {
"description": "A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.",
"properties": {
"key": {
"description": "key is the label key that the selector applies to.",
"type": "string"
},
"operator": {
"description": "operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.",
"type": "string"
},
"values": {
"description": "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.",
"items": {
"type": "string"
},
"type": "array"
}
},
"required": [
"key",
"operator"
],
"type": "object"
},
"type": "array"
},
"matchLabels": {
"additionalProperties": {
"type": "string"
},
"description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \"key\", the operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
"type": "object"
}
},
"type": "object"
}
},
"type": "object"
},
"nullable": true,
"type": "array"
},
"port": {
"description": "Container port the broker binds. Unique within the cluster.",
"format": "int32",
"type": "integer"
},
"tls": {
"default": false,
"description": "Transport-level TLS. When `true`, the listener uses the per-broker\nkeystore that the cluster CA signed, and clients must use TLS to\nconnect. This field is independent of `authentication`. A `tls: true`\nlistener with no `authentication` is anonymous over TLS.",
"type": "boolean"
},
"type": {
"description": "Listener type. `internal` is in-cluster. `nodeport` and\n`loadbalancer` create external Services. The schema accepts `ingress`\nand `route`, but the reconcile rejects them.",
"enum": [
"internal",
"nodeport",
"loadbalancer",
"ingress",
"route"
],
"type": "string"
}
},
"required": [
"name",
"port",
"type"
],
"type": "object"
},
"type": "array"
},
"logging": {
"description": "Broker log configuration. When `None`, the brokers use their built-in\ndefault `RUST_LOG` filter. When `Some`, the operator composes an inline\n`tracing` env-filter string, or reads an external one. The operator\nthen renders it into the broker `ConfigMap` under the `rust.log` key,\nwires it into the `RUST_LOG` env of each broker pod, and rolls the\ncluster on a change through the config hash.",
"nullable": true,
"properties": {
"loggers": {
"additionalProperties": {
"type": "string"
},
"description": "Inline loggers, from tracing target to level. The key `root` is\ncase-insensitive and sets the global default level as a bare\nenv-filter directive. Any other key is a tracing target, that is, a\nRust module path such as `krabka_broker`. The levels are\n`trace|debug|info|warn|error|off`, and they are case-insensitive.\n`fatal` is accepted as an alias for `error`.",
"type": "object"
},
"type": {
"default": "inline",
"enum": [
"inline",
"external"
],
"type": "string"
},
"valueFrom": {
"description": "External logging source. This field is required when\n`type: external`. The operator uses the value of the referenced\n`ConfigMap` key verbatim as the broker's `RUST_LOG` filter.",
"nullable": true,
"properties": {
"configMapKeyRef": {
"properties": {
"key": {
"type": "string"
},
"name": {
"type": "string"
}
},
"required": [
"key",
"name"
],
"type": "object"
}
},
"required": [
"configMapKeyRef"
],
"type": "object"
}
},
"type": "object"
},
"metadataVersion": {
"description": "`KRaft` metadata version, the runtime analog of\n`inter.broker.protocol.version`. When unset, it tracks the\n`major.minor` of `kafkaVersion`. When set, it pins the metadata version\nfor a two-step upgrade or an online downgrade. The operator validates\nit against `kafkaVersion`; changes on an existing cluster are finalized\nthrough `UpdateFeatures`, with safe-downgrade semantics for a lower\ntarget. Rejections surface `KafkaVersionValid=False` and leave\n`status.metadataVersion` unchanged.",
"nullable": true,
"type": "string"
},
"metricsConfig": {
"description": "Prometheus scrape configuration. When `None`, the brokers do not bind\n`/metrics`, and the operator renders no `PodMonitor` and no\n`ServiceMonitor`. When `Some`, the broker `StatefulSet` gains a\n`metrics` container port on TCP 9404, and the operator SSA-applies the\nresources that `pod_monitor` and `service_monitor` request.",
"nullable": true,
"properties": {
"podMonitor": {
"nullable": true,
"properties": {
"interval": {
"nullable": true,
"type": "string"
},
"labels": {
"additionalProperties": {
"type": "string"
},
"type": "object"
},
"scrapeTimeout": {
"nullable": true,
"type": "string"
}
},
"type": "object"
},
"serviceMonitor": {
"nullable": true,
"properties": {
"interval": {
"nullable": true,
"type": "string"
},
"labels": {
"additionalProperties": {
"type": "string"
},
"type": "object"
},
"scrapeTimeout": {
"nullable": true,
"type": "string"
}
},
"type": "object"
},
"type": {
"default": "prometheus",
"enum": [
"prometheus"
],
"type": "string"
}
},
"type": "object"
},
"networkPolicy": {
"description": "Opt-in `NetworkPolicy` generation. When `None`, the operator generates\nno `NetworkPolicy`. When `Some`, even `{}`, the operator renders a\ncluster-level `NetworkPolicy` that gates ingress to the broker and\ncontroller pods.",
"nullable": true,
"type": "object"
},
"tieredStorage": {
"description": "KIP-405: cluster-wide tiered storage. When `Some`, every broker pod\nboots with the local-tier RSM enabled, with an `emptyDir` mounted at\n`/var/lib/krabka/remote`, which is the broker's\n`remote_log_storage_dir`, and with `[remote_storage]` rendered in the\nbroker TOML. The per-topic enablement does not change. It stays\n`KafkaTopic.spec.config[\"remote.storage.enable\"] = \"true\"`.\n\nWith the `emptyDir` default and `InmemoryRemoteLogMetadataManager` as\nthe only RLMM, tier data does not survive pod restarts. PVC support\npairs with the production RLMM.",
"nullable": true,
"properties": {
"gcs": {
"description": "GCS-backend tuning. It is required when `kind == Gcs`, and it must be\nabsent in any other case. The struct has the same shape as\n`krabka_remote_storage::GcsConfig`. The operator renders the\nnon-credential fields verbatim into the broker TOML's\n`[remote_storage.gcs]` block. S3 uses env-var credentials, but GCS does\nnot. The operator mounts an explicit service-account JSON key as a FILE\non the broker pod and gives it to the broker as `service_account_path`\nin the TOML. Unset credentials select keyless Workload Identity or\nADC.",
"nullable": true,
"properties": {
"allowHttp": {
"description": "Allow plaintext HTTP. It is off by default. Turn it on for GCS\nemulators that run without TLS. Real GCS never needs it.",
"type": "boolean"
},
"bucket": {
"description": "GCS bucket name. Required.",
"type": "string"
},
"credentials": {
"description": "Optional explicit service-account credentials. When None, the broker\nuses Workload Identity or ADC, which is the keyless GKE path.",
"nullable": true,
"properties": {
"serviceAccountKey": {
"description": "Reference to the Secret holding the service-account JSON key.",
"properties": {
"key": {
"description": "Key within the Secret's `data`. Defaults to `secret-key`.",
"nullable": true,
"type": "string"
},
"name": {
"description": "Secret name in the same namespace as the `Kafka` CR.",
"type": "string"
}
},
"required": [
"name"
],
"type": "object"
}
},
"required": [
"serviceAccountKey"
],
"type": "object"
},
"endpoint": {
"description": "Optional custom GCS API base URL, for example for emulators and\nfakes. When `None`, the broker uses the standard Google Cloud Storage\nendpoint.",
"nullable": true,
"type": "string"
},
"multipartChunkSize": {
"description": "Override the per-part size for multipart uploads in bytes. When unset,\nthe broker uses\n`krabka_remote_storage::DEFAULT_MULTIPART_CHUNK_SIZE`, which is\n16 MiB.",
"format": "uint64",
"minimum": 0,
"nullable": true,
"type": "integer"
},
"multipartThreshold": {
"description": "Override the single-PUT and multipart cutoff in bytes. When unset, the\nbroker uses `krabka_remote_storage::DEFAULT_MULTIPART_THRESHOLD`, which\nis 100 MiB. Lower it in tests to exercise the multipart path on small\nfixtures.",
"format": "uint64",
"minimum": 0,
"nullable": true,
"type": "integer"
},
"prefix": {
"description": "Optional key prefix inside the bucket. It lets more than one Krabka\ncluster share a bucket without a collision.",
"nullable": true,
"type": "string"
}
},
"required": [
"bucket"
],
"type": "object"
},
"metadataManager": {
"description": "KIP-405: pick the `RemoteLogMetadataManager` that the broker pods run.\nWhen the field is absent, or when it is `type: Topic`, the broker\nactivates the durable\n`krabka_remote_storage_topic::TopicBasedRemoteLogMetadataManager`\nagainst the internal `__remote_log_metadata` topic. Tier-segment\nmetadata then survives pod restarts and is consistent across the\nbrokers in the cluster. Only an explicit `type: InMemory` selects the\nin-memory fixture, which is for test and dev only.",
"nullable": true,
"properties": {
"topic": {
"description": "Topic-backed tuning. It is optional when `kind == Topic`, and the\nbroker fills the defaults for the bootstrap and topic parameters. It\nmust be absent in any other case.",
"nullable": true,
"properties": {
"bootstrap": {
"description": "`host:port` that the broker pod dials to reach its own listener, so\nthat it can publish and consume `__remote_log_metadata`. This is\nusually the pod's loopback inter-broker listener, for example\n`127.0.0.1:9094`.",
"type": "string"
},
"eventQueueCapacity": {
"description": "Capacity of the shared metadata-event delivery queue.",
"format": "uint",
"minimum": 1,
"nullable": true,
"type": "integer"
},
"fetchMaxBytes": {
"description": "Maximum bytes returned by each per-partition metadata fetch.",
"nullable": true,
"type": "string"
},
"fetchMaxWait": {
"description": "Maximum wait for each per-partition metadata fetch.",
"nullable": true,
"type": "string"
},
"fetchRetryBackoff": {
"description": "Backoff after a failed metadata fetch.",
"nullable": true,
"type": "string"
},
"numPartitions": {
"description": "Partition count for `__remote_log_metadata` on the first creation.\nDefaults to 50, which is the Kafka\n`remote.log.metadata.topic.num.partitions`.",
"format": "int32",
"nullable": true,
"type": "integer"
},
"replication": {
"description": "Replication factor for `__remote_log_metadata` on the first creation.\nDefaults to 3, which is the Kafka\n`remote.log.metadata.topic.replication.factor`.",
"format": "int32",
"nullable": true,
"type": "integer"
},
"snapshotInterval": {
"description": "RLMM cache snapshot cadence.",
"nullable": true,
"type": "string"
},
"topicCreateTimeout": {
"description": "Timeout for provisioning each internal metadata topic.",
"nullable": true,
"type": "string"
}
},
"required": [
"bootstrap"
],
"type": "object"
},
"type": {
"description": "Implementation selector.",
"enum": [
"InMemory",
"Topic"
],
"type": "string"
}
},
"required": [
"type"
],
"type": "object"
},
"persistence": {
"description": "KIP-405: durable storage for the local-tier directory. It is valid\nonly with `type=Local`. When it is absent, which is the default, the\noperator renders an `emptyDir` for `tier-storage`. When `Some`, the\noperator renders a `volumeClaimTemplate` of the configured size and\nclass, so tier data survives pod restarts. Together with the\ntopic-backed RLMM, this closes the \"tier data is lost on pod restart\"\ncaveat.",
"nullable": true,
"properties": {
"class": {
"description": "Storage class name. `None` means the cluster default.",
"nullable": true,
"type": "string"
},
"deleteClaim": {
"default": false,
"description": "`true` gives\n`persistentVolumeClaimRetentionPolicy.whenDeleted: Delete`. It must\nmatch the parent `KafkaNodePool.spec.storage.deleteClaim` when both\nPVCs are present, because K8s `StatefulSets` have one set-wide\nretention policy and no per-template override. The operator validates\nthis at reconcile time, and a mismatch surfaces as\n`TieredStorageInvalid`.",
"type": "boolean"
},
"size": {
"description": "K8s `Quantity`, for example `\"50Gi\"` or `\"500Mi\"`. It must be\nnon-empty. The Kubernetes API server validates the resource-quantity\nform at SSA time.",
"type": "string"
}
},
"required": [
"size"
],
"type": "object"
},
"s3": {
"description": "S3-backend tuning. It is required when `kind == S3`, and it must be\nabsent in any other case. The struct has the same shape as\n`krabka_remote_storage::S3Config`. The operator renders the\nnon-credential fields verbatim into the broker TOML's\n`[remote_storage.s3]` block. The credentials come from Kubernetes\nSecrets, and the operator injects them as the broker-pod env vars\n`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`.",
"nullable": true,
"properties": {
"allowHttp": {
"description": "Allow plaintext HTTP. It is off by default. Turn it on for a `MinIO`\nthat runs without TLS. AWS S3 never needs it.",
"type": "boolean"
},
"bucket": {
"description": "S3 bucket name. Required.",
"type": "string"
},
"credentials": {
"description": "Optional explicit credentials. When `None`, the broker falls back to\nthe AWS credential chain, such as IRSA on EKS or an instance profile on\nEC2.",
"nullable": true,
"properties": {
"accessKeyId": {
"description": "Reference to the Secret holding the `AWS_ACCESS_KEY_ID` value.",
"properties": {
"key": {
"description": "Key within the Secret's `data`. Defaults to `secret-key`.",
"nullable": true,
"type": "string"
},
"name": {
"description": "Secret name in the same namespace as the `Kafka` CR.",
"type": "string"
}
},
"required": [
"name"
],
"type": "object"
},
"secretAccessKey": {
"description": "Reference to the Secret holding the `AWS_SECRET_ACCESS_KEY` value.",
"properties": {
"key": {
"description": "Key within the Secret's `data`. Defaults to `secret-key`.",
"nullable": true,
"type": "string"
},
"name": {
"description": "Secret name in the same namespace as the `Kafka` CR.",
"type": "string"
}
},
"required": [
"name"
],
"type": "object"
}
},
"required": [
"accessKeyId",
"secretAccessKey"
],
"type": "object"
},
"endpoint": {
"description": "Optional custom endpoint URL, for example `http://minio:9000` for\n`MinIO`, or `https://<account>.r2.cloudflarestorage.com` for Cloudflare\nR2. When `None`, the broker uses the AWS S3 endpoint for the configured\nregion.",
"nullable": true,
"type": "string"
},
"multipartChunkSize": {
"description": "Override the per-part size for multipart uploads in bytes. When unset,\nthe broker uses\n`krabka_remote_storage::DEFAULT_MULTIPART_CHUNK_SIZE`, which is\n16 MiB.",
"format": "uint64",
"minimum": 0,
"nullable": true,
"type": "integer"
},
"multipartThreshold": {
"description": "Override the single-PUT and multipart cutoff in bytes. When unset, the\nbroker uses `krabka_remote_storage::DEFAULT_MULTIPART_THRESHOLD`, which\nis 100 MiB. Lower it in tests to exercise the multipart path on small\nfixtures.",
"format": "uint64",
"minimum": 0,
"nullable": true,
"type": "integer"
},
"prefix": {
"description": "Optional key prefix inside the bucket. It lets more than one Krabka\ncluster share a bucket without a collision.",
"nullable": true,
"type": "string"
},
"region": {
"description": "AWS region. It is required even for the non-AWS endpoints `MinIO` and\nR2, because the `AmazonS3Builder` of `object_store` rejects an empty\nregion.",
"type": "string"
}
},
"required": [
"bucket",
"region"
],
"type": "object"
},
"type": {
"description": "Backend kind selector.",
"enum": [
"Local",
"S3",
"Gcs"
],
"type": "string"
}
},
"required": [
"type"
],
"type": "object"
},
"tracing": {
"description": "Distributed-tracing wiring for the broker pods. When `Some`, the\noperator renders the matching `KRABKA_OTLP_*` env vars onto every\nbroker pod. The broker's telemetry pipeline reads them with\n`TelemetryConfig::from_env` and installs the OTLP tracer at startup.\nWhen `None`, the operator emits no OTLP env vars, and the broker leaves\ntracing off. That is the default.",
"nullable": true,
"properties": {
"otlp": {
"description": "OTLP-backend tuning. Required when `kind == Otlp`.",
"nullable": true,
"properties": {
"endpoint": {
"description": "Required. OTLP collector endpoint in the form `scheme://host:port`.\nThe operator renders it as `KRABKA_OTLP_ENDPOINT`. A set field also\nsets `KRABKA_OTLP_ENABLED=true`.",
"type": "string"
},
"protocol": {
"description": "OTLP wire protocol selector. It has the same shape as the broker's\ninternal `OtlpProtocol` enum and the `OTEL_EXPORTER_OTLP_PROTOCOL` spec\nvalues.",
"enum": [
"grpc",
"http_protobuf"
],
"nullable": true,
"type": "string"
},
"sampleRatio": {
"description": "Optional sampling ratio in `[0.0, 1.0]`. The operator renders it as\n`KRABKA_OTLP_SAMPLE_RATIO`. An unset field leaves the binary's own\ndefault of `1.0`, which samples every trace.",
"format": "double",
"nullable": true,
"type": "number"
},
"serviceName": {
"description": "Optional `service.name` resource attribute. The operator renders it as\n`OTEL_SERVICE_NAME`. An unset field leaves the binary's own name, which\nis `\"krabka-broker\"` for `Kafka` and `\"krabka-gres\"` for `Gres`.",
"nullable": true,
"type": "string"
},
"timeout": {
"description": "Optional export timeout. The operator renders it as\n`KRABKA_OTLP_TIMEOUT`. An unset field leaves the binary's own default\nof `10s`.",
"nullable": true,
"type": "string"
}
},
"required": [
"endpoint"
],
"type": "object"
},
"type": {
"description": "Tracing backend selector.",
"enum": [
"Otlp"
],
"type": "string"
}
},
"required": [
"type"
],
"type": "object"
}
},
"required": [
"kafkaVersion"
],
"type": "object"
},
"status": {
"nullable": true,
"properties": {
"clientsCa": {
"description": "Status surface for one CA.\n\nThe reconciler fills it in from the parsed CA cert and the CRD spec.",
"nullable": true,
"properties": {
"certGeneration": {
"default": 0,
"description": "Monotonic generation of the active signing cert. It increments on\na same-key renewal and on a key promotion.",
"format": "uint64",
"minimum": 0,
"type": "integer"
},
"generated": {
"description": "`true` when the operator generated this CA, that is, when\n`generateCertificateAuthority == true`. `false` for a BYO CA.",
"type": "boolean"
},
"keyGeneration": {
"default": 0,
"description": "Monotonic generation of the active signing key. It increments only\non a key replacement.",
"format": "uint64",
"minimum": 0,
"type": "integer"
},
"notAfter": {
"description": "RFC3339 `notAfter` of the current CA cert, which is the signing\ncert.",
"type": "string"
},
"rotationPhase": {
"description": "Staged key-replacement phase. One of `idle`, `key-replace-trust`,\nand `key-replace-promote`.",
"nullable": true,
"type": "string"
},
"trustAnchors": {
"description": "Number of CA certs in the trust bundle now.",
"format": "uint",
"minimum": 0,
"nullable": true,
"type": "integer"
}
},
"required": [
"generated",
"notAfter"
],
"type": "object"
},
"clusterCa": {
"description": "Status surface for one CA.\n\nThe reconciler fills it in from the parsed CA cert and the CRD spec.",
"nullable": true,
"properties": {
"certGeneration": {
"default": 0,
"description": "Monotonic generation of the active signing cert. It increments on\na same-key renewal and on a key promotion.",
"format": "uint64",
"minimum": 0,
"type": "integer"
},
"generated": {
"description": "`true` when the operator generated this CA, that is, when\n`generateCertificateAuthority == true`. `false` for a BYO CA.",
"type": "boolean"
},
"keyGeneration": {
"default": 0,
"description": "Monotonic generation of the active signing key. It increments only\non a key replacement.",
"format": "uint64",
"minimum": 0,
"type": "integer"
},
"notAfter": {
"description": "RFC3339 `notAfter` of the current CA cert, which is the signing\ncert.",
"type": "string"
},
"rotationPhase": {
"description": "Staged key-replacement phase. One of `idle`, `key-replace-trust`,\nand `key-replace-promote`.",
"nullable": true,
"type": "string"
},
"trustAnchors": {
"description": "Number of CA certs in the trust bundle now.",
"format": "uint",
"minimum": 0,
"nullable": true,
"type": "integer"
}
},
"required": [
"generated",
"notAfter"
],
"type": "object"
},
"conditions": {
"default": [],
"description": "Standard Kubernetes-style condition list. It shows `Ready`,\n`ListenersValid`, and `ListenersReady`.",
"items": {
"properties": {
"lastTransitionTime": {
"description": "RFC3339 timestamp.",
"type": "string"
},
"message": {
"description": "Human-readable message.",
"type": "string"
},
"reason": {
"description": "CamelCase machine reason.",
"type": "string"
},
"status": {
"description": "`True`, `False`, or `Unknown`.",
"type": "string"
},
"type": {
"description": "For example, `Ready`.",
"type": "string"
}
},
"required": [
"lastTransitionTime",
"message",
"reason",
"status",
"type"
],
"type": "object"
},
"type": "array"
},
"kafkaVersion": {
"description": "Echo of `spec.kafkaVersion`, for observability.",
"nullable": true,
"type": "string"
},
"listeners": {
"description": "Per-listener resolved addresses. The operator fills them in once\n`ListenersReady=True`.",
"items": {
"properties": {
"addresses": {
"default": [],
"items": {
"properties": {
"host": {
"type": "string"
},
"port": {
"format": "int32",
"type": "integer"
}
},
"required": [
"host",
"port"
],
"type": "object"
},
"type": "array"
},
"bootstrapServers": {
"description": "`host:port` that clients put in `bootstrap.servers`.",
"type": "string"
},
"name": {
"type": "string"
},
"type": {
"enum": [
"internal",
"nodeport",
"loadbalancer",
"ingress",
"route"
],
"type": "string"
}
},
"required": [
"bootstrapServers",
"name",
"type"
],
"type": "object"
},
"type": "array"
},
"metadataVersion": {
"description": "The operator-finalized metadata version. On an existing cluster it\nadvances only after `UpdateFeatures` accepts the requested level.",
"nullable": true,
"type": "string"
},
"readyReplicas": {
"description": "The same value as `StatefulSet.status.readyReplicas`.",
"format": "int32",
"nullable": true,
"type": "integer"
},
"replicas": {
"description": "The same value as `StatefulSet.status.replicas`.",
"format": "int32",
"nullable": true,
"type": "integer"
},
"targetMetadataVersion": {
"description": "The metadata feature level requested by the current spec. This may be\nnewer than `metadataVersion` while broker pools are rolling.",
"nullable": true,
"type": "string"
}
},
"type": "object"
}
},
"required": [
"spec"
],
"title": "Kafka",
"type": "object"
}
spec
spec
object
Required
17 fields
Krabka cluster spec. The spec carries only the version label. Sibling KafkaNodePools labeled krabka.io/cluster=<this name> describe the broker pods.
- Example
-
View JSON example
{ "kafkaVersion": "4.0.0" } - Default No schema default
- Not declared
authorization
object | null
Optional
7 fields
Cluster-level authorizer selection. When None, the broker uses the default AllowAll authorizer and makes no ACL checks. When Some, the operator renders the [authorization] TOML section, so the broker builds the matching Arc<dyn Authorizer>. That is SimpleAclAuthorizer for type: simple, and OpaAuthorizer for type: opa. With simple or opa selected, the operator's inter-broker principal MUST appear in super_users. There is no implicit ANONYMOUS allow, and operators must opt in explicitly.
- Example
-
View JSON example
{ "type": "simple", "superUsers": [ "User:admin", "ANONYMOUS" ] } - Default Runtime / omission
AllowAll when omitted: the broker makes no ACL checks.
allowOnError
boolean
Optional
- Example
-
false - Default Runtime / omission
false for OPA authorization. Deny requests when OPA returns an error.
expireAfterMs
integer
Optional
- Example
-
3600000 - Default Runtime / omission
Unset: use the broker's OPA cache entry TTL.
Validation and schema details
- Minimum
1000
initialCacheCapacity
integer
Optional
- Example
-
1000 - Default Runtime / omission
Unset: use the broker's initial OPA cache capacity.
Validation and schema details
- Minimum
0
maximumCacheSize
integer
Optional
- Example
-
50000 - Default Runtime / omission
Unset: use the broker's maximum OPA cache size.
Validation and schema details
- Minimum
1
superUsers
array
Optional
1 field
- Example
-
View JSON example
[ "User:admin", "ANONYMOUS" ]
- Default Runtime / omission
[] when omitted for simple authorization. With opa, the operator adds its mTLS principal.
[]
string
Array item
- Example
-
"User:admin" - Default No independent default
- Defined by the parent
type
string
Required
- Example
-
"simple" - Default No schema default
- Not declared
"simple""opa"
url
string
Optional
- Example
-
"http://opa:8181/v1/data/kafka/authz/allow" - Default No schema default
- Not declared
brokerTuning
object | null
Optional
139 fields
Validated broker operational policy rendered into [runtime].
- Example
-
View JSON example
{ "aclMaxPrincipal": "1MiB" } - Default No schema default
- Not declared
aclMaxPrincipal
string | null
Optional
- Example
-
"1MiB" - Default Runtime / omission
Unset; the broker uses its configured default.
aclMaxResourceName
string | null
Optional
- Example
-
"1MiB" - Default Runtime / omission
Unset; the broker uses its configured default.
auditEventQueueCapacity
integer | null (uint)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
auditPartitionWaitTimeout
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
auditSpoolReplayInterval
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
auditStatsPollInterval
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
auditTailReadMax
string | null
Optional
- Example
-
"1MiB" - Default Runtime / omission
Unset; the broker uses its configured default.
auditTailWindowOffsets
integer | null (int64)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
autoJoinRetryBackoff
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
autoJoinVoterRequestTimeout
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
classicGroupInitialRebalanceDelay
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
cleanerInterval
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
clientMetricsDefaultInterval
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
clientMetricsEvictionTick
string | null
Optional
- Example
-
"60000ms" - Default Runtime / omission
Unset; the broker uses its configured default.
clientMetricsOtlpQueueCapacity
integer | null (uint)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
clientMetricsPromSnapshotTtl
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
clientMetricsStaleFloor
string | null
Optional
- Example
-
"600000ms" - Default Runtime / omission
Unset; the broker uses its configured default.
clientMetricsStalePushIntervals
integer | null (uint32)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
clientMetricsTelemetryMax
string | null
Optional
- Example
-
"1MiB" - Default Runtime / omission
Unset; the broker uses its configured default.
connectionCreationThrottleMax
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
consumerGroupHeartbeatInterval
string | null
Optional
- Example
-
"5000ms" - Default Runtime / omission
Unset; the broker uses its configured default.
consumerGroupMaxHeartbeatInterval
string | null
Optional
- Example
-
"15000ms" - Default Runtime / omission
Unset; the broker uses its configured default.
consumerGroupMaxSessionTimeout
string | null
Optional
- Example
-
"60000ms" - Default Runtime / omission
Unset; the broker uses its configured default.
consumerGroupMaxSize
integer | null (uint)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
consumerGroupMinHeartbeatInterval
string | null
Optional
- Example
-
"5000ms" - Default Runtime / omission
Unset; the broker uses its configured default.
consumerGroupMinSessionTimeout
string | null
Optional
- Example
-
"45000ms" - Default Runtime / omission
Unset; the broker uses its configured default.
consumerGroupSessionTimeout
string | null
Optional
- Example
-
"45000ms" - Default Runtime / omission
Unset; the broker uses its configured default.
controlledShutdownDrainTimeout
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
controllerElectionTimeout
string | null
Optional
- Example
-
"5000ms" - Default Runtime / omission
Unset; the broker uses its configured default.
controllerFetchMissLimit
integer | null (uint32)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
controllerHeartbeatInterval
string | null
Optional
- Example
-
"500ms" - Default Runtime / omission
Unset; the broker uses its configured default.
coordinatorActorMailboxCapacity
integer | null (uint)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
coordinatorSessionExpiryTick
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
coordinatorShutdownAckTimeout
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
defaultMinInsyncReplicas
integer | null (int32)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
delegationTokenDefaultRenewPeriod
string | null
Optional
- Example
-
"86400000ms" - Default Runtime / omission
Unset; the broker uses its configured default.
delegationTokenExpiryCheckInterval
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
delegationTokenMaxLifetime
string | null
Optional
- Example
-
"604800000ms" - Default Runtime / omission
Unset; the broker uses its configured default.
disklessWalFlushInterval
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
disklessWalFlushMaxSize
string | null
Optional
- Example
-
"1MiB" - Default Runtime / omission
Unset; the broker uses its configured default.
disklessWalIndexProjectionTimeout
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
disklessWalLocalReplicaCount
integer | null (uint)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
disklessWalTrimSafetyLag
integer | null (int64)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
0
futureLogMoveReadChunk
string | null
Optional
- Example
-
"1MiB" - Default Runtime / omission
Unset; the broker uses its configured default.
futureLogMoveRetryBackoff
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
gaugePollInterval
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
heartbeatInterval
string | null
Optional
- Example
-
"3000ms" - Default Runtime / omission
Unset; the broker uses its configured default.
heartbeatTimeout
string | null
Optional
- Example
-
"9000ms" - Default Runtime / omission
Unset; the broker uses its configured default.
interBrokerServerName
string | null
Optional
- Example
-
"my-cluster.kafka.svc.cluster.local" - Default Runtime / omission
Unset; the broker uses its configured default.
Validation and schema details
- Minimum length
1
isrScanInterval
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
leaderImbalanceCheckInterval
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
leaderImbalancePerBroker
string | null
Optional
- Example
-
"50%" - Default Runtime / omission
Unset; the broker uses its configured default.
livenessTickInterval
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
logReadBufferCap
string | null
Optional
- Example
-
"1MiB" - Default Runtime / omission
Unset; the broker uses its configured default.
logTimestampScanWindow
string | null
Optional
- Example
-
"1MiB" - Default Runtime / omission
Unset; the broker uses its configured default.
maxConnections
integer | null (uint)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
0
maxConnectionsPerIp
integer | null (uint)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
0
maxIncrementalFetchSessionCacheSlots
integer | null (uint)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
0
maxProduceGroup
integer | null (uint)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
metadataMaxBetweenSnapshots
string | null
Optional
- Example
-
"1MiB" - Default Runtime / omission
Unset; the broker uses its configured default.
metadataMaxSnapshotInterval
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
metadataRaftCommandQueueCapacity
integer | null (uint)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
metadataRaftFetchMax
string | null
Optional
- Example
-
"1MiB" - Default Runtime / omission
Unset; the broker uses its configured default.
metadataSnapshotFetchMax
string | null
Optional
- Example
-
"1MiB" - Default Runtime / omission
Unset; the broker uses its configured default.
metadataSnapshotIntervalRecords
integer | null (uint64)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
oauthJwksHttpTimeout
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
observerFetchMax
string | null
Optional
- Example
-
"1MiB" - Default Runtime / omission
Unset; the broker uses its configured default.
observerLagBound
integer | null (uint64)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
0
observerPollInterval
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
offsetsTopicMetadataWaitTimeout
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
opaHttpTimeout
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
operatorRecoveryDeadline
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
partitionDiskScanInterval
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
partitionWriterQueueDepth
integer | null (uint)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
producerIdExpiration
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
producerIdExpirationScanInterval
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
quotaThrottleMax
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
recordDecompressionMaxRatio
string | null
Optional
- Example
-
"50%" - Default Runtime / omission
Unset; the broker uses its configured default.
recordDecompressionOutputCeiling
string | null
Optional
- Example
-
"1GiB" - Default Runtime / omission
Unset; the broker uses its configured default.
recordDecompressionOutputFloor
string | null
Optional
- Example
-
"1MiB" - Default Runtime / omission
Unset; the broker uses its configured default.
remoteLogManagerInterval
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
replicaLagTimeMax
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
replicationEpochFenceBackoff
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
replicationFetchMax
string | null
Optional
- Example
-
"1048576B" - Default Runtime / omission
Unset; the broker uses its configured default.
replicationFetchMaxWait
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
replicationFetchMin
string | null
Optional
- Example
-
"1B" - Default Runtime / omission
Unset; the broker uses its configured default.
replicationReconnectDelayCap
string | null
Optional
- Example
-
"5000ms" - Default Runtime / omission
Unset; the broker uses its configured default.
replicationReconnectInitialDelay
string | null
Optional
- Example
-
"100ms" - Default Runtime / omission
Unset; the broker uses its configured default.
replicationSendErrorBackoff
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
replicationThrottleExhaustedBackoff
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
replicationUnexpectedErrorBackoff
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
replicationUnknownTopicRetryDelay
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
rlmmBootstrapBackoffInitial
string | null
Optional
- Example
-
"250ms" - Default Runtime / omission
Unset; the broker uses its configured default.
rlmmBootstrapBackoffMax
string | null
Optional
- Example
-
"10000ms" - Default Runtime / omission
Unset; the broker uses its configured default.
rlmmReconcileTick
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
selfRegistrationBackoffMax
string | null
Optional
- Example
-
"5000ms" - Default Runtime / omission
Unset; the broker uses its configured default.
selfRegistrationBackoffMin
string | null
Optional
- Example
-
"100ms" - Default Runtime / omission
Unset; the broker uses its configured default.
selfRegistrationMaxAttempts
integer | null (uint32)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
sendfileMin
string | null
Optional
- Example
-
"1MiB" - Default Runtime / omission
Unset; the broker uses its configured default.
shareGroupEnable
boolean | null
Optional
- Example
-
true - Default No schema default
- Not declared
shareGroupHeartbeatInterval
string | null
Optional
- Example
-
"5s" - Default Runtime / omission
Unset; the broker uses its configured default.
shareGroupIsolationLevel
string | null
Optional
- Example
-
"read-committed" - Default Runtime / omission
Unset; the broker uses its configured default.
shareGroupMaxDeliveryAttempts
integer | null (int16)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Maximum
32767
- Minimum
1
shareGroupMaxInflightRecords
integer | null (int32)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
shareGroupMaxSize
integer | null (uint)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
shareGroupRecordLockDuration
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
shareGroupSessionTimeout
string | null
Optional
- Example
-
"45s" - Default Runtime / omission
Unset; the broker uses its configured default.
shareRecoveryReadMax
string | null
Optional
- Example
-
"1MiB" - Default Runtime / omission
Unset; the broker uses its configured default.
shareSessionCacheMaxWhenUnlimited
integer | null (uint)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
shareStateNumPartitions
integer | null (int32)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
shareStateReplicationFactor
integer | null (int16)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Maximum
32767
- Minimum
1
socketReceiveBuffer
string | null
Optional
- Example
-
"1MiB" - Default Runtime / omission
Unset; the broker uses its configured default.
socketRequestMax
string | null
Optional
- Example
-
"1MiB" - Default Runtime / omission
Unset; the broker uses its configured default.
socketSendBuffer
string | null
Optional
- Example
-
"1MiB" - Default Runtime / omission
Unset; the broker uses its configured default.
startupLeaderWaitTimeout
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
streamsGroupAcceptableRecoveryLag
integer | null (int64)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
0
streamsGroupAssignor
string | null
Optional
- Example
-
"auto" - Default Runtime / omission
Unset; the broker uses its configured default.
streamsGroupEnable
boolean | null
Optional
- Example
-
true - Default No schema default
- Not declared
streamsGroupHeartbeatInterval
string | null
Optional
- Example
-
"5s" - Default Runtime / omission
Unset; the broker uses its configured default.
streamsGroupMaxSize
integer | null (uint)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
streamsGroupNumStandbyReplicas
integer | null (int32)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
0
streamsGroupNumWarmupReplicas
integer | null (int32)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
0
streamsGroupSessionTimeout
string | null
Optional
- Example
-
"45s" - Default Runtime / omission
Unset; the broker uses its configured default.
streamsGroupTaskOffsetInterval
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
streamsInternalTopicReplicationFactor
integer | null (int16)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Maximum
32767
- Minimum
1
syncGroupFollowerWait
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
telemetryDecompressedOutputCeiling
string | null
Optional
- Example
-
"1073741824B" - Default Runtime / omission
Unset; the broker uses its configured default.
telemetryDecompressedOutputFloor
string | null
Optional
- Example
-
"16777216B" - Default Runtime / omission
Unset; the broker uses its configured default.
telemetryMaxDecompressionRatio
string | null
Optional
- Example
-
"50%" - Default Runtime / omission
Unset; the broker uses its configured default.
tlsReloadInterval
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
transactionMaxTimeout
string | null
Optional
- Example
-
"900000ms" - Default Runtime / omission
Unset; the broker uses its configured default.
transactionMinTimeout
string | null
Optional
- Example
-
"1000ms" - Default Runtime / omission
Unset; the broker uses its configured default.
transactionRecoveryReadMax
string | null
Optional
- Example
-
"1MiB" - Default Runtime / omission
Unset; the broker uses its configured default.
transactionStateNumPartitions
integer | null (int32)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
transactionStateReplicationFactor
integer | null (int16)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Maximum
32767
- Minimum
1
txnAbortCleanupInterval
string | null
Optional
- Example
-
"1s" - Default Runtime / omission
Unset; the broker uses its configured default.
uncleanRecoveryAggressiveDeadline
string | null
Optional
- Example
-
"2000ms" - Default Runtime / omission
Unset; the broker uses its configured default.
uncleanRecoveryBalancedDeadline
string | null
Optional
- Example
-
"30000ms" - Default Runtime / omission
Unset; the broker uses its configured default.
uncleanRecoveryQueueCapacity
integer | null (uint)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
clientsCa
object | null
Optional
3 fields
Per-cluster CA that signs KafkaUser TLS certs. When absent, the operator uses a fully-defaulted CertificateAuthority.
- Example
-
View JSON example
{ "generateCertificateAuthority": true, "validityDays": 365, "renewalDays": 30 } - Default Runtime / omission
Generate the CA, with 365 days of validity and a 30-day renewal window.
generateCertificateAuthority
boolean
Optional
When true, which is the default, the operator generates and renews this CA. When false, the cluster admin must create the CA Secret pair first, and the operator refuses to overwrite them. The admin renews a BYO CA. The CronJob skips a BYO CA and emits an Event when the CA comes near its expiry.
- Example
-
true - Default Schema default
true
renewalDays
integer (uint32)
Optional
Window in days before notAfter in which the renewal CronJob reissues the leaf certs. Default 30.
- Example
-
30 - Default Schema default
30
Validation and schema details
- Minimum
0
validityDays
integer (uint32)
Optional
Cert validity in days. Default 365.
- Example
-
365 - Default Schema default
365
Validation and schema details
- Minimum
0
clusterCa
object | null
Optional
3 fields
Per-cluster CA for inter-broker mTLS and broker certs. When absent, the operator uses a fully-defaulted CertificateAuthority, which it generates itself with 365/30 days.
- Example
-
View JSON example
{ "generateCertificateAuthority": true, "validityDays": 365, "renewalDays": 30 } - Default Runtime / omission
Generate the CA, with 365 days of validity and a 30-day renewal window.
generateCertificateAuthority
boolean
Optional
When true, which is the default, the operator generates and renews this CA. When false, the cluster admin must create the CA Secret pair first, and the operator refuses to overwrite them. The admin renews a BYO CA. The CronJob skips a BYO CA and emits an Event when the CA comes near its expiry.
- Example
-
true - Default Schema default
true
renewalDays
integer (uint32)
Optional
Window in days before notAfter in which the renewal CronJob reissues the leaf certs. Default 30.
- Example
-
30 - Default Schema default
30
Validation and schema details
- Minimum
0
validityDays
integer (uint32)
Optional
Cert validity in days. Default 365.
- Example
-
365 - Default Schema default
365
Validation and schema details
- Minimum
0
config
object | null
Optional
1 field
Opaque broker properties, in server.properties-style key and value pairs. The operator passes them through to the broker's [server_properties] TOML table, and the broker treats them as inert today. Changes propagate through the config hash.
- Example
-
View JSON example
{ "log.retention.ms": "604800000" } - Default No schema default
- Not declared
Validation and schema details
- Additional properties
{ "type": "string" }
{key}
string
Map value
- Example
-
"604800000" - Default No independent default
- Defined by the parent
delegationToken
object | null
Optional
1 field
Delegation-token master HMAC key source. When None, the broker rejects all KIP-48 delegation-token RPCs with err 61 DELEGATION_TOKEN_AUTH_DISABLED. When Some, the operator injects KRABKA_DELEGATION_TOKEN_SECRET_KEY into each broker pod through a valueFrom.secretKeyRef. The key is then part of the rendered StatefulSet, so the SSA reconcile does not race with out-of-band kubectl set env patches.
- Example
-
View JSON example
{ "secretKeyRef": { "name": "delegation-token-key", "key": "secret-key" } } - Default Runtime / omission
Disabled when omitted. Delegation-token RPCs return DELEGATION_TOKEN_AUTH_DISABLED (61).
secretKeyRef
object
Required
2 fields
Reference to a Kubernetes Secret in the same namespace as the Kafka CR. Its data.<key> value is the broker's master HMAC key for KIP-48 delegation tokens.
- Example
-
View JSON example
{ "name": "delegation-token-key" } - Default No schema default
- Not declared
interBrokerKerberos
object | null
Optional
3 fields
Inter-broker Kerberos initiate config. It is required when interBrokerListenerName resolves to a type: gssapi listener. It supplies the shared client principal and the KDC. The keytab comes from that listener's keytabSecretRef.
- Example
-
View JSON example
{ "clientPrincipal": "kafka@EXAMPLE.COM", "kdcUrl": "tcp://kdc:88" } - Default No schema default
- Not declared
clientPrincipal
string
Required
Principal that every broker authenticates as when it dials peers, for example kafka@EXAMPLE.COM. It must exist in the shared keytab.
- Example
-
"kafka@EXAMPLE.COM" - Default No schema default
- Not declared
kdcUrl
string
Required
KDC endpoint, for example tcp://kdc:88.
- Example
-
"tcp://kdc:88" - Default No schema default
- Not declared
serviceName
string | null
Optional
Target SPN primary. Defaults to kafka.
- Example
-
"kafka" - Default Runtime / omission
kafka when omitted.
interBrokerListenerName
string | null
Optional
Name of the listener for inter-broker traffic. When None, the operator picks the first internal listener. When listeners is empty, the operator picks the synthesized default "PLAIN".
- Example
-
"plain" - Default Runtime / omission
Use the first internal listener. If listeners is empty, use the generated PLAIN listener.
kafkaVersion
string
Required
Krabka version label. The operator propagates it to all pool pods through the app.kubernetes.io/version label.
- Example
-
"4.0.0" - Default No schema default
- Not declared
krb5ConfSecretRef
object | null
Optional
2 fields
Optional process-wide krb5.conf. The operator mounts it into the broker pods and points KRB5_CONFIG at it. It serves both the accept path and the initiate path.
- Example
-
View JSON example
{ "key": "krb5.conf", "secretName": "kerberos-config" } - Default No schema default
- Not declared
listeners
array
Optional
1 field
Named listeners. An empty or absent list synthesizes one internal PLAIN listener on port 9092.
- Example
-
View JSON example
[ { "name": "plain", "port": 9092, "type": "internal", "tls": false } ] - Default Runtime / omission
Absent or empty: create an internal PLAIN listener on port 9092.
[]
object
Array item
7 fields
- Example
-
View JSON example
{ "name": "plain", "port": 9092, "type": "internal", "tls": false } - Default No independent default
- Defined by the parent
authentication
object | null
Optional
31 fields
Per-listener authentication mechanism. Absent means anonymous, and no client identity is required. When the field is type: tls, the listener must also have tls: true. The reconcile enforces this rule.
- Example
-
View JSON example
{ "type": "scram-sha-512" } - Default Runtime / omission
Anonymous access when omitted. No client identity is required.
accessTokenIsJwt
boolean
Optional
- Example
-
true - Default Runtime / omission
true for OAuth authentication. Validate signed JWTs against jwksEndpointUri.
clientId
string
Optional
- Example
-
"kafka-broker" - Default No schema default
- Not declared
Validation and schema details
- Minimum length
1
clientSecret
object
Optional
2 fields
- Example
-
View JSON example
{ "secretName": "oauth-client", "key": "client-secret" } - Default No schema default
- Not declared
customClaimCheck
string
Optional
- Example
-
"$.scope[?@ == 'kafka.write']" - Default No schema default
- Not declared
Validation and schema details
- Minimum length
1
enableOauthBearer
boolean
Optional
- Example
-
true - Default Runtime / omission
true for OAuth authentication. Advertise the OAUTHBEARER SASL mechanism.
fallbackUserNameClaim
string
Optional
- Example
-
"client_id" - Default No schema default
- Not declared
Validation and schema details
- Minimum length
1
fallbackUserNamePrefix
string
Optional
- Example
-
"service-account-" - Default No schema default
- Not declared
Validation and schema details
- Minimum length
1
groupsClaim
string
Optional
- Example
-
"$.realm_access.roles[*]" - Default No schema default
- Not declared
Validation and schema details
- Minimum length
1
groupsClaimDelimiter
string
Optional
- Example
-
"," - Default No schema default
- Not declared
Validation and schema details
- Minimum length
1
introspectionEndpointUri
string
Optional
- Example
-
"https://identity.example.com/realms/kafka/protocol/openid-connect/token/introspect" - Default No schema default
- Not declared
Validation and schema details
- Minimum length
1
introspectionHttpTimeoutSeconds
integer
Optional
- Example
-
10 - Default Runtime / omission
10 seconds for OAuth token introspection when omitted.
Validation and schema details
- Minimum
1
jwksEndpointUri
string
Optional
- Example
-
"https://identity.example.com/realms/kafka/protocol/openid-connect/certs" - Default No schema default
- Not declared
Validation and schema details
- Minimum length
1
jwksExpirySeconds
integer (int32)
Optional
- Example
-
360 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
jwksIgnoreKeyUse
boolean
Optional
- Example
-
false - Default Runtime / omission
false for JWT authentication. Keep signing keys with use=sig.
jwksMinRefreshPauseSeconds
integer (int32)
Optional
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
0
jwksRefreshSeconds
integer
Optional
- Example
-
300 - Default No schema default
- Not declared
Validation and schema details
- Minimum
0
kdc
string
Optional
- Example
-
"tcp://kdc:88" - Default Runtime / omission
Use krb5.conf discovery when omitted.
Validation and schema details
- Minimum length
1
keytabSecretRef
object
Optional
2 fields
- Example
-
View JSON example
{ "secretName": "kafka-keytab", "key": "kafka.keytab" } - Default No schema default
- Not declared
maxClockSkewSeconds
integer
Optional
- Example
-
30 - Default No schema default
- Not declared
Validation and schema details
- Minimum
0
maxSecondsWithoutReauthentication
integer (int32)
Optional
- Example
-
3600 - Default Runtime / omission
Unset: the session lasts until the token's natural expiry.
Validation and schema details
- Minimum
1
maxTimeSkew
string
Optional
- Example
-
"5m" - Default No schema default
- Not declared
Validation and schema details
- Minimum length
1
principalToLocalRules
array
Optional
1 field
- Example
-
View JSON example
[ "DEFAULT" ]
- Default Runtime / omission
[] when omitted; no explicit principal mapping rules.
[]
string
Array item
- Example
-
"DEFAULT" - Default No independent default
- Defined by the parent
Validation and schema details
- Minimum length
1
realm
string
Optional
- Example
-
"EXAMPLE.COM" - Default No schema default
- Not declared
Validation and schema details
- Minimum length
1
serviceName
string
Optional
- Example
-
"kafka" - Default Runtime / omission
kafka for GSSAPI authentication when omitted.
Validation and schema details
- Minimum length
1
tlsTrustedCertificates
array
Optional
1 field
- Example
-
View JSON example
[ { "secretName": "identity-ca", "certificate": "ca.crt" } ] - Default Runtime / omission
[] for OAuth authentication. Create no trust-bundle Secret or mount.
[]
object
Array item
2 fields
- Example
-
View JSON example
{ "secretName": "identity-ca", "certificate": "ca.crt" } - Default No independent default
- Defined by the parent
type
string
Required
- Example
-
"tls" - Default No schema default
- Not declared
"tls""scram-sha-512""scram-sha-256""oauth""gssapi"
userInfoEndpointUri
string
Optional
- Example
-
"https://identity.example.com/realms/kafka/protocol/openid-connect/userinfo" - Default No schema default
- Not declared
Validation and schema details
- Minimum length
1
userNameClaim
string
Optional
- Example
-
"preferred_username" - Default Runtime / omission
sub for OAuth authentication when omitted.
validAudience
string
Optional
- Example
-
"kafka" - Default Runtime / omission
No audience check when omitted.
validIssuerUri
string
Optional
- Example
-
"https://identity.example.com/realms/kafka" - Default No schema default
- Not declared
Validation and schema details
- Minimum length
1
validTokenType
string
Optional
- Example
-
"Bearer" - Default No schema default
- Not declared
Validation and schema details
- Minimum length
1
configuration
object | null
Optional
3 fields
Optional listener-type-specific configuration.
- Example
-
View JSON example
{ "bootstrap": { "annotations": { "example": "example-value" } } } - Default No schema default
- Not declared
bootstrap
object | null
Optional
5 fields
- Example
-
View JSON example
{ "annotations": { "example": "example-value" } } - Default No schema default
- Not declared
annotations
object
Optional
1 field
Annotations to add to the bootstrap Service.
- Example
-
View JSON example
{ "example": "example-value" } - Default No schema default
- Not declared
Validation and schema details
- Additional properties
{ "type": "string" }
{key}
string
Map value
- Example
-
"example-value" - Default No independent default
- Defined by the parent
host
string | null
Optional
ingress / route only: bootstrap hostname.
- Example
-
"kafka.example.com" - Default No schema default
- Not declared
labels
object
Optional
1 field
Labels to add to the bootstrap Service.
- Example
-
View JSON example
{ "example": "kafka" } - Default No schema default
- Not declared
Validation and schema details
- Additional properties
{ "type": "string" }
{key}
string
Map value
- Example
-
"kafka" - Default No independent default
- Defined by the parent
loadBalancerIP
string | null
Optional
loadbalancer only: pin the bootstrap LB IP.
- Example
-
"192.0.2.10" - Default No schema default
- Not declared
nodePort
integer | null (int32)
Optional
nodeport only: pin the bootstrap NodePort.
- Example
-
32092 - Default No schema default
- Not declared
brokers
array
Optional
1 field
- Example
-
View JSON example
[ { "broker": 1 } ] - Default No schema default
- Not declared
[]
object
Array item
6 fields
- Example
-
View JSON example
{ "broker": 1 } - Default No independent default
- Defined by the parent
advertisedHost
string | null
Optional
Override the computed advertised host.
- Example
-
"broker-0.kafka.example.com" - Default No schema default
- Not declared
advertisedPort
integer | null (int32)
Optional
Override the computed advertised port.
- Example
-
9092 - Default No schema default
- Not declared
broker
integer (int32)
Required
Broker id this override applies to (matches the node id).
- Example
-
1 - Default No schema default
- Not declared
host
string | null
Optional
ingress / route only: per-broker hostname.
- Example
-
"broker-0.kafka.example.com" - Default No schema default
- Not declared
loadBalancerIP
string | null
Optional
loadbalancer only: pin this broker's Service.spec.loadBalancerIP.
- Example
-
"192.0.2.11" - Default No schema default
- Not declared
nodePort
integer | null (int32)
Optional
nodeport only: pin this broker's Service.spec.ports[0].nodePort.
- Example
-
32093 - Default No schema default
- Not declared
class
string | null
Optional
ingress only: the spec.ingressClassName that the operator sets on every generated Ingress. This is the Strimzi-shaped configuration.class. It is inert for other listener types.
- Example
-
"nginx" - Default No schema default
- Not declared
name
string
Required
Unique within the cluster. Alphanumeric characters and -, ≤25 chars. It is the Kafka listener name, and it appears in bootstrap.servers-style URLs.
- Example
-
"plain" - Default No schema default
- Not declared
networkPolicyPeers
array | null
Optional
1 field
Per-listener peer allow-list. It is tri-state:
Nonegives no per-listener restriction, that is, allow-all on this port.Some(vec![])gives deny-all on this listener port. The operator emits no per-listener rule, and the default-deny applies.Some(non_empty)lets only the listed peers reach this port.
The operator reads this field only when Kafka.spec.networkPolicy is set. In any other case the field is inert. The operator auto-allow rule still fires on this port for deny-all listeners, so that the operator can manage the cluster.
- Example
-
View JSON example
[ { "podSelector": { "matchLabels": { "app": "kafka-client" } } } ] - Default Runtime / omission
No per-listener restriction when omitted. [] denies clients on this port; the operator's automatic allow rule still applies. Used only when networkPolicy is set.
[]
object
Array item
2 fields
Subset of networking.k8s.io/v1.NetworkPolicyPeer.
This struct omits ipBlock on purpose. Someone can add it later if external CIDR allow-lists become a real need.
- Example
-
View JSON example
{ "namespaceSelector": { "matchExpressions": [ { "key": "app", "operator": "In" } ] } } - Default No independent default
- Defined by the parent
namespaceSelector
object | null
Optional
2 fields
A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.
- Example
-
View JSON example
{ "matchExpressions": [ { "key": "app", "operator": "In" } ] } - Default No schema default
- Not declared
matchExpressions
array
Optional
1 field
matchExpressions is a list of label selector requirements. The requirements are ANDed.
- Example
-
View JSON example
[ { "key": "app", "operator": "In" } ] - Default No schema default
- Not declared
[]
object
Array item
3 fields
A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
- Example
-
View JSON example
{ "key": "app", "operator": "In" } - Default No independent default
- Defined by the parent
key
string
Required
key is the label key that the selector applies to.
- Example
-
"app" - Default No schema default
- Not declared
operator
string
Required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
- Example
-
"In" - Default No schema default
- Not declared
values
array
Optional
1 field
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
- Example
-
View JSON example
[ "kafka" ]
- Default No schema default
- Not declared
[]
string
Array item
- Example
-
"kafka" - Default No independent default
- Defined by the parent
matchLabels
object
Optional
1 field
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
- Example
-
View JSON example
{ "example": "kafka" } - Default No schema default
- Not declared
Validation and schema details
- Additional properties
{ "type": "string" }
{key}
string
Map value
- Example
-
"kafka" - Default No independent default
- Defined by the parent
podSelector
object | null
Optional
2 fields
A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.
- Example
-
View JSON example
{ "matchExpressions": [ { "key": "app", "operator": "In" } ] } - Default No schema default
- Not declared
matchExpressions
array
Optional
1 field
matchExpressions is a list of label selector requirements. The requirements are ANDed.
- Example
-
View JSON example
[ { "key": "app", "operator": "In" } ] - Default No schema default
- Not declared
[]
object
Array item
3 fields
A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
- Example
-
View JSON example
{ "key": "app", "operator": "In" } - Default No independent default
- Defined by the parent
key
string
Required
key is the label key that the selector applies to.
- Example
-
"app" - Default No schema default
- Not declared
operator
string
Required
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
- Example
-
"In" - Default No schema default
- Not declared
values
array
Optional
1 field
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
- Example
-
View JSON example
[ "kafka" ]
- Default No schema default
- Not declared
[]
string
Array item
- Example
-
"kafka" - Default No independent default
- Defined by the parent
matchLabels
object
Optional
1 field
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
- Example
-
View JSON example
{ "example": "kafka" } - Default No schema default
- Not declared
Validation and schema details
- Additional properties
{ "type": "string" }
{key}
string
Map value
- Example
-
"kafka" - Default No independent default
- Defined by the parent
port
integer (int32)
Required
Container port the broker binds. Unique within the cluster.
- Example
-
9092 - Default No schema default
- Not declared
tls
boolean
Optional
Transport-level TLS. When true, the listener uses the per-broker keystore that the cluster CA signed, and clients must use TLS to connect. This field is independent of authentication. A tls: true listener with no authentication is anonymous over TLS.
- Example
-
false - Default Schema default
false
type
string
Required
Listener type. internal is in-cluster. nodeport and loadbalancer create external Services. The schema accepts ingress and route, but the reconcile rejects them.
- Example
-
"internal" - Default No schema default
- Not declared
"internal""nodeport""loadbalancer""ingress""route"
logging
object | null
Optional
3 fields
Broker log configuration. When None, the brokers use their built-in default RUST_LOG filter. When Some, the operator composes an inline tracing env-filter string, or reads an external one. The operator then renders it into the broker ConfigMap under the rust.log key, wires it into the RUST_LOG env of each broker pod, and rolls the cluster on a change through the config hash.
- Example
-
View JSON example
{ "type": "inline", "loggers": { "root": "info", "krabka_broker": "debug" } } - Default Runtime / omission
Use the broker's built-in RUST_LOG filter when omitted.
loggers
object
Optional
1 field
Inline loggers, from tracing target to level. The key root is case-insensitive and sets the global default level as a bare env-filter directive. Any other key is a tracing target, that is, a Rust module path such as krabka_broker. The levels are trace|debug|info|warn|error|off, and they are case-insensitive. fatal is accepted as an alias for error.
- Example
-
View JSON example
{ "root": "info", "krabka_broker": "debug" } - Default Runtime / omission
{} when omitted; no inline logger overrides.
Validation and schema details
- Additional properties
{ "type": "string" }
{key}
string
Map value
- Example
-
"info" - Default No independent default
- Defined by the parent
type
string
Optional
- Example
-
"inline" - Default Schema default
"inline"
"inline""external"
valueFrom
object | null
Optional
1 field
External logging source. This field is required when type: external. The operator uses the value of the referenced ConfigMap key verbatim as the broker's RUST_LOG filter.
- Example
-
View JSON example
{ "configMapKeyRef": { "name": "broker-logging", "key": "rust.log" } } - Default No schema default
- Not declared
configMapKeyRef
object
Required
2 fields
- Example
-
View JSON example
{ "key": "rust.log", "name": "broker-logging" } - Default No schema default
- Not declared
metadataVersion
string | null
Optional
KRaft metadata version, the runtime analog of inter.broker.protocol.version. When unset, it tracks the major.minor of kafkaVersion. When set, it pins the metadata version for a two-step upgrade or an online downgrade. The operator validates it against kafkaVersion; changes on an existing cluster are finalized through UpdateFeatures, with safe-downgrade semantics for a lower target. Rejections surface KafkaVersionValid=False and leave status.metadataVersion unchanged.
- Example
-
"4.0" - Default Runtime / omission
Use the major.minor version from kafkaVersion when omitted.
metricsConfig
object | null
Optional
3 fields
Prometheus scrape configuration. When None, the brokers do not bind /metrics, and the operator renders no PodMonitor and no ServiceMonitor. When Some, the broker StatefulSet gains a metrics container port on TCP 9404, and the operator SSA-applies the resources that pod_monitor and service_monitor request.
- Example
-
View JSON example
{ "type": "prometheus", "podMonitor": {} } - Default Runtime / omission
Disabled when omitted: no metrics listener, PodMonitor, or ServiceMonitor.
podMonitor
object | null
Optional
3 fields
- Example
-
View JSON example
{ "interval": "30s" } - Default No schema default
- Not declared
interval
string | null
Optional
- Example
-
"30s" - Default No schema default
- Not declared
labels
object
Optional
1 field
- Example
-
View JSON example
{ "example": "kafka" } - Default No schema default
- Not declared
Validation and schema details
- Additional properties
{ "type": "string" }
{key}
string
Map value
- Example
-
"kafka" - Default No independent default
- Defined by the parent
scrapeTimeout
string | null
Optional
- Example
-
"10s" - Default No schema default
- Not declared
serviceMonitor
object | null
Optional
3 fields
- Example
-
View JSON example
{ "interval": "30s" } - Default No schema default
- Not declared
interval
string | null
Optional
- Example
-
"30s" - Default No schema default
- Not declared
labels
object
Optional
1 field
- Example
-
View JSON example
{ "example": "kafka" } - Default No schema default
- Not declared
Validation and schema details
- Additional properties
{ "type": "string" }
{key}
string
Map value
- Example
-
"kafka" - Default No independent default
- Defined by the parent
scrapeTimeout
string | null
Optional
- Example
-
"10s" - Default No schema default
- Not declared
type
string
Optional
- Example
-
"prometheus" - Default Schema default
"prometheus"
"prometheus"
networkPolicy
object | null
Optional
Opt-in NetworkPolicy generation. When None, the operator generates no NetworkPolicy. When Some, even {}, the operator renders a cluster-level NetworkPolicy that gates ingress to the broker and controller pods.
- Example
-
View JSON example
{} - Default Runtime / omission
Create no NetworkPolicy when omitted. {} enables policy generation.
tieredStorage
object | null
Optional
5 fields
KIP-405: cluster-wide tiered storage. When Some, every broker pod boots with the local-tier RSM enabled, with an emptyDir mounted at /var/lib/krabka/remote, which is the broker's remote_log_storage_dir, and with [remote_storage] rendered in the broker TOML. The per-topic enablement does not change. It stays KafkaTopic.spec.config["remote.storage.enable"] = "true".
With the emptyDir default and InmemoryRemoteLogMetadataManager as the only RLMM, tier data does not survive pod restarts. PVC support pairs with the production RLMM.
- Example
-
View JSON example
{ "type": "Local" } - Default Runtime / omission
Absent: the operator renders no tiered-storage configuration. Set type and backend settings to enable it.
gcs
object | null
Optional
7 fields
GCS-backend tuning. It is required when kind == Gcs, and it must be absent in any other case. The struct has the same shape as krabka_remote_storage::GcsConfig. The operator renders the non-credential fields verbatim into the broker TOML's [remote_storage.gcs] block. S3 uses env-var credentials, but GCS does not. The operator mounts an explicit service-account JSON key as a FILE on the broker pod and gives it to the broker as service_account_path in the TOML. Unset credentials select keyless Workload Identity or ADC.
- Example
-
View JSON example
{ "bucket": "kafka-tiered-data" } - Default No schema default
- Not declared
allowHttp
boolean
Optional
Allow plaintext HTTP. It is off by default. Turn it on for GCS emulators that run without TLS. Real GCS never needs it.
- Example
-
false - Default Runtime / omission
false: require HTTPS. Set true for a GCS emulator without TLS.
bucket
string
Required
GCS bucket name. Required.
- Example
-
"kafka-tiered-data" - Default No schema default
- Not declared
credentials
object | null
Optional
1 field
Optional explicit service-account credentials. When None, the broker uses Workload Identity or ADC, which is the keyless GKE path.
- Example
-
View JSON example
{ "serviceAccountKey": { "name": "gcs-credentials", "key": "service-account.json" } } - Default Runtime / omission
Use Workload Identity or Application Default Credentials when omitted.
serviceAccountKey
object
Required
2 fields
Reference to the Secret holding the service-account JSON key.
- Example
-
View JSON example
{ "name": "gcs-credentials" } - Default No schema default
- Not declared
key
string | null
Optional
Key within the Secret's data. Defaults to secret-key.
- Example
-
"service-account.json" - Default Runtime / omission
secret-key when omitted.
name
string
Required
Secret name in the same namespace as the Kafka CR.
- Example
-
"gcs-credentials" - Default No schema default
- Not declared
endpoint
string | null
Optional
Optional custom GCS API base URL, for example for emulators and fakes. When None, the broker uses the standard Google Cloud Storage endpoint.
- Example
-
"http://gcs-emulator:4443" - Default Runtime / omission
Use the standard Google Cloud Storage endpoint when omitted.
multipartChunkSize
integer | null (uint64)
Optional
Override the per-part size for multipart uploads in bytes. When unset, the broker uses krabka_remote_storage::DEFAULT_MULTIPART_CHUNK_SIZE, which is 16 MiB.
- Example
-
16777216 - Default Runtime / omission
16 MiB (16777216 bytes) when omitted.
Validation and schema details
- Minimum
0
multipartThreshold
integer | null (uint64)
Optional
Override the single-PUT and multipart cutoff in bytes. When unset, the broker uses krabka_remote_storage::DEFAULT_MULTIPART_THRESHOLD, which is 100 MiB. Lower it in tests to exercise the multipart path on small fixtures.
- Example
-
104857600 - Default Runtime / omission
100 MiB (104857600 bytes) when omitted.
Validation and schema details
- Minimum
0
prefix
string | null
Optional
Optional key prefix inside the bucket. It lets more than one Krabka cluster share a bucket without a collision.
- Example
-
"my-cluster/" - Default No schema default
- Not declared
metadataManager
object | null
Optional
2 fields
KIP-405: pick the RemoteLogMetadataManager that the broker pods run. When the field is absent, or when it is type: Topic, the broker activates the durable krabka_remote_storage_topic::TopicBasedRemoteLogMetadataManager against the internal __remote_log_metadata topic. Tier-segment metadata then survives pod restarts and is consistent across the brokers in the cluster. Only an explicit type: InMemory selects the in-memory fixture, which is for test and dev only.
- Example
-
View JSON example
{ "type": "Topic" } - Default Runtime / omission
Use the topic-backed metadata manager (type Topic) when omitted.
topic
object | null
Optional
9 fields
Topic-backed tuning. It is optional when kind == Topic, and the broker fills the defaults for the bootstrap and topic parameters. It must be absent in any other case.
- Example
-
View JSON example
{ "bootstrap": "127.0.0.1:9094" } - Default Runtime / omission
For type Topic, use the broker's bootstrap and topic defaults when omitted.
bootstrap
string
Required
host:port that the broker pod dials to reach its own listener, so that it can publish and consume __remote_log_metadata. This is usually the pod's loopback inter-broker listener, for example 127.0.0.1:9094.
- Example
-
"127.0.0.1:9094" - Default No schema default
- Not declared
eventQueueCapacity
integer | null (uint)
Optional
Capacity of the shared metadata-event delivery queue.
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
1
fetchMaxBytes
string | null
Optional
Maximum bytes returned by each per-partition metadata fetch.
- Example
-
"1MiB" - Default No schema default
- Not declared
fetchMaxWait
string | null
Optional
Maximum wait for each per-partition metadata fetch.
- Example
-
"500ms" - Default No schema default
- Not declared
fetchRetryBackoff
string | null
Optional
Backoff after a failed metadata fetch.
- Example
-
"1s" - Default No schema default
- Not declared
numPartitions
integer | null (int32)
Optional
Partition count for __remote_log_metadata on the first creation. Defaults to 50, which is the Kafka remote.log.metadata.topic.num.partitions.
- Example
-
50 - Default Runtime / omission
50 partitions when omitted.
replication
integer | null (int32)
Optional
Replication factor for __remote_log_metadata on the first creation. Defaults to 3, which is the Kafka remote.log.metadata.topic.replication.factor.
- Example
-
3 - Default Runtime / omission
3 replicas when omitted.
snapshotInterval
string | null
Optional
RLMM cache snapshot cadence.
- Example
-
"60s" - Default No schema default
- Not declared
topicCreateTimeout
string | null
Optional
Timeout for provisioning each internal metadata topic.
- Example
-
"30s" - Default No schema default
- Not declared
type
string
Required
Implementation selector.
- Example
-
"InMemory" - Default No schema default
- Not declared
"InMemory""Topic"
persistence
object | null
Optional
3 fields
KIP-405: durable storage for the local-tier directory. It is valid only with type=Local. When it is absent, which is the default, the operator renders an emptyDir for tier-storage. When Some, the operator renders a volumeClaimTemplate of the configured size and class, so tier data survives pod restarts. Together with the topic-backed RLMM, this closes the "tier data is lost on pod restart" caveat.
- Example
-
View JSON example
{ "size": "50Gi", "deleteClaim": false } - Default Runtime / omission
For type Local, use emptyDir storage when omitted.
class
string | null
Optional
Storage class name. None means the cluster default.
- Example
-
"fast-ssd" - Default Runtime / omission
Use the cluster's default StorageClass when omitted.
deleteClaim
boolean
Optional
true gives persistentVolumeClaimRetentionPolicy.whenDeleted: Delete. It must match the parent KafkaNodePool.spec.storage.deleteClaim when both PVCs are present, because K8s StatefulSets have one set-wide retention policy and no per-template override. The operator validates this at reconcile time, and a mismatch surfaces as TieredStorageInvalid.
- Example
-
false - Default Schema default
false
size
string
Required
K8s Quantity, for example "50Gi" or "500Mi". It must be non-empty. The Kubernetes API server validates the resource-quantity form at SSA time.
- Example
-
"50Gi" - Default No schema default
- Not declared
s3
object | null
Optional
8 fields
S3-backend tuning. It is required when kind == S3, and it must be absent in any other case. The struct has the same shape as krabka_remote_storage::S3Config. The operator renders the non-credential fields verbatim into the broker TOML's [remote_storage.s3] block. The credentials come from Kubernetes Secrets, and the operator injects them as the broker-pod env vars AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.
- Example
-
View JSON example
{ "bucket": "kafka-tiered-data", "region": "us-west-2" } - Default No schema default
- Not declared
allowHttp
boolean
Optional
Allow plaintext HTTP. It is off by default. Turn it on for a MinIO that runs without TLS. AWS S3 never needs it.
- Example
-
false - Default Runtime / omission
false: require HTTPS. Set true for a MinIO endpoint without TLS.
bucket
string
Required
S3 bucket name. Required.
- Example
-
"kafka-tiered-data" - Default No schema default
- Not declared
credentials
object | null
Optional
2 fields
Optional explicit credentials. When None, the broker falls back to the AWS credential chain, such as IRSA on EKS or an instance profile on EC2.
- Example
-
View JSON example
{ "accessKeyId": { "name": "s3-credentials", "key": "access-key-id" }, "secretAccessKey": { "name": "s3-credentials", "key": "secret-access-key" } } - Default Runtime / omission
Use the AWS credential chain when omitted, such as IRSA or an instance profile.
accessKeyId
object
Required
2 fields
Reference to the Secret holding the AWS_ACCESS_KEY_ID value.
- Example
-
View JSON example
{ "name": "s3-credentials" } - Default No schema default
- Not declared
secretAccessKey
object
Required
2 fields
Reference to the Secret holding the AWS_SECRET_ACCESS_KEY value.
- Example
-
View JSON example
{ "name": "s3-credentials" } - Default No schema default
- Not declared
key
string | null
Optional
Key within the Secret's data. Defaults to secret-key.
- Example
-
"secret-access-key" - Default Runtime / omission
secret-key when omitted.
name
string
Required
Secret name in the same namespace as the Kafka CR.
- Example
-
"s3-credentials" - Default No schema default
- Not declared
endpoint
string | null
Optional
Optional custom endpoint URL, for example http://minio:9000 for MinIO, or https://<account>.r2.cloudflarestorage.com for Cloudflare R2. When None, the broker uses the AWS S3 endpoint for the configured region.
- Example
-
"http://minio:9000" - Default Runtime / omission
Use the AWS S3 endpoint for the configured region when omitted.
multipartChunkSize
integer | null (uint64)
Optional
Override the per-part size for multipart uploads in bytes. When unset, the broker uses krabka_remote_storage::DEFAULT_MULTIPART_CHUNK_SIZE, which is 16 MiB.
- Example
-
16777216 - Default Runtime / omission
16 MiB (16777216 bytes) when omitted.
Validation and schema details
- Minimum
0
multipartThreshold
integer | null (uint64)
Optional
Override the single-PUT and multipart cutoff in bytes. When unset, the broker uses krabka_remote_storage::DEFAULT_MULTIPART_THRESHOLD, which is 100 MiB. Lower it in tests to exercise the multipart path on small fixtures.
- Example
-
104857600 - Default Runtime / omission
100 MiB (104857600 bytes) when omitted.
Validation and schema details
- Minimum
0
prefix
string | null
Optional
Optional key prefix inside the bucket. It lets more than one Krabka cluster share a bucket without a collision.
- Example
-
"my-cluster/" - Default No schema default
- Not declared
region
string
Required
AWS region. It is required even for the non-AWS endpoints MinIO and R2, because the AmazonS3Builder of object_store rejects an empty region.
- Example
-
"us-west-2" - Default No schema default
- Not declared
type
string
Required
Backend kind selector.
- Example
-
"Local" - Default No schema default
- Not declared
"Local""S3""Gcs"
tracing
object | null
Optional
2 fields
Distributed-tracing wiring for the broker pods. When Some, the operator renders the matching KRABKA_OTLP_* env vars onto every broker pod. The broker's telemetry pipeline reads them with TelemetryConfig::from_env and installs the OTLP tracer at startup. When None, the operator emits no OTLP env vars, and the broker leaves tracing off. That is the default.
- Example
-
View JSON example
{ "type": "Otlp", "otlp": { "endpoint": "http://otel-collector:4317" } } - Default Runtime / omission
Disabled when omitted: emit no OTLP environment variables.
otlp
object | null
Optional
5 fields
OTLP-backend tuning. Required when kind == Otlp.
- Example
-
View JSON example
{ "endpoint": "http://otel-collector:4317" } - Default No schema default
- Not declared
endpoint
string
Required
Required. OTLP collector endpoint in the form scheme://host:port. The operator renders it as KRABKA_OTLP_ENDPOINT. A set field also sets KRABKA_OTLP_ENABLED=true.
- Example
-
"http://otel-collector:4317" - Default No schema default
- Not declared
protocol
string | null
Optional
OTLP wire protocol selector. It has the same shape as the broker's internal OtlpProtocol enum and the OTEL_EXPORTER_OTLP_PROTOCOL spec values.
- Example
-
"grpc" - Default Runtime / omission
grpc when omitted.
"grpc""http_protobuf"
sampleRatio
number | null (double)
Optional
Optional sampling ratio in [0.0, 1.0]. The operator renders it as KRABKA_OTLP_SAMPLE_RATIO. An unset field leaves the binary's own default of 1.0, which samples every trace.
- Example
-
0.1 - Default Runtime / omission
1.0 when omitted; sample every trace.
serviceName
string | null
Optional
Optional service.name resource attribute. The operator renders it as OTEL_SERVICE_NAME. An unset field leaves the binary's own name, which is "krabka-broker" for Kafka and "krabka-gres" for Gres.
- Example
-
"krabka-broker" - Default Runtime / omission
krabka-broker when omitted on a Kafka resource.
timeout
string | null
Optional
Optional export timeout. The operator renders it as KRABKA_OTLP_TIMEOUT. An unset field leaves the binary's own default of 10s.
- Example
-
"10s" - Default Runtime / omission
10s when omitted.
type
string
Required
Tracing backend selector.
- Example
-
"Otlp" - Default No schema default
- Not declared
"Otlp"status
status
object | null
Optional
9 fields
- Example
-
View JSON example
{ "clientsCa": { "generated": true, "notAfter": "2027-10-05T00:00:00Z" } } - Default No schema default
- Not declared
clientsCa
object | null
Optional
6 fields
Status surface for one CA.
The reconciler fills it in from the parsed CA cert and the CRD spec.
- Example
-
View JSON example
{ "generated": true, "notAfter": "2027-10-05T00:00:00Z" } - Default No schema default
- Not declared
certGeneration
integer (uint64)
Optional
Monotonic generation of the active signing cert. It increments on a same-key renewal and on a key promotion.
- Example
-
0 - Default Schema default
0
Validation and schema details
- Minimum
0
generated
boolean
Required
true when the operator generated this CA, that is, when generateCertificateAuthority == true. false for a BYO CA.
- Example
-
true - Default No schema default
- Not declared
keyGeneration
integer (uint64)
Optional
Monotonic generation of the active signing key. It increments only on a key replacement.
- Example
-
0 - Default Schema default
0
Validation and schema details
- Minimum
0
notAfter
string
Required
RFC3339 notAfter of the current CA cert, which is the signing cert.
- Example
-
"2027-10-05T00:00:00Z" - Default No schema default
- Not declared
rotationPhase
string | null
Optional
Staged key-replacement phase. One of idle, key-replace-trust, and key-replace-promote.
- Example
-
"idle" - Default No schema default
- Not declared
trustAnchors
integer | null (uint)
Optional
Number of CA certs in the trust bundle now.
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
0
clusterCa
object | null
Optional
6 fields
Status surface for one CA.
The reconciler fills it in from the parsed CA cert and the CRD spec.
- Example
-
View JSON example
{ "generated": true, "notAfter": "2027-10-05T00:00:00Z" } - Default No schema default
- Not declared
certGeneration
integer (uint64)
Optional
Monotonic generation of the active signing cert. It increments on a same-key renewal and on a key promotion.
- Example
-
0 - Default Schema default
0
Validation and schema details
- Minimum
0
generated
boolean
Required
true when the operator generated this CA, that is, when generateCertificateAuthority == true. false for a BYO CA.
- Example
-
true - Default No schema default
- Not declared
keyGeneration
integer (uint64)
Optional
Monotonic generation of the active signing key. It increments only on a key replacement.
- Example
-
0 - Default Schema default
0
Validation and schema details
- Minimum
0
notAfter
string
Required
RFC3339 notAfter of the current CA cert, which is the signing cert.
- Example
-
"2027-10-05T00:00:00Z" - Default No schema default
- Not declared
rotationPhase
string | null
Optional
Staged key-replacement phase. One of idle, key-replace-trust, and key-replace-promote.
- Example
-
"idle" - Default No schema default
- Not declared
trustAnchors
integer | null (uint)
Optional
Number of CA certs in the trust bundle now.
- Example
-
1 - Default No schema default
- Not declared
Validation and schema details
- Minimum
0
conditions
array
Optional
1 field
Standard Kubernetes-style condition list. It shows Ready, ListenersValid, and ListenersReady.
- Example
-
View JSON example
[ { "lastTransitionTime": "2026-10-05T12:00:00Z", "message": "The resource is ready.", "reason": "Reconciled", "status": "True", "type": "Ready" } ] - Default Schema default
[]
[]
object
Array item
5 fields
- Example
-
View JSON example
{ "lastTransitionTime": "2026-10-05T12:00:00Z", "message": "The resource is ready.", "reason": "Reconciled", "status": "True", "type": "Ready" } - Default No schema default
- Not declared
lastTransitionTime
string
Required
RFC3339 timestamp.
- Example
-
"2026-10-05T12:00:00Z" - Default No schema default
- Not declared
message
string
Required
Human-readable message.
- Example
-
"The resource is ready." - Default No schema default
- Not declared
reason
string
Required
CamelCase machine reason.
- Example
-
"Reconciled" - Default No schema default
- Not declared
status
string
Required
True, False, or Unknown.
- Example
-
"True" - Default No schema default
- Not declared
type
string
Required
For example, Ready.
- Example
-
"Ready" - Default No schema default
- Not declared
kafkaVersion
string | null
Optional
Echo of spec.kafkaVersion, for observability.
- Example
-
"4.0.0" - Default No schema default
- Not declared
listeners
array
Optional
1 field
Per-listener resolved addresses. The operator fills them in once ListenersReady=True.
- Example
-
View JSON example
[ { "bootstrapServers": "kafka.example.com:9092", "name": "plain", "type": "internal" } ] - Default No schema default
- Not declared
[]
object
Array item
4 fields
- Example
-
View JSON example
{ "bootstrapServers": "kafka.example.com:9092", "name": "plain", "type": "internal" } - Default No schema default
- Not declared
addresses
array
Optional
1 field
- Example
-
View JSON example
[ { "host": "kafka.example.com", "port": 9092 } ] - Default Schema default
[]
[]
object
Array item
2 fields
- Example
-
View JSON example
{ "host": "kafka.example.com", "port": 9092 } - Default No schema default
- Not declared
bootstrapServers
string
Required
host:port that clients put in bootstrap.servers.
- Example
-
"kafka.example.com:9092" - Default No schema default
- Not declared
name
string
Required
- Example
-
"plain" - Default No schema default
- Not declared
type
string
Required
- Example
-
"internal" - Default No schema default
- Not declared
"internal""nodeport""loadbalancer""ingress""route"
metadataVersion
string | null
Optional
The operator-finalized metadata version. On an existing cluster it advances only after UpdateFeatures accepts the requested level.
- Example
-
"4.0" - Default No schema default
- Not declared
readyReplicas
integer | null (int32)
Optional
The same value as StatefulSet.status.readyReplicas.
- Example
-
1 - Default No schema default
- Not declared
replicas
integer | null (int32)
Optional
The same value as StatefulSet.status.replicas.
- Example
-
1 - Default No schema default
- Not declared
targetMetadataVersion
string | null
Optional
The metadata feature level requested by the current spec. This may be newer than metadataVersion while broker pools are rolling.
- Example
-
"4.0" - Default No schema default
- Not declared
Resource schema
Resource schema
object
Resource schema
Auto-generated derived type for KafkaSpec via CustomResource
- Example
-
View JSON example
{ "apiVersion": "krabka.io/v1alpha1", "kind": "Kafka", "metadata": { "name": "my-cluster", "namespace": "default" }, "spec": { "kafkaVersion": "4.0.0" } } - Default No resource default
- None