KafkaGrpcGateway

Expand a field to see its description, example, and default behavior. Nested fields are grouped under their parent.

API group: krabka.io
Scope: Namespaced
Resource name: kafkagrpcgateways
Short names: kgg

Required fields must be present when their parent object exists. [] denotes an array item; {key} denotes a map value. status is written by the operator. Reconcile-time checks and runtime defaults can add requirements beyond the schema.

Examples are illustrative JSON values. Open “View JSON example” for an object or array. Adapt names, endpoints, and credentials to your cluster. Kubernetes applies schema defaults when the containing object exists. Runtime and omission notes describe operator behavior. Status examples show reported data.

Runtime notes and domain examples were reviewed against operator source at b409b56.

View the complete CRD manifest at 618d621

Example manifest

This example includes the required spec fields. Adapt its values and create any referenced resources before applying it.

apiVersion: krabka.io/v1alpha1
kind: KafkaGrpcGateway
metadata:
  name: example
  namespace: default
  labels:
    krabka.io/cluster: my-cluster
spec:
  allowedTargets:
    - scheme: https
      host: hooks.example.com

krabka.io/v1alpha1

Served API version · Storage version · 113 schema entries

Complete OpenAPI schema (JSON)

{
  "description": "Auto-generated derived type for KafkaGrpcGatewaySpec via `CustomResource`",
  "properties": {
    "spec": {
      "properties": {
        "allowedTargets": {
          "description": "Explicit SSRF allowlist for outbound HTTP targets. The controller\nderives the entries from the `targetUrl` of each subscription. Use\nthis field to add more allowed hosts.",
          "items": {
            "description": "One entry in the SSRF allowlist of the gateway.\n\nThe gateway permits an outbound HTTP request only when `scheme` and\n`host` match.",
            "properties": {
              "host": {
                "description": "Hostname of the allowed target, with an optional port.",
                "type": "string"
              },
              "scheme": {
                "description": "URL scheme. One of `http` or `https`.",
                "type": "string"
              }
            },
            "required": [
              "host",
              "scheme"
            ],
            "type": "object"
          },
          "type": "array"
        },
        "authz": {
          "description": "Authorization configuration. When absent, the gateway uses simple\nACL-based authorization, which is mode `simple`.",
          "nullable": true,
          "properties": {
            "aclRefresh": {
              "description": "How often the gateway refreshes its ACL cache from the broker,\nas a unit-carrying duration. Default `60s`.",
              "nullable": true,
              "type": "string"
            },
            "bearer": {
              "description": "Bearer-token authentication configuration. When absent,\nbearer auth is disabled.",
              "nullable": true,
              "properties": {
                "allowableClockSkew": {
                  "description": "Allowable clock skew for bearer-token timestamps, as a\nunit-carrying duration such as `30s` or `500ms`.",
                  "nullable": true,
                  "type": "string"
                },
                "mode": {
                  "description": "Bearer auth mode. One of `off` or `unsecured`. Default `off`.",
                  "nullable": true,
                  "type": "string"
                },
                "principalClaim": {
                  "description": "JWT claim used as the Kafka principal. Default `sub`.",
                  "nullable": true,
                  "type": "string"
                }
              },
              "type": "object"
            },
            "mode": {
              "description": "Authorization mode. One of `off` or `simple`. Default `simple`,\nwhich is ACL-based and reads the `KafkaUser` ACLs from the broker.",
              "nullable": true,
              "type": "string"
            },
            "superUsers": {
              "description": "Principal strings, for example `User:admin`, that bypass all ACL\nchecks.",
              "items": {
                "type": "string"
              },
              "type": "array"
            }
          },
          "type": "object"
        },
        "dedup": {
          "description": "Configuration for the deduplication topic below the idempotent\nproduce, which gives exactly-once delivery. When absent, the\ncontroller defaults apply.",
          "nullable": true,
          "properties": {
            "ownershipGroup": {
              "description": "Consumer group used to divide dedup ownership between replicas.\nDefaults to a value derived from the gateway name.",
              "nullable": true,
              "type": "string"
            },
            "partitions": {
              "description": "Number of partitions for the dedup topic. Default 8.",
              "format": "uint32",
              "maximum": 2147483647,
              "minimum": 1,
              "nullable": true,
              "type": "integer"
            },
            "topic": {
              "description": "Kafka topic used to store dedup state. Defaults to\n`<gateway-name>-dedup` when absent.",
              "nullable": true,
              "type": "string"
            },
            "txnIdPrefix": {
              "description": "Prefix for transactional producer IDs. Defaults to the gateway\nname. The full `transactional.id` is `<prefix>-<partition>`.",
              "nullable": true,
              "type": "string"
            },
            "window": {
              "description": "Dedup window, as a unit-carrying duration such as `24h` or `30m`.\nThe gateway drops records with the same idempotency key inside this\nwindow. Default `24h`.",
              "nullable": true,
              "type": "string"
            }
          },
          "type": "object"
        },
        "healthChecks": {
          "description": "Kubernetes readiness and liveness probe timing.",
          "nullable": true,
          "properties": {
            "livenessInitialDelaySeconds": {
              "format": "int32",
              "minimum": 0,
              "nullable": true,
              "type": "integer"
            },
            "livenessPeriodSeconds": {
              "format": "int32",
              "minimum": 1,
              "nullable": true,
              "type": "integer"
            },
            "readinessInitialDelaySeconds": {
              "format": "int32",
              "minimum": 0,
              "nullable": true,
              "type": "integer"
            },
            "readinessPeriodSeconds": {
              "format": "int32",
              "minimum": 1,
              "nullable": true,
              "type": "integer"
            }
          },
          "type": "object"
        },
        "image": {
          "description": "Container image override. When absent, the operator uses its\n`--default-gateway-image` flag.",
          "nullable": true,
          "type": "string"
        },
        "membershipTopic": {
          "description": "Internal membership / owner-routing topic.",
          "nullable": true,
          "type": "string"
        },
        "outboundSubscriptions": {
          "description": "Outbound webhook subscriptions. Each entry reads from\n`sourceTopics` and HTTP-POSTs records to `targetUrl`.",
          "items": {
            "description": "One outbound webhook subscription.\n\nThe gateway reads from `sourceTopics` and sends each record to\n`targetUrl` with an HTTP POST.",
            "properties": {
              "baseBackoff": {
                "description": "Initial backoff for exponential retry, as a unit-carrying duration.\nDefault `500ms`.",
                "nullable": true,
                "type": "string"
              },
              "deadLetterTopic": {
                "description": "Kafka topic for the records that used all their delivery attempts.\nWhen absent, the gateway logs a failed record and discards it.",
                "nullable": true,
                "type": "string"
              },
              "decodeToJson": {
                "description": "Decode Schema Registry framed values to JSON before delivery.",
                "nullable": true,
                "type": "boolean"
              },
              "filter": {
                "description": "CEL expression evaluated against the record to decide whether to\ndeliver it. An absent or empty filter delivers all records.",
                "nullable": true,
                "type": "string"
              },
              "groupId": {
                "description": "Consumer group override for this subscription.",
                "nullable": true,
                "type": "string"
              },
              "headers": {
                "additionalProperties": {
                  "type": "string"
                },
                "description": "Static HTTP headers appended to every delivery request.",
                "type": "object"
              },
              "maxAttempts": {
                "description": "Maximum number of delivery attempts before moving the record to\nthe dead-letter topic. Default 5.",
                "format": "uint32",
                "minimum": 1,
                "nullable": true,
                "type": "integer"
              },
              "maxBackoff": {
                "description": "Maximum backoff cap, as a unit-carrying duration. Default `30s`.",
                "nullable": true,
                "type": "string"
              },
              "name": {
                "description": "Unique name for this subscription. It is the suffix of the\nconsumer group id.",
                "type": "string"
              },
              "requestTimeout": {
                "description": "HTTP request timeout, as a unit-carrying duration. Default `10s`.",
                "nullable": true,
                "type": "string"
              },
              "signingSecretRef": {
                "description": "Secret key reference for the HMAC signing secret of the outbound\nrequest. The controller resolves it at render time.",
                "nullable": true,
                "properties": {
                  "key": {
                    "description": "Key inside the `data` map of the Secret.",
                    "type": "string"
                  },
                  "name": {
                    "description": "Name of the Kubernetes Secret.",
                    "type": "string"
                  }
                },
                "required": [
                  "key",
                  "name"
                ],
                "type": "object"
              },
              "sourceTopics": {
                "description": "Kafka topics to consume records from.",
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              "targetUrl": {
                "description": "HTTP endpoint to POST records to.",
                "type": "string"
              }
            },
            "required": [
              "name",
              "targetUrl"
            ],
            "type": "object"
          },
          "type": "array"
        },
        "replicas": {
          "description": "Number of gateway replicas. Defaults to 1 when absent.",
          "format": "int32",
          "minimum": 1,
          "nullable": true,
          "type": "integer"
        },
        "resources": {
          "description": "CPU / memory resource requests and limits for the gateway container.",
          "nullable": true,
          "properties": {
            "claims": {
              "description": "Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container.\n\nThis is an alpha field and requires enabling the DynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.",
              "items": {
                "description": "ResourceClaim references one entry in PodSpec.ResourceClaims.",
                "properties": {
                  "name": {
                    "description": "Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container.",
                    "type": "string"
                  },
                  "request": {
                    "description": "Request is the name chosen for a request in the referenced claim. If empty, everything from the claim is made available, otherwise only the result of this request.",
                    "type": "string"
                  }
                },
                "required": [
                  "name"
                ],
                "type": "object"
              },
              "type": "array"
            },
            "limits": {
              "additionalProperties": {
                "description": "Quantity is a fixed-point representation of a number. It provides convenient marshaling/unmarshaling in JSON and YAML, in addition to String() and AsInt64() accessors.\n\nThe serialization format is:\n\n``` <quantity>        ::= <signedNumber><suffix>\n\n\t(Note that <suffix> may be empty, from the \"\" case in <decimalSI>.)\n\n<digit>           ::= 0 | 1 | ... | 9 <digits>          ::= <digit> | <digit><digits> <number>          ::= <digits> | <digits>.<digits> | <digits>. | .<digits> <sign>            ::= \"+\" | \"-\" <signedNumber>    ::= <number> | <sign><number> <suffix>          ::= <binarySI> | <decimalExponent> | <decimalSI> <binarySI>        ::= Ki | Mi | Gi | Ti | Pi | Ei\n\n\t(International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)\n\n<decimalSI>       ::= m | \"\" | k | M | G | T | P | E\n\n\t(Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)\n\n<decimalExponent> ::= \"e\" <signedNumber> | \"E\" <signedNumber> ```\n\nNo matter which of the three exponent forms is used, no quantity may represent a number greater than 2^63-1 in magnitude, nor may it have more than 3 decimal places. Numbers larger or more precise will be capped or rounded up. (E.g.: 0.1m will rounded up to 1m.) This may be extended in the future if we require larger or smaller quantities.\n\nWhen a Quantity is parsed from a string, it will remember the type of suffix it had, and will use the same type again when it is serialized.\n\nBefore serializing, Quantity will be put in \"canonical form\". This means that Exponent/suffix will be adjusted up or down (with a corresponding increase or decrease in Mantissa) such that:\n\n- No precision is lost - No fractional digits will be emitted - The exponent (or suffix) is as large as possible.\n\nThe sign will be omitted unless the number is negative.\n\nExamples:\n\n- 1.5 will be serialized as \"1500m\" - 1.5Gi will be serialized as \"1536Mi\"\n\nNote that the quantity will NEVER be internally represented by a floating point number. That is the whole point of this exercise.\n\nNon-canonical values will still parse as long as they are well formed, but will be re-emitted in their canonical form. (So always use canonical form, or don't diff.)\n\nThis format is intended to make it difficult to use these numbers without writing some sort of special handling code in the hopes that that will cause implementors to also use a fixed point implementation.",
                "x-kubernetes-int-or-string": true
              },
              "description": "Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/",
              "type": "object"
            },
            "requests": {
              "additionalProperties": {
                "description": "Quantity is a fixed-point representation of a number. It provides convenient marshaling/unmarshaling in JSON and YAML, in addition to String() and AsInt64() accessors.\n\nThe serialization format is:\n\n``` <quantity>        ::= <signedNumber><suffix>\n\n\t(Note that <suffix> may be empty, from the \"\" case in <decimalSI>.)\n\n<digit>           ::= 0 | 1 | ... | 9 <digits>          ::= <digit> | <digit><digits> <number>          ::= <digits> | <digits>.<digits> | <digits>. | .<digits> <sign>            ::= \"+\" | \"-\" <signedNumber>    ::= <number> | <sign><number> <suffix>          ::= <binarySI> | <decimalExponent> | <decimalSI> <binarySI>        ::= Ki | Mi | Gi | Ti | Pi | Ei\n\n\t(International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)\n\n<decimalSI>       ::= m | \"\" | k | M | G | T | P | E\n\n\t(Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)\n\n<decimalExponent> ::= \"e\" <signedNumber> | \"E\" <signedNumber> ```\n\nNo matter which of the three exponent forms is used, no quantity may represent a number greater than 2^63-1 in magnitude, nor may it have more than 3 decimal places. Numbers larger or more precise will be capped or rounded up. (E.g.: 0.1m will rounded up to 1m.) This may be extended in the future if we require larger or smaller quantities.\n\nWhen a Quantity is parsed from a string, it will remember the type of suffix it had, and will use the same type again when it is serialized.\n\nBefore serializing, Quantity will be put in \"canonical form\". This means that Exponent/suffix will be adjusted up or down (with a corresponding increase or decrease in Mantissa) such that:\n\n- No precision is lost - No fractional digits will be emitted - The exponent (or suffix) is as large as possible.\n\nThe sign will be omitted unless the number is negative.\n\nExamples:\n\n- 1.5 will be serialized as \"1500m\" - 1.5Gi will be serialized as \"1536Mi\"\n\nNote that the quantity will NEVER be internally represented by a floating point number. That is the whole point of this exercise.\n\nNon-canonical values will still parse as long as they are well formed, but will be re-emitted in their canonical form. (So always use canonical form, or don't diff.)\n\nThis format is intended to make it difficult to use these numbers without writing some sort of special handling code in the hopes that that will cause implementors to also use a fixed point implementation.",
                "x-kubernetes-int-or-string": true
              },
              "description": "Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/",
              "type": "object"
            }
          },
          "type": "object"
        },
        "schemaRegistry": {
          "description": "Schema Registry integration.",
          "nullable": true,
          "properties": {
            "frameRaw": {
              "nullable": true,
              "type": "boolean"
            },
            "latestCacheTtl": {
              "nullable": true,
              "type": "string"
            },
            "url": {
              "nullable": true,
              "type": "string"
            }
          },
          "type": "object"
        },
        "telemetry": {
          "description": "OpenTelemetry / observability configuration. When absent,\nthe gateway exports no telemetry.",
          "nullable": true,
          "properties": {
            "otlpEndpoint": {
              "description": "OTLP exporter endpoint URL, for example\n`http://otel-collector.observability.svc:4317`.",
              "nullable": true,
              "type": "string"
            },
            "otlpProtocol": {
              "description": "OTLP exporter protocol. One of `grpc` or `http`. Default `grpc`.",
              "nullable": true,
              "type": "string"
            },
            "sampleRatio": {
              "description": "Fraction of traces to sample, in the range `[0.0, 1.0]`. Default\n1.0, which samples all traces.",
              "format": "double",
              "maximum": 1,
              "minimum": 0,
              "nullable": true,
              "type": "number"
            }
          },
          "type": "object"
        },
        "tls": {
          "description": "TLS serving configuration. When absent, the TLS defaults apply:\n`clientAuth: required` and `validityDays: 365`.",
          "nullable": true,
          "properties": {
            "clientAuth": {
              "description": "How the gateway authenticates inbound clients.\nOne of `disabled`, `optional`, `required`. Default `required`.",
              "nullable": true,
              "type": "string"
            },
            "reloadInterval": {
              "description": "Cert hot-reload poll interval, as a unit-carrying duration. Default `30s`.",
              "nullable": true,
              "type": "string"
            },
            "validityDays": {
              "description": "Serving-cert lifetime in days. Default 365.",
              "format": "uint32",
              "minimum": 1,
              "nullable": true,
              "type": "integer"
            }
          },
          "type": "object"
        },
        "tuning": {
          "description": "Gateway runtime policy overrides.",
          "nullable": true,
          "properties": {
            "clientDispatchQueueCapacity": {
              "description": "Kafka client request-dispatch queue capacity.",
              "format": "uint",
              "minimum": 1,
              "nullable": true,
              "type": "integer"
            },
            "clientFrameMax": {
              "description": "Maximum accepted Kafka client frame size.",
              "nullable": true,
              "type": "string"
            },
            "consumerPollTimeout": {
              "nullable": true,
              "type": "string"
            },
            "forwardMaxBody": {
              "nullable": true,
              "type": "string"
            },
            "internalTopicAllowReplicationFallback": {
              "nullable": true,
              "type": "boolean"
            },
            "internalTopicCreateTimeout": {
              "nullable": true,
              "type": "string"
            },
            "internalTopicMinCleanableDirtyRatio": {
              "nullable": true,
              "type": "string"
            },
            "internalTopicReplicationFactor": {
              "format": "int16",
              "maximum": 32767,
              "minimum": 1,
              "nullable": true,
              "type": "integer"
            },
            "internalTopicSegment": {
              "nullable": true,
              "type": "string"
            },
            "ownershipWarmupEmptyPolls": {
              "format": "uint32",
              "minimum": 1,
              "nullable": true,
              "type": "integer"
            },
            "produceMaxBody": {
              "nullable": true,
              "type": "string"
            },
            "readinessPollInterval": {
              "nullable": true,
              "type": "string"
            }
          },
          "type": "object"
        },
        "webhooks": {
          "description": "Inbound HTTP-webhook endpoints. Each entry creates one\nauthenticated ingress route that produces records to\n`targetTopic`.",
          "items": {
            "description": "One inbound HTTP-webhook endpoint.\n\nThe gateway does one produce call against `targetTopic` for every\nverified POST to `/<name>`.",
            "properties": {
              "forwardHeaders": {
                "description": "Request headers to preserve as Kafka record headers. Authentication\ncredentials and webhook signatures cannot be forwarded.",
                "items": {
                  "type": "string"
                },
                "nullable": true,
                "type": "array"
              },
              "idempotencySource": {
                "description": "How to derive the idempotency key for deduplication, for example\n`header:X-Idempotency-Key` or `body_hash`.",
                "nullable": true,
                "type": "string"
              },
              "keySource": {
                "description": "How to derive the Kafka record key from the request, for example\n`header:X-Record-Key` or `body_path:.id`.",
                "nullable": true,
                "type": "string"
              },
              "maxBody": {
                "description": "Maximum accepted request body size in bytes. Default 1 MiB.",
                "nullable": true,
                "type": "string"
              },
              "name": {
                "description": "Unique name for this webhook route. It is the URL path segment.",
                "type": "string"
              },
              "principal": {
                "description": "Kafka principal for ACL checks on produce to `targetTopic`.\nDefaults to the gateway service account principal when absent.",
                "nullable": true,
                "type": "string"
              },
              "schemaFormat": {
                "description": "Structured payload format: `avro`, `json`, or `protobuf`.",
                "nullable": true,
                "type": "string"
              },
              "schemaSubject": {
                "description": "Optional Schema Registry subject for structured request bodies.",
                "nullable": true,
                "type": "string"
              },
              "secretRef": {
                "description": "Kubernetes Secret key reference for the HMAC signing secret or the\nStandard Webhooks signing token required by `signatureMode`. The\ncontroller resolves it at render time and puts the raw secret value\ninto the config Secret. The CRD never stores that value.",
                "nullable": true,
                "properties": {
                  "key": {
                    "description": "Key inside the `data` map of the Secret.",
                    "type": "string"
                  },
                  "name": {
                    "description": "Name of the Kubernetes Secret.",
                    "type": "string"
                  }
                },
                "required": [
                  "key",
                  "name"
                ],
                "type": "object"
              },
              "signatureEncoding": {
                "description": "Signature encoding. One of `hex` or `base64`. Default `hex`.",
                "nullable": true,
                "type": "string"
              },
              "signatureHeader": {
                "description": "HTTP header that carries the HMAC signature, for example\n`X-Hub-Signature-256`.",
                "nullable": true,
                "type": "string"
              },
              "signatureMode": {
                "description": "Signature protocol. Set `standard_webhooks` to verify the signed\nmessage ID, timestamp, and body; omit for body-only HMAC verification.",
                "nullable": true,
                "type": "string"
              },
              "signaturePrefix": {
                "description": "Prefix to remove from the signature header value before the\ngateway verifies it, for example `sha256=`.",
                "nullable": true,
                "type": "string"
              },
              "targetTopic": {
                "description": "Kafka topic that the gateway produces the records to.",
                "type": "string"
              },
              "timestampHeader": {
                "description": "HTTP header that carries the request timestamp. The gateway uses\nit with `timestampTolerance` to reject replayed requests.",
                "nullable": true,
                "type": "string"
              },
              "timestampTolerance": {
                "description": "Maximum age of a request timestamp before it is rejected as a replay,\nas a unit-carrying duration. Default `300s`.",
                "nullable": true,
                "type": "string"
              }
            },
            "required": [
              "name",
              "targetTopic"
            ],
            "type": "object"
          },
          "type": "array"
        }
      },
      "type": "object"
    },
    "status": {
      "description": "Status reported back by the controller onto each `KafkaGrpcGateway`.",
      "nullable": true,
      "properties": {
        "conditions": {
          "default": [],
          "description": "Standard Kubernetes-style condition list. It reports `Ready`,\n`KafkaVersionValid`, `CertReady`, and `Degraded`.",
          "items": {
            "properties": {
              "lastTransitionTime": {
                "description": "RFC3339 timestamp.",
                "type": "string"
              },
              "message": {
                "description": "Human-readable message.",
                "type": "string"
              },
              "reason": {
                "description": "CamelCase machine reason.",
                "type": "string"
              },
              "status": {
                "description": "`True`, `False`, or `Unknown`.",
                "type": "string"
              },
              "type": {
                "description": "For example, `Ready`.",
                "type": "string"
              }
            },
            "required": [
              "lastTransitionTime",
              "message",
              "reason",
              "status",
              "type"
            ],
            "type": "object"
          },
          "type": "array"
        },
        "observedGeneration": {
          "description": "`metadata.generation` of the last successfully-reconciled spec.",
          "format": "int64",
          "nullable": true,
          "type": "integer"
        },
        "readyReplicas": {
          "description": "Number of gateway replicas that report Ready now.",
          "format": "int32",
          "nullable": true,
          "type": "integer"
        }
      },
      "type": "object"
    }
  },
  "required": [
    "spec"
  ],
  "title": "KafkaGrpcGateway",
  "type": "object"
}

spec

spec object Required 14 fields

Example: View JSON example

{ "allowedTargets": [ { "scheme": "https", "host": "hooks.example.com" } ] }
Default No schema default: Not declared

allowedTargets array Optional 1 field

Explicit SSRF allowlist for outbound HTTP targets. The controller derives the entries from the targetUrl of each subscription. Use this field to add more allowed hosts.

Example: View JSON example

[ { "scheme": "https", "host": "hooks.example.com" } ]
Default Runtime / omission: No extra hosts. The operator derives allowlist entries from outbound targetUrl values.

[] object Array item 2 fields

One entry in the SSRF allowlist of the gateway.

The gateway permits an outbound HTTP request only when scheme and host match.

Example: View JSON example

{ "scheme": "https", "host": "hooks.example.com" }
Default No independent default: Defined by the parent

host string Required

Hostname of the allowed target, with an optional port.

Example: "hooks.example.com"
Default No schema default: Not declared

scheme string Required

URL scheme. One of http or https.

Example: "https"
Default No schema default: Not declared

authz object | null Optional 4 fields

Authorization configuration. When absent, the gateway uses simple ACL-based authorization, which is mode simple.

Example: View JSON example

{ "mode": "simple", "aclRefresh": "60s" }
Default Documented behavior: When absent, the gateway uses simple ACL-based authorization, which is mode simple.

aclRefresh string | null Optional

How often the gateway refreshes its ACL cache from the broker, as a unit-carrying duration. Default 60s.

Example: "60s"
Default Documented behavior: Default 60s.

bearer object | null Optional 3 fields

Bearer-token authentication configuration. When absent, bearer auth is disabled.

Example: View JSON example

{ "mode": "off", "principalClaim": "sub", "allowableClockSkew": "30s" }
Default Documented behavior: When absent, bearer auth is disabled.

allowableClockSkew string | null Optional

Allowable clock skew for bearer-token timestamps, as a unit-carrying duration such as 30s or 500ms.

Example: "30s"
Default No schema default: Not declared

mode string | null Optional

Bearer auth mode. One of off or unsecured. Default off.

Example: "off"
Default Documented behavior: Default off.

principalClaim string | null Optional

JWT claim used as the Kafka principal. Default sub.

Example: "sub"
Default Documented behavior: Default sub.

mode string | null Optional

Authorization mode. One of off or simple. Default simple, which is ACL-based and reads the KafkaUser ACLs from the broker.

Example: "simple"
Default Documented behavior: Default simple, which is ACL-based and reads the KafkaUser ACLs from the broker.

superUsers array Optional 1 field

Principal strings, for example User:admin, that bypass all ACL checks.

Example: View JSON example

[ "User:admin" ]
Default Runtime / omission: [] (no principals bypass ACL checks).

[] string Array item

Example: "User:admin"
Default No independent default: Defined by the parent

dedup object | null Optional 5 fields

Configuration for the deduplication topic below the idempotent produce, which gives exactly-once delivery. When absent, the controller defaults apply.

Example: View JSON example

{ "topic": "orders-gateway-dedup", "partitions": 8, "window": "24h" }
Default Documented behavior: When absent, the controller defaults apply.

ownershipGroup string | null Optional

Consumer group used to divide dedup ownership between replicas. Defaults to a value derived from the gateway name.

Example: "orders-gateway-ownership"
Default Documented behavior: Defaults to a value derived from the gateway name.

partitions integer | null (uint32) Optional

Number of partitions for the dedup topic. Default 8.

Example: 8
Default Documented behavior: Default 8.

Validation and schema details

Maximum: 2147483647
Minimum: 1

topic string | null Optional

Kafka topic used to store dedup state. Defaults to <gateway-name>-dedup when absent.

Example: "orders-gateway-dedup"
Default Documented behavior: Defaults to <gateway-name>-dedup when absent.

txnIdPrefix string | null Optional

Prefix for transactional producer IDs. Defaults to the gateway name. The full transactional.id is <prefix>-<partition>.

Example: "orders-gateway"
Default Documented behavior: Defaults to the gateway name.

window string | null Optional

Dedup window, as a unit-carrying duration such as 24h or 30m. The gateway drops records with the same idempotency key inside this window. Default 24h.

Example: "24h"
Default Documented behavior: Default 24h.

healthChecks object | null Optional 4 fields

Kubernetes readiness and liveness probe timing.

Example: View JSON example

{ "livenessInitialDelaySeconds": 10 }
Default No schema default: Not declared

livenessInitialDelaySeconds integer | null (int32) Optional

Example: 10
Default No schema default: Not declared

Validation and schema details

Minimum: 0

livenessPeriodSeconds integer | null (int32) Optional

Example: 10
Default No schema default: Not declared

Validation and schema details

Minimum: 1

readinessInitialDelaySeconds integer | null (int32) Optional

Example: 5
Default No schema default: Not declared

Validation and schema details

Minimum: 0

readinessPeriodSeconds integer | null (int32) Optional

Example: 10
Default No schema default: Not declared

Validation and schema details

Minimum: 1

image string | null Optional

Container image override. When absent, the operator uses its --default-gateway-image flag.

Example: "registry.example.com/krabka/gateway:1.0.0"
Default Runtime / omission: Use the operator's --default-gateway-image value when omitted.

membershipTopic string | null Optional

Internal membership / owner-routing topic.

Example: "orders-gateway-membership"
Default No schema default: Not declared

outboundSubscriptions array Optional 1 field

Outbound webhook subscriptions. Each entry reads from sourceTopics and HTTP-POSTs records to targetUrl.

Example: View JSON example

[ { "name": "orders-delivery", "sourceTopics": [ "orders" ], "targetUrl": "https://hooks.example.com/orders", "deadLetterTopic": "orders-dead-letter", "maxAttempts": 5 } ]
Default Runtime / omission: [] (no outbound subscriptions).

[] object Array item 13 fields

One outbound webhook subscription.

The gateway reads from sourceTopics and sends each record to targetUrl with an HTTP POST.

Example: View JSON example

{ "name": "orders-delivery", "sourceTopics": [ "orders" ], "targetUrl": "https://hooks.example.com/orders", "deadLetterTopic": "orders-dead-letter", "maxAttempts": 5 }
Default No independent default: Defined by the parent

baseBackoff string | null Optional

Initial backoff for exponential retry, as a unit-carrying duration. Default 500ms.

Example: "500ms"
Default Documented behavior: Default 500ms.

deadLetterTopic string | null Optional

Kafka topic for the records that used all their delivery attempts. When absent, the gateway logs a failed record and discards it.

Example: "orders-dead-letter"
Default Documented behavior: When absent, the gateway logs a failed record and discards it.

decodeToJson boolean | null Optional

Decode Schema Registry framed values to JSON before delivery.

Example: true
Default No schema default: Not declared

filter string | null Optional

CEL expression evaluated against the record to decide whether to deliver it. An absent or empty filter delivers all records.

Example: "true"
Default Runtime / omission: Absent or empty: deliver all records.

groupId string | null Optional

Consumer group override for this subscription.

Example: "orders-delivery"
Default No schema default: Not declared

headers object Optional 1 field

Static HTTP headers appended to every delivery request.

Example: View JSON example

{ "X-Source": "orders-gateway" }
Default Runtime / omission: {} (no extra delivery headers).

Validation and schema details

Additional properties: { "type": "string" }

{key} string Map value

Example: "orders-gateway"
Default No independent default: Defined by the parent

maxAttempts integer | null (uint32) Optional

Maximum number of delivery attempts before moving the record to the dead-letter topic. Default 5.

Example: 5
Default Documented behavior: Default 5.

Validation and schema details

Minimum: 1

maxBackoff string | null Optional

Maximum backoff cap, as a unit-carrying duration. Default 30s.

Example: "30s"
Default Documented behavior: Default 30s.

name string Required

Unique name for this subscription. It is the suffix of the consumer group id.

Example: "orders-delivery"
Default No schema default: Not declared

requestTimeout string | null Optional

HTTP request timeout, as a unit-carrying duration. Default 10s.

Example: "10s"
Default Documented behavior: Default 10s.

signingSecretRef object | null Optional 2 fields

Secret key reference for the HMAC signing secret of the outbound request. The controller resolves it at render time.

Example: View JSON example

{ "name": "orders-delivery-signing", "key": "token" }
Default No schema default: Not declared

key string Required

Key inside the data map of the Secret.

Example: "token"
Default No schema default: Not declared

name string Required

Name of the Kubernetes Secret.

Example: "orders-delivery-signing"
Default No schema default: Not declared

sourceTopics array Optional 1 field

Kafka topics to consume records from.

Example: View JSON example

[ "orders" ]
Default No schema default: Not declared

[] string Array item

Example: "orders"
Default No independent default: Defined by the parent

targetUrl string Required

HTTP endpoint to POST records to.

Example: "https://hooks.example.com/orders"
Default No schema default: Not declared

replicas integer | null (int32) Optional

Number of gateway replicas. Defaults to 1 when absent.

Example: 2
Default Documented behavior: Defaults to 1 when absent.

Validation and schema details

Minimum: 1

resources object | null Optional 3 fields

CPU / memory resource requests and limits for the gateway container.

Example: View JSON example

{ "claims": [ { "name": "example" } ] }
Default No schema default: Not declared

claims array Optional 1 field

Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container.

This is an alpha field and requires enabling the DynamicResourceAllocation feature gate.

This field is immutable. It can only be set for containers.

Example: View JSON example

[ { "name": "example" } ]
Default No schema default: Not declared

[] object Array item 2 fields

ResourceClaim references one entry in PodSpec.ResourceClaims.

Example: View JSON example

{ "name": "example" }
Default No independent default: Defined by the parent

name string Required

Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container.

Example: "example"
Default No schema default: Not declared

request string Optional

Request is the name chosen for a request in the referenced claim. If empty, everything from the claim is made available, otherwise only the result of this request.

Example: "example"
Default No schema default: Not declared

limits object Optional 1 field

Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

Example: View JSON example

{ "example": "256Mi" }
Default No schema default: Not declared

Validation and schema details

Additional properties: { "description": "Quantity is a fixed-point representation of a number. It provides convenient marshaling/unmarshaling in JSON and YAML, in addition to String() and AsInt64() accessors.\n\nThe serialization format is:\n\n``` <quantity> ::= <signedNumber><suffix>\n\n\t(Note that <suffix> may be empty, from the \"\" case in <decimalSI>.)\n\n<digit> ::= 0 | 1 | ... | 9 <digits> ::= <digit> | <digit><digits> <number> ::= <digits> | <digits>.<digits> | <digits>. | .<digits> <sign> ::= \"+\" | \"-\" <signedNumber> ::= <number> | <sign><number> <suffix> ::= <binarySI> | <decimalExponent> | <decimalSI> <binarySI> ::= Ki | Mi | Gi | Ti | Pi | Ei\n\n\t(International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)\n\n<decimalSI> ::= m | \"\" | k | M | G | T | P | E\n\n\t(Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)\n\n<decimalExponent> ::= \"e\" <signedNumber> | \"E\" <signedNumber> ```\n\nNo matter which of the three exponent forms is used, no quantity may represent a number greater than 2^63-1 in magnitude, nor may it have more than 3 decimal places. Numbers larger or more precise will be capped or rounded up. (E.g.: 0.1m will rounded up to 1m.) This may be extended in the future if we require larger or smaller quantities.\n\nWhen a Quantity is parsed from a string, it will remember the type of suffix it had, and will use the same type again when it is serialized.\n\nBefore serializing, Quantity will be put in \"canonical form\". This means that Exponent/suffix will be adjusted up or down (with a corresponding increase or decrease in Mantissa) such that:\n\n- No precision is lost - No fractional digits will be emitted - The exponent (or suffix) is as large as possible.\n\nThe sign will be omitted unless the number is negative.\n\nExamples:\n\n- 1.5 will be serialized as \"1500m\" - 1.5Gi will be serialized as \"1536Mi\"\n\nNote that the quantity will NEVER be internally represented by a floating point number. That is the whole point of this exercise.\n\nNon-canonical values will still parse as long as they are well formed, but will be re-emitted in their canonical form. (So always use canonical form, or don't diff.)\n\nThis format is intended to make it difficult to use these numbers without writing some sort of special handling code in the hopes that that will cause implementors to also use a fixed point implementation.", "x-kubernetes-int-or-string": true }

{key} integer | string Map value

Quantity is a fixed-point representation of a number. It provides convenient marshaling/unmarshaling in JSON and YAML, in addition to String() and AsInt64() accessors.

The serialization format is:

<quantity>        ::= <signedNumber><suffix>

	(Note that <suffix> may be empty, from the "" case in <decimalSI>.)

<digit>           ::= 0 | 1 | ... | 9 <digits>          ::= <digit> | <digit><digits> <number>          ::= <digits> | <digits>.<digits> | <digits>. | .<digits> <sign>            ::= "+" | "-" <signedNumber>    ::= <number> | <sign><number> <suffix>          ::= <binarySI> | <decimalExponent> | <decimalSI> <binarySI>        ::= Ki | Mi | Gi | Ti | Pi | Ei

	(International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)

<decimalSI>       ::= m | "" | k | M | G | T | P | E

	(Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)

<decimalExponent> ::= "e" <signedNumber> | "E" <signedNumber>

No matter which of the three exponent forms is used, no quantity may represent a number greater than 2^63-1 in magnitude, nor may it have more than 3 decimal places. Numbers larger or more precise will be capped or rounded up. (E.g.: 0.1m will rounded up to 1m.) This may be extended in the future if we require larger or smaller quantities.

When a Quantity is parsed from a string, it will remember the type of suffix it had, and will use the same type again when it is serialized.

Before serializing, Quantity will be put in "canonical form". This means that Exponent/suffix will be adjusted up or down (with a corresponding increase or decrease in Mantissa) such that:

No precision is lost - No fractional digits will be emitted - The exponent (or suffix) is as large as possible.

The sign will be omitted unless the number is negative.

Examples:

1.5 will be serialized as "1500m" - 1.5Gi will be serialized as "1536Mi"

Note that the quantity will NEVER be internally represented by a floating point number. That is the whole point of this exercise.

Non-canonical values will still parse as long as they are well formed, but will be re-emitted in their canonical form. (So always use canonical form, or don't diff.)

This format is intended to make it difficult to use these numbers without writing some sort of special handling code in the hopes that that will cause implementors to also use a fixed point implementation.

Example: "256Mi"
Default No independent default: Defined by the parent

Validation and schema details

x-kubernetes-int-or-string: true

requests object Optional 1 field

Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

Example: View JSON example

{ "example": "256Mi" }
Default Documented behavior: If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value.

Validation and schema details

Additional properties: { "description": "Quantity is a fixed-point representation of a number. It provides convenient marshaling/unmarshaling in JSON and YAML, in addition to String() and AsInt64() accessors.\n\nThe serialization format is:\n\n``` <quantity> ::= <signedNumber><suffix>\n\n\t(Note that <suffix> may be empty, from the \"\" case in <decimalSI>.)\n\n<digit> ::= 0 | 1 | ... | 9 <digits> ::= <digit> | <digit><digits> <number> ::= <digits> | <digits>.<digits> | <digits>. | .<digits> <sign> ::= \"+\" | \"-\" <signedNumber> ::= <number> | <sign><number> <suffix> ::= <binarySI> | <decimalExponent> | <decimalSI> <binarySI> ::= Ki | Mi | Gi | Ti | Pi | Ei\n\n\t(International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)\n\n<decimalSI> ::= m | \"\" | k | M | G | T | P | E\n\n\t(Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)\n\n<decimalExponent> ::= \"e\" <signedNumber> | \"E\" <signedNumber> ```\n\nNo matter which of the three exponent forms is used, no quantity may represent a number greater than 2^63-1 in magnitude, nor may it have more than 3 decimal places. Numbers larger or more precise will be capped or rounded up. (E.g.: 0.1m will rounded up to 1m.) This may be extended in the future if we require larger or smaller quantities.\n\nWhen a Quantity is parsed from a string, it will remember the type of suffix it had, and will use the same type again when it is serialized.\n\nBefore serializing, Quantity will be put in \"canonical form\". This means that Exponent/suffix will be adjusted up or down (with a corresponding increase or decrease in Mantissa) such that:\n\n- No precision is lost - No fractional digits will be emitted - The exponent (or suffix) is as large as possible.\n\nThe sign will be omitted unless the number is negative.\n\nExamples:\n\n- 1.5 will be serialized as \"1500m\" - 1.5Gi will be serialized as \"1536Mi\"\n\nNote that the quantity will NEVER be internally represented by a floating point number. That is the whole point of this exercise.\n\nNon-canonical values will still parse as long as they are well formed, but will be re-emitted in their canonical form. (So always use canonical form, or don't diff.)\n\nThis format is intended to make it difficult to use these numbers without writing some sort of special handling code in the hopes that that will cause implementors to also use a fixed point implementation.", "x-kubernetes-int-or-string": true }

{key} integer | string Map value

Quantity is a fixed-point representation of a number. It provides convenient marshaling/unmarshaling in JSON and YAML, in addition to String() and AsInt64() accessors.

The serialization format is:

<quantity>        ::= <signedNumber><suffix>

	(Note that <suffix> may be empty, from the "" case in <decimalSI>.)

<digit>           ::= 0 | 1 | ... | 9 <digits>          ::= <digit> | <digit><digits> <number>          ::= <digits> | <digits>.<digits> | <digits>. | .<digits> <sign>            ::= "+" | "-" <signedNumber>    ::= <number> | <sign><number> <suffix>          ::= <binarySI> | <decimalExponent> | <decimalSI> <binarySI>        ::= Ki | Mi | Gi | Ti | Pi | Ei

	(International System of units; See: http://physics.nist.gov/cuu/Units/binary.html)

<decimalSI>       ::= m | "" | k | M | G | T | P | E

	(Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.)

<decimalExponent> ::= "e" <signedNumber> | "E" <signedNumber>

When a Quantity is parsed from a string, it will remember the type of suffix it had, and will use the same type again when it is serialized.

Before serializing, Quantity will be put in "canonical form". This means that Exponent/suffix will be adjusted up or down (with a corresponding increase or decrease in Mantissa) such that:

No precision is lost - No fractional digits will be emitted - The exponent (or suffix) is as large as possible.

The sign will be omitted unless the number is negative.

Examples:

1.5 will be serialized as "1500m" - 1.5Gi will be serialized as "1536Mi"

Note that the quantity will NEVER be internally represented by a floating point number. That is the whole point of this exercise.

Non-canonical values will still parse as long as they are well formed, but will be re-emitted in their canonical form. (So always use canonical form, or don't diff.)

Example: "256Mi"
Default No independent default: Defined by the parent

Validation and schema details

x-kubernetes-int-or-string: true

schemaRegistry object | null Optional 3 fields

Schema Registry integration.

Example: View JSON example

{ "url": "http://schema-registry.kafka.svc.cluster.local:8081", "latestCacheTtl": "1m", "frameRaw": false }
Default No schema default: Not declared

frameRaw boolean | null Optional

Example: false
Default No schema default: Not declared

latestCacheTtl string | null Optional

Example: "1m"
Default No schema default: Not declared

url string | null Optional

Example: "http://schema-registry.kafka.svc.cluster.local:8081"
Default No schema default: Not declared

telemetry object | null Optional 3 fields

OpenTelemetry / observability configuration. When absent, the gateway exports no telemetry.

Example: View JSON example

{ "otlpEndpoint": "http://otel-collector.observability.svc:4317", "otlpProtocol": "grpc", "sampleRatio": 1 }
Default Documented behavior: When absent, the gateway exports no telemetry.

otlpEndpoint string | null Optional

OTLP exporter endpoint URL, for example http://otel-collector.observability.svc:4317.

Example: "http://otel-collector.observability.svc:4317"
Default No schema default: Not declared

otlpProtocol string | null Optional

OTLP exporter protocol. One of grpc or http. Default grpc.

Example: "grpc"
Default Documented behavior: Default grpc.

sampleRatio number | null (double) Optional

Fraction of traces to sample, in the range [0.0, 1.0]. Default 1.0, which samples all traces.

Example: 1
Default Documented behavior: Default 1.0, which samples all traces.

Validation and schema details

Maximum: 1
Minimum: 0

tls object | null Optional 3 fields

TLS serving configuration. When absent, the TLS defaults apply: clientAuth: required and validityDays: 365.

Example: View JSON example

{ "clientAuth": "required", "validityDays": 365, "reloadInterval": "30s" }
Default Documented behavior: When absent, the TLS defaults apply: clientAuth: required and validityDays: 365.

clientAuth string | null Optional

How the gateway authenticates inbound clients. One of disabled, optional, required. Default required.

Example: "required"
Default Documented behavior: Default required.

reloadInterval string | null Optional

Cert hot-reload poll interval, as a unit-carrying duration. Default 30s.

Example: "30s"
Default Documented behavior: Default 30s.

validityDays integer | null (uint32) Optional

Serving-cert lifetime in days. Default 365.

Example: 365
Default Documented behavior: Default 365.

Validation and schema details

Minimum: 1

tuning object | null Optional 12 fields

Gateway runtime policy overrides.

Example: View JSON example

{ "clientDispatchQueueCapacity": 1024 }
Default No schema default: Not declared

clientDispatchQueueCapacity integer | null (uint) Optional

Kafka client request-dispatch queue capacity.

Example: 1024
Default No schema default: Not declared

Validation and schema details

Minimum: 1

clientFrameMax string | null Optional

Maximum accepted Kafka client frame size.

Example: "100MiB"
Default No schema default: Not declared

consumerPollTimeout string | null Optional

Example: "500ms"
Default No schema default: Not declared

forwardMaxBody string | null Optional

Example: "3MiB"
Default No schema default: Not declared

internalTopicAllowReplicationFallback boolean | null Optional

Example: false
Default No schema default: Not declared

internalTopicCreateTimeout string | null Optional

Example: "10s"
Default No schema default: Not declared

internalTopicMinCleanableDirtyRatio string | null Optional

Example: "50%"
Default No schema default: Not declared

internalTopicReplicationFactor integer | null (int16) Optional

Example: 3
Default No schema default: Not declared

Validation and schema details

Maximum: 32767
Minimum: 1

internalTopicSegment string | null Optional

Example: "1m"
Default No schema default: Not declared

ownershipWarmupEmptyPolls integer | null (uint32) Optional

Example: 3
Default No schema default: Not declared

Validation and schema details

Minimum: 1

produceMaxBody string | null Optional

Example: "2MiB"
Default No schema default: Not declared

readinessPollInterval string | null Optional

Example: "250ms"
Default No schema default: Not declared

webhooks array Optional 1 field

Inbound HTTP-webhook endpoints. Each entry creates one authenticated ingress route that produces records to targetTopic.

Example: View JSON example

[ { "name": "orders", "targetTopic": "orders", "secretRef": { "name": "orders-webhook-signing", "key": "token" }, "signatureMode": "standard_webhooks", "timestampTolerance": "300s", "maxBody": "1MiB" } ]
Default Runtime / omission: [] (no inbound webhook routes).

[] object Array item 16 fields

One inbound HTTP-webhook endpoint.

The gateway does one produce call against targetTopic for every verified POST to /<name>.

Example: View JSON example

{ "name": "orders", "targetTopic": "orders", "secretRef": { "name": "orders-webhook-signing", "key": "token" }, "signatureMode": "standard_webhooks", "timestampTolerance": "300s", "maxBody": "1MiB" }
Default No independent default: Defined by the parent

forwardHeaders array | null Optional 1 field

Request headers to preserve as Kafka record headers. Authentication credentials and webhook signatures cannot be forwarded.

Example: View JSON example

[ "content-type", "x-request-id" ]
Default No schema default: Not declared

[] string Array item

Example: "x-request-id"
Default No independent default: Defined by the parent

idempotencySource string | null Optional

How to derive the idempotency key for deduplication, for example header:X-Idempotency-Key or body_hash.

Example: "header:X-Idempotency-Key"
Default No schema default: Not declared

keySource string | null Optional

How to derive the Kafka record key from the request, for example header:X-Record-Key or body_path:.id.

Example: "header:X-Record-Key"
Default No schema default: Not declared

maxBody string | null Optional

Maximum accepted request body size in bytes. Default 1 MiB.

Example: "1MiB"
Default Documented behavior: Default 1 MiB.

name string Required

Unique name for this webhook route. It is the URL path segment.

Example: "orders"
Default No schema default: Not declared

principal string | null Optional

Kafka principal for ACL checks on produce to targetTopic. Defaults to the gateway service account principal when absent.

Example: "User:orders-hook"
Default Documented behavior: Defaults to the gateway service account principal when absent.

schemaFormat string | null Optional

Structured payload format: avro, json, or protobuf.

Example: "json"
Default No schema default: Not declared

schemaSubject string | null Optional

Optional Schema Registry subject for structured request bodies.

Example: "orders-value"
Default No schema default: Not declared

secretRef object | null Optional 2 fields

Kubernetes Secret key reference for the HMAC signing secret or the Standard Webhooks signing token required by signatureMode. The controller resolves it at render time and puts the raw secret value into the config Secret. The CRD never stores that value.

Example: View JSON example

{ "name": "orders-webhook-signing", "key": "token" }
Default No schema default: Not declared

key string Required

Key inside the data map of the Secret.

Example: "token"
Default No schema default: Not declared

name string Required

Name of the Kubernetes Secret.

Example: "orders-webhook-signing"
Default No schema default: Not declared

signatureEncoding string | null Optional

Signature encoding. One of hex or base64. Default hex.

Example: "hex"
Default Documented behavior: Default hex.

signatureHeader string | null Optional

HTTP header that carries the HMAC signature, for example X-Hub-Signature-256.

Example: "X-Hub-Signature-256"
Default No schema default: Not declared

signatureMode string | null Optional

Signature protocol. Set standard_webhooks to verify the signed message ID, timestamp, and body; omit for body-only HMAC verification.

Example: "standard_webhooks"
Default No schema default: Not declared

signaturePrefix string | null Optional

Prefix to remove from the signature header value before the gateway verifies it, for example sha256=.

Example: "sha256="
Default No schema default: Not declared

targetTopic string Required

Kafka topic that the gateway produces the records to.

Example: "orders"
Default No schema default: Not declared

timestampHeader string | null Optional

HTTP header that carries the request timestamp. The gateway uses it with timestampTolerance to reject replayed requests.

Example: "X-Webhook-Timestamp"
Default No schema default: Not declared

timestampTolerance string | null Optional

Maximum age of a request timestamp before it is rejected as a replay, as a unit-carrying duration. Default 300s.

Example: "300s"
Default Documented behavior: Default 300s.

status

status object | null Optional 3 fields

Status reported back by the controller onto each KafkaGrpcGateway.

Example: View JSON example

{ "conditions": [ { "lastTransitionTime": "2026-10-05T12:00:00Z", "message": "The resource is ready.", "reason": "Reconciled", "status": "True", "type": "Ready" } ] }
Default No schema default: Not declared

conditions array Optional 1 field

Standard Kubernetes-style condition list. It reports Ready, KafkaVersionValid, CertReady, and Degraded.

Example: View JSON example

[ { "lastTransitionTime": "2026-10-05T12:00:00Z", "message": "The resource is ready.", "reason": "Reconciled", "status": "True", "type": "Ready" } ]
Default Schema default: []

[] object Array item 5 fields

Example: View JSON example

{ "lastTransitionTime": "2026-10-05T12:00:00Z", "message": "The resource is ready.", "reason": "Reconciled", "status": "True", "type": "Ready" }
Default No schema default: Not declared

lastTransitionTime string Required

RFC3339 timestamp.

Example: "2026-10-05T12:00:00Z"
Default No schema default: Not declared

message string Required

Human-readable message.

Example: "The resource is ready."
Default No schema default: Not declared

reason string Required

CamelCase machine reason.

Example: "Reconciled"
Default No schema default: Not declared

status string Required

True, False, or Unknown.

Example: "True"
Default No schema default: Not declared

type string Required

For example, Ready.

Example: "Ready"
Default No schema default: Not declared

observedGeneration integer | null (int64) Optional

metadata.generation of the last successfully-reconciled spec.

Example: 1
Default No schema default: Not declared

readyReplicas integer | null (int32) Optional

Number of gateway replicas that report Ready now.

Example: 2
Default No schema default: Not declared

Resource schema

Resource schema object Resource schema

Auto-generated derived type for KafkaGrpcGatewaySpec via CustomResource

Example: View JSON example

{ "apiVersion": "krabka.io/v1alpha1", "kind": "KafkaGrpcGateway", "metadata": { "name": "example", "namespace": "default", "labels": { "krabka.io/cluster": "my-cluster" } }, "spec": { "allowedTargets": [ { "scheme": "https", "host": "hooks.example.com" } ] } }
Default No resource default: None