Kafka Connect 0.8.1 Helm Readme

# Default values for the kafka-connect chart.
# Templates a Strimzi KafkaConnect custom resource; the Strimzi operator runs the pods.

# -- Override the chart name used to build the release name. Rarely needed.
# nameOverride: ""

# -- Override the KafkaConnect CR's name entirely (and so every Strimzi-derived resource: pods,
# the -connect-api Service). Without it the name follows the Helm release name. Pin this when a
# GitOps tool's release name would otherwise differ from an already-running workload's name and
# rename/orphan it.
# fullnameOverride: ""

# -- Kafka version for the Connect workers. Must be supported by the installed Strimzi operator.
kafkaVersion: "4.1.1"

# -- Number of Connect worker pods.
replicas: 1

# -- Kafka broker bootstrap per listener/auth mechanism. The worker selects by authentication.type,
# the ACL-bootstrap Job by aclBootstrap.auth.type; set only the one(s) you use. See README.
bootstrapServers:
  # -- Bootstrap for the TLS/mTLS listener (used when auth type is "tls").
  tls: ""
  # -- Bootstrap for the SASL_SSL listener (used when auth type is "scram-sha-512").
  sasl: ""

# Broker TLS trust. Required for any TLS listener (mTLS or SASL_SSL).
tls:
  # -- CA(s) that verify the broker's server cert. Example entry:
  #   - secretName: my-cluster-ca-cert
  #     certificate: ca.crt
  trustedCertificates: []

# Worker authentication to the broker. Rendered into spec.authentication.
# Supported types: tls (mTLS), scram-sha-512. SASL/SCRAM-SHA-256 is not supported (Strimzi
# supports SCRAM-SHA-512 only); SASL/PLAIN and OAuth are not supported either.
authentication:
  type: tls
  # For type: tls - a K8s Secret holding the worker's client cert.
  certificateAndKey:
    secretName: ""
    certificate: ""
    key: ""
  # For type: scram-sha-512:
  # username: ""
  # passwordSecret:
  #   secretName: ""
  #   password: password

# -- Plugin delivery mode: "imageVolumes" (default; per-plugin OCI images, Strimzi >=0.47 + K8s >=1.31)
# or "prebuiltImage" (a full Connect image with plugins baked in).
pluginDelivery: imageVolumes

# -- Strimzi operator version. Used to build the Connect base image tag.
strimziVersion: "0.51.0"

# -- Full Connect image with plugins baked in. Used only when pluginDelivery=prebuiltImage
# and prebuiltImageProfile is unset.
prebuiltConnectImage: "registry.axual.io/internal/axual/kafka-connect-with-smt:0.0.8-strimzi-0.51.0-kafka-4.1.1"

# -- Registry+repo the profile image is built from:
# <prebuiltImageRegistry>/<profile>:<chartVersion>-strimzi-<strimziVersion>-kafka-<kafkaVersion>.
# A value like every other image path, so a mirrored or air-gapped install can redirect it.
prebuiltImageRegistry: "registry.axual.io/internal/axual/kafka-connect"

# -- Profile name for pluginDelivery=prebuiltImage. Takes precedence over prebuiltConnectImage.
prebuiltImageProfile: default

# -- Registry+repo for the Connect base image: the worker image in imageVolumes mode, and the
# ACL-bootstrap Job image in every mode. Plain Strimzi plus vault-config-provider baked into /opt/kafka/libs/.
connectBaseImageRegistry: "registry.axual.io/axual/kafka-connect-base"

# -- Full override for the Connect base image. Sets the worker image in imageVolumes mode and the
# ACL-bootstrap Job image in every mode (in prebuiltImage mode it controls the Job, not the worker).
# Empty => computed from chart/strimzi/kafka versions. Pin an image when the CI-built one is missing. See README.
connectBaseImage: ""

# -- Plugins to mount (imageVolumes mode). Empty by default; add the plugins this deployment
# needs, by name. Each name must appear in plugin-catalog.yaml, which carries the full image
# reference (tag + digest) published by connect-plugins-lifecycle. An unknown name fails the
# render and lists the catalogued plugins.
plugins: []

# Plugins managed outside git by a provisioner, on top of `plugins`. Off by default.
# NOT SUPPORTED YET: no provisioner implements this side so far. Shipped now so turning it on later
# needs no new chart release.
# When on, the chart renders a Kyverno Policy that reads the ConfigMap <fullname>-managed-plugins
# (owned by the provisioner, never by the chart) and mounts one image volume per plugin into each
# new worker pod. Kyverno must run in the cluster. See README "Plugins managed by a provisioner".
managedPlugins:
  # -- Render the Kyverno Policy.
  enabled: false
  # -- Registry prefixes managed plugin images may come from. Required when enabled. Every image
  # must also be pinned by digest. Example: [registry.axual.io/axual/connect-plugins/]
  allowedRegistries: []

# Kyverno Policy that admits a pod running the Connect base image only when it is signed by this
# chart's release pipeline (cosign keyless, GitLab OIDC). Off by default. Needs Kyverno 1.19+: on
# 1.17 and 1.18 it refuses every worker pod. Kyverno must reach registry.axual.io and
# rekor.sigstore.dev, so it does not work air-gapped.
# See README "Verifying the base image".
baseImageVerification:
  # -- Render the Kyverno Policy.
  enabled: false
  # -- Regular expression the signing identity must match. The default admits only images built by
  # an X.Y.Z release tag of this repository, so main and branch images are refused.
  subjectRegExp: '^https://gitlab\.com/axual/product/kafka-connect-helm//\.gitlab-ci\.yml@refs/tags/[0-9]+\.[0-9]+\.[0-9]+$'
  # -- Secrets in the Kyverno namespace Kyverno reads the signatures with, when the registry needs
  # credentials. Example: [harbor-robot]
  registryCredentialsSecrets: []

# -- Connect's group id and its three internal topics (config, offsets, status).
#
# Leave empty and they are derived as `_<tenant>-<instance>-<clusterName>-connect[-configs|-offsets|
# -status]`. That matters because these topics live on a Kafka cluster shared by many tenants: two
# workers sharing a group id and a config topic are one Connect cluster as far as Kafka Connect is
# concerned, so a fixed default would make two customers on one Kafka cluster either merge into a
# single Connect cluster or fail to start, depending on the ACLs.
#
# Set a value to use it verbatim. Do that only when adopting a cluster that already holds state under
# different names, because renaming these topics loses the worker's connector configurations, offsets
# and status.
groupId: ""
offsetStorageTopic: ""
configStorageTopic: ""
statusStorageTopic: ""

# -- Cluster identity. All three are required. They become the pod labels axual.io/tenant,
# axual.io/instance and axual.io/connect-cluster, which is how the log viewer finds this cluster's
# pods. Use the Self-Service names in lowercase: at most 63 characters, starting and ending with a
# letter or digit.
tenant: ""
instance: ""
clusterName: ""

# -- Annotations for the worker pods. Empty by default.
#
# A log pipeline that reads container output has to be told the format, and these workers write JSON.
# Fluent Bit takes it as a pod annotation, so a cluster behind Fluent Bit wants
# `fluentbit.io/parser: json`. The chart does not set it for you, because which pipeline is in front
# of the cluster is not the chart's to know.
podAnnotations: {}

# -- Worker log configuration, rendered into a log4j2 config for Strimzi.
#
# Entries are written as ECS JSON, one object per entry, and the format is not configurable. Strimzi's
# own default is plain text and its inline logging can only set levels, so the chart hands it a whole
# file. The platform reads these logs, and it reads one format: a Java error keeps its whole stack
# trace inside one entry, and the severity is a field rather than a word in a sentence, which is what
# lets the log viewer filter by level.
#
# `kubectl logs` and k9s therefore show raw JSON. To read it by hand, see "Worker log format" in the
# README for a jq recipe, or use a k9s plugin.
logging:
  # -- Root log level.
  level: "INFO"
  # -- Levels for individual loggers, as name: level. Each one writes to the same console appender
  # as the root logger, so raising a level here really does produce more output. Any logger name is
  # fine: the log4j2 property key is generated, not derived from the name.
  loggers:
    org.reflections: "ERROR"
    org.apache.kafka.connect.runtime.rest.RestServer: "WARN"
  # -- Seconds between checks of the log config, so a change needs no restart. Strimzi copies this
  # ConfigMap into its own first and the worker mounts that copy, so a change takes a few minutes to
  # reach a running worker.
  #
  # log4j2 reconfigures only when the file has changed, not on every check, so a level raised by hand
  # through Connect's REST API (PUT /admin/loggers/<name>) is not reverted on this timer. It lasts
  # until the config really changes, or until the pod restarts.
  #
  # Setting 0 turns the check off, which also means a config change then needs a pod restart.
  monitorInterval: 30

# -- Worker-level Connect configuration. Do not add plugin.path (Strimzi manages it).
config:
  offset.storage.replication.factor: 1
  config.storage.replication.factor: 1
  status.storage.replication.factor: 1
  key.converter: org.apache.kafka.connect.json.JsonConverter
  value.converter: org.apache.kafka.connect.json.JsonConverter
  key.converter.schemas.enable: false
  value.converter.schemas.enable: false
  connector.client.config.override.policy: All

# Worker Vault integration. vault-config-provider is always on the worker classpath; this only
# wires it up at runtime when enabled=true.
vault:
  # -- Turn on Vault integration.
  enabled: false
  # -- Vault server address.
  address: ""
  # -- Auth method. APPROLE is currently the only supported value.
  authMethod: APPROLE
  # -- AppRole auth mount path.
  approlePath: approle
  # -- Vault Enterprise namespace (leave empty for OSS).
  namespace: ""
  # -- Optional Vault path read once at startup as a liveness check.
  testPath: ""
  # -- Verify the Vault server's TLS certificate.
  sslVerify: true
  # -- Recommended: name of a pre-existing K8s Secret with keys VAULT_APPROLE_ROLE_ID and
  # VAULT_APPROLE_SECRET_ID. When set, the credential stays in the Secret, not in the CR.
  credentialsSecret: ""
  # -- Inline AppRole credentials (used only when credentialsSecret is empty). These end up in the
  # KafkaConnect resource in plain text, readable by anyone who can get kafkaconnects in the
  # namespace, which SOPS on the values file does not change. Prefer credentialsSecret.
  approleRoleId: ""
  approleSecretId: ""
  # -- Optional K8s Secret with the Vault CA truststore (keys: truststore.p12, truststore.password),
  # mounted at /mnt/vault-truststore/. Required when Vault uses HTTPS with a private CA.
  truststoreSecret: ""

# Optional superuser Helm-hook Job that creates Connect's internal topics and grants the worker
# the required ACLs (never Create). Off by default; enable only where Self-Service does not
# provision them. See README "Bootstrapping internal topics and ACLs".
aclBootstrap:
  # -- Turn the bootstrap Job on.
  enabled: false
  # -- Verify the broker TLS hostname against the certificate SAN. Set false only when the broker
  # cert SAN does not include the bootstrap address (e.g. an internal Service name or localhost).
  verifyHostname: true
  auth:
    # -- Superuser identity that creates the topics + ACLs. Must be a Kafka superuser: the worker's
    # own certificate cannot grant its own ACLs. One of: tls, scram-sha-512.
    type: tls
    # For type: tls - a K8s Secret with the superuser cert + key (PEM).
    tls:
      secretName: ""
      certificate: tls.crt
      key: tls.key
    # For type: scram-sha-512 - superuser username + a Secret holding its password.
    scram:
      username: ""
      passwordSecret:
        secretName: ""
        password: password
  # -- Principal that receives the ACLs = the Connect worker identity.
  # For tls: "User:<worker cert DN>". For scram: "User:<worker username>".
  principal: ""
  # -- Optional extra principal (e.g. a "read all" distributor) that also receives the ACLs.
  distributionPrincipal: ""
  # -- Replication factor for the internal topics. Match your broker count.
  replicationFactor: 1
  # -- min.insync.replicas for the internal topics. Must be <= replicationFactor.
  minInsyncReplicas: 1
  # -- Partition counts. The config topic is always single-partition (a Connect requirement).
  offsetTopicPartitions: 25
  statusTopicPartitions: 5
  # -- segment.ms for the (compacted) internal topics; controls how often log compaction runs.
  segmentMs: 3600000
  # -- Extra lines appended verbatim to the admin client .properties (e.g. retries or extra
  # security settings). Request timeouts are already set by the chart.
  additionalClientConfigs: []
  # -- Job retry budget.
  backoffLimit: 3
  # -- Hard time limit for the Job in seconds. A stuck run fails here; kept below Helm's default
  # 300s hook timeout so the Job (not Helm) reports the failure first.
  activeDeadlineSeconds: 240
  # -- Image for the Job. Always the imageVolumes Connect base image (ships the Kafka CLI),
  # regardless of pluginDelivery - NOT the prebuiltImage worker image. Override here if needed.
  image: ""
  # -- Pod resource requests/limits for the Job. Modest defaults sized for the short-lived Kafka
  # CLI (a small JVM); override for constrained namespaces.
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      memory: 512Mi
  # -- Security contexts for the Job. Defaults enforce a hardened, restricted-PSS-friendly baseline
  # (the base image runs as non-root uid 1001; the script writes only to an emptyDir at /tmp).
  podSecurityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  securityContext:
    allowPrivilegeEscalation: false
    readOnlyRootFilesystem: true
    capabilities:
      drop:
        - ALL

# -- "false" keeps connectors created via the REST API (not reconciled from KafkaConnector CRs).
useConnectorResources: "false"

# -- Image pull secrets for private registries. Example: [{ name: regcred-harbor }]
imagePullSecrets: []

# -- Credentials for the registries the worker and plugin images come from, one entry per registry.
# The chart writes them into one kubernetes.io/dockerconfigjson Secret and adds it to the worker
# pods' imagePullSecrets. Plain text in values: SOPS-encrypt the file. The ACL bootstrap Job runs
# before this Secret exists, so the registry of its image must be covered by imagePullSecrets.
registryCredentials: []
#  - registry: registry.axual.io
#    username: robot$connect-pull
#    password: ""
#  - registry: acme.azurecr.io
#    username: 00000000-0000-0000-0000-000000000000
#    password: ""

# -- Pod resource requests/limits. None by default.
resources: {}
#  requests:
#    cpu: 250m
#    memory: 1Gi
#  limits:
#    memory: 2Gi

# -- Security contexts for the worker pods, rendered into spec.template.pod.securityContext and
# spec.template.connectContainer.securityContext. Strimzi's pod security provider is "baseline",
# which sets neither, so without these the workers run third-party connector code with the full
# default capability set and no seccomp profile.
#
# The defaults are the restricted Pod Security Standard, the same thing Strimzi's own "restricted"
# provider applies. readOnlyRootFilesystem is deliberately not among them: Connect and its plugins
# write outside the /tmp emptyDir Strimzi mounts, so it is left to be turned on per deployment.
podSecurityContext:
  runAsNonRoot: true
  seccompProfile:
    type: RuntimeDefault
securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL

# -- Container runtime for the worker pods, e.g. "kata-vm-isolation" for AKS Pod Sandboxing.
# Empty (default) means the node's normal runtime and nothing extra is installed.
#
# Strimzi's pod template has no runtimeClassName field, so the chart cannot put this on the
# KafkaConnect resource. Setting it renders a Kyverno Policy in the release namespace that adds
# the field to the worker pods at admission time, so Kyverno must be running in the cluster.
#
# Set `affinity` as well. Kubernetes normally copies a RuntimeClass's own scheduling.nodeSelector
# onto the pod, but that built-in step runs before Kyverno, so a runtime class added this way
# never gets it. Without affinity the pod can be scheduled onto a node that has no such runtime
# and will fail to start. See README "Running the workers on a different container runtime".
runtimeClassName: ""

# -- Where the worker pods may run, passed through to spec.template.pod.affinity. Strimzi has no
# nodeSelector field, so express node pinning as nodeAffinity. Example:
#  nodeAffinity:
#    requiredDuringSchedulingIgnoredDuringExecution:
#      nodeSelectorTerms:
#        - matchExpressions:
#            - key: kubernetes.azure.com/kata-vm-isolation
#              operator: In
#              values: ["true"]
affinity: {}

# -- Node taints the worker pods tolerate, passed through to spec.template.pod.tolerations.
tolerations: []

# -- Worker JVM options, passed through to spec.jvmOptions. javaSystemProperties is how worker level
# plugin settings are set. Values are plain text in the pod spec: never put secrets here.
jvmOptions: {}
#  javaSystemProperties:
#    - name: com.example.plugin.setting
#      value: some-value

# -- Extra labels for the worker pods. The chart's identity labels win over the same key.
podLabels: {}

# -- Annotations for the worker service account that Strimzi creates.
serviceAccountAnnotations: {}

# -- Extra volumes for the worker pods, passed through to spec.template.pod.volumes.
# Every connector on the worker can read them.
extraVolumes: []
#  - name: my-secret
#    secret:
#      secretName: my-secret

# -- Mounts of extraVolumes in the Connect container. readOnly defaults to true. mountPath must be
# under /mnt (a Strimzi rule). Writable mounts are fine for connector files. Only /mnt/custom-plugins
# loads plugins, and it must stay read-only.
extraVolumeMounts: []
#  - name: my-secret
#    mountPath: /mnt/my-secret

# NetworkPolicy limiting where the worker pods may connect to. Off by default. Connector code runs
# in these pods, so without it a compromised plugin reaches anything the pod network does, the
# cloud metadata endpoint (169.254.169.254) and the Kubernetes API included. Connectors share the
# pods, so the allow list is per Connect cluster. Only enforced on a CNI that supports it.
egress:
  # -- Turn the egress NetworkPolicy on.
  enabled: false
  # -- "to" peers that serve DNS, allowed on port 53. The default fits kube-dns / CoreDNS.
  dns:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
      podSelector:
        matchLabels:
          k8s-app: kube-dns
  # -- Allowed destinations, as standard NetworkPolicy egress rules. Required when enabled: list
  # the brokers, Vault, the schema registry and every connector source/sink. Other workers of this
  # cluster are always allowed. Example:
  #   - to:
  #       - ipBlock:
  #           cidr: 10.0.0.0/8
  #     ports:
  #       - port: 9093
  #   # anything public, except the cloud metadata endpoint
  #   - to:
  #       - ipBlock:
  #           cidr: 0.0.0.0/0
  #           except: [10.0.0.0/8, 169.254.169.254/32]
  rules: []

# How the Connect REST API is reached, and who may reach it at all.
#
# Kafka Connect's own Basic Auth cannot be switched on: it needs rest.extension.classes, which
# Strimzi forbids and silently drops. The password check therefore lives in whatever fronts the API,
# and every implementation wires it differently, so the chart renders the route and the credentials
# Secret and takes the wiring from you as data. README "REST API access" has working blocks for
# ingress-nginx, F5 NGINX Ingress Controller and NGINX Gateway Fabric.
restApi:
  route:
    # -- Render the route. Requires restApi.networkPolicy.enabled: a route only filters traffic that
    # chooses to go through it, the policy is what closes the direct Service route.
    enabled: false
    # -- Ingress or HTTPRoute (Gateway API).
    kind: Ingress
    # -- Hostname for the REST API. Required. Register it in Self-Service as connectUrl.
    host: ""
    # -- basic or none. Required; matches Platform Manager's BASIC_AUTH and NO_AUTH. With basic,
    # something has to carry out the check: basicAuth.annotations, route.filters or extraObjects.
    authMethod: ""
    # -- Annotations that are not about authentication. Auth ones belong in basicAuth.annotations.
    annotations: {}
    # -- IngressClass name, e.g. nginx-private or f5-nginx-public. Required for kind: Ingress.
    className: ""
    # -- TLS Secret for the host (kind: Ingress). Empty serves plain HTTP. For kind: HTTPRoute, TLS
    # belongs to the Gateway listener and this is unused.
    tlsSecret: ""
    # -- Allow basic auth over plain HTTP (kind: Ingress, no tlsSecret). Local runs only: the
    # password would otherwise leave the cluster unencrypted. No effect on kind: HTTPRoute, whose
    # TLS lives on the Gateway listener.
    allowInsecureBasicAuth: false
    # -- Gateways this route attaches to. Required for kind: HTTPRoute. Example:
    #   - name: nginx-cluster-private
    #     namespace: infra-gateways
    parentRefs: []
    # -- Filters on the route rule (kind: HTTPRoute). This is where Gateway API implementations put
    # authentication, e.g. an NGINX Gateway Fabric AuthenticationFilter through ExtensionRef.
    filters: []
  # Credentials for authMethod: basic. Point at a Secret, or let the chart create one. The shape
  # differs per implementation: ingress-nginx and NGINX Gateway Fabric read an Opaque Secret with
  # the key "auth", F5 NGINX Ingress Controller a nginx.org/htpasswd Secret with the key "htpasswd".
  basicAuth:
    # -- Existing Secret holding an htpasswd line. Wins over htpasswd; the chart then creates
    # nothing, and matching secretType/secretKey is yours to get right.
    existingSecret: ""
    # -- htpasswd line (`htpasswd -nbB <user> <pass>`) the chart writes into its own Secret.
    # A hash, never a plain password: see README "Credentials". SOPS-encrypt the values file.
    htpasswd: ""
    # -- Type and data key of the chart-created Secret. Match what your controller expects.
    secretType: Opaque
    secretKey: auth
    # -- Annotations that switch authentication on. Controller-specific by nature, so the chart
    # only merges them onto the route. Templated, so an annotation can name the Secret above
    # whichever way it was given. Example for ingress-nginx:
    #   nginx.ingress.kubernetes.io/auth-type: basic
    #   nginx.ingress.kubernetes.io/auth-secret: '{{ include "kafka-connect.restApi.authSecretName" . }}'
    #   nginx.ingress.kubernetes.io/auth-realm: "Kafka Connect REST API"
    annotations: {}
  # -- Objects the chart renders verbatim, for implementations whose authentication is a resource
  # rather than an annotation: an F5 NIC Policy, an NGF AuthenticationFilter, an Envoy Gateway
  # SecurityPolicy. Entries are templated, so `{{ include "kafka-connect.fullname" . }}` works.
  extraObjects: []
  # NetworkPolicy restricting ingress to the REST API (HTTP :8083). Only enforced on a CNI that
  # supports NetworkPolicy. With `route` it leaves the route as the only way in; on its own it is
  # defence in depth.
  networkPolicy:
    # -- Turn the NetworkPolicy on. Same-cluster Connect pods are always allowed (inter-worker
    # REST forwarding).
    enabled: false
    # -- The pods that terminate the route and forward to Connect: the ingress controller, or a
    # Gateway's data plane. Required when route.enabled, otherwise the policy blocks the very thing
    # serving the route. Rendered only when namespace is set. Verify against what runs:
    # `kubectl get pod -n <namespace> --show-labels`.
    router:
      namespace: ""
      podLabels: {}
    # -- The Strimzi operator, which calls the REST API on every reconcile: without it the cluster
    # never reports Ready. Empty namespace means the release namespace.
    strimziOperator:
      namespace: ""
      podLabels:
        strimzi.io/kind: cluster-operator
    # -- Extra peers, as standard NetworkPolicy "from" entries. Prefer a podSelector over a whole
    # namespaceSelector. Required when the policy is on without a route, because the operator alone
    # reaches nothing. Platform Manager does not belong here once a route is in place: it should
    # go through the authenticated path. Log streaming reads pod logs through the Kubernetes API and
    # never touches this port. Example:
    #   - podSelector:
    #       matchLabels:
    #         app.kubernetes.io/name: provisioner
    allowedFrom: []