Kafka Connect Chart Values Reference

Strimzi cluster operator (validated production minimum)

>= 0.51.0

Tenant short name

axual

Instance short name

dev

Kafka Connect (KC) cluster name (unique per instance, lowercase)

my-cluster

Kafka bootstrap address for the TLS/mutual TLS (mTLS) listener

my-kafka-bootstrap:9093

Kafka bootstrap address for the SASL_SSL listener

my-kafka-bootstrap:9094

Broker CA certificate: Kubernetes Secret name and key

my-cluster-ca-cert / ca.crt

Worker mTLS client-cert: Kubernetes Secret name

connect-worker-cert

Worker Simple Authentication and Security Layer (SASL) username and password Secret name

connect-worker / connect-worker

Connector Vault URL

https://vault.example:8200

nameOverride

string

""

Replaces the chart name (kafka-connect) when building the resource name. Not in values.yaml, accepted by the schema.

fullnameOverride

string

""

Pins the KafkaConnect Custom Resource (CR) name, and so the REST API Service <fullnameOverride>-connect-api:8083. When empty, the name is the Helm release name if it already contains the chart name, otherwise <release>-kafka-connect. Not in values.yaml, accepted by the schema.

tenant / instance / clusterName

string

""

Required. The tenant and instance short names, and the Kafka Connect cluster name as registered in Self-Service. Rendered as the axual.io/tenant, axual.io/instance and axual.io/connect-cluster pod labels. The schema rejects a value that isn’t a Kubernetes label value: 1 to 63 characters matching ^[a-z0-9]([-a-z0-9._]{0,61}[a-z0-9])?$.

tls.trustedCertificates

list

[]

CA certificates that verify the broker TLS certificate, for both tls and scram-sha-512. Each entry has secretName (Kubernetes Secret) and certificate (key within the Secret), one entry per certificate in the chain.

authentication.certificateAndKey.secretName / certificate / key

string

""

Required when authentication.type: tls. Secret name, and the keys within it for the certificate (for example tls.crt) and private key (for example tls.key).

plugins

list

[]

Plugins to mount in imageVolumes mode, in one of three entry forms (see Plugin entry forms). A string or name-only entry without a catalogue spec fails the render with no spec file at plugins/<name>.yaml.

prebuiltConnectImage

string

registry.axual.io/internal/axual/kafka-connect-with-smt:0.0.8-strimzi-0.51.0-kafka-4.1.1

Full Connect image for pluginDelivery: prebuiltImage, used only when prebuiltImageProfile is empty.

prebuiltImageProfile

string

default

When set, the image is <prebuiltImageRegistry>/<profile>:<chart-version>-strimzi-<strimziVersion>-kafka-<kafkaVersion> and takes precedence over prebuiltConnectImage. Profiles: default (kafka-topic-name-transforms), with-cdc (adds debezium-postgres).

config.offset.storage.replication.factor / config.config.storage.replication.factor / config.status.storage.replication.factor

integer

1

Replication factor for the offset, config, and status storage topics. Equals the broker count in a production setup.

config.key.converter / config.value.converter

string

org.apache.kafka.connect.json.JsonConverter

Default key and value converters for connectors that don’t set their own.

config.key.converter.schemas.enable / config.value.converter.schemas.enable

boolean

false

Whether the JSON key or value payload includes the schema.

config.key.converter.apicurio.registry.url / config.value.converter.apicurio.registry.url

string

(unset)

Apicurio Registry URL read by an Apicurio Kafka Connect converter, for example io.apicurio.registry.utils.converter.AvroConverter. No effect while the converter stays at the default JsonConverter. A connector that overrides its converter to an Apicurio class supplies its own copy of this key. See the Apicurio Registry documentation for the converter classes.

config.connector.client.config.override.policy

string

All

Allows connectors to override their own producer, consumer, and admin configuration. Required for per-connector Vault identities.

resources

object

{}

Worker pod requests and limits. The chart sets none by default (the Helm Readme’s 250m/1Gi and 2Gi aren’t in values.yaml).

imagePullSecrets

list

[]

Required for development images from the private internal Harbor project. Not required for production images from the public Harbor project.

logging.level

string

INFO

One of OFF, FATAL, ERROR, WARN, INFO, DEBUG, TRACE, ALL.

logging.loggers

object

{org.reflections: ERROR, org.apache.kafka.connect.runtime.rest.RestServer: WARN}

Per-logger levels, as name: level. The default has two entries.

aclBootstrap.minInsyncReplicas

integer

1

Minimum 1. Must be less than or equal to aclBootstrap.replicationFactor.

restApi.route.annotations

object

{}

Merged with restApi.basicAuth.annotations, which wins on a key collision.

restApi.route.parentRefs / filters

list

[]

kind: HTTPRoute only. Either one set on kind: Ingress fails the render.

restApi.networkPolicy.strimziOperator.namespace

string

""

Empty allows the operator only from the Connect cluster’s own namespace. With a cluster-wide operator in another namespace, an empty value blocks every reconcile and the KafkaConnect resource never reports Ready.

KC REST URL

connect_cluster.connect_urls

Connect API authentication (basic or none)

connect_cluster.connect_api_auth_method

Worker auth method (tls or scram-sha-512)

connect_cluster.auth_method

Connector Vault URL, KV path, AppRole mount path, Vault namespace

connect_cluster.connector_vault_*

Platform Manager writer role-id and secret-id (strict on-premises only)

Governance Vault at <tenant>/<instance>/<kafka-cluster-name>/connects/<connect-cluster-name>, under the keys roleId and secretId. Not required on Axual Cloud, where Platform Manager uses its own AppRole.

Connect log viewer URL (the Log Provisioner address)

connect_cluster.log_viewer_url