Explicit SSRF allowlist for outbound HTTP targets. The controller derives the entries from the targetUrl of each subscription. Use this field to add more allowed hosts.
authz
object
no
Authorization configuration. When absent, the gateway uses simple ACL-based authorization, which is mode simple.
authz.aclRefresh
string
no
How often the gateway refreshes its ACL cache from the broker, as a unit-carrying duration. Default 60s.
authz.bearer
object
no
Bearer-token authentication configuration. When absent, bearer auth is disabled.
authz.bearer.allowableClockSkew
string
no
Allowable clock skew for bearer-token timestamps, as a unit-carrying duration such as 30s or 500ms.
authz.bearer.mode
string
no
Bearer auth mode. One of off or unsecured. Default off.
authz.bearer.principalClaim
string
no
JWT claim used as the Kafka principal. Default sub.
authz.mode
string
no
Authorization mode. One of off or simple. Default simple, which is ACL-based and reads the KafkaUser ACLs from the broker.
authz.superUsers
array
no
Principal strings, for example User:admin, that bypass all ACL checks.
dedup
object
no
Configuration for the deduplication topic below the idempotent produce, which gives exactly-once delivery. When absent, the controller defaults apply.
dedup.ownershipGroup
string
no
Consumer group used to divide dedup ownership between replicas. Defaults to a value derived from the gateway name.
dedup.partitions
integer
no
Number of partitions for the dedup topic. Default 8.
dedup.topic
string
no
Kafka topic used to store dedup state. Defaults to <gateway-name>-dedup when absent.
dedup.txnIdPrefix
string
no
Prefix for transactional producer IDs. Defaults to the gateway name. The full transactional.id is <prefix>-<partition>.
dedup.window
string
no
Dedup window, as a unit-carrying duration such as 24h or 30m. The gateway drops records with the same idempotency key inside this window. Default 24h.
healthChecks
object
no
Kubernetes readiness and liveness probe timing.
healthChecks.livenessInitialDelaySeconds
integer
no
healthChecks.livenessPeriodSeconds
integer
no
healthChecks.readinessInitialDelaySeconds
integer
no
healthChecks.readinessPeriodSeconds
integer
no
image
string
no
Container image override. When absent, the operator uses its --default-gateway-image flag.
membershipTopic
string
no
Internal membership / owner-routing topic.
outboundSubscriptions
array
no
Outbound webhook subscriptions. Each entry reads from sourceTopics and HTTP-POSTs records to targetUrl.
replicas
integer
no
Number of gateway replicas. Defaults to 1 when absent.
resources
object
no
CPU / memory resource requests and limits for the gateway container.
resources.claims
array
no
Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. This is an alpha field and requires enabling the DynamicResourceAllocation feature gate. This field is immutable. It can only be set for containers.
resources.limits
object
no
Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources.requests
object
no
Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
schemaRegistry
object
no
Schema Registry integration.
schemaRegistry.frameRaw
boolean
no
schemaRegistry.latestCacheTtl
string
no
schemaRegistry.url
string
no
telemetry
object
no
OpenTelemetry / observability configuration. When absent, the gateway exports no telemetry.
telemetry.otlpEndpoint
string
no
OTLP exporter endpoint URL, for example http://otel-collector.observability.svc:4317.
telemetry.otlpProtocol
string
no
OTLP exporter protocol. One of grpc or http. Default grpc.
telemetry.sampleRatio
number
no
Fraction of traces to sample, in the range [0.0, 1.0]. Default 1.0, which samples all traces.
tls
object
no
TLS serving configuration. When absent, the TLS defaults apply: clientAuth: required and validityDays: 365.
tls.clientAuth
string
no
How the gateway authenticates inbound clients. One of disabled, optional, required. Default required.
tls.reloadInterval
string
no
Cert hot-reload poll interval, as a unit-carrying duration. Default 30s.
tls.validityDays
integer
no
Serving-cert lifetime in days. Default 365.
tuning
object
no
Gateway runtime policy overrides.
tuning.clientDispatchQueueCapacity
integer
no
Kafka client request-dispatch queue capacity.
tuning.clientFrameMax
string
no
Maximum accepted Kafka client frame size.
tuning.consumerPollTimeout
string
no
tuning.forwardMaxBody
string
no
tuning.internalTopicAllowReplicationFallback
boolean
no
tuning.internalTopicCreateTimeout
string
no
tuning.internalTopicMinCleanableDirtyRatio
string
no
tuning.internalTopicReplicationFactor
integer
no
tuning.internalTopicSegment
string
no
tuning.ownershipWarmupEmptyPolls
integer
no
tuning.produceMaxBody
string
no
tuning.readinessPollInterval
string
no
webhooks
array
no
Inbound HTTP-webhook endpoints. Each entry creates one authenticated ingress route that produces records to targetTopic.
Status
Field
Type
Required
Default
Description
conditions
array
no
[]
Standard Kubernetes-style condition list. It reports Ready, KafkaVersionValid, CertReady, and Degraded.
observedGeneration
integer
no
metadata.generation of the last successfully-reconciled spec.