KafkaUser

API group/version: crabka.io/v1alpha1

Spec

Field	Type	Required	Default	Description
`authentication`	object	yes		Tagged enum on `type`, in the same shape as Strimzi. The wire shape is flat and Strimzi-compatible. `type` is the discriminator, and the per-variant config fields are siblings of `type`. The custom `schema_with` writes a structural schema by hand, because the `StructuralSchemaRewriter` of kube-rs 3.x panics when `oneOf` branches share a `type` property with different `enum` values. That is the default schemars output for tagged-union enums. This is the same workaround as `Storage` in `kafka_node_pool.rs`. The operator enforces the cross-variant constraints at reconcile time, and the apiserver does not. One such constraint is that `iterations` is valid only when `type=scram-sha-512`.
`authentication.iterations`	integer	no
`authentication.maxLifetime`	string	no
`authentication.passwordLength`	integer	no
`authentication.renewBeforeExpiry`	string	no
`authentication.renewalDays`	integer	no
`authentication.renewers`	array	no
`authentication.type`	string	yes
`authentication.validityDays`	integer	no
`authorization`	object	no		Authorization is optional. A user with no ACLs can still authenticate. When this field is absent, the operator skips ACL reconciliation.
`quotas`	object	no		Optional per-user client quotas (KIP-13/124/257). This field maps onto Kafka's `(user)` quota entity through `AlterClientQuotas`, which is `api_key` 49. When the field is absent, the operator does not touch the broker's quota state. When the field is present, the operator drives the broker's quota keys for `User:<name>` toward the spec. It sets the configured fields and tombstones the omitted ones.
`quotas.consumerByteRate`	integer	no		Maximum consume-side bytes/sec. Backed by `consumer_byte_rate`.
`quotas.controllerMutationRate`	number	no		KIP-599 controller-mutation rate in creates and deletes per second. Backed by `controller_mutation_rate`.
`quotas.producerByteRate`	integer	no		Maximum produce-side bytes/sec. Backed by `producer_byte_rate`.
`quotas.requestPercentage`	integer	no		Maximum percentage of a request-handler thread's time that the user can consume, in the range `0..=100`. Backed by `request_percentage`.

Status

Field	Type	Required	Default	Description
`conditions`	array	no	`[]`	Standard Kubernetes-style condition list. It shows `Ready`.
`delegationTokenExpiryTimestampMs`	integer	no		Current `expiry_timestamp_ms` of the operator-managed delegation token. Each successful renew extends it. The operator compares it against `now` to decide when to renew, as `spec.authentication.renewBeforeExpiry` specifies.
`delegationTokenId`	string	no		Persisted `token_id`, a UUID, of the operator-managed delegation token for this user. The operator uses it across reconciles to find the same token with `DescribeDelegationToken`. It is present once the operator has issued a token with `CreateDelegationToken`.
`delegationTokenMaxTimestampMs`	integer	no		Token's absolute upper bound, which is `max_timestamp_ms`. A renew can never push `expiry_timestamp_ms` past this bound. The operator stops the renews and surfaces `TokenExpiring` once no more extension is possible.
`external`	boolean	no	`false`	`true` once the operator has reconciled a credential-less user with `type: tls-external`. It appears in `kubectl describe ku`, so that operators can see that the operator does not own this user's credentials.
`observedGeneration`	integer	no		`metadata.generation` of the last successfully-reconciled spec.
`quotasInSync`	boolean	no	`false`	True once the operator has reflected the spec's `quotas`, if any, in the broker's `(user)` client-quota state. False when `spec.quotas` is `None`, because the operator then does not touch broker quotas.
`scramSha256`	boolean	no	`false`	True once SCRAM-SHA-256 credentials are provisioned.
`scramSha512`	boolean	no	`false`	True once SCRAM-SHA-512 credentials are provisioned.
`secret`	string	no		Name of the Kubernetes Secret holding the user's password.
`tls`	boolean	no	`false`	`true` once a TLS user has a current cert Secret. It has the same shape as `scram_sha512`.
`tlsCertNotAfter`	string	no		RFC3339 timestamp of the user cert's `notAfter`. Present when `tls == true`.
`tlsPrincipal`	string	no		The principal string that the operator pinned in ACLs. It is `User:CN=alice` for TLS users, and `User:alice` for SCRAM and `tls-external` users. It is always filled in when the user is provisioned. It is load-bearing for the debug of ACL-match problems.
`username`	string	no		Effective Kafka principal name. It matches `metadata.name`.