Secret key holding the htpasswd-style file. Default users.
authentication.basic.usersSecretName
string
yes
Secret with one key that holds user:cred entries, one on each line. The cred is plaintext or a $2… bcrypt hash. The operator mounts the key as a file and gives it in --basic-auth-file.
authentication.bearer
object
no
authentication.bearer.jwksEndpointUri
string
no
JWKS endpoint URI. It is necessary when mode is Jwks.
authentication.bearer.jwksExpectedAudience
string
no
Expected aud claim value.
authentication.bearer.jwksPrincipalClaim
string
no
JWT claim to use as the principal when the mode is Jwks. It overrides principalClaim on the JWKS paths.
authentication.bearer.jwksRefresh
string
no
JWKS key-set refresh interval. Default 1m.
authentication.bearer.jwksTlsSecretName
string
no
Name of the Secret whose ca.crt key the operator mounts and gives in --bearer-jwks-ca.
authentication.bearer.jwksValidIssuer
string
no
Expected iss claim value.
authentication.bearer.mode
string
yes
authentication.bearer.principalClaim
string
no
JWT claim used as the principal name. Default sub.
authentication.realm
string
no
WWW-Authenticate: basic realm="<realm>".
authentication.requireAuth
boolean
no
false
Reject anonymous requests with 401.
authorization
object
no
REST authorization, based on the Kafka ACLs.
authorization.aclRefresh
string
no
ACL-cache refresh interval. Default 30s.
authorization.enabled
boolean
no
false
authorization.superUsers
array
no
bootstrapServers
string
no
Bootstrap override for an external Kafka that the operator does not manage. When unset, the operator derives the bootstrap from the internal listener of the Kafka with the crabka.io/cluster label. Secured external brokers are future work. The managed path with the label is the secured one.
clientId
string
no
Kafka client id used by the registry. Default crabka-schema-registry.
groupId
string
no
Election group id. Default schema-registry.
healthChecks
object
no
Kubernetes probe timing overrides.
healthChecks.livenessInitialDelaySeconds
integer
no
healthChecks.livenessPeriodSeconds
integer
no
healthChecks.readinessInitialDelaySeconds
integer
no
healthChecks.readinessPeriodSeconds
integer
no
image
string
no
Container image. Defaults to the operator's --default-schema-registry-image.
kafkaClient
object
no
Client security from the SR to the broker, with SASL and TLS. It maps to the --kafka-* flags.
kafkaClient.sasl
object
no
SASL credentials for the connection from the SR to the broker.
kafkaClient.sasl.mechanism
string
yes
For example PLAIN, SCRAM-SHA-256, or SCRAM-SHA-512.
kafkaClient.sasl.secretRef
string
yes
Name of the Secret that holds the username and password keys.
kafkaClient.securityProtocol
string
no
For example PLAINTEXT, SASL_PLAINTEXT, SSL, or SASL_SSL.
kafkaClient.tls
object
no
TLS settings for the connection from the SR to the broker.
kafkaClient.tls.caSecretName
string
no
Secret with a ca.crt key that gives the broker CA.
kafkaClient.tls.serverNameOverride
string
no
Override the server name for TLS SNI and hostname verification.
replicas
integer
yes
Number of stateless replicas. All of them join the election group. Default 1.
resources
object
no
Pod resource requirements.
resources.claims
array
no
Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. This is an alpha field and requires enabling the DynamicResourceAllocation feature gate. This field is immutable. It can only be set for containers.
resources.limits
object
no
Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources.requests
object
no
Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
runtime
object
no
Schema Registry runtime policy.
runtime.clientDispatchQueueCapacity
integer
no
Kafka client request-dispatch queue capacity.
runtime.clientFrameMax
string
no
Maximum accepted Kafka client frame size.
runtime.defaultCompatibilityLevel
string
no
runtime.defaultMode
string
no
runtime.electionHeartbeatInterval
string
no
runtime.electionRebalanceTimeout
string
no
runtime.electionReconnectBackoff
string
no
runtime.electionSessionTimeout
string
no
runtime.forwardMaxBody
string
no
runtime.schemasTopicCreateTimeout
string
no
runtime.storeReaderFetchMax
string
no
runtime.storeReaderFetchMaxWait
string
no
runtime.storeReaderRetryBackoff
string
no
schemasTopic
string
no
Backing compacted topic. Default _schemas.
schemasTopicReplicationFactor
integer
no
Replication factor for _schemas when auto-created. Default 3.
tls
object
no
Server TLS for the HTTPS REST surface. None means plain HTTP.
tls.clientAuth
string
no
Client-cert mode. Default Disabled.
tls.clientCaSecretName
string
no
Secret with ca.crt that verifies the client certs. It is necessary when clientAuth is not Disabled.
tls.issuerRef
object
no
cert-manager issuer reference. Do not set it together with secretName.
tls.issuerRef.group
string
no
API group. Default cert-manager.io.
tls.issuerRef.kind
string
no
The default is Issuer. Set ClusterIssuer for an issuer with cluster scope.
tls.issuerRef.name
string
yes
tls.secretName
string
no
Secret of type kubernetes.io/tls with tls.crt and tls.key. Do not set it together with issuerRef.
Status
Field
Type
Required
Default
Description
conditions
array
no
[]
Kubernetes-style conditions: KafkaReady, Available, and Ready.
observedGeneration
integer
no
metadata.generation of the last successfully-reconciled spec.