KafkaAccessPolicy

Field reference for the KafkaAccessPolicy resource (gitops.monedula.dev/v1alpha1): every spec and status field with its type, default and validation rules.

Summary

apiVersion	`gitops.monedula.dev/v1alpha1`
kind	`KafkaAccessPolicy`
Scope	Namespaced
`kubectl get` columns	Cluster, Phase, Age

KafkaAccessPolicySpec carries a CEL transition rule enforcing clusterRef immutability at the apiserver (always on, webhooks or not): repointing a policy to a different cluster orphans the ACLs applied on the previous one.

Rules enforced by the API server:

spec.clusterRef.name is immutable (repointing a policy orphans ACLs on the previous cluster)

Example

kafka-access-policy.yaml

apiVersion: gitops.monedula.dev/v1alpha1
kind: KafkaAccessPolicy
metadata:
  name: sample-access-policy
  namespace: monedula-system
spec:
  clusterRef:
    name: sample-cluster
  rules:
  - principal: User:orders-service
    permission: Allow
    host: "*"
    resource:
      type: topic
      name: orders.events
      patternType: literal
    operations:
    - Write
    - Describe
  - principal: User:billing-service
    permission: Allow
    host: "*"
    resource:
      type: group
      name: billing-consumers
      patternType: literal
    operations:
    - Read
  reconciliation:
    mode: Enforce
  deletionPolicy: Delete

Spec

spec.clusterRef object required

spec.clusterRef.name string required

spec.deletionPolicy string

One of: Orphan, Delete

spec.prune boolean

Prune opts this policy's managed ACL scope into pruning: in-scope live ACLs no longer desired are deleted only when every resource whose scope covers them sets prune: true. Default false - prune candidates are reported as drift but never deleted.

spec.reconciliation object

spec.reconciliation.mode string

One of: Enforce, DetectOnly, ObserveOnly

spec.rules array<object> required

spec.rules[].host string

spec.rules[].operations array<string> required

spec.rules[].permission string

One of: Allow, Deny

spec.rules[].principal string required

spec.rules[].resource object required

spec.rules[].resource.name string required

spec.rules[].resource.patternType string

One of: literal, prefixed

spec.rules[].resource.type string required

One of: topic, group, cluster, transactionalId, delegationToken

Status

Written by the operator; read-only for users.

status.conditions array<object>

status.conditions[].lastTransitionTime string required

lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.

format: date-time

status.conditions[].message string required

message is a human readable message indicating details about the transition. This may be an empty string.

max length: 32768

status.conditions[].observedGeneration integer

observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

format: int64, min: 0

status.conditions[].reason string required

reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.

pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$, min length: 1, max length: 1024

status.conditions[].status string required

status of the condition, one of True, False, Unknown.

One of: True, False, Unknown

status.conditions[].type string required

type of condition in CamelCase or in foo.example.com/CamelCase.

pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$, max length: 316

status.drift object

status.drift.detected boolean required

status.drift.fields array<string>

status.lastAppliedTime string

format: date-time