KafkaQuota

Field reference for the KafkaQuota resource (gitops.monedula.dev/v1alpha1): every spec and status field with its type, default and validation rules.

Summary

apiVersion	`gitops.monedula.dev/v1alpha1`
kind	`KafkaQuota`
Scope	Namespaced
`kubectl get` columns	Cluster, Phase, Age

KafkaQuotaSpec carries CEL transition rules enforcing entity and clusterRef immutability at the apiserver (always on, webhooks or not): changing the entity orphans the previous entity's quota (a delete + create of a different Kafka quota entity), and repointing clusterRef orphans the quota on the previous cluster. CEL object equality compares the whole entity block field-wise, mirroring the webhook's resolved-entity-key comparison (all components are scalars).

Rules enforced by the API server:

spec.entity is immutable (changing it orphans the previous entity's quota)
spec.clusterRef.name is immutable (repointing a quota orphans the previous cluster's quota)

Example

kafka-quota.yaml

apiVersion: gitops.monedula.dev/v1alpha1
kind: KafkaQuota
metadata:
  name: sample-quota
  namespace: monedula-system
spec:
  clusterRef:
    name: sample-cluster
  entity:
    user: User:svc-checkout
    clientId: batch
  limits:
    producerByteRate: 1048576
    consumerByteRate: 2097152
  reconciliation:
    mode: Enforce

Spec

spec.clusterRef object required

spec.clusterRef.name string required

spec.entity object required

QuotaEntity identifies a Kafka quota target. It is either an ip dimension (ip or ipDefault) OR a user/client-id dimension - never both. A specific name XOR its per-type default; at least one component required.

spec.entity.clientId string

ClientId is a specific client-id. Mutually exclusive with clientIdDefault.

spec.entity.clientIdDefault boolean

ClientIdDefault targets the client-id-default entity (Kafka null name).

spec.entity.ip string

Ip targets a Kafka ip quota entity by a single IPv4/IPv6 literal. It is a SEPARATE quota dimension: mutually exclusive with ipDefault AND with every user/client-id component (an entity is either ip or user/client-id, never both). Validated as a net.ParseIP literal (no CIDR/hostname).

spec.entity.ipDefault boolean

IpDefault targets the ip-default entity (Kafka null name).

spec.entity.user string

User in KafkaPrincipal form "User:<name>" (the "User:" prefix is stripped for Kafka's quota API). Mutually exclusive with userDefault.

spec.entity.userDefault boolean

UserDefault targets the user-default entity (Kafka null name).

spec.limits object required

QuotaLimits are the five Kafka quota value keys. At least one required; authoritative for the entity (an unset dimension present live is removed).

spec.limits.connectionCreationRate number

ConnectionCreationRate caps new connections/second. It is valid ONLY on an ip entity (and is the only limit valid there); rejected on user/client-id entities.

min: 0

spec.limits.consumerByteRate number

ConsumerByteRate caps fetch throughput in bytes/second.

min: 0

spec.limits.controllerMutationRate number

ControllerMutationRate caps the create/delete topic+partition mutation rate (mutations/second).

min: 0

spec.limits.producerByteRate number

ProducerByteRate caps produce throughput in bytes/second.

min: 0

spec.limits.requestPercentage number

RequestPercentage caps broker request-handler time as a percent (may exceed 100 on multi-core brokers).

min: 0

spec.reconciliation object

spec.reconciliation.mode string

One of: Enforce, DetectOnly, ObserveOnly

Status

Written by the operator; read-only for users.

status.conditions array<object>

status.conditions[].lastTransitionTime string required

lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.

format: date-time

status.conditions[].message string required

message is a human readable message indicating details about the transition. This may be an empty string.

max length: 32768

status.conditions[].observedGeneration integer

observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

format: int64, min: 0

status.conditions[].reason string required

reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.

pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$, min length: 1, max length: 1024

status.conditions[].status string required

status of the condition, one of True, False, Unknown.

One of: True, False, Unknown

status.conditions[].type string required

type of condition in CamelCase or in foo.example.com/CamelCase.

pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$, max length: 316

status.drift object

status.drift.detected boolean required

status.drift.fields array<string>

status.lastAppliedTime string

format: date-time

status.lastCheckedTime string

format: date-time

status.observedGeneration integer

format: int64

status.observedLimits object

QuotaLimits are the five Kafka quota value keys. At least one required; authoritative for the entity (an unset dimension present live is removed).

status.observedLimits.connectionCreationRate number

ConnectionCreationRate caps new connections/second. It is valid ONLY on an ip entity (and is the only limit valid there); rejected on user/client-id entities.

min: 0

status.observedLimits.consumerByteRate number

ConsumerByteRate caps fetch throughput in bytes/second.

min: 0

status.observedLimits.controllerMutationRate number

ControllerMutationRate caps the create/delete topic+partition mutation rate (mutations/second).

min: 0

status.observedLimits.producerByteRate number

ProducerByteRate caps produce throughput in bytes/second.

min: 0

status.observedLimits.requestPercentage number

RequestPercentage caps broker request-handler time as a percent (may exceed 100 on multi-core brokers).