KafkaRoleBinding

Field reference for the KafkaRoleBinding resource (gitops.monedula.dev/v1alpha1): every spec and status field with its type, default and validation rules.

Reference 18 of 20

Reference for monedula-gitops v1.0.0

Updated 9 October 2026

Summary

apiVersion	`gitops.monedula.dev/v1alpha1`
kind	`KafkaRoleBinding`
Scope	Namespaced
`kubectl get` columns	Cluster, Phase, Age

KafkaRoleBindingSpec carries CEL transition rules enforcing the MDS binding identity set's immutability at the apiserver (always on, webhooks or not). The set mirrors the webhook exactly: clusterRef.name, principal, role, and scope.type - changing any of these orphans the previous MDS bindings. spec.resources changes ARE allowed (the reconciler converges the set).

Rules enforced by the API server:

spec.clusterRef.name is immutable (changing it orphans the previous MDS bindings)
spec.principal is immutable (changing it orphans the previous MDS bindings)
spec.role is immutable (changing it orphans the previous MDS bindings)
spec.scope.type is immutable (changing it orphans the previous MDS bindings)

Example

kafka-role-binding.yaml

apiVersion: gitops.monedula.dev/v1alpha1
kind: KafkaRoleBinding
metadata:
  name: checkout-writer
  namespace: team-payments
spec:
  clusterRef:
    name: sample-cluster
  principal: User:svc-checkout
  role: DeveloperWrite
  scope:
    type: kafka
  resources:
    - type: Topic
      name: payments.orders
      patternType: literal
  reconciliation:
    mode: Enforce

Spec

spec.clusterRef object required

spec.clusterRef.name string required

spec.deletionPolicy string

DeletionPolicy defaults to Delete: the compiled MDS role bindings are the entire reason this resource exists, so removing them when the resource is deleted is the expected behavior. Set Orphan to leave the live MDS role bindings in place on deletion.

One of: Orphan, Delete

spec.principal string required

spec.prune boolean

spec.reconciliation object

spec.reconciliation.mode string

One of: Enforce, DetectOnly, ObserveOnly

spec.resources array<object>

spec.resources[].name string required

spec.resources[].patternType string

One of: literal, prefixed

spec.resources[].type string required

spec.role string required

spec.scope object required

spec.scope.type string required

One of: kafka, schema-registry, connect, ksql

Status

Written by the operator; read-only for users.

status.conditions array<object>

status.conditions[].lastTransitionTime string required

lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.

format: date-time

status.conditions[].message string required

message is a human readable message indicating details about the transition. This may be an empty string.

max length: 32768

status.conditions[].observedGeneration integer

observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

format: int64, min: 0

status.conditions[].reason string required

reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.

pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$, min length: 1, max length: 1024

status.conditions[].status string required

status of the condition, one of True, False, Unknown.

One of: True, False, Unknown

status.conditions[].type string required

type of condition in CamelCase or in foo.example.com/CamelCase.

pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$, max length: 316

status.lastAppliedTime string

format: date-time

status.lastCheckedTime string

format: date-time

status.observedGeneration integer