| acl.enabled | bool | false | @param acl.enabled Enable ACLs for AutoMQ # |
| acl.superUsers | list | [] | @param acl.superUsers Comma-separated list of super users for AutoMQ ACLs # |
| broker | object | {"annotations":{},"env":[],"extraConfig":"","labels":{},"partition":0,"persistence":{"fallback":{"accessMode":"ReadWriteOnce","annotations":{},"enabled":false,"size":"20Gi","storageClass":""},"wal":{"accessMode":"ReadWriteOnce","annotations":{},"enabled":true,"size":"20Gi","storageClass":""}},"replicas":0,"resources":{},"topologySpreadConstraints":[]} | @section Broker statefulset parameters # |
| broker.annotations | object | {} | @param broker.annotations Extra annotations for AutoMQ broker pods # |
| broker.env | list | [] | @param broker.env Extra env arrays for AutoMQ broker pods # Set KAFKA_HEAP_OPTS explicitly according to resources.limits.memory. As a recommended starting # point, set both -Xms and -Xmx to 75% of the Pod memory limit and adjust for the workload. # For example, use 12g for a 16Gi limit. # E.g. # env: # - name: “KAFKA_HEAP_OPTS” # value: “-Xms12g -Xmx12g -XX:MetaspaceSize=96m” # - name: “KAFKA_OPTS” # value: “-XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError” # |
| broker.extraConfig | string | "" | @param controller.extraConfig Extra configuration file for Kafka controller nodes, rendered as a template. Auto-generated based on chart values when not specified. # |
| broker.labels | object | {} | @param broker.labels Extra labels for AutoMQ broker pods # |
| broker.partition | int | 0 | @param broker.partition Partition rolling update strategy for AutoMQ controller nodes # |
| broker.persistence | object | {"fallback":{"accessMode":"ReadWriteOnce","annotations":{},"enabled":false,"size":"20Gi","storageClass":""},"wal":{"accessMode":"ReadWriteOnce","annotations":{},"enabled":true,"size":"20Gi","storageClass":""}} | Enable persistence using Persistent Volume Claims # ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/ # |
| broker.persistence.fallback | object | {"accessMode":"ReadWriteOnce","annotations":{},"enabled":false,"size":"20Gi","storageClass":""} | fallback volume for AutoMQ broker nodes |
| broker.persistence.fallback.accessMode | string | "ReadWriteOnce" | @param broker.persistence.fallback.accessModes Persistent fallback Volume Access Modes # |
| broker.persistence.fallback.annotations | object | {} | @param broker.persistence.fallback.annotations Annotations for the fallback PVC # |
| broker.persistence.fallback.size | string | "20Gi" | @param broker.persistence.fallback.size PVC Storage Request for AutoMQ fallback volume # |
| broker.persistence.fallback.storageClass | string | "" | @param broker.persistence.fallback.storageClass PVC Storage Class for AutoMQ fallback volume # |
| broker.persistence.wal | object | {"accessMode":"ReadWriteOnce","annotations":{},"enabled":true,"size":"20Gi","storageClass":""} | wal volume for AutoMQ broker nodes # |
| broker.persistence.wal.accessMode | string | "ReadWriteOnce" | @param broker.persistence.wal.accessModes Persistent wal Volume Access Modes # |
| broker.persistence.wal.annotations | object | {} | @param broker.persistence.wal.annotations Annotations for the PVC # |
| broker.persistence.wal.size | string | "20Gi" | @param broker.persistence.wal.size PVC Storage Request for AutoMQ wal volume # |
| broker.persistence.wal.storageClass | string | "" | @param broker.persistence.wal.storageClass PVC Storage Class for the AutoMQ WAL volume. Set this during initial installation even when broker.replicas is zero because the StatefulSet volumeClaimTemplate is immutable # |
| broker.replicas | int | 0 | @param broker.replicas Number of additional data-plane-only AutoMQ broker nodes # |
| broker.resources | object | {} | @param broker.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads) # E.g. # resources: # requests: # cpu: 2 # memory: 12Gi # limits: # cpu: 3 # memory: 16Gi # |
| controller | object | {"annotations":{},"args":[],"command":[],"env":[],"extraConfig":"","labels":{},"partition":0,"persistence":{"fallback":{"accessMode":"ReadWriteOnce","annotations":{},"enabled":false,"size":"20Gi","storageClass":""},"metadata":{"accessMode":"ReadWriteOnce","annotations":{},"size":"20Gi","storageClass":""},"wal":{"accessMode":"ReadWriteOnce","annotations":{},"enabled":true,"size":"20Gi","storageClass":""}},"replicas":3,"resources":{},"topologySpreadConstraints":[]} | @section Controller statefulset parameters # |
| controller.annotations | object | {} | @param controller.annotations Extra annotations for AutoMQ Controller pods # |
| controller.env | list | [] | @param controller.env Extra env arrays for AutoMQ Controller pods # Set KAFKA_HEAP_OPTS explicitly according to resources.limits.memory. As a recommended starting # point, set both -Xms and -Xmx to 75% of the Pod memory limit and adjust for the workload. # For example, use 12g for a 16Gi limit. # E.g. # env: # - name: “KAFKA_HEAP_OPTS” # value: “-Xms12g -Xmx12g -XX:MetaspaceSize=96m” # - name: “KAFKA_OPTS” # value: “-XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError” # |
| controller.extraConfig | string | "" | @param controller.extraConfig Extra configuration file for Kafka controller nodes, rendered as a template. Auto-generated based on chart values when not specified. # |
| controller.labels | object | {} | @param controller.labels Extra labels for AutoMQ Controller pods # |
| controller.partition | int | 0 | @param controller.partition Partition rolling update strategy for AutoMQ controller nodes # |
| controller.persistence | object | {"fallback":{"accessMode":"ReadWriteOnce","annotations":{},"enabled":false,"size":"20Gi","storageClass":""},"metadata":{"accessMode":"ReadWriteOnce","annotations":{},"size":"20Gi","storageClass":""},"wal":{"accessMode":"ReadWriteOnce","annotations":{},"enabled":true,"size":"20Gi","storageClass":""}} | Enable persistence using Persistent Volume Claims # ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/ # |
| controller.persistence.fallback | object | {"accessMode":"ReadWriteOnce","annotations":{},"enabled":false,"size":"20Gi","storageClass":""} | fallback volume for AutoMQ controller nodes |
| controller.persistence.fallback.accessMode | string | "ReadWriteOnce" | @param controller.persistence.fallback.accessModes Persistent fallback Volume Access Modes # |
| controller.persistence.fallback.annotations | object | {} | @param controller.persistence.fallback.annotations Annotations for the fallback PVC # |
| controller.persistence.fallback.size | string | "20Gi" | @param controller.persistence.fallback.size PVC Storage Request for AutoMQ fallback volume # |
| controller.persistence.fallback.storageClass | string | "" | @param controller.persistence.fallback.storageClass PVC Storage Class for AutoMQ fallback volume # |
| controller.persistence.metadata | object | {"accessMode":"ReadWriteOnce","annotations":{},"size":"20Gi","storageClass":""} | kraft metadata volume for AutoMQ controller nodes # |
| controller.persistence.metadata.accessMode | string | "ReadWriteOnce" | @param controller.persistence.metadata.accessMode Persistent metadata Volume Access Modes # |
| controller.persistence.metadata.annotations | object | {} | @param controller.persistence.metadata.annotations Annotations for the PVC # |
| controller.persistence.metadata.size | string | "20Gi" | @param controller.persistence.metadata.size PVC Storage Request for AutoMQ metadata volume # |
| controller.persistence.metadata.storageClass | string | "" | @param controller.persistence.metadata.storageClass PVC Storage Class for AutoMQ metadata volume # |
| controller.persistence.wal | object | {"accessMode":"ReadWriteOnce","annotations":{},"enabled":true,"size":"20Gi","storageClass":""} | wal volume for AutoMQ controller nodes # |
| controller.persistence.wal.accessMode | string | "ReadWriteOnce" | @param controller.persistence.wal.accessModes Persistent wal Volume Access Modes # |
| controller.persistence.wal.annotations | object | {} | @param controller.persistence.wal.annotations Annotations for the PVC # |
| controller.persistence.wal.size | string | "20Gi" | @param controller.persistence.wal.size PVC Storage Request for AutoMQ wal volume # |
| controller.persistence.wal.storageClass | string | "" | @param controller.persistence.wal.storageClass PVC Storage Class for AutoMQ wal volume # |
| controller.replicas | int | 3 | @param controller.replicas Number of controller-eligible AutoMQ nodes. Use three replicas for production high availability; these nodes also serve Kafka traffic # |
| controller.resources | object | {} | @param controller.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads) # E.g. # resources: # requests: # cpu: 2 # memory: 12Gi # limits: # cpu: 3 # memory: 16Gi # |
| externalAccess.broker.enabled | bool | false | |
| externalAccess.broker.externalDns.annotations | object | {} | |
| externalAccess.broker.externalDns.enabled | bool | false | |
| externalAccess.broker.externalDns.hostname | string | "" | |
| externalAccess.broker.externalDns.privateZoneId | string | "" | |
| externalAccess.broker.externalDns.recordType | string | "A" | |
| externalAccess.broker.externalDns.ttl | int | 60 | |
| externalAccess.broker.externalDns.zoneId | string | "" | |
| externalAccess.broker.service.annotations | object | {} | |
| externalAccess.broker.service.extraPorts | list | [] | |
| externalAccess.broker.service.labels | object | {} | |
| externalAccess.broker.service.loadBalancerAnnotations | object | {} | |
| externalAccess.broker.service.type | string | "LoadBalancer" | |
| externalAccess.controller.enabled | bool | false | |
| externalAccess.controller.externalDns.annotations | object | {} | |
| externalAccess.controller.externalDns.enabled | bool | false | |
| externalAccess.controller.externalDns.hostname | string | "" | |
| externalAccess.controller.externalDns.privateZoneId | string | "" | |
| externalAccess.controller.externalDns.recordType | string | "A" | |
| externalAccess.controller.externalDns.ttl | int | 60 | |
| externalAccess.controller.externalDns.zoneId | string | "" | |
| externalAccess.controller.forceExpose | bool | false | |
| externalAccess.controller.service.annotations | object | {} | |
| externalAccess.controller.service.extraPorts | list | [] | |
| externalAccess.controller.service.labels | object | {} | |
| externalAccess.controller.service.loadBalancerAnnotations | object | {} | |
| externalAccess.controller.service.type | string | "LoadBalancer" | |
| extraVolumeMounts | list | [] | |
| extraVolumes | list | [] | |
| global.automqInstanceId | string | "" | @param global.automqInstanceId AutoMQ instance ID used for instance-scoped integrations such as managed DNS |
| global.autoscaling | object | {"enabled":false} | @section Experimental: Controller-driven Broker AutoScaling configuration |
| global.autoscaling.enabled | bool | false | @param global.autoscaling.enabled Allow the AutoMQ Controller to own the Broker replica count. When enabled, the chart omits Broker StatefulSet spec.replicas and grants permission to update the statefulsets/scale subresource. This value does not enable the AutoMQ runtime autoscaler or configure its policy. After deploying the chart with this value enabled, configure automq.autoscaling.config and automq.autoscaling.platform.config through Kafka broker-default dynamic configuration, then set automq.autoscaling.enabled=true. To disable autoscaling, reverse the order: disable the runtime autoscaler first, then let the chart manage broker.replicas again. # |
| global.cloudProvider.credentials | string | "" | @param global.cloudProvider.credentials Credential URI used by AutoMQ. Use instance:// for a VM identity, pod:// for a Kubernetes workload identity, or static:// for explicit credentials. Prefer an identity-based mode over static credentials in production E.g. instance://?role=<your_role_id> or static://?accessKey=<your_encoded_ak>&secretKey=<your_encoded_sk> # |
| global.cloudProvider.dnsCrossAccountRoleArn | string | "" | @param global.cloudProvider.dnsCrossAccountRoleArn IAM role ARN assumed for AutoMQ-managed Route 53 records Only needed when listeners.*.advertisedHostnames targets a public or private hosted zone in another AWS account. This role is not used by the separately deployed external-dns controller Value is a plain ARN string, e.g. arn:aws:iam::123456789012:role/automq-dns-env-abc # |
| global.cloudProvider.name | string | "" | @param global.cloudProvider.name Cloud provider where AutoMQ is running E.g. aws, azure, gcp, etc. # |
| global.clusterId | string | "" | @param global.clusterId Existing AutoMQ cluster ID. Leave empty to let the chart generate one |
| global.commonAnnotations | object | {} | @param global.commonAnnotations Annotations to add to all deployed objects # |
| global.commonLabels | object | {} | @param global.commonLabels Labels to add to all deployed objects # |
| global.config | string | "# Data storage (required)\ns3.data.buckets=0@s3://xxx_bucket?region=us-east-1\n\n# Operations storage (required)\ns3.ops.buckets=1@s3://xxx_bucket?region=us-east-1\n\n# WAL (required)\n# For block WAL, use block:///dev/wal and set controller.persistence.wal.enabled=true.\n# Also set broker.persistence.wal.enabled=true when broker.replicas is greater than zero.\n# For object-storage WAL, use an object-storage URI and disable the corresponding WAL PVCs.\ns3.wal.path=0@block:///dev/wal\n\n# Performance tuning\n# Recommended settings for a 3GiB heap:\n# s3.wal.cache.size=524288000\n# s3.block.cache.size=104857600\n# s3.wal.upload.threshold=62914560\n\n# Recommended settings for a 6GiB heap:\n# s3.wal.cache.size=2147483648\n# s3.block.cache.size=536870912\n# s3.wal.upload.threshold=357913941\n\n# Recommended settings for a 12GiB heap:\n# s3.wal.cache.size=4294967296\n# s3.block.cache.size=1073741824\n# s3.wal.upload.threshold=536870912\n\n# Recommended settings for a 24GiB heap:\n# s3.wal.cache.size=8589934592\n# s3.block.cache.size=2147483648\n# s3.wal.upload.threshold=1073741824\n\n# Set the broker's baseline network bandwidth in bytes/s, not its burst bandwidth.\n# s3.network.baseline.bandwidth=\n" | @param global.config Shared AutoMQ properties applied to Controller and Broker nodes # |
| global.existingSecretConfig | string | "" | NOTE: This will override secretConfig value # |
| global.image.pullPolicy | string | "Always" | |
| global.image.pullSecrets | list | [] | |
| global.image.registry | string | "automq-docker-registry-registry.cn-hangzhou.cr.aliyuncs.com" | @param global.image.registry Global Docker image registry |
| global.image.repository | string | "automq/automq-enterprise" | |
| global.image.schemaRegistry | object | {"repository":"automq/karapace","tag":"6.2.0"} | @param global.image.schemaRegistry Global Docker image schema registry |
| global.image.tag | string | "5.5.6" | |
| global.livenessProbe | object | {"failureThreshold":4,"initialDelaySeconds":60,"periodSeconds":15,"probePort":9092,"successThreshold":1,"timeoutSeconds":1} | Configure extra options for Kafka containers’ liveness probes # |
| global.livenessProbe.failureThreshold | int | 4 | @param global.livenessProbe.failureThreshold Failure threshold for livenessProbe # |
| global.livenessProbe.initialDelaySeconds | int | 60 | @param global.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe # |
| global.livenessProbe.periodSeconds | int | 15 | @param global.livenessProbe.periodSeconds Period seconds for livenessProbe # |
| global.livenessProbe.probePort | int | 9092 | @param global.probePort tcp socket port for livenessProbe and readinessProbe check # |
| global.livenessProbe.successThreshold | int | 1 | @param global.livenessProbe.successThreshold Success threshold for livenessProbe # |
| global.livenessProbe.timeoutSeconds | int | 1 | @param global.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe # |
| global.nodeAffinities | list | [{"key":"kubernetes.io/arch","values":["amd64"]}] | @param global.nodeAffinities Affinity for node assignment # |
| global.nodeTuning | object | {"enabled":false} | Optional privileged node tuning. Enables BBR and sets vm.max_map_count=524288, which supports ZGC heaps up to 128 GiB. |
| global.nodeTuning.enabled | bool | false | @param global.nodeTuning.enabled Create the privileged node-tuning DaemonSet |
| global.readinessProbe | object | {"failureThreshold":8,"initialDelaySeconds":10,"periodSeconds":10,"probePort":9092,"successThreshold":1,"timeoutSeconds":1} | Configure extra options for Kafka containers’ readiness probes # |
| global.readinessProbe.failureThreshold | int | 8 | @param global.readinessProbe.failureThreshold Failure threshold for readinessProbe # |
| global.readinessProbe.initialDelaySeconds | int | 10 | @param global.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe # |
| global.readinessProbe.periodSeconds | int | 10 | @param global.readinessProbe.periodSeconds Period seconds for readinessProbe # |
| global.readinessProbe.probePort | int | 9092 | @param global.probePort tcp socket port for livenessProbe and readinessProbe check # |
| global.readinessProbe.successThreshold | int | 1 | @param global.readinessProbe.successThreshold Success threshold for readinessProbe # |
| global.readinessProbe.timeoutSeconds | int | 1 | @param global.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe # |
| global.serviceAccount.annotations | object | {} | @param global.serviceAccount.annotations Annotations for the AutoMQ ServiceAccount AWS IRSA example: annotations: eks.amazonaws.com/role-arn: arn:aws:iam::<account-id>:role/<automq-role> When using IRSA, also set global.cloudProvider.name=aws and global.cloudProvider.credentials=pod://?. The IAM role must trust this ServiceAccount and grant access to the configured S3 buckets and any EBS operations required by the selected WAL mode. # |
| global.serviceAccount.create | bool | true | @param global.serviceAccount.create Create a ServiceAccount for AutoMQ |
| global.serviceAccount.name | string | "" | If not set and create is true, a name is generated using “automq-sa” # |
| global.tolerations | list | [{"effect":"NoSchedule","key":"dedicated","operator":"Equal","value":"automq"}] | Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ # |
| global.topologySpreadWhenUnsatisfiable | string | "DoNotSchedule" | @param global.topologySpreadWhenUnsatisfiable Topology spread when unsatisfiable schedule policy # |
| global.zoneSpreadConstraints | bool | false | @param global.zoneSpreadConstraints Availability Zone Balancing Constraint of AutoMQ nodes # |
| listeners.client[0].advertisedHostnames.baseDomain | string | "" | @param listeners.client.advertisedHostnames.baseDomain Expected Route53/Private DNS base domain for validation and advertised listener overrides |
| listeners.client[0].advertisedHostnames.enabled | bool | false | @param listeners.client.advertisedHostnames.enabled Enable AutoMQ-managed DNS records for this listener |
| listeners.client[0].advertisedHostnames.externalDns.privateZoneId | string | "" | @param listeners.client.advertisedHostnames.externalDns.privateZoneId Deprecated alias for zoneId; despite its name, it accepts public or private hosted zone IDs |
| listeners.client[0].advertisedHostnames.externalDns.zoneId | string | "" | @param listeners.client.advertisedHostnames.externalDns.zoneId Route 53 hosted zone ID |
| listeners.client[0].advertisedHostnames.externalDns.zoneType | string | "" | @param listeners.client.advertisedHostnames.externalDns.zoneType Route 53 hosted zone type. Allowed values are PUBLIC and PRIVATE |
| listeners.client[0].advertisedHostnames.hostnamePattern | string | "" | @param listeners.client.advertisedHostnames.hostnamePattern Optional template for DNS record names. Defaults to kernel fallback when empty |
| listeners.client[0].advertisedHostnames.ttl | string | nil | @param listeners.client.advertisedHostnames.ttl TTL override (seconds) for Route53 records created by the kernel. Leave null to use the default |
| listeners.client[0].containerPort | int | 9092 | @param listeners.client.containerPort Port for the Kafka client listener # |
| listeners.client[0].name | string | "PLAINTEXT" | listeners.client.name Name for the Kafka client listener |
| listeners.client[0].protocol | string | "PLAINTEXT" | @param listeners.client.protocol Security protocol for the Kafka client listener. Allowed values are ‘PLAINTEXT’, ‘SASL_PLAINTEXT’, ‘SASL_SSL’ and ‘SSL’ # |
| listeners.client[0].sslClientAuth | string | "" | @param listeners.client.sslClientAuth Optional. If SASL_SSL is enabled, configure mTLS TLS authentication type. If SSL protocol is enabled, overrides tls.authType for this listener. Allowed values are ‘none’, ‘requested’ and ‘required’ # |
| listeners.controller[0].advertisedHostnames.baseDomain | string | "" | @param listeners.controller.advertisedHostnames.baseDomain Expected Route 53 or private DNS base domain for validation and advertised listener overrides |
| listeners.controller[0].advertisedHostnames.enabled | bool | false | @param listeners.controller.advertisedHostnames.enabled Enable AutoMQ-managed DNS records for this listener |
| listeners.controller[0].advertisedHostnames.externalDns.privateZoneId | string | "" | @param listeners.controller.advertisedHostnames.externalDns.privateZoneId Deprecated alias for zoneId; despite its name, it accepts public or private hosted zone IDs |
| listeners.controller[0].advertisedHostnames.externalDns.zoneId | string | "" | @param listeners.controller.advertisedHostnames.externalDns.zoneId Route 53 hosted zone ID |
| listeners.controller[0].advertisedHostnames.externalDns.zoneType | string | "" | @param listeners.controller.advertisedHostnames.externalDns.zoneType Route 53 hosted zone type. Allowed values are PUBLIC and PRIVATE |
| listeners.controller[0].advertisedHostnames.hostnamePattern | string | "" | @param listeners.controller.advertisedHostnames.hostnamePattern Optional template for DNS record names. Defaults to kernel fallback when empty |
| listeners.controller[0].advertisedHostnames.ttl | string | nil | @param listeners.controller.advertisedHostnames.ttl TTL override in seconds for Route 53 records created by AutoMQ. Leave null to use the default |
| listeners.controller[0].containerPort | int | 9093 | @param listeners.controller.containerPort Port for the Kafka controller listener # |
| listeners.controller[0].name | string | "CONTROLLER" | @param listeners.controller.name Name for the Kafka controller listener # |
| listeners.controller[0].protocol | string | "PLAINTEXT" | @param listeners.controller.protocol Security protocol for the Kafka controller listener. Allowed values are ‘PLAINTEXT’, ‘SASL_PLAINTEXT’, ‘SASL_SSL’ and ‘SSL’ # |
| listeners.controller[0].sslClientAuth | string | "" | @param listeners.controller.sslClientAuth Optional. If SASL_SSL is enabled, configure mTLS TLS authentication type. If SSL protocol is enabled, overrides tls.authType for this listener. Allowed values are ‘none’, ‘requested’ and ‘required’ # |
| listeners.interbroker[0].advertisedHostnames.baseDomain | string | "" | @param listeners.interbroker.advertisedHostnames.baseDomain Expected Route 53 or private DNS base domain for validation and advertised listener overrides |
| listeners.interbroker[0].advertisedHostnames.enabled | bool | false | @param listeners.interbroker.advertisedHostnames.enabled Enable AutoMQ-managed DNS records for this listener |
| listeners.interbroker[0].advertisedHostnames.externalDns.privateZoneId | string | "" | @param listeners.interbroker.advertisedHostnames.externalDns.privateZoneId Deprecated alias for zoneId; despite its name, it accepts public or private hosted zone IDs |
| listeners.interbroker[0].advertisedHostnames.externalDns.zoneId | string | "" | @param listeners.interbroker.advertisedHostnames.externalDns.zoneId Route 53 hosted zone ID |
| listeners.interbroker[0].advertisedHostnames.externalDns.zoneType | string | "" | @param listeners.interbroker.advertisedHostnames.externalDns.zoneType Route 53 hosted zone type. Allowed values are PUBLIC and PRIVATE |
| listeners.interbroker[0].advertisedHostnames.hostnamePattern | string | "" | @param listeners.interbroker.advertisedHostnames.hostnamePattern Optional template for DNS record names. Defaults to kernel fallback when empty |
| listeners.interbroker[0].advertisedHostnames.ttl | string | nil | @param listeners.interbroker.advertisedHostnames.ttl TTL override in seconds for Route 53 records created by AutoMQ. Leave null to use the default |
| listeners.interbroker[0].containerPort | int | 9094 | @param listeners.interbroker.containerPort Port for the Kafka inter-broker listener # |
| listeners.interbroker[0].name | string | "BROKER" | @param listeners.interbroker.name Name for the Kafka inter-broker listener # |
| listeners.interbroker[0].protocol | string | "PLAINTEXT" | @param listeners.interbroker.protocol Security protocol for the Kafka inter-broker listener. Allowed values are ‘PLAINTEXT’, ‘SASL_PLAINTEXT’, ‘SASL_SSL’ and ‘SSL’ # |
| listeners.interbroker[0].sslClientAuth | string | "" | @param listeners.interbroker.sslClientAuth Optional. If SASL_SSL is enabled, configure mTLS TLS authentication type. If SSL protocol is enabled, overrides tls.authType for this listener. Allowed values are ‘none’, ‘requested’ and ‘required’ # |
| networkPolicy.enabled | bool | false | |
| networkPolicy.ingressRules | list | [] | @param ingressRules Add ingress rules to the AutoMQ pod(s) # e.g: # ingressRules: # - ports: target-ports # - 9102 # ipBlocks: ip block settings # - cidr: 0.0.0.0/0 |
| sasl.client | object | {"passwords":null,"users":["user1"]} | Credentials for client communications. # |
| sasl.client.passwords | string | nil | @param sasl.client.passwords Comma-separated list of passwords for client communications when SASL is enabled, must match the number of client.users # |
| sasl.client.users | list | ["user1"] | @param sasl.client.users Comma-separated list of usernames for client communications when SASL is enabled # |
| sasl.controller | object | {"password":null,"user":"controller_user"} | Credentials for controller communications. # |
| sasl.controller.password | string | nil | @param sasl.controller.password Password for controller communications when SASL is enabled. If not set and SASL is enabled for the inter-broker listener, a random password will be generated. # |
| sasl.controller.user | string | "controller_user" | @param sasl.controller.user Username for controller communications when SASL is enabled # |
| sasl.controllerMechanism | string | "PLAIN" | @param sasl.controllerMechanism SASL mechanism for controller communications. # |
| sasl.enabledMechanisms | string | "PLAIN,SCRAM-SHA-256,SCRAM-SHA-512" | NOTE: At the moment, Kafka Raft mode does not support SCRAM, that is why only PLAIN is configured. # |
| sasl.existingSecret | string | "" | |
| sasl.interBrokerMechanism | string | "PLAIN" | @param sasl.interBrokerMechanism SASL mechanism for inter broker communication. # |
| sasl.interbroker | object | {"password":null,"user":"inter_broker_user"} | Credentials for inter-broker communications. # |
| sasl.interbroker.password | string | nil | @param sasl.interbroker.password Password for inter-broker communications when SASL is enabled. If not set and SASL is enabled for the controller listener, a random password will be generated. # |
| sasl.interbroker.user | string | "inter_broker_user" | @param sasl.interbroker.user Username for inter-broker communications when SASL is enabled # |
| schemaRegistry | object | {"create":false,"env":[]} | SchemaRegistry configuration # |
| schemaRegistry.create | bool | false | @param schemaRegistry.create Deploy the built-in Karapace Schema Registry sidecar on controller pods |
| schemaRegistry.env | list | [] | Karapace client configuration https://github.com/Aiven-Open/karapace # - KARAPACE_BOOTSTRAP_URI # - KARAPACE_SECURITY_PROTOCOL # - KARAPACE_SASL_MECHANISM # - KARAPACE_SASL_PLAIN_USERNAME # - KARAPACE_SASL_PLAIN_PASSWORD |
| service | object | {"headless":{"annotations":{},"labels":{}}} | Service for AutoMQ, service type: ClusterIP # |
| service.headless | object | {"annotations":{},"labels":{}} | Headless service properties # |
| service.headless.annotations | object | {} | @param service.headless.annotations Annotations for the cluster headless service. # |
| service.headless.labels | object | {} | @param service.headless.labels Labels for the cluster headless service. # |
| tls | object | {"autoGenerated":false,"customAltNames":[],"endpointIdentificationAlgorithm":"https","existingSecret":"","jksKeystoreKey":"","jksTruststoreKey":"","jksTruststoreSecret":"","keyPassword":"","keystorePassword":"","passwordsSecret":"","passwordsSecretKeystoreKey":"keystore-password","passwordsSecretPemPasswordKey":"","passwordsSecretTruststoreKey":"truststore-password","pemChainIncluded":false,"selfConfigure":false,"sslClientAuth":"required","truststorePassword":"","type":"JKS"} | Kafka TLS settings, required if SSL or SASL_SSL listeners are configured # |
| tls.autoGenerated | bool | false | @param tls.autoGenerated Generate automatically self-signed TLS certificates for Kafka brokers. Currently only supported if tls.type is PEM # Note: ignored when using ‘jks’ format or tls.existingSecret is not empty # |
| tls.customAltNames | list | [] | @param tls.customAltNames Optionally specify extra list of additional subject alternative names (SANs) for the automatically generated TLS certificates. # |
| tls.endpointIdentificationAlgorithm | string | "https" | @param tls.endpointIdentificationAlgorithm The endpoint identification algorithm to validate server hostname using server certificate # Disable server host name verification by setting it to an empty string. # ref: https://docs.confluent.io/current/kafka/authentication_ssl.html#optional-settings # |
| tls.existingSecret | string | "" | @param tls.existingSecret Name of the existing secret containing the TLS certificates for the Kafka nodes. # - For tls.type=PEM, the secret must contain a shared CA (kafka-ca.crt) plus a single certificate/key pair (kafka.crt + kafka.key or tls.crt + tls.key). The chart converts this bundle into the JKS keystore/truststore files automatically. # - For tls.type=JKS, the secret must contain kafka.keystore.jks and kafka.truststore.jks (also shared by all nodes). Per-role or per-pod keystores are no longer required. # The shared certificate must have SANs covering every advertised hostname. |
| tls.jksKeystoreKey | string | "" | @param tls.jksKeystoreKey The secret key from the tls.existingSecret containing the keystore # Note: ignored when using ‘pem’ format for certificates. # |
| tls.jksTruststoreKey | string | "" | @param tls.jksTruststoreKey The secret key from the tls.existingSecret or tls.jksTruststoreSecret containing the truststore # Note: ignored when using ‘pem’ format for certificates. # |
| tls.jksTruststoreSecret | string | "" | @param tls.jksTruststoreSecret Name of the existing secret containing your truststore if truststore not existing or different from the one in the tls.existingSecret # Note: ignored when using ‘pem’ format for certificates. # |
| tls.keyPassword | string | "" | @param tls.keyPassword Password to access the PEM key when it is password-protected. # Note: ignored when using ‘tls.passwordsSecret’ # |
| tls.keystorePassword | string | "" | @param tls.keystorePassword Password to access the JKS keystore when it is password-protected. Ignored when ‘tls.passwordsSecret’ is provided. # When using tls.type=PEM, the generated keystore will use this password or randomly generate one. # |
| tls.passwordsSecret | string | "" | @param tls.passwordsSecret Name of the secret containing the password to access the JKS files or PEM key when they are password-protected. (key: password) # |
| tls.passwordsSecretKeystoreKey | string | "keystore-password" | @param tls.passwordsSecretKeystoreKey The secret key from the tls.passwordsSecret containing the password for the Keystore. # |
| tls.passwordsSecretPemPasswordKey | string | "" | @param tls.passwordsSecretPemPasswordKey The secret key from the tls.passwordsSecret containing the password for the PEM key inside ‘tls.passwordsSecret’. # |
| tls.passwordsSecretTruststoreKey | string | "truststore-password" | @param tls.passwordsSecretTruststoreKey The secret key from the tls.passwordsSecret containing the password for the Truststore. # |
| tls.pemChainIncluded | bool | false | @param tls.pemChainIncluded Flag to denote that the Certificate Authority (CA) certificates are bundled with the endpoint cert. # Certificates must be in proper order, where the top certificate is the leaf and the bottom certificate is the top-most intermediate CA. # |
| tls.selfConfigure | bool | false | @param tls.selfConfigure Enable self-configured TLS certificates for AutoMQ # |
| tls.sslClientAuth | string | "required" | @param tls.sslClientAuth Sets the default value for the ssl.client.auth Kafka setting. # ref: https://docs.confluent.io/current/kafka/authentication_ssl.html#optional-settings # |
| tls.truststorePassword | string | "" | @param tls.truststorePassword Password to access the JKS truststore when it is password-protected. Ignored when ‘tls.passwordsSecret’ is provided. # When using tls.type=PEM, the generated keystore will use this password or randomly generate one. # |
| tls.type | string | "JKS" | @param tls.type Format to use for TLS certificates. Allowed types: JKS and PEM # |
A Helm chart for AutoMQ Enterprise