helm pull oci://automq.azurecr.io/helm/automq-software-chart --version <version-from-release-notes>

global:
  cloudProvider:
    name: "Replace With Your True Cloud Provider Name"
    credentials: "Replace With Your True Your Credentials"
  config: |
    s3.ops.buckets=Replace With Your True Ops Bucket URL
    s3.data.buckets=Replace With Your True Data Bucket URL
    s3.wal.path=Replace With Your True WAL PATH

controller:
  resources:
    requests:
      cpu: "3000m"
      memory: "12Gi"
    limits:
      cpu: "4000m"
      memory: "16Gi"
  persistence:
    metadata:
      storageClass: "Replace With Your True StroageClass"
    wal:
      enabled: false

  annotations:

  env:
    - name: "KAFKA_JVM_PERFORMANCE_OPTS"
      value: "-server -XX:+UseZGC -XX:ZCollectionInterval=5"
    - name: "KAFKA_OPTS"
      value: "-XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError"
    - name: "KAFKA_HEAP_OPTS"
      value: "-Xmx6g -Xms6g -XX:MaxDirectMemorySize=6g -XX:MetaspaceSize=96m"
    - name: "KAFKA_S3_ACCESS_KEY"
      value: "Replace With Your True ACCESS_KEY"
    - name: "KAFKA_S3_SECRET_KEY"
      value: "Replace With Your True SECRET_KEY"

broker:
  replicas: 0
  resources:
    requests:
      cpu: "3000m"
      memory: "12Gi"
    limits:
      cpu: "4000m"
      memory: "16Gi"

  persistence:
    wal:
      enabled: false

  annotations:

  env:
    - name: "KAFKA_JVM_PERFORMANCE_OPTS"
      value: "-server -XX:+UseZGC -XX:ZCollectionInterval=5"
    - name: "KAFKA_OPTS"
      value: "-XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError"
    - name: "KAFKA_HEAP_OPTS"
      value: "-Xmx6g -Xms6g -XX:MaxDirectMemorySize=6g -XX:MetaspaceSize=96m"
    - name: "KAFKA_S3_ACCESS_KEY"
      value: "Replace With Your True ACCESS_KEY"
    - name: "KAFKA_S3_SECRET_KEY"
      value: "Replace With Your True SECRET_KEY"
externalAccess:
  controller:
    enabled: true
    service:
      type: LoadBalancer
      loadBalancerAnnotations:
        <Add Cloud Provider Specific Annotations Here>

      extraPorts:
        - name: "tcp-9092"
          port: 9092
          protocol: "TCP"
          targetPort: 9092

global:
  cloudProvider: 
    credentials: static://?accessKey=<your-accesskey>&secretKey=<your-secretkey>

controller:
  env:
    - name: "KAFKA_S3_ACCESS_KEY"
      value: "Replace With Your True ACCESS_KEY"
    - name: "KAFKA_S3_SECRET_KEY"
      value: "Replace With Your True SECRET_KEY"

broker:
  env:
    - name: "KAFKA_S3_ACCESS_KEY"
      value: "Replace With Your True ACCESS_KEY"
    - name: "KAFKA_S3_SECRET_KEY"
      value: "Replace With Your True SECRET_KEY"

global:
  zoneSpreadConstraints: true
  topologySpreadWhenUnsatisfiable: DoNotSchedule
  config: |
    automq.zonerouter.channels=0@s3://<data-bucket>?region=<region>

controller:
  replicas: 3

broker:
  replicas: 0

helm upgrade --install <release-name> oci://automq.azurecr.io/helm/automq-software-chart --version <version-from-release-notes> -f <your-custom-values.yaml> --namespace <namespace> --create-namespace

kubectl get svc --namespace <namespace> -l "app.kubernetes.io/component=controller" -w

./kafka-console-producer.sh \
  --bootstrap-server <release-name>-automq-enterprise-controller-0.<release-name>-automq-enterprise-controller-headless.<namespace>.svc.cluster.local:9092 \
  --topic test-topic

kubectl get svc automq-release-automq-enterprise-controller-loadbalancer -n automq -o jsonpath='{.status.loadBalancer.ingress[0].hostname}'

# Replace <EXTERNAL-IP> with the address from the previous step
./kafka-console-producer.sh \
  --bootstrap-server <EXTERNAL-IP>:9092 \
  --topic test-topic

global:  
  tolerations:  
  - key: "dedicated"  
    operator: "Equal"  
    value: "automq"  
    effect: "NoSchedule"  

controller:  
  nodeAffinity:  
    requiredDuringSchedulingIgnoredDuringExecution:  
      nodeSelectorTerms:  
      - matchExpressions:  
        - key: "node-type"  
          operator: In  
          values: ["automq-worker"]  

global:
  autoscaling:
    enabled: true

kubectl get statefulsets -n "<kubernetes-namespace>"

# 示例容量范围，请根据业务负载和节点预算调整。
# 容量总数包含 3 个固定的 combined Broker/Controller 节点。
# minCount=6：至少 3 个固定节点 + 3 个纯 Broker。
# maxCount=30：最多 3 个固定节点 + 27 个纯 Broker。
# unit=3：纯 Broker 容量按 3 个一组对齐，配合三 AZ 部署。
# targetTracking.cpu/network.enabled：启用 CPU/network 指标进行容量计算。
# targetRatio=1.0：以 AutoMQ 的 80% 原始利用率安全水位为目标。
# 已启用信号的 targetRatio 必须显式配置，没有默认值。
# CPU/network 采用容量需求较大的建议，并受上下限和安全检查约束。
# 未配置的 scalingBehavior 使用默认值，包括 30 分钟缩容稳定窗口。
automq.autoscaling.config={"capacity":{"minCount":6,"maxCount":30,"unit":3},"targetTracking":{"cpu":{"enabled":true,"targetRatio":1.0},"network":{"enabled":true,"targetRatio":1.0}}}

# platform=k8s：通过 Kubernetes API 调整纯 Broker StatefulSet 副本数。
# kubernetesNamespace：替换为 Helm release 所在的 namespace。
# brokerStatefulSetName：替换为实际纯 Broker StatefulSet 名称，不要填写 Controller。
automq.autoscaling.platform.config={"platform":"k8s","kubernetesNamespace":"<kubernetes-namespace>","brokerStatefulSetName":"<broker-statefulset-name>"}

# 运行时开关；false 表示停止自动伸缩，并保留当前副本数。
# 同时需要在 Chart 中设置 global.autoscaling.enabled=true。
automq.autoscaling.enabled=true

bin/kafka-configs.sh \
  --bootstrap-server "<bootstrap-server>" \
  --command-config admin.properties \
  --entity-type brokers --entity-default --alter \
  --add-config-file autoscaling.properties

bin/kafka-configs.sh \
  --bootstrap-server "<bootstrap-server>" \
  --command-config admin.properties \
  --entity-type brokers --entity-default --describe

kubectl get statefulsets,pods -n "<kubernetes-namespace>" -w

bin/kafka-configs.sh \
  --bootstrap-server "<bootstrap-server>" \
  --command-config admin.properties \
  --entity-type brokers --entity-default --alter \
  --add-config automq.autoscaling.enabled=false

listeners:
  client:
    - containerPort: 9092
      protocol: SASL_PLAINTEXT
      name: BROKER_SASL
  controller:
    - containerPort: 9093
      protocol: SASL_PLAINTEXT
      name: CONTROLLER_SASL
  interbroker:
    - containerPort: 9094
      protocol: SASL_PLAINTEXT
      name: BROKER_SASL

sasl:
  controller:
    user: "user1"
    password: "PWDxxx"
  interbroker:
    user: "user2"
    password: "PWDxxx"
  client:
    user: "user3"
    password: "PWDxxx"

listeners:
  client:
    - name: CLIENT_SASL_SSL
      containerPort: 9112
      protocol: SASL_SSL
      advertisedHostnames:
        enabled: true
        baseDomain: automq.private
        externalDns:
          privateZoneId: <your-route53-zone-id>

externalAccess:
  controller:
    enabled: true
    service:
      type: LoadBalancer
    externalDns:
      enabled: true
      hostname: automq-bootstrap.automq.private
      privateZoneId: <your-route53-zone-id>
      recordType: A
      ttl: 60

global:
  config: |
    s3.telemetry.metrics.exporter.uri=prometheus://?host=0.0.0.0&port=9090

controller:
  annotations:
    prometheus.io/automq-scrape: "true"
    prometheus.io/automq-port: "9090"
    prometheus.io/automq-path: "/metrics"

broker:
  annotations:
    prometheus.io/automq-scrape: "true"
    prometheus.io/automq-port: "9090"
    prometheus.io/automq-path: "/metrics"

curl --fail http://<pod-ip>:9090/metrics

# 1. 为 SASL_SSL 客户端定义监听器
listeners:
  client:
    - containerPort: 9112
      protocol: SASL_SSL
      name: CLIENT_SASL_SSL
      advertisedHostnames:
        enabled: true
        baseDomain: automq.private
        externalDns:
          privateZoneId: <your-route53-zone-id>

# 2. 引用包含服务器 TLS 证书的 Secret
tls:
  type: PEM
  existingSecret: automq-server-tls # Secret 中必须包含 server.crt, server.key, ca.crt

# 3. 从外部暴露 SASL_SSL 端口
externalAccess:
  controller:
    enabled: true
    service:
      type: LoadBalancer
      extraPorts:
        - name: "sasl-client"
          port: 9112
          protocol: "TCP"
          targetPort: 9112
    externalDns:
      enabled: true
      hostname: automq-bootstrap.automq.private
      privateZoneId: <your-route53-zone-id>
      recordType: A
      ttl: 60

# 4. 启用 ACL 并定义 SASL 超级用户
acl:
  enabled: true
  superUsers:
    - "_automq"

# 5. 为超级用户和普通客户端用户定义凭证
sasl:
  controller:
    password: "\<strong-password-for-automq\>"
    user: _automq
  interbroker:
    password: "\<strong-password-for-automq\>"
    user: _automq
  client:
    users:
      - "my-user" # 一个普通的应用用户
    passwords:
      - "<password-for-my-user>"

2.  **授予权限:**
使用 `kafka-acls.sh` 和管理员配置为 `my-user` 授予 `WRITE` 和 `READ` 权限。
```bash
kafka-acls.sh --bootstrap-server <your-load-balancer-dns>:9112 
  --command-config superuser.properties 
  --add --allow-principal User:my-user --operation WRITE --topic my-topic

# 'my-user' 的 client.properties
security.protocol=SASL_SSL
sasl.mechanism=PLAIN
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required 
  username="my-user" 
  password="<password-for-my-user>";

# 指向包含 CA 证书的 PEM 文件路径
ssl.truststore.certificates=/path/to/your/ca.crt

# 'my-user' 的 client.properties
security.protocol=SASL_SSL
sasl.mechanism=PLAIN
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required 
  username="my-user" 
  password="<password-for-my-user>";

ssl.truststore.location=/path/to/your/truststore.jks
ssl.truststore.password=your_truststore_password

# 1. 为 mTLS 客户端定义监听器并要求客户端认证
listeners:
  client:
    - containerPort: 9122
      protocol: SSL
      name: CLIENT_MTLS
      # 此项强制启用 mTLS
      sslClientAuth: required
      advertisedHostnames:
        enabled: true
        baseDomain: automq.private
        externalDns:
          privateZoneId: <your-route53-zone-id>

# 2. 引用包含服务器 TLS 证书的 Secret
tls:
  type: PEM
  existingSecret: automq-server-tls

# 3. 从外部暴露 SSL 端口
externalAccess:
  controller:
    enabled: true
    service:
      type: LoadBalancer
      extraPorts:
        - name: "tls-client"
          port: 9122
          protocol: "TCP"
          targetPort: 9122
    externalDns:
      enabled: true
      hostname: automq-bootstrap.automq.private
      privateZoneId: <your-route53-zone-id>
      recordType: A
      ttl: 60

# 4. 启用 ACL 并定义基于证书的超级用户
acl:
  enabled: true
  # Principal 是 'User:' + 管理员证书的完整主题
  superUsers:
    - "User:CN=automq-admin"

# 5. SASL 仍用于内部通信
sasl:
  # ... _automq 的配置 ...

# 'my-app' 的 client.properties
security.protocol=SSL
ssl.truststore.certificates=/path/to/your/ca.crt
ssl.keystore.key=/path/to/your/myapp.key
ssl.keystore.certificate.chain=/path/to/your/myapp.crt

# 'my-app' 的 client.properties
security.protocol=SSL
ssl.truststore.location=/path/to/your/truststore.jks
ssl.truststore.password=your_truststore_password
ssl.keystore.location=/path/to/your/myapp-keystore.jks
ssl.keystore.password=your_keystore_password