Kafka on Kubernetes without Bitnami, with Kapitan

Apache Kafka with Strimzi, in place of Bitnami's kafka chart: a KRaft cluster of three nodes that are controllers and brokers at once, an internal TLS listener with mutual TLS and ACLs, the topic "orders" and the user "orders-app" allowed to use it (its certificate is in the Secret orders-app). Needs the Strimzi Cluster Operator watching the namespace.

Replaces the Bitnami charts: kafka
Generators: kubernetes, strimzi
Operators: Strimzi

Inventory class

inventory/classes/recipes/kafka.yml, as on the main branch of kadet-hub/examples. A target includes it next to the pins below.

# Apache Kafka with Strimzi, in place of Bitnami's kafka chart: a KRaft
# cluster of three nodes that are controllers and brokers at once, an
# internal TLS listener with mutual TLS and ACLs, the topic "orders" and the
# user "orders-app" allowed to use it (its certificate is in the Secret
# orders-app). Needs the Strimzi Cluster Operator watching the namespace.
classes:
  - recipes.lib.kubernetes
  - recipes.lib.strimzi

parameters:
  generators:
    kubernetes:
      namespaces:
        kafka: {}
    strimzi:
      namespace: kafka
      kafkas:
        events:
          version: 4.3.1
          metadata_version: 4.3-IV0
          node_pools:
            dual:
              roles: [controller, broker]
              replicas: 3
              storage: 10Gi
      topics:
        orders:
          partitions: 3
      users:
        orders-app:
          authentication: tls
          acls:
            - topic: orders
              operations: [Describe, Read, Write]
            - group: orders-app
              operations: [Read]

Compile classes

The class includes one per generator; each compiles its generator once, so a target can combine several recipes.

inventory/classes/recipes/lib/kubernetes.yml

# Compiles the kubernetes generator; recipes include this class, so a target that
# combines several recipes compiles it once.
parameters:
  kapitan:
    compile:
      - {input_type: kadet, output_type: yml, input_paths: [lib/kubernetes], output_path: kubernetes/}

inventory/classes/recipes/lib/strimzi.yml

# Compiles the strimzi generator; recipes include this class, so a target that
# combines several recipes compiles it once.
parameters:
  kapitan:
    compile:
      - {input_type: kadet, output_type: yml, input_paths: [lib/strimzi], output_path: strimzi/}

Generator pins

The entries of inventory/classes/generators.yml for these generators, pinned by version and digest.

parameters:
  kapitan:
    dependencies:
    - output_path: lib/strimzi
      source: ghcr.io/kadet-hub/strimzi:1.0.1@sha256:2efec7979887658e10ec0c99d727cb935bcfc6a63cee51e3a24d336eaaa40de5
      type: oci
    - output_path: lib/kubernetes
      source: ghcr.io/kadet-hub/kubernetes:1.2.0@sha256:52017626e77dd5bf7293ce465ff0c3dc7a61dae1ae8353a56a53ffebe1bfb67c
      type: oci

How it is checked

The examples CI verifies the signed index and the attestation of every pinned generator, compiles the target, validates the output against the generators' schemas, deploys it to a new kind cluster with the operators above and fails unless the Kafka is Ready and a message is produced and consumed. The Chainsaw test holds the assertions.

All recipes · Bitnami chart alternatives