Strimzi on Kubernetes without Helm, with Kapitan

The Strimzi Cluster Operator 1.3.0, watching every namespace, with its RBAC and the CRDs, rendered by the kadet-hub kubernetes generator 1.9.0. Derived from Strimzi’s operator chart, which the kafka recipe requires.

Source chart: oci://quay.io/strimzi-helm/strimzi-kafka-operator:1.3.0@sha256:08852fb5aca9782750ec1698616cad0efe15d5eef1a366d124373129ff9c29ea
Proof level: deploys, compared with the chart by the kadet-hub/recipes CI
Generators: kubernetes 1.9.0 sha256:987694d4d8b061a6937fb5b8acd17416a16ed3fea36786a7604e6d607c210e24

What it deploys

recipes.strimzi (init.yml)
recipes.strimzi.cluster-operator (cluster-operator.yml): strimzi-cluster-operator

Required parameters

No parameter has to be set.

Include

A target includes the recipe and its options as classes and can override anything the recipe sets:

classes:
  - recipes.strimzi
parameters:
  namespace: strimzi
  kapitan:
    vars:
      target: strimzi

Fetching it

Until this recipe is published as an OCI artifact, a separate fetch inventory pins kadet-hub/recipes by commit. This is fetch/targets/recipes.yml at the commit the page was built from:

parameters:
  kapitan:
    vars:
      target: recipes
    dependencies:
      - type: git
        source: https://github.com/kadet-hub/recipes.git
        ref: 21d393a220614c2e353c431ae0c3bff4b8485c90
        subdir: strimzi
        output_path: inventory/classes/recipes/strimzi

The first command fetches the recipe into inventory/classes/recipes/strimzi, the second the generators and compiles:

kapitan compile --inventory-path fetch --fetch --output-path .
kapitan compile --fetch

The first command exits with status 1 because the fetch target compiles nothing. Kapitan's --fetch checks neither the digest nor the attestation of a generator. Using a recipe describes how to verify them and how to raise the pin.

Settings

Chart value	Inventory
`namespace` (release namespace)	`namespace`
`defaultImageTag`, `image.tag`	`applications.strimzi.operator_image`, tag and digest, and the tags of `applications.strimzi.kafka_image`, `STRIMZI_DEFAULT_BUILDAH_IMAGE` and `STRIMZI_DEFAULT_MAVEN_BUILDER`
`watchNamespaces`, `watchAnyNamespace`	`components.strimzi-cluster-operator.env.STRIMZI_NAMESPACE`, a comma-separated list of namespaces in place of `*`. The ClusterRoleBindings stay.
`replicas`	`components.strimzi-cluster-operator.replicas`
`resources`	`components.strimzi-cluster-operator.resources`
`fullReconciliationIntervalMs`, `operationTimeoutMs`, `featureGates`	`components.strimzi-cluster-operator.env.STRIMZI_FULL_RECONCILIATION_INTERVAL_MS`, `STRIMZI_OPERATION_TIMEOUT_MS`, `STRIMZI_FEATURE_GATES`
`logLevel`	`components.strimzi-cluster-operator.env.STRIMZI_LOG_LEVEL`, read by the log configuration, `INFO` when unset
`extraEnvs`	`components.strimzi-cluster-operator.env.<name>`

The operator image is pinned by digest in the container and in STRIMZI_DEFAULT_TOPIC_OPERATOR_IMAGE, STRIMZI_DEFAULT_USER_OPERATOR_IMAGE and STRIMZI_DEFAULT_KAFKA_INIT_IMAGE. The other images the operator starts are named by tag, as the chart names them. STRIMZI_KAFKA_IMAGES maps each Kafka version to its image. A Kafka that sets spec.kafka.image, as the kafka recipe does, runs that image instead.

Renamed RBAC objects

The kubernetes generator names a role and its binding after the entry. The ClusterRoles keep the chart’s names, because the operator binds strimzi-kafka-broker, strimzi-entity-operator and strimzi-kafka-client by name to the pods it starts.

Chart	Recipe
ClusterRoleBinding `strimzi-cluster-operator`	`strimzi-cluster-operator-global`
ClusterRoleBinding `strimzi-cluster-operator-kafka-broker-delegation`	`strimzi-kafka-broker`
ClusterRoleBinding `strimzi-cluster-operator-entity-operator-delegation`	`strimzi-entity-operator`
ClusterRoleBinding `strimzi-cluster-operator-kafka-client-delegation`	`strimzi-kafka-client`

Proof

check strimzi --level deploys with tests/values.yaml (watchAnyNamespace: true and the operator image by digest) and tests/target.yml, on kind kindest/node:v1.37.0. The objects outside RBAC differ only in these classes:

Selector scheme: the Deployment selects on name, the chart on name and strimzi.io/kind. The pods carry both labels.
Explicit default: the ServiceAccount sets automountServiceAccountToken: true. The pod mounts its token through the projected volume kube-api-access, as in the chart.

All ServiceAccounts and users bound to view, edit and admin have the same permissions. tests/smoke creates a single-node Kafka on ephemeral storage in the namespace strimzi-smoke and waits until it is Ready.

The recipe's files are in kadet-hub/recipes. All recipes