Helm chart & listener configuration

Deploying with the chart: the Strimzi-shape listeners array, cluster-wide authorization values, and how the bundled CRDs are handled.

The chart at deploy/helm/kaas/ is the source of truth for production configuration — replicas, controller-Lease tuning, storage class, image repositories. It deploys the broker StatefulSet, the operator Deployment, and one shared RWX PVC. Installation, image derivation, and the smoke test live in the chart's own deploy/helm/kaas/README.md; this chapter covers the concepts that need more than a values table.

helm install my-kaas oci://ghcr.io/woestebanaan/charts/kaas \
  --version 0.2.4-preview \
  --namespace kafka --create-namespace \
  --set storage.className=<your-rwx-class> \
  --set broker.replicaCount=3

The listeners array

.Values.listeners is a Strimzi-shape array (gh #126): each entry declares name (free-form), port, type (internal / external), tls, an authentication.type (none / scram-sha-512 / mtls / plain), and an optional enabled flag (absence = enabled). The default values ship three entries — plain (9092, anonymous), external (9093, TLS, disabled by default), and authed (9095, SCRAM, disabled by default).

The templates iterate the array to emit the StatefulSet container ports, the KAAS_LISTENERS JSON env the broker parses, the Service ports, and the NOTES.txt bootstrap output. The three axes are orthogonal — see Listeners, authentication, authorization for how the broker treats them; mtls authentication is the only combination constraint (it requires tls: true).

Two implementation notes worth knowing:

• Only the first type: external listener drives the KafkaCluster CR plumbing (Certificates, per-broker Services, TLSRoutes) — the CR template still synthesizes the legacy single-listener shape for the operator; a follow-up refactors the operator to consume the array natively.
• External listeners use per-broker hostnames on one SAN-per-broker certificate (works with HTTP-01 ACME; one DNS record per broker). cert-manager rotates the single Secret in place and brokers hot-reload it without a restart. Scaling replicaCount re-reconciles the Certificate's SAN list.

Cluster-wide authorization

Authorization is deliberately not per-listener: .Values.authorization.type ("" = off, simple = ACL enforcement) and .Values.authorization.superUsers (list of User:foo strings, emitted as KAAS_SUPER_USERS) apply to every listener. Authentication stays per-listener. Users, ACLs, and quotas are authored as KafkaUser CRs — see Kubernetes integration.

CRDs on install and upgrade

The chart bundles its CRDs in crds/ (regenerated by cargo xtask gen-crds; CI fails on drift). Helm installs them on first install but deliberately never upgrades CRDs from a chart's crds/ directory — on any release that changes them, apply the new CRDs explicitly before helm upgrade (exact commands in the chart README's "CRDs on upgrade" section).

Other levers

• broker.controllerLease.durationSeconds (default 15) — controller failover latency vs API-server write rate.
• podDisruptionBudget.maxUnavailable (default 1) — keeps voluntary disruptions from taking multiple single-writer brokers down at once.
• storage.* — see Storage substrate requirements; the PVC carries helm.sh/resource-policy: keep, so uninstall never deletes data.