apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: kafka
  namespace: kafka
spec:
  interval: 5m
  timeout: 15m
  values:
    fullnameOverride: kafka
    clusterId: lCoW1UrZvu8ZtrBQ4blYmt
    global:
      imagePullSecrets:
        - regcred
      defaultStorageClass: csi-ceph-ssd-retain
    image:
      pullSecrets:
        - regcred
    controller:
      replicaCount: 3
      automountServiceAccountToken: true
      podAntiAffinityPreset: hard
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: kafka-contour
              app.kubernetes.io/instance: kafka
              app.kubernetes.io/component: controller-eligible
      resources:
        requests:
          cpu: "1"
          memory: 4Gi
        limits:
          memory: 6Gi
      persistence:
        size: 200Gi
        storageClass: csi-ceph-ssd-retain
      overrideConfiguration:
        authorizer.class.name: org.apache.kafka.metadata.authorizer.StandardAuthorizer
        allow.everyone.if.no.acl.found: false
        super.users: User:controller_user;User:inter_broker_user
        offsets.topic.replication.factor: 3
        transaction.state.log.replication.factor: 3
        transaction.state.log.min.isr: 2
        default.replication.factor: 3
        min.insync.replicas: 2
        unclean.leader.election.enable: false
        auto.create.topics.enable: false
    broker:
      replicaCount: 0
      automountServiceAccountToken: true
    listeners:
      client:
        protocol: SASL_PLAINTEXT
        sslClientAuth: ""
    provisioning:
      enabled: false
    sasl:
      managedExistingSecret:
        enabled: false
      existingSecret: kafka-sasl
      enabledMechanisms: PLAIN,SCRAM-SHA-512
      interBrokerMechanism: PLAIN
      controllerMechanism: PLAIN
      client:
        users: []
        passwords: ""
    tls:
      type: PEM
    vault:
      enabled: false