MSK

9 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

MSKBatchScramSecret # CLOUD CONTROL · AWS::MSK::BatchScramSecret

MSKBatchScramSecret manages AWS::MSK::BatchScramSecret through the AWS Cloud Control API.

kubectl get mskbatchscramsecrets · example on GitHub

Example

# MSKBatchScramSecret — MSK
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/kafka.html#mskbatchscramsecret
apiVersion: aws.konfig.io/v1alpha1
kind: MSKBatchScramSecret
metadata:
  name: example-mskbatchscramsecret
  namespace: default
spec:
  clusterArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-mskbatchscramsecret
    region: us-east-1
  secretArnList:
  - example

Spec

Field	Type	Required	Description
`clusterArn`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`secretArnList`	array<string>	—

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

MSKChannel # CLOUD CONTROL · AWS::MSK::Channel

MSKChannel manages AWS::MSK::Channel through the AWS Cloud Control API.

kubectl get mskchannels · example on GitHub

Example

# MSKChannel — MSK
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/kafka.html#mskchannel
apiVersion: aws.konfig.io/v1alpha1
kind: MSKChannel
metadata:
  name: example-mskchannel
  namespace: default
spec:
  channelName: example-mskchannel
  clusterArn: arn:aws:iam::123456789012:role/example-role
  encryptionConfiguration:
    kmsKeyArn: arn:aws:iam::123456789012:role/example-role
  icebergDestinationConfiguration:
    appendOnly: false
    catalog:
      catalogArn: arn:aws:iam::123456789012:role/example-role
      warehouseLocation: example
    compressionType: ZSTD
    dataFreshnessInSeconds: 60
    deadLetterQueueS3:
      bucketArn: arn:aws:iam::123456789012:role/example-role
      errorOutputPrefix: example
      expectedBucketOwner: example
    destinationTableList:
    - destinationDatabaseName: example-mskchannel
      destinationTableName: example-mskchannel
    schemaEvolution:
      enableSchemaEvolution: true
    serviceExecutionRoleArn: arn:aws:iam::123456789012:role/example-role
    tableCreation:
      enableTableCreation: true
  loggingInfo:
    cloudWatchLogs:
      enabled: true
      logGroup: example
    firehose:
      deliveryStream: example
      enabled: true
    s3:
      bucket: example
      enabled: true
      prefix: example
  providerRef:
    name: example-mskchannel
    region: us-east-1
  s3DestinationConfiguration:
    dataFreshnessInSeconds: 60
    deadLetterQueueS3:
      bucketArn: arn:aws:iam::123456789012:role/example-role
      errorOutputPrefix: example
      expectedBucketOwner: example
    serviceExecutionRoleArn: arn:aws:iam::123456789012:role/example-role
    storage:
      bucketArn: arn:aws:iam::123456789012:role/example-role
      compressionType: NONE
      expectedBucketOwner: example
      outputKeyTemplate: example
      outputPrefix: example
      storageClass: STANDARD
  tags:
    environment: dev
    team: platform
  topicConfigurationList:
  - recordConverter:
      valueConverter: BYTE_ARRAY
    recordSchema:
      gsrArn: arn:aws:iam::123456789012:role/example-role
    topicArn: arn:aws:iam::123456789012:role/example-role

Spec

Field	Type	Required	Description
`channelName`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`clusterArn`	string	—	The Amazon Resource Name (ARN) of the cluster Create-only in AWS: changing it requires replacing the resource.
`encryptionConfiguration`	object	—	Create-only in AWS: changing it requires replacing the resource.
`encryptionConfiguration.kmsKeyArn`	string	yes	The ARN of the KMS key for encryption
`icebergDestinationConfiguration`	object	—	MSKChannelIcebergDestinationConfiguration is a nested property type of AWS::MSK::Channel.
`icebergDestinationConfiguration.appendOnly`	boolean	yes	Append only mode
`icebergDestinationConfiguration.catalog`	object	—	MSKChannelCatalog is a nested property type of AWS::MSK::Channel.
`icebergDestinationConfiguration.catalog.catalogArn`	string	—	The ARN of the catalog
`icebergDestinationConfiguration.catalog.warehouseLocation`	string	—	The warehouse location
`icebergDestinationConfiguration.compressionType`	enum	—	Allowed: `ZSTD, SNAPPY`
`icebergDestinationConfiguration.dataFreshnessInSeconds`	integer	—	Data freshness in seconds
`icebergDestinationConfiguration.deadLetterQueueS3`	object	yes	MSKChannelDeadLetterQueueS3 is a nested property type of AWS::MSK::Channel.
`icebergDestinationConfiguration.deadLetterQueueS3.bucketArn`	string	yes	The ARN of the S3 bucket
`icebergDestinationConfiguration.deadLetterQueueS3.errorOutputPrefix`	string	yes	The error output prefix
`icebergDestinationConfiguration.deadLetterQueueS3.expectedBucketOwner`	string	—	Optional 12-digit AWS account ID expected to own the dead-letter S3 bucket
`icebergDestinationConfiguration.destinationTableList`	array<object>	yes	List of destination tables
`icebergDestinationConfiguration.destinationTableList[].destinationDatabaseName`	string	yes	The destination database name
`icebergDestinationConfiguration.destinationTableList[].destinationTableName`	string	yes	The destination table name
`icebergDestinationConfiguration.destinationTableList[].partitionSpec`	object	—	MSKChannelPartitionSpec is a nested property type of AWS::MSK::Channel.
`icebergDestinationConfiguration.destinationTableList[].partitionSpec.partitionStrategy`	enum	yes	Allowed: `TIME_HOUR`
`icebergDestinationConfiguration.destinationTableList[].partitionSpec.sourceList`	array<object>	—	Source list
`icebergDestinationConfiguration.destinationTableList[].partitionSpec.sourceList[].sourceName`	string	—	Source name
`icebergDestinationConfiguration.schemaEvolution`	object	yes	MSKChannelSchemaEvolution is a nested property type of AWS::MSK::Channel.
`icebergDestinationConfiguration.schemaEvolution.enableSchemaEvolution`	boolean	yes	Whether schema evolution is enabled
`icebergDestinationConfiguration.serviceExecutionRoleArn`	string	yes	The Amazon Resource Name (ARN) of an IAM role used by MSK to access the table
`icebergDestinationConfiguration.tableCreation`	object	yes	MSKChannelTableCreation is a nested property type of AWS::MSK::Channel.
`icebergDestinationConfiguration.tableCreation.enableTableCreation`	boolean	yes	Whether table creation is enabled
`loggingInfo`	object	—	Create-only in AWS: changing it requires replacing the resource.
`loggingInfo.cloudWatchLogs`	object	—	MSKChannelCloudWatchLogsLogDestination is a nested property type of AWS::MSK::Channel.
`loggingInfo.cloudWatchLogs.enabled`	boolean	yes	Whether CloudWatch Logs logging is enabled
`loggingInfo.cloudWatchLogs.logGroup`	string	—	The CloudWatch log group for log delivery
`loggingInfo.firehose`	object	—	MSKChannelFirehoseLogDestination is a nested property type of AWS::MSK::Channel.
`loggingInfo.firehose.deliveryStream`	string	—	The Firehose delivery stream for log delivery
`loggingInfo.firehose.enabled`	boolean	yes	Whether Firehose logging is enabled
`loggingInfo.s3`	object	—	MSKChannelS3LogDestination is a nested property type of AWS::MSK::Channel.
`loggingInfo.s3.bucket`	string	—	The name of the S3 bucket for log delivery
`loggingInfo.s3.enabled`	boolean	yes	Whether S3 logging is enabled
`loggingInfo.s3.prefix`	string	—	The S3 prefix for log delivery
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`s3DestinationConfiguration`	object	—	MSKChannelS3DestinationConfiguration is a nested property type of AWS::MSK::Channel.
`s3DestinationConfiguration.dataFreshnessInSeconds`	integer	—	Data freshness in seconds
`s3DestinationConfiguration.deadLetterQueueS3`	object	yes	MSKChannelDeadLetterQueueS3 is a nested property type of AWS::MSK::Channel.
`s3DestinationConfiguration.deadLetterQueueS3.bucketArn`	string	yes	The ARN of the S3 bucket
`s3DestinationConfiguration.deadLetterQueueS3.errorOutputPrefix`	string	yes	The error output prefix
`s3DestinationConfiguration.deadLetterQueueS3.expectedBucketOwner`	string	—	Optional 12-digit AWS account ID expected to own the dead-letter S3 bucket
`s3DestinationConfiguration.serviceExecutionRoleArn`	string	yes	The Amazon Resource Name (ARN) of an IAM role used by MSK to access S3
`s3DestinationConfiguration.storage`	object	yes	MSKChannelS3Storage is a nested property type of AWS::MSK::Channel.
`s3DestinationConfiguration.storage.bucketArn`	string	yes	ARN of the S3 bucket
`s3DestinationConfiguration.storage.compressionType`	enum	yes	Allowed: `NONE, GZIP, ZSTD`
`s3DestinationConfiguration.storage.expectedBucketOwner`	string	—	Optional 12-digit AWS account ID expected to own the S3 bucket
`s3DestinationConfiguration.storage.outputKeyTemplate`	string	—	Template for S3 key for output objects, used for partitioning
`s3DestinationConfiguration.storage.outputPrefix`	string	—	Optional prefix for output objects
`s3DestinationConfiguration.storage.storageClass`	enum	yes	Allowed: `STANDARD, INTELLIGENT_TIERING, GLACIER_IR`
`tags`	map<string>	—
`topicConfigurationList`	array<object>	yes	Topic configuration Create-only in AWS: changing it requires replacing the resource.
`topicConfigurationList[].recordConverter`	object	yes	MSKChannelRecordConverter is a nested property type of AWS::MSK::Channel.
`topicConfigurationList[].recordConverter.valueConverter`	enum	yes	Allowed: `BYTE_ARRAY, JSON, JSON_SCHEMA_GSR, STRING`
`topicConfigurationList[].recordSchema`	object	—	MSKChannelRecordSchema is a nested property type of AWS::MSK::Channel.
`topicConfigurationList[].recordSchema.gsrArn`	string	yes	ARN of Glue Schema Registry resource used for table schema
`topicConfigurationList[].topicArn`	string	yes	The Amazon Resource Name (ARN) that uniquely identifies the topic

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`channelArn`	string	—	The Amazon Resource Name (ARN) that uniquely identifies the channel Read-only: reported by AWS after creation.
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`stateInfo`	object	—	Read-only: reported by AWS after creation.
`stateInfo.code`	string	—	Code for channel state
`stateInfo.message`	string	—	Message for channel state
`status`	enum	—	Read-only: reported by AWS after creation. Allowed: `CREATING, ACTIVE, UPDATING, DELETING, FAILED, SUSPENDING, SUSPENDED`

MSKCluster # GA

MSKCluster is the Schema for managing MSK provisioned clusters.

kubectl get mskclusters · example on GitHub

Example

# MSKCluster — MSK
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/kafka.html#mskcluster
apiVersion: aws.konfig.io/v1alpha1
kind: MSKCluster
metadata:
  name: example-mskcluster
  namespace: default
spec:
  brokerNodeGroupInfo:
    clientSubnets:
    - example
    instanceType: example
    securityGroups:
    - example
    storageVolumeSizeGiB: 2
  clusterName: example-mskcluster
  kafkaVersion: '1.0'
  numberOfBrokerNodes: 1
  providerRef:
    name: example-mskcluster
    region: us-east-1
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`brokerNodeGroupInfo`	object	yes	BrokerNodeGroupInfo defines the broker node configuration.
`brokerNodeGroupInfo.clientSubnets`	array<string>	yes	ClientSubnets is the list of subnets for the broker nodes.
`brokerNodeGroupInfo.instanceType`	string	yes	InstanceType is the Amazon MSK broker instance type (e.g.
`brokerNodeGroupInfo.securityGroups`	array<string>	—	SecurityGroups is the list of security group IDs for broker nodes.
`brokerNodeGroupInfo.storageVolumeSizeGiB`	integer	—	StorageVolumeSizeGiB is the EBS volume size in GiB per broker.
`clusterName`	string	yes	ClusterName is the name of the cluster.
`kafkaVersion`	string	yes	KafkaVersion is the Kafka version to deploy (e.g.
`numberOfBrokerNodes`	integer	yes	NumberOfBrokerNodes is the total number of broker nodes across all AZs.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are metadata tags for the cluster.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`clusterARN`	string	—	ClusterARN is the ARN of the MSK cluster.
`clusterState`	string	—	ClusterState is the current state of the cluster (CREATING, ACTIVE, DELETING, etc.).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

MSKClusterPolicy # CLOUD CONTROL · AWS::MSK::ClusterPolicy

MSKClusterPolicy manages AWS::MSK::ClusterPolicy through the AWS Cloud Control API.

kubectl get mskclusterpolicies · example on GitHub

Example

# MSKClusterPolicy — MSK
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/kafka.html#mskclusterpolicy
apiVersion: aws.konfig.io/v1alpha1
kind: MSKClusterPolicy
metadata:
  name: example-mskclusterpolicy
  namespace: default
spec:
  clusterArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-mskclusterpolicy
    region: us-east-1

Spec

Field	Type	Required	Description
`clusterArn`	string	yes	The arn of the cluster for the resource policy.
`policy`	object	yes	A policy document containing permissions to add to the specified cluster.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`currentVersion`	string	—	The current version of the policy attached to the specified cluster Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

MSKConfiguration # GA

MSKConfiguration is the Schema for managing MSK cluster configurations.

kubectl get mskconfigurations · example on GitHub

Example

# MSKConfiguration — MSK
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/kafka.html#mskconfiguration
apiVersion: aws.konfig.io/v1alpha1
kind: MSKConfiguration
metadata:
  name: example-mskconfiguration
  namespace: default
spec:
  description: Managed by konfig-konector
  kafkaVersions:
  - example
  name: example-mskconfiguration
  providerRef:
    name: example-mskconfiguration
    region: us-east-1
  serverProperties: example

Spec

Field	Type	Required	Description
`description`	string	—	Description describes the configuration.
`kafkaVersions`	array<string>	—	KafkaVersions is the list of Kafka version strings this configuration applies to.
`name`	string	yes	Name is the name of the configuration.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`serverProperties`	string	yes	ServerProperties contains the kafka server.properties content.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`configurationARN`	string	—	ConfigurationARN is the ARN of the MSK configuration.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`latestRevision`	integer	—	LatestRevision is the current revision number.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

MSKReplicator # CLOUD CONTROL · AWS::MSK::Replicator

MSKReplicator manages AWS::MSK::Replicator through the AWS Cloud Control API.

kubectl get mskreplicators · example on GitHub

Example

# MSKReplicator — MSK
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/kafka.html#mskreplicator
apiVersion: aws.konfig.io/v1alpha1
kind: MSKReplicator
metadata:
  name: example-mskreplicator
  namespace: default
spec:
  description: Managed by konfig-konector
  kafkaClusters:
  - amazonMskCluster:
      mskClusterArn: arn:aws:iam::123456789012:role/example-role
    apacheKafkaCluster:
      apacheKafkaClusterId: example-id
      bootstrapBrokerString: example
    encryptionInTransit:
      encryptionType: TLS
      rootCaCertificate: example
    vpcConfig:
      securityGroupIds:
      - example
      subnetIds:
      - example
  logDelivery:
    replicatorLogDelivery:
      cloudWatchLogs:
        enabled: true
        logGroup: example
      firehose:
        deliveryStream: example
        enabled: true
      s3:
        bucket: example
        enabled: true
        prefix: example
  providerRef:
    name: example-mskreplicator
    region: us-east-1
  replicationInfoList:
  - consumerGroupReplication:
      consumerGroupOffsetSyncMode: LEGACY
      consumerGroupsToExclude:
      - example
      consumerGroupsToReplicate:
      - example
      detectAndCopyNewConsumerGroups: false
      synchroniseConsumerGroupOffsets: false
    sourceKafkaClusterArn: arn:aws:iam::123456789012:role/example-role
    targetCompressionType: NONE
    targetKafkaClusterArn: arn:aws:iam::123456789012:role/example-role
    topicReplication:
      copyAccessControlListsForTopics: false
      copyTopicConfigurations: false
      detectAndCopyNewTopics: false
      topicsToExclude:
      - example
      topicsToReplicate:
      - example
  replicatorName: example-mskreplicator
  serviceExecutionRoleArn: arn:aws:iam::123456789012:role/example-role
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`description`	string	—	A summary description of the replicator.
`kafkaClusters`	array<object>	yes	Specifies a list of Kafka clusters which are targets of the replicator.
`kafkaClusters[].amazonMskCluster`	object	—	Details of an Amazon MSK cluster.
`kafkaClusters[].amazonMskCluster.mskClusterArn`	string	yes	The ARN of an Amazon MSK cluster.
`kafkaClusters[].apacheKafkaCluster`	object	—	Details of an Apache Kafka cluster.
`kafkaClusters[].apacheKafkaCluster.apacheKafkaClusterId`	string	yes	The ID of the Apache Kafka cluster.
`kafkaClusters[].apacheKafkaCluster.bootstrapBrokerString`	string	yes	The bootstrap broker string of the Apache Kafka cluster.
`kafkaClusters[].clientAuthentication`	object	—	Details of the client authentication used by the Apache Kafka cluster.
`kafkaClusters[].clientAuthentication.mtls`	object	—	Details for mTLS client authentication.
`kafkaClusters[].clientAuthentication.mtls.secretArn`	string	yes	The Amazon Resource Name (ARN) of the Secrets Manager secret.
`kafkaClusters[].clientAuthentication.saslOAuthBearer`	object	—	Details for client authentication using SASL/OAUTHBEARER.
`kafkaClusters[].clientAuthentication.saslOAuthBearer.clientCredentials`	object	—	Details for SASL/OAUTHBEARER using standard client_credentials grant.
`kafkaClusters[].clientAuthentication.saslOAuthBearer.clientCredentials.tokenRequestSecretArn`	string	yes	Secrets Manager ARN of the secret containing the client_id and client_secret used to obtain an OAuth Bearer token via the client_credentials grant.
`kafkaClusters[].clientAuthentication.saslOAuthBearer.clientCredentialsAssertion`	object	—	Details for SASL/OAUTHBEARER using client credentials grant with JWT client assertion (RFC 7521/7523).
`kafkaClusters[].clientAuthentication.saslOAuthBearer.clientCredentialsAssertion.audience`	string	yes	The audience (aud claim) set in the STS JWT client assertion.
`kafkaClusters[].clientAuthentication.saslOAuthBearer.clientCredentialsAssertion.signingAlgorithm`	enum	yes	The algorithm used to sign the JWT client assertion. Allowed: `RS256, ES384`
`kafkaClusters[].clientAuthentication.saslOAuthBearer.clientCredentialsAssertion.tokenRequestSecretArn`	string	—	Optional Secrets Manager ARN for identity providers that require client_id as a form parameter alongside the JWT client assertion.
`kafkaClusters[].clientAuthentication.saslOAuthBearer.iamJwtBearer`	object	—	Details for SASL/OAUTHBEARER using JWT Bearer assertion grant (RFC 7523).
`kafkaClusters[].clientAuthentication.saslOAuthBearer.iamJwtBearer.audience`	string	yes	The audience (aud claim) set in the STS JWT assertion.
`kafkaClusters[].clientAuthentication.saslOAuthBearer.iamJwtBearer.signingAlgorithm`	enum	yes	The algorithm used to sign the JWT assertion. Allowed: `RS256, ES384`
`kafkaClusters[].clientAuthentication.saslOAuthBearer.iamJwtBearer.tokenRequestSecretArn`	string	—	Optional Secrets Manager ARN for identity providers that require client authentication alongside the JWT Bearer assertion.
`kafkaClusters[].clientAuthentication.saslOAuthBearer.scope`	string	—	OAuth scope to request.
`kafkaClusters[].clientAuthentication.saslOAuthBearer.tokenEndpointAuthenticationMethod`	enum	yes	How client credentials are sent to the identity provider (POST, BASIC, or NONE). Allowed: `POST, BASIC, NONE`
`kafkaClusters[].clientAuthentication.saslOAuthBearer.tokenEndpointTlsCertificateArn`	string	—	Secrets Manager ARN containing a custom CA certificate for the identity provider.
`kafkaClusters[].clientAuthentication.saslOAuthBearer.tokenEndpointUrl`	string	yes	The HTTPS URL of the OAuth token endpoint that vends OAuth Bearer tokens per RFC 6749.
`kafkaClusters[].clientAuthentication.saslScram`	object	—	Details for SASL/SCRAM client authentication.
`kafkaClusters[].clientAuthentication.saslScram.mechanism`	enum	yes	The SASL/SCRAM authentication mechanism. Allowed: `SHA256, SHA512`
`kafkaClusters[].clientAuthentication.saslScram.secretArn`	string	yes	The Amazon Resource Name (ARN) of the Secrets Manager secret.
`kafkaClusters[].encryptionInTransit`	object	—	Details of encryption in transit to the Apache Kafka cluster.
`kafkaClusters[].encryptionInTransit.encryptionType`	enum	yes	The type of encryption in transit to the Apache Kafka cluster. Allowed: `TLS`
`kafkaClusters[].encryptionInTransit.rootCaCertificate`	string	—	The root CA certificate.
`kafkaClusters[].vpcConfig`	object	—	Details of an Amazon VPC which has network connectivity to the Apache Kafka cluster.
`kafkaClusters[].vpcConfig.securityGroupIds`	array<string>	—	The AWS security groups to associate with the elastic network interfaces in order to specify what the replicator has access to.
`kafkaClusters[].vpcConfig.subnetIds`	array<string>	yes	The list of subnets to connect to in the virtual private cloud (VPC).
`logDelivery`	object	—	Configuration for log delivery for the replicator.
`logDelivery.replicatorLogDelivery`	object	—	The replicator logs configuration.
`logDelivery.replicatorLogDelivery.cloudWatchLogs`	object	—	Details of the CloudWatch Logs destination for replicator logs.
`logDelivery.replicatorLogDelivery.cloudWatchLogs.enabled`	boolean	yes	Whether log delivery to CloudWatch Logs is enabled.
`logDelivery.replicatorLogDelivery.cloudWatchLogs.logGroup`	string	—	The CloudWatch log group that is the destination for log delivery.
`logDelivery.replicatorLogDelivery.firehose`	object	—	Details of the Kinesis Data Firehose delivery stream that is the destination for replicator logs.
`logDelivery.replicatorLogDelivery.firehose.deliveryStream`	string	—	The Firehose delivery stream that is the destination for log delivery.
`logDelivery.replicatorLogDelivery.firehose.enabled`	boolean	yes	Whether log delivery to Firehose is enabled.
`logDelivery.replicatorLogDelivery.s3`	object	—	Details of the Amazon S3 destination for replicator logs.
`logDelivery.replicatorLogDelivery.s3.bucket`	string	—	The S3 bucket that is the destination for log delivery.
`logDelivery.replicatorLogDelivery.s3.enabled`	boolean	yes	Whether log delivery to S3 is enabled.
`logDelivery.replicatorLogDelivery.s3.prefix`	string	—	The S3 prefix that is the destination for log delivery.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`replicationInfoList`	array<object>	yes	A list of replication configurations, where each configuration targets a given source cluster to target cluster replication flow.
`replicationInfoList[].consumerGroupReplication`	object	yes	Configuration relating to consumer group replication.
`replicationInfoList[].consumerGroupReplication.consumerGroupOffsetSyncMode`	enum	—	The consumer group offset synchronization mode. Allowed: `LEGACY, ENHANCED`
`replicationInfoList[].consumerGroupReplication.consumerGroupsToExclude`	array<string>	—	List of regular expression patterns indicating the consumer groups that should not be replicated.
`replicationInfoList[].consumerGroupReplication.consumerGroupsToReplicate`	array<string>	yes	List of regular expression patterns indicating the consumer groups to copy.
`replicationInfoList[].consumerGroupReplication.detectAndCopyNewConsumerGroups`	boolean	—	Whether to periodically check for new consumer groups.
`replicationInfoList[].consumerGroupReplication.synchroniseConsumerGroupOffsets`	boolean	—	Whether to periodically write the translated offsets to __consumer_offsets topic in target cluster.
`replicationInfoList[].sourceKafkaClusterArn`	string	—	Amazon Resource Name of the source Kafka cluster.
`replicationInfoList[].sourceKafkaClusterId`	string	—	The ID of the source Kafka cluster.
`replicationInfoList[].targetCompressionType`	enum	yes	The type of compression to use writing records to target Kafka cluster. Allowed: `NONE, GZIP, SNAPPY, LZ4, ZSTD`
`replicationInfoList[].targetKafkaClusterArn`	string	—	Amazon Resource Name of the target Kafka cluster.
`replicationInfoList[].targetKafkaClusterId`	string	—	The ID of the target Kafka cluster.
`replicationInfoList[].topicReplication`	object	yes	Configuration relating to topic replication.
`replicationInfoList[].topicReplication.copyAccessControlListsForTopics`	boolean	—	Whether to periodically configure remote topic ACLs to match their corresponding upstream topics.
`replicationInfoList[].topicReplication.copyTopicConfigurations`	boolean	—	Whether to periodically configure remote topics to match their corresponding upstream topics.
`replicationInfoList[].topicReplication.detectAndCopyNewTopics`	boolean	—	Whether to periodically check for new topics and partitions.
`replicationInfoList[].topicReplication.startingPosition`	object	—	Configuration for specifying the position in the topics to start replicating from.
`replicationInfoList[].topicReplication.startingPosition.type`	enum	—	Allowed: `LATEST, EARLIEST`
`replicationInfoList[].topicReplication.topicNameConfiguration`	object	—	Configuration for specifying replicated topic names should be the same as their corresponding upstream topics or prefixed with source cluster alias.
`replicationInfoList[].topicReplication.topicNameConfiguration.type`	enum	—	Allowed: `PREFIXED_WITH_SOURCE_CLUSTER_ALIAS, IDENTICAL`
`replicationInfoList[].topicReplication.topicsToExclude`	array<string>	—	List of regular expression patterns indicating the topics that should not be replicated.
`replicationInfoList[].topicReplication.topicsToReplicate`	array<string>	yes	List of regular expression patterns indicating the topics to copy.
`replicatorName`	string	yes	The name of the replicator.
`serviceExecutionRoleArn`	string	yes	The Amazon Resource Name (ARN) of the IAM role used by the replicator to access external resources.
`tags`	array<object>	—	A collection of tags associated with a resource
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`currentVersion`	string	—	The current version of the MSK replicator.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`replicatorArn`	string	—	Amazon Resource Name for the created replicator.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

MSKServerlessCluster # GA

MSKServerlessCluster is the Schema for managing MSK serverless clusters.

kubectl get mskserverlessclusters · example on GitHub

Example

# MSKServerlessCluster — MSK
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/kafka.html#mskserverlesscluster
apiVersion: aws.konfig.io/v1alpha1
kind: MSKServerlessCluster
metadata:
  name: example-mskserverlesscluster
  namespace: default
spec:
  clusterName: example-mskserverlesscluster
  providerRef:
    name: example-mskserverlesscluster
    region: us-east-1
  tags:
    environment: dev
    team: platform
  vpcConfigs:
  - securityGroupIDs:
    - example
    subnetIDs:
    - example

Spec

Field	Type	Required	Description
`clusterName`	string	yes	ClusterName is the name of the serverless cluster.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are metadata tags for the cluster.
`vpcConfigs`	array<object>	yes	VpcConfigs is the list of VPC configurations.
`vpcConfigs[].securityGroupIDs`	array<string>	—	SecurityGroupIDs is the list of security group IDs.
`vpcConfigs[].subnetIDs`	array<string>	yes	SubnetIDs is the list of subnet IDs.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`clusterARN`	string	—	ClusterARN is the ARN of the serverless MSK cluster.
`clusterState`	string	—	ClusterState is the current state of the cluster.
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

MSKTopic # CLOUD CONTROL · AWS::MSK::Topic

MSKTopic manages AWS::MSK::Topic through the AWS Cloud Control API.

kubectl get msktopics · example on GitHub

Example

# MSKTopic — MSK
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/kafka.html#msktopic
apiVersion: aws.konfig.io/v1alpha1
kind: MSKTopic
metadata:
  name: example-msktopic
  namespace: default
spec:
  clusterArn: arn:aws:iam::123456789012:role/example-role
  configs: example
  partitionCount: 1
  providerRef:
    name: example-msktopic
    region: us-east-1
  replicationFactor: 1
  topicName: example-msktopic

Spec

Field	Type	Required	Description
`clusterArn`	string	yes	The Amazon Resource Name (ARN) of the MSK cluster Create-only in AWS: changing it requires replacing the resource.
`configs`	string	—	Base64 encoded configuration properties of the topic
`partitionCount`	integer	yes	The number of partitions for the topic
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`replicationFactor`	integer	yes	The replication factor for the topic Create-only in AWS: changing it requires replacing the resource.
`topicName`	string	yes	The name of the topic Create-only in AWS: changing it requires replacing the resource.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`topicArn`	string	—	The Amazon Resource Name (ARN) of the topic Read-only: reported by AWS after creation.

MSKVpcConnection # CLOUD CONTROL · AWS::MSK::VpcConnection

MSKVpcConnection manages AWS::MSK::VpcConnection through the AWS Cloud Control API.

kubectl get mskvpcconnections · example on GitHub

Example

# MSKVpcConnection — MSK
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/kafka.html#mskvpcconnection
apiVersion: aws.konfig.io/v1alpha1
kind: MSKVpcConnection
metadata:
  name: example-mskvpcconnection
  namespace: default
spec:
  authentication: SASL_IAM
  clientSubnets:
  - example
  providerRef:
    name: example-mskvpcconnection
    region: us-east-1
  securityGroups:
  - example
  tags:
    environment: dev
    team: platform
  targetClusterArn: arn:aws:iam::123456789012:role/example-role
  vpcId: vpc-0abc12def3456789

Spec

Field	Type	Required	Description
`authentication`	enum	yes	Create-only in AWS: changing it requires replacing the resource. Allowed: `SASL_IAM, SASL_SCRAM, TLS`
`clientSubnets`	array<string>	yes	Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`securityGroups`	array<string>	yes	Create-only in AWS: changing it requires replacing the resource.
`tags`	map<string>	—
`targetClusterArn`	string	yes	The Amazon Resource Name (ARN) of the target cluster Create-only in AWS: changing it requires replacing the resource.
`vpcId`	string	yes	Create-only in AWS: changing it requires replacing the resource.

Status

Field	Type	Required	Description
`arn`	string	—	Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.