Skip to content

Commit 46db5ae

Browse files
notshivanshnotshivansh
committed
optional separate kafka
1 parent 3a29e94 commit 46db5ae

8 files changed

Lines changed: 300 additions & 179 deletions

File tree

‎charts/mini-runtime/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@ apiVersion: v2
22
name: akto-mini-runtime
33
description: Helm chart for installing Akto hybrid runtime
44
type: application
5-
version: 0.5.5
6-
appVersion: "0.5.5"
5+
version: 0.6.0
6+
appVersion: "0.6.0"
77
home: https://www.akto.io
88
icon: https://akto-setup.s3.amazonaws.com/templates/128x128.png
99
sources:

‎charts/mini-runtime/README.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,25 @@ Here are the steps to install Akto mini-runtime via Helm charts -
4141

4242
3. Run `kubectl get pods -n <NAMESPACE>` and verify you can see 1 mini-runtime pod with 4 containers and 1 keel pod.
4343

44+
### Kafka Deployment Options
45+
46+
The chart supports two Kafka deployment modes:
47+
48+
1. **Sidecar Mode (Default)** - Kafka runs as a sidecar container in the same pod as mini-runtime. This is the default for backward compatibility.
49+
- Mini-runtime connects to Kafka via `localhost:29092`
50+
- Single pod contains both mini-runtime and Kafka
51+
52+
2. **Separate Deployment Mode** - Kafka runs as a standalone deployment with its own service.
53+
- Mini-runtime connects to Kafka via FQDN (e.g., `akto-mini-runtime-kafka.<namespace>.svc.cluster.local:9092`)
54+
- Allows independent scaling and resource management
55+
56+
To enable separate Kafka deployment:
57+
```bash
58+
helm install akto-mini-runtime akto/akto-mini-runtime -n <your-namespace> \
59+
--set mini_runtime.aktoApiSecurityRuntime.env.databaseAbstractorToken="<your-token>" \
60+
--set mini_runtime.separateKafkaDeployment=true
61+
```
62+
4463
### Upgrading to new version
4564

4665
1. Update helm repo

‎charts/mini-runtime/templates/_helpers.tpl‎

Lines changed: 218 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,3 +59,221 @@ Create the name of the service account to use
5959
{{- default "default" .Values.serviceAccount.name }}
6060
{{- end }}
6161
{{- end }}
62+
63+
{{/*
64+
Kafka service name based on deployment mode
65+
Usage: {{ include "akto.kafka.serviceName" (dict "root" . "separate" true/false) }}
66+
*/}}
67+
{{- define "akto.kafka.serviceName" -}}
68+
{{- if .separate }}
69+
{{- printf "%s-kafka" (include "akto.fullname" .root) }}
70+
{{- else }}
71+
{{- printf "%s-mini-runtime" (include "akto.fullname" .root) }}
72+
{{- end }}
73+
{{- end }}
74+
75+
{{/*
76+
Kafka FQDN based on deployment mode
77+
Usage: {{ include "akto.kafka.fqdn" (dict "root" . "separate" true/false) }}
78+
*/}}
79+
{{- define "akto.kafka.fqdn" -}}
80+
{{- $serviceName := include "akto.kafka.serviceName" . }}
81+
{{- printf "%s.%s.svc.%s" $serviceName .root.Release.Namespace .root.Values.kubernetesClusterDomain }}
82+
{{- end }}
83+
84+
{{/*
85+
Kafka service template
86+
Usage: {{ include "akto.kafka.service" (dict "root" . "separate" true/false) }}
87+
*/}}
88+
{{- define "akto.kafka.service" -}}
89+
apiVersion: v1
90+
kind: Service
91+
metadata:
92+
name: {{ include "akto.kafka.serviceName" . }}
93+
labels:
94+
{{- include "akto.labels" .root | nindent 4 }}
95+
annotations:
96+
{{- with .root.Values.mini_runtime.annotations }}
97+
{{- toYaml . | nindent 4 }}
98+
{{- end }}
99+
spec:
100+
type: {{ .root.Values.mini_runtime.type }}
101+
selector:
102+
app: {{ include "akto.kafka.serviceName" . }}
103+
{{- include "akto.selectorLabels" .root | nindent 4 }}
104+
ports:
105+
{{- if .root.Values.mini_runtime.kafka1.useSasl }}
106+
{{- .root.Values.ports.sasl | toYaml | nindent 4 -}}
107+
{{- else if .root.Values.mini_runtime.kafka1.useTls }}
108+
{{- .root.Values.ports.tls | toYaml | nindent 4 -}}
109+
{{- else }}
110+
{{- .root.Values.ports.default | toYaml | nindent 4 -}}
111+
{{- end }}
112+
{{- end }}
113+
114+
{{/*
115+
Kafka advertised listeners based on mode and security settings
116+
Usage: {{ include "akto.kafka.advertisedListeners" (dict "root" . "separate" true/false) }}
117+
*/}}
118+
{{- define "akto.kafka.advertisedListeners" -}}
119+
{{- $fqdn := include "akto.kafka.fqdn" . }}
120+
{{- if .root.Values.mini_runtime.kafka1.env.kafkaAdvertisedListeners }}
121+
{{ .root.Values.mini_runtime.kafka1.env.kafkaAdvertisedListeners }}
122+
{{- else if and .root.Values.mini_runtime.kafka1.useSasl .root.Values.mini_runtime.kafka1.useTls }}
123+
LISTENER_DOCKER_EXTERNAL_DIFFHOST_SASL://{{ $fqdn }}:9093, LISTENER_DOCKER_EXTERNAL_LOCALHOST_SASL://localhost:29092
124+
{{- else if .root.Values.mini_runtime.kafka1.useSasl }}
125+
LISTENER_DOCKER_EXTERNAL_LOCALHOST_SASL://localhost:29092,LISTENER_DOCKER_EXTERNAL_DIFFHOST_SASL://{{ $fqdn }}:9092
126+
{{- else if .root.Values.mini_runtime.kafka1.useTls }}
127+
LISTENER_DOCKER_EXTERNAL_LOCALHOST://localhost:29092,LISTENER_DOCKER_EXTERNAL_DIFFHOST://{{ $fqdn }}:9092,LISTENER_DOCKER_EXTERNAL_DIFFHOST_ENCRYPTED://{{ $fqdn }}:9093
128+
{{- else }}
129+
LISTENER_DOCKER_EXTERNAL_LOCALHOST://localhost:29092,LISTENER_DOCKER_EXTERNAL_DIFFHOST://{{ $fqdn }}:9092
130+
{{- end }}
131+
{{- end }}
132+
133+
{{/*
134+
Kafka container template
135+
Usage: {{ include "akto.kafka.container" (dict "root" . "separate" true/false) }}
136+
*/}}
137+
{{- define "akto.kafka.container" -}}
138+
- env:
139+
- name: MY_POD_NAMESPACE
140+
valueFrom:
141+
fieldRef:
142+
fieldPath: metadata.namespace
143+
- name: KAFKA_ADVERTISED_LISTENERS
144+
value: >-
145+
{{- include "akto.kafka.advertisedListeners" . | nindent 6 }}
146+
- name: KAFKA_BROKER_ID
147+
value: {{ quote .root.Values.mini_runtime.kafka1.env.kafkaBrokerId }}
148+
- name: KAFKA_CLEANUP_POLICY
149+
value: {{ quote .root.Values.mini_runtime.kafka1.env.kafkaCleanupPolicy }}
150+
- name: KAFKA_CREATE_TOPICS
151+
{{- if and .separate .root.Values.mini_runtime.kafkaSeparate.kafkaCreateTopics }}
152+
value: {{ quote .root.Values.mini_runtime.kafkaSeparate.kafkaCreateTopics }}
153+
{{- else }}
154+
value: {{ quote .root.Values.mini_runtime.kafka1.env.kafkaCreateTopics }}
155+
{{- end }}
156+
- name: KAFKA_INTER_BROKER_LISTENER_NAME
157+
value: >-
158+
{{- if .root.Values.mini_runtime.kafka1.env.kafkaAdvertisedListeners }}
159+
{{ .root.Values.mini_runtime.kafka1.env.kafkaInterBrokerListenerName }}
160+
{{- else if .root.Values.mini_runtime.kafka1.useSasl }}
161+
LISTENER_DOCKER_EXTERNAL_DIFFHOST_SASL
162+
{{- else if .root.Values.mini_runtime.kafka1.useTls }}
163+
LISTENER_DOCKER_EXTERNAL_DIFFHOST
164+
{{- else }}
165+
{{ .root.Values.mini_runtime.kafka1.env.kafkaInterBrokerListenerName }}
166+
{{- end }}
167+
- name: KAFKA_LISTENER_SECURITY_PROTOCOL_MAP
168+
value: >-
169+
{{- if and .root.Values.mini_runtime.kafka1.useSasl .root.Values.mini_runtime.kafka1.useTls }}
170+
{{ .root.Values.mini_runtime.kafka1.env.kafkaListenerSecurityProtocolMapSaslTls }}
171+
{{- else if .root.Values.mini_runtime.kafka1.useSasl }}
172+
{{ .root.Values.mini_runtime.kafka1.env.kafkaListenerSecurityProtocolMapSasl }}
173+
{{- else if .root.Values.mini_runtime.kafka1.useTls }}
174+
{{ .root.Values.mini_runtime.kafka1.env.kafkaListenerSecurityProtocolMapSsl }}
175+
{{- else }}
176+
{{ .root.Values.mini_runtime.kafka1.env.kafkaListenerSecurityProtocolMap }}
177+
{{- end }}
178+
- name: KAFKA_PROCESS_ROLES
179+
value: {{ quote .root.Values.mini_runtime.kafka1.env.kafkaProcessRoles }}
180+
- name: KAFKA_NODE_ID
181+
value: {{ quote .root.Values.mini_runtime.kafka1.env.kafkaNodeId }}
182+
- name: KAFKA_CONTROLLER_QUORUM_VOTERS
183+
value: {{ quote .root.Values.mini_runtime.kafka1.env.kafkaControllerQuorumVoters }}
184+
- name: KAFKA_CONTROLLER_LISTENER_NAMES
185+
value: {{ quote .root.Values.mini_runtime.kafka1.env.kafkaControllerListenerNames }}
186+
- name: KAFKA_LISTENERS
187+
value: >-
188+
{{- if .root.Values.mini_runtime.kafka1.env.kafkaListeners }}
189+
{{ .root.Values.mini_runtime.kafka1.env.kafkaListeners }}
190+
{{- else if and .root.Values.mini_runtime.kafka1.useSasl .root.Values.mini_runtime.kafka1.useTls }}
191+
CONTROLLER://0.0.0.0:9094,LISTENER_DOCKER_EXTERNAL_LOCALHOST_SASL://0.0.0.0:29092,LISTENER_DOCKER_EXTERNAL_DIFFHOST_SASL://0.0.0.0:9093
192+
{{- else if .root.Values.mini_runtime.kafka1.useSasl }}
193+
CONTROLLER://0.0.0.0:9094,LISTENER_DOCKER_EXTERNAL_LOCALHOST_SASL://0.0.0.0:29092,LISTENER_DOCKER_EXTERNAL_DIFFHOST_SASL://0.0.0.0:9092
194+
{{- else if .root.Values.mini_runtime.kafka1.useTls }}
195+
CONTROLLER://0.0.0.0:9094,LISTENER_DOCKER_EXTERNAL_LOCALHOST://0.0.0.0:29092,LISTENER_DOCKER_EXTERNAL_DIFFHOST_ENCRYPTED://0.0.0.0:9093
196+
{{- else }}
197+
CONTROLLER://0.0.0.0:9094,LISTENER_DOCKER_EXTERNAL_LOCALHOST://0.0.0.0:29092,LISTENER_DOCKER_EXTERNAL_DIFFHOST://0.0.0.0:9092
198+
{{- end }}
199+
- name: KAFKA_LOG_CLEANER_ENABLE
200+
value: {{ quote .root.Values.mini_runtime.kafka1.env.kafkaLogCleanerEnable }}
201+
- name: KAFKA_LOG_RETENTION_BYTES
202+
value: {{ quote .root.Values.mini_runtime.kafka1.env.kafkaLogRetentionBytes }}
203+
- name: KAFKA_LOG_RETENTION_CHECK_INTERVAL_MS
204+
value: {{ quote .root.Values.mini_runtime.kafka1.env.kafkaLogRetentionCheckIntervalMs }}
205+
- name: KAFKA_LOG_RETENTION_HOURS
206+
value: {{ quote .root.Values.mini_runtime.kafka1.env.kafkaLogRetentionHours }}
207+
- name: KAFKA_LOG_SEGMENT_BYTES
208+
value: {{ quote .root.Values.mini_runtime.kafka1.env.kafkaLogSegmentBytes }}
209+
- name: KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR
210+
value: {{ quote .root.Values.mini_runtime.kafka1.env.kafkaOffsetsTopicReplicationFactor }}
211+
- name: KAFKA_TRANSACTION_STATE_LOG_MIN_ISR
212+
value: {{ quote .root.Values.mini_runtime.kafka1.env.kafkaTransactionStateLogMinIsr }}
213+
- name: KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR
214+
value: {{ quote .root.Values.mini_runtime.kafka1.env.kafkaTransactionStateLogReplicationFactor }}
215+
- name: CLUSTER_ID
216+
value: {{ quote .root.Values.mini_runtime.kafka1.env.kafkaClusterId }}
217+
{{- if .root.Values.mini_runtime.kafka1.useTls }}
218+
- name: KAFKA_SSL_KEYSTORE_LOCATION
219+
value: {{ quote .root.Values.mini_runtime.kafka1.env.sslKeystoreLocation }}
220+
- name: KAFKA_SSL_KEYSTORE_PASSWORD
221+
value: {{ quote .root.Values.mini_runtime.kafka1.env.sslKeystorePassword }}
222+
- name: KAFKA_SSL_KEY_PASSWORD
223+
value: {{ quote .root.Values.mini_runtime.kafka1.env.sslKeyPassword }}
224+
- name: KAFKA_SSL_TRUSTSTORE_LOCATION
225+
value: {{ quote .root.Values.mini_runtime.kafka1.env.sslTruststoreLocation }}
226+
- name: KAFKA_SSL_TRUSTSTORE_PASSWORD
227+
value: {{ quote .root.Values.mini_runtime.kafka1.env.sslTruststorePassword }}
228+
{{- end }}
229+
{{- if .root.Values.mini_runtime.kafka1.useSasl }}
230+
- name: KAFKA_OPTS
231+
value: "-Djava.security.auth.login.config=/etc/kafka/config/kafka_server_jaas.conf"
232+
- name: KAFKA_SASL_ENABLED_MECHANISMS
233+
value: "PLAIN"
234+
- name: KAFKA_SASL_MECHANISM_INTER_BROKER_PROTOCOL
235+
value: "PLAIN"
236+
{{- end }}
237+
- name: KUBERNETES_CLUSTER_DOMAIN
238+
value: {{ quote .root.Values.kubernetesClusterDomain }}
239+
image: {{ .root.Values.mini_runtime.kafka1.image.repository }}:{{ .root.Values.mini_runtime.kafka1.image.tag | default .root.Chart.AppVersion }}
240+
{{- if or .root.Values.mini_runtime.kafka1.useTls .root.Values.mini_runtime.kafka1.useSasl }}
241+
volumeMounts:
242+
{{- if .root.Values.mini_runtime.kafka1.useTls }}
243+
- name: kafka-certs
244+
mountPath: {{ quote .root.Values.mini_runtime.kafka1.env.sslBaseMountPath }}
245+
{{- end }}
246+
{{- if .root.Values.mini_runtime.kafka1.useSasl }}
247+
- name: kafka-jaas-config
248+
mountPath: /etc/kafka/config
249+
readOnly: true
250+
{{- end }}
251+
{{- end }}
252+
name: {{ if .separate }}kafka{{ else }}kafka1{{ end }}
253+
ports:
254+
- containerPort: 9092
255+
- containerPort: 9093
256+
- containerPort: 29092
257+
- containerPort: 9999
258+
resources: {{- toYaml .root.Values.mini_runtime.kafka1.resources | nindent 4 }}
259+
{{- end }}
260+
261+
{{/*
262+
Kafka volumes template
263+
Usage: {{ include "akto.kafka.volumes" . }}
264+
*/}}
265+
{{- define "akto.kafka.volumes" -}}
266+
{{- if or .Values.mini_runtime.kafka1.useTls .Values.mini_runtime.kafka1.useSasl }}
267+
volumes:
268+
{{- if .Values.mini_runtime.kafka1.useTls }}
269+
- name: kafka-certs
270+
secret:
271+
secretName: {{ quote .Values.mini_runtime.kafka1.env.sslSecretName }}
272+
{{- end }}
273+
{{- if .Values.mini_runtime.kafka1.useSasl }}
274+
- name: kafka-jaas-config
275+
configMap:
276+
name: {{ include "akto.fullname" . }}-kafka-jaas-config
277+
{{- end }}
278+
{{- end }}
279+
{{- end }}

0 commit comments

Comments
 (0)