AutoMQ

{{- if .Values.bucketJob.enabled }}
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ include "automq.bucketJobName" . }}
  namespace: {{ .Release.Namespace }}
  annotations:
    # ArgoCD translates these to PreSync hooks; runs before the StatefulSet.
    helm.sh/hook: pre-install,pre-upgrade
    helm.sh/hook-weight: "-5"
    helm.sh/hook-delete-policy: before-hook-creation
spec:
  backoffLimit: 3
  # Fails visibly (rather than hanging the sync) if the Reflector-copied
  # secret or the RustFS service never becomes reachable.
  activeDeadlineSeconds: 300
  template:
    metadata:
      labels:
        app: {{ include "automq.bucketJobName" . }}
    spec:
      restartPolicy: Never
      containers:
        - name: bucket-init
          # rc image has ENTRYPOINT ["rc"]; the /bin/sh command replaces it.
          image: {{ .Values.bucketJob.image }}
          imagePullPolicy: IfNotPresent
          env:
            - name: ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: object-storage-secret
                  key: access-key
            - name: SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: object-storage-secret
                  key: secret-key
          command:
            - /bin/sh
            - -c
            - |
              set -eu
              rc alias set rustfs {{ .Values.bucketJob.endpoint }} "$ACCESS_KEY" "$SECRET_KEY"
              for bucket in {{ .Values.bucketJob.buckets | join " " }}; do
                if rc ls "rustfs/$bucket/" >/dev/null 2>&1; then
                  echo "bucket $bucket already exists"
                else
                  rc mb "rustfs/$bucket"
                fi
              done
{{- end }}

{{- if .Values.external.kafka.enabled }}
apiVersion: v1
kind: Service
metadata:
  name: automq-external-service
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: automq
    app.kubernetes.io/instance: {{ .Release.Namespace }}
spec:
  type: ClusterIP
  # Same selector as the chart's shared client Service (combined mode).
  selector:
    app.kubernetes.io/name: automq
    app.kubernetes.io/instance: {{ .Release.Namespace }}
    app.kubernetes.io/component: controller-eligible
    app.kubernetes.io/part-of: kafka
  ports:
    - name: tcp-external
      port: {{ .Values.external.kafka.port }}
      protocol: TCP
      # Broker speaks Kafka on container port 9092; 9095 (legacy traefik-era
      # bind port) answers nothing.
      targetPort: 9092
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
metadata:
  name: {{ .Release.Namespace }}-kafka-external
  namespace: {{ .Release.Namespace }}
spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: istio-gateway
      namespace: istio
      sectionName: kafka
  rules:
    - backendRefs:
        - group: ''
          kind: Service
          name: automq-external-service
          port: 9092
          weight: 1
{{- end }}

{{- if .Values.ui.enabled }}
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: {{ .Release.Namespace }}-kafka-ui
  namespace: {{ .Release.Namespace }}
  labels:
    app: {{ .Release.Namespace }}-kafka-ui
spec:
  replicas: 1
  strategy:
    canary:
      steps:
      - setWeight: 25
      - pause: {duration: 30s}
      - setWeight: 50
      - pause: {duration: 45s}
      - setWeight: 100
  selector:
    matchLabels:
      app: {{ .Release.Namespace }}-kafka-ui
  template:
    metadata:
      labels:
        app: {{ .Release.Namespace }}-kafka-ui
    spec:
      containers:
        - name: kafka-ui
          image: {{ .Values.ui.image }}
          imagePullPolicy: IfNotPresent
          env:
            - name: KAFKA_CLUSTERS_0_NAME
              value: automq
            - name: KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS
              value: automq.{{ .Release.Namespace }}.svc.cluster.local:9092
            {{- if .Values.schemaRegistry.enabled }}
            - name: KAFKA_CLUSTERS_0_SCHEMAREGISTRY
              value: http://{{ .Release.Namespace }}-schema-registry.{{ .Release.Namespace }}.svc.cluster.local:8081
            {{- end }}
            # TieredStopAtLevel=1: skip full JIT during startup — cuts cold
            # start substantially on ARM; throughput penalty is irrelevant
            # for an admin UI. egd avoids SecureRandom blocking in containers.
            - name: JAVA_OPTS
              value: -Xmx512m -XX:TieredStopAtLevel=1 -Djava.security.egd=file:/dev/./urandom
          ports:
            - name: http
              containerPort: 8080
          resources: {{- toYaml .Values.ui.resources | nindent 12 }}
          # Kafbat health endpoint is /actuator/health (per their own compose
          # healthchecks); /healthcheck 404s and crash-looped the pod via
          # liveness. startupProbe absorbs the Java cold start; timeoutSeconds
          # is raised because the default 1s produces false failures while
          # Spring is still initializing after Jetty binds.
          startupProbe:
            httpGet:
              path: /actuator/health
              port: http
            periodSeconds: 5
            timeoutSeconds: 5
            failureThreshold: 60
          livenessProbe:
            httpGet:
              path: /actuator/health
              port: http
            periodSeconds: 30
            timeoutSeconds: 5
            failureThreshold: 5
          readinessProbe:
            httpGet:
              path: /actuator/health
              port: http
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 6
---
apiVersion: v1
kind: Service
metadata:
  name: {{ .Release.Namespace }}-kafka-ui
  namespace: {{ .Release.Namespace }}
  labels:
    app: {{ .Release.Namespace }}-kafka-ui
spec:
  type: ClusterIP
  selector:
    app: {{ .Release.Namespace }}-kafka-ui
  ports:
    - name: http
      port: 80
      targetPort: http
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: {{ .Release.Namespace }}-kafka-ui
  namespace: {{ .Release.Namespace }}
  annotations:
    link.argocd.argoproj.io/external-link: "https://automq.opi5cluster.co.uk"
spec:
  parentRefs:
    - name: istio-gateway
      namespace: istio
      sectionName: websecure
  hostnames:
    - automq.opi5cluster.co.uk
  rules:
    - backendRefs:
        - name: {{ .Release.Namespace }}-kafka-ui
          port: 80
{{- end }}

{{- if .Values.schemaRegistry.enabled }}
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: {{ .Release.Namespace }}-schema-registry
  namespace: {{ .Release.Namespace }}
  labels:
    app: {{ .Release.Namespace }}-schema-registry
spec:
  replicas: 1
  strategy:
    canary:
      steps:
      - setWeight: 25
      - pause: {duration: 30s}
      - setWeight: 50
      - pause: {duration: 45s}
      - setWeight: 100
  selector:
    matchLabels:
      app: {{ .Release.Namespace }}-schema-registry
  template:
    metadata:
      labels:
        app: {{ .Release.Namespace }}-schema-registry
    spec:
      containers:
        - name: schema-registry
          image: {{ .Values.schemaRegistry.image }}
          imagePullPolicy: IfNotPresent
          env:
            # KRaft mode: schema state lives in the compacted _schemas topic
            # on AutoMQ — no ZooKeeper, no PVC. NOTE: bare host:port only —
            # a "plaintext://" prefix is parsed as a listener name by
            # Confluent SR and rejected ("No supported Kafka endpoints").
            - name: SCHEMA_REGISTRY_KAFKASTORE_BOOTSTRAP_SERVERS
              value: automq.{{ .Release.Namespace }}.svc.cluster.local:9092
            - name: SCHEMA_REGISTRY_KAFKASTORE_SECURITY_PROTOCOL
              value: PLAINTEXT
            - name: SCHEMA_REGISTRY_KAFKASTORE_TOPIC
              value: _schemas
            # Must match broker count — the default (3) kills topic creation
            # on this single-broker cluster. Raise alongside controller.replicaCount.
            - name: SCHEMA_REGISTRY_KAFKASTORE_TOPIC_REPLICATION_FACTOR
              value: "1"
            - name: SCHEMA_REGISTRY_HOST_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: SCHEMA_REGISTRY_LISTENERS
              value: http://0.0.0.0:8081
            - name: SCHEMA_REGISTRY_SCHEMA_REGISTRY_GROUP_ID
              value: schema-registry
            - name: SCHEMA_REGISTRY_HEAP_OPTS
              value: -Xms256m -Xmx512m
          ports:
            - name: http
              containerPort: 8081
          resources: {{- toYaml .Values.schemaRegistry.resources | nindent 12 }}
          livenessProbe:
            httpGet:
              path: /subjects
              port: http
            periodSeconds: 30
            failureThreshold: 6
          readinessProbe:
            httpGet:
              path: /subjects
              port: http
            periodSeconds: 10
            failureThreshold: 18
---
apiVersion: v1
kind: Service
metadata:
  name: {{ .Release.Namespace }}-schema-registry
  namespace: {{ .Release.Namespace }}
  labels:
    app: {{ .Release.Namespace }}-schema-registry
spec:
  type: ClusterIP
  selector:
    app: {{ .Release.Namespace }}-schema-registry
  ports:
    - name: http
      port: 8081
      targetPort: http
{{- end }}
{{- if and .Values.schemaRegistry.enabled .Values.external.schemaRegistry.enabled }}
---
# Schema Registry is plain HTTP(S) — standard house HTTPRoute on the shared
# websecure listener, wildcard *.opi5cluster.co.uk TLS. External clients use
# https://automq.schemaregistry.opi5cluster.co.uk; in-cluster consumers keep the
# Service DNS (automq-schema-registry:8081).
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: {{ .Release.Namespace }}-schema-registry
  namespace: {{ .Release.Namespace }}
  annotations:
    link.argocd.argoproj.io/external-link: "http://{{ .Values.external.schemaRegistry.hostname }}"
spec:
  parentRefs:
    - name: istio-gateway
      namespace: istio
      sectionName: web
  hostnames:
    - {{ .Values.external.schemaRegistry.hostname }}
  rules:
    - backendRefs:
        - name: {{ .Release.Namespace }}-schema-registry
          port: 8081
{{- end }}