Secure Kafka UI Helm Configuration for Kubernetes#

1
replicaCount: 1
2
image:
3
  registry: docker.io
4
  repository: provectuslabs/kafka-ui
5
  pullPolicy: IfNotPresent
6
  tag: "v0.7.1" # Pinned to a specific version for security
7
imagePullSecrets: []
8
nameOverride: ""
9
fullnameOverride: "kafka-ui"
10
serviceAccount:
11
  create: true
12
  annotations: {}
13
  name: "kafka-ui"
14

15
# Configure Kafka connection and security settings
16
yamlApplicationConfig:
17
  kafka:
18
    clusters:
19
      - name: Yc8CaFhBkszRek42s5EIvf
20
        bootstrapServers: kafka.mukti.svc.cluster.local:9092
21
        properties:
22
          security.protocol: SASL_PLAINTEXT
23
          sasl.mechanism: SCRAM-SHA-512
24
          # Reference environment variables instead of hardcoded credentials
25
          sasl.jaas.config: org.apache.kafka.common.security.scram.ScramLoginModule required username="${KAFKA_USERNAME}" password="${KAFKA_PASSWORD}";
26
        schemaRegistry:
27
          enabled: false
28
        metrics:
29
          enabled: false
30
  auth:
31
    type: basic # Enabled for production security
32
    basicAuth:
33
      username: "${ADMIN_USERNAME}"
34
      password: "${ADMIN_PASSWORD}"
35
  management:
36
    health:
37
      ldap:
38
        enabled: false
39
  server:
40
    servlet:
41
      context-path: /
42
    port: 8080
43

44
# Use environment variables for sensitive data
45
# Fixed structure for secrets (direct format instead of nested map)
46
envs:
47
  secret:
48
    # Direct string values that will be read from secrets
49
    KAFKA_USERNAME: user1
50
    KAFKA_PASSWORD: ohXVKqI5Ld
51
    ADMIN_USERNAME: admin
52
    ADMIN_PASSWORD: securePassword123
53

54
# Network policy to allow communication with Kafka
55
networkPolicy:
56
  enabled: true
57
  egressRules:
58
    customRules:
59
      - to:
60
          - podSelector:
61
              matchLabels:
62
                app.kubernetes.io/name: kafka
63
                app.kubernetes.io/part-of: kafka
64
            namespaceSelector:
65
              matchLabels:
66
                kubernetes.io/metadata.name: mukti
67
        ports:
68
          - port: 9092
69
            protocol: TCP
70
  ingressRules:
71
    customRules: []
72

73
# Enhanced security annotations
74
podAnnotations:
75
  seccomp.security.alpha.kubernetes.io/pod: runtime/default
76

77
# Add labels to identify this application
78
podLabels:
79
  app.kubernetes.io/name: kafka-ui
80
  app.kubernetes.io/part-of: kafka
81

82
# Enhanced security context for the pod
83
podSecurityContext:
84
  fsGroup: 1000
85
  runAsNonRoot: true
86
  runAsUser: 1000
87
  runAsGroup: 1000
88

89
# Container security context
90
securityContext:
91
  capabilities:
92
    drop:
93
      - ALL
94
  readOnlyRootFilesystem: true
95
  runAsNonRoot: true
96
  runAsUser: 1000
97
  allowPrivilegeEscalation: false
98

99
# Service configuration
100
service:
101
  type: ClusterIP
102
  port: 80
103
  targetPort: 8080
104

105
# Ingress configuration - disabled by default
106
ingress:
107
  enabled: false
108
  annotations:
109
    kubernetes.io/ingress.class: nginx
110
    # Consider adding security headers for ingress
111
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
112
    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
113
    nginx.ingress.kubernetes.io/configuration-snippet: |
114
      more_set_headers "X-Frame-Options: DENY";
115
      more_set_headers "X-Content-Type-Options: nosniff";
116
      more_set_headers "X-XSS-Protection: 1; mode=block";
117
  path: /
118
  host: kafka-ui.example.com
119
  tls:
120
    enabled: false
121

122
# Resource limits to prevent resource exhaustion
123
resources:
124
  limits:
125
    cpu: 300m
126
    memory: 512Mi
127
  requests:
128
    cpu: 100m
129
    memory: 256Mi
130

131
autoscaling:
132
  enabled: false
133
  minReplicas: 1
134
  maxReplicas: 2
135
  targetCPUUtilizationPercentage: 80
136

137
nodeSelector: {}
138
tolerations: []
139
affinity: {}
140

141
# Probes for health monitoring
142
livenessProbe:
143
  httpGet:
144
    path: /actuator/health
145
    port: 8080
146
  initialDelaySeconds: 30
147
  periodSeconds: 10
148
  failureThreshold: 3
149

150
readinessProbe:
151
  httpGet:
152
    path: /actuator/health
153
    port: 8080
154
  initialDelaySeconds: 30
155
  periodSeconds: 10
156
  failureThreshold: 3