Add chart strimzi-kafka-operator 0.47.0

2025-09-08 09:19:22 +09:00
parent dcaf0c3edd
commit f58c922eaa
48 changed files with 38747 additions and 0 deletions
@@ -0,0 +1,13 @@
+{{- if .Values.serviceAccountCreate -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.serviceAccount }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "strimzi.name" . }}
+    chart: {{ template "strimzi.chart" . }}
+    component: service-account
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+{{- end -}}
@@ -0,0 +1,163 @@
+{{- if and .Values.rbac.create .Values.createGlobalResources -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: strimzi-cluster-operator-namespaced
+  labels:
+    app: {{ template "strimzi.name" . }}
+    chart: {{ template "strimzi.chart" . }}
+    component: role
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+rules:
+# Resources in this role are used by the operator based on an operand being deployed in some namespace. When needed, you
+# can deploy the operator as a cluster-wide operator. But grant the rights listed in this role only on the namespaces
+# where the operands will be deployed. That way, you can limit the access the operator has to other namespaces where it
+# does not manage any clusters.
+- apiGroups:
+  - "rbac.authorization.k8s.io"
+  resources:
+    # The cluster operator needs to access and manage rolebindings to grant Strimzi components cluster permissions
+  - rolebindings
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - delete
+  - patch
+  - update
+- apiGroups:
+  - "rbac.authorization.k8s.io"
+  resources:
+    # The cluster operator needs to access and manage roles to grant the entity operator permissions
+  - roles
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - delete
+  - patch
+  - update
+- apiGroups:
+  - ""
+  resources:
+    # The cluster operator needs to access and delete pods, this is to allow it to monitor pod health and coordinate rolling updates
+  - pods
+    # The cluster operator needs to access and manage service accounts to grant Strimzi components cluster permissions
+  - serviceaccounts
+    # The cluster operator needs to access and manage config maps for Strimzi components configuration
+  - configmaps
+    # The cluster operator needs to access and manage services and endpoints to expose Strimzi components to network traffic
+  - services
+  - endpoints
+    # The cluster operator needs to access and manage secrets to handle credentials
+  - secrets
+    # The cluster operator needs to access and manage persistent volume claims to bind them to Strimzi components for persistent data
+  - persistentvolumeclaims
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - delete
+  - patch
+  - update
+- apiGroups:
+  - "apps"
+  resources:
+    # The cluster operator needs to access and manage deployments to run deployment based Strimzi components
+  - deployments
+    # The cluster operator needs to access replica-sets to manage Strimzi components and to determine error states
+  - replicasets
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - delete
+  - patch
+  - update
+- apiGroups:
+  - "apps"
+  resources:
+    # The Cluster Operator needs to scale Deployments while migrating Connect and Mirror Maker 2 clusters from Deployments to StrimziPodSets
+  - deployments/scale
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - "events.k8s.io" # new events api, used by cluster operator
+  resources:
+    # The cluster operator needs to be able to create events
+  - events
+  verbs:
+  - create
+- apiGroups:
+    # Kafka Connect Build on OpenShift requirement
+  - build.openshift.io
+  resources:
+  - buildconfigs
+  - buildconfigs/instantiate
+  - builds
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - delete
+  - patch
+  - update
+- apiGroups:
+  - networking.k8s.io
+  resources:
+    # The cluster operator needs to access and manage network policies to lock down communication between Strimzi components
+  - networkpolicies
+    # The cluster operator needs to access and manage ingresses which allow external access to the services in a cluster
+  - ingresses
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - delete
+  - patch
+  - update
+- apiGroups:
+  - route.openshift.io
+  resources:
+    # The cluster operator needs to access and manage routes to expose Strimzi components for external access
+  - routes
+  - routes/custom-host
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - delete
+  - patch
+  - update
+- apiGroups:
+  - image.openshift.io
+  resources:
+  # The cluster operator needs to verify the image stream when used for Kafka Connect image build
+  - imagestreams
+  verbs:
+  - get
+- apiGroups:
+  - policy
+  resources:
+    # The cluster operator needs to access and manage pod disruption budgets this limits the number of concurrent disruptions
+    # that a Strimzi component experiences, allowing for higher availability
+  - poddisruptionbudgets
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - delete
+  - patch
+  - update
+{{- end -}}
@@ -0,0 +1,39 @@
+{{- if .Values.rbac.create -}}
+{{- $root := . -}}
+{{- $watchNamespaces := .Values.watchNamespaces -}}
+{{- if $root.Values.watchAnyNamespace }}
+  {{- $watchNamespaces = list -}}  
+{{- end }}
+{{- range append $watchNamespaces .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if $root.Values.watchAnyNamespace }}
+kind: ClusterRoleBinding
+{{- else }}
+kind: RoleBinding
+{{- end }}
+metadata:
+  {{- if $root.Values.watchAnyNamespace }}
+  name: strimzi-cluster-operator-namespaced
+  {{- else }}
+  name: strimzi-cluster-operator
+  {{- end }}  
+  {{- if not $root.Values.watchAnyNamespace }}
+  namespace: {{ . }}
+  {{- end }}
+  labels:
+    app: {{ template "strimzi.name" $root }}
+    chart: {{ template "strimzi.chart" $root }}
+    component: role-binding
+    release: {{ $root.Release.Name }}
+    heritage: {{ $root.Release.Service }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ $root.Values.serviceAccount }}
+    namespace: {{ $root.Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: strimzi-cluster-operator-namespaced
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}
+{{- end }}
@@ -0,0 +1,44 @@
+{{- if and .Values.rbac.create .Values.createGlobalResources -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: strimzi-cluster-operator-global
+  labels:
+    app: {{ template "strimzi.name" . }}
+    chart: {{ template "strimzi.chart" . }}
+    component: role
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+rules:
+- apiGroups:
+  - "rbac.authorization.k8s.io"
+  resources:
+    # The cluster operator needs to create and manage cluster role bindings in the case of an install where a user
+    # has specified they want their cluster role bindings generated
+  - clusterrolebindings
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - delete
+  - patch
+  - update
+- apiGroups:
+  - storage.k8s.io
+  resources:
+    # The cluster operator requires "get" permissions to view storage class details
+    # This is because only a persistent volume of a supported storage class type can be resized
+  - storageclasses
+  verbs:
+  - get
+- apiGroups:
+    - ""
+  resources:
+    # The cluster operator requires "list" permissions to view all nodes in a cluster
+    # The listing is used to determine the node addresses when NodePort access is configured
+    # These addresses are then exposed in the custom resource states
+  - nodes
+  verbs:
+  - list
+{{- end -}}
@@ -0,0 +1,20 @@
+{{- if and .Values.rbac.create .Values.createGlobalResources -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: strimzi-cluster-operator
+  labels:
+    app: {{ template "strimzi.name" . }}
+    chart: {{ template "strimzi.chart" . }}
+    component: role-binding
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.serviceAccount }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: strimzi-cluster-operator-global
+  apiGroup: rbac.authorization.k8s.io
+{{- end -}}
@@ -0,0 +1,37 @@
+{{- if and .Values.rbac.create .Values.createGlobalResources -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: strimzi-cluster-operator-leader-election
+  labels:
+    app: {{ template "strimzi.name" . }}
+    chart: {{ template "strimzi.chart" . }}
+    component: role
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+rules:
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+    # The cluster operator needs to access and manage leases for leader election
+    # The "create" verb cannot be used with "resourceNames"
+  - leases
+  verbs:
+  - create
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+    # The cluster operator needs to access and manage leases for leader election
+  - leases
+  resourceNames:
+    # The default RBAC files give the operator only access to the Lease resource names strimzi-cluster-operator
+    # If you want to use another resource name or resource namespace, you have to configure the RBAC resources accordingly
+  - strimzi-cluster-operator
+  verbs:
+  - get
+  - list
+  - watch
+  - delete
+  - patch
+  - update
+{{- end -}}
@@ -0,0 +1,21 @@
+{{- if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: strimzi-cluster-operator-leader-election
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "strimzi.name" . }}
+    chart: {{ template "strimzi.chart" . }}
+    component: role-binding
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.serviceAccount }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: strimzi-cluster-operator-leader-election
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}
@@ -0,0 +1,87 @@
+{{- if and .Values.rbac.create .Values.createGlobalResources -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: strimzi-cluster-operator-watched
+  labels:
+    app: {{ template "strimzi.name" . }}
+    chart: {{ template "strimzi.chart" . }}
+    component: role
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+rules:
+# Resources in this role are being watched by the operator. When operator is deployed as cluster-wide, these permissions
+# need to be granted to the operator on a cluster wide level as well, even if the operands will be deployed only in
+# few of the namespaces in given cluster. This is required to set up the Kubernetes watches and informers.
+# Note: The rights included in this role might change in the future
+- apiGroups:
+  - ""
+  resources:
+    # The cluster operator needs to access and delete pods, this is to allow it to monitor pod health and coordinate rolling updates
+  - pods
+  verbs:
+  - watch
+  - list
+- apiGroups:
+  - "kafka.strimzi.io"
+  resources:
+  # The Cluster Operator operates the Strimzi custom resources
+  - kafkas
+  - kafkanodepools
+  - kafkaconnects
+  - kafkaconnectors
+  - kafkabridges
+  - kafkamirrormaker2s
+  - kafkarebalances
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - patch
+  - update
+- apiGroups:
+  - "kafka.strimzi.io"
+  resources:
+  # The Cluster Operator needs to manage the status of the Strimzi custom resources
+  - kafkas/status
+  - kafkanodepools/status
+  - kafkaconnects/status
+  - kafkaconnectors/status
+  - kafkabridges/status
+  - kafkamirrormaker2s/status
+  - kafkarebalances/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - "core.strimzi.io"
+  resources:
+  # The cluster operator uses StrimziPodSets to manage the Kafka, Kafka Connect, and Kafka MirrorMaker 2 pods
+  - strimzipodsets
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - delete
+  - patch
+  - update
+- apiGroups:
+  - "core.strimzi.io"
+  resources:
+  # The Cluster Operator needs to manage the status of the StrimziPodSet custom resource
+  - strimzipodsets/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+    - "kafka.strimzi.io"
+  resources:
+    # The Cluster Operator needs deletion for KafkaRebalance only (during auto-rebalancing)
+    - kafkarebalances
+  verbs:
+    - delete
+{{- end -}}
@@ -0,0 +1,39 @@
+{{- if .Values.rbac.create -}}
+{{- $root := . -}}
+{{- $watchNamespaces := .Values.watchNamespaces -}}
+{{- if $root.Values.watchAnyNamespace }}
+  {{- $watchNamespaces = list -}}  
+{{- end }}
+{{- range append $watchNamespaces .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if $root.Values.watchAnyNamespace }}
+kind: ClusterRoleBinding
+{{- else }}
+kind: RoleBinding
+{{- end }}
+metadata:
+  {{- if $root.Values.watchAnyNamespace }}
+  name: strimzi-cluster-operator-watched
+  {{- else }}
+  name: strimzi-cluster-operator-watched
+  {{- end }}
+  {{- if not $root.Values.watchAnyNamespace }}
+  namespace: {{ . }}
+  {{- end }}
+  labels:
+    app: {{ template "strimzi.name" $root }}
+    chart: {{ template "strimzi.chart" $root }}
+    component: role-binding
+    release: {{ $root.Release.Name }}
+    heritage: {{ $root.Release.Service }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ $root.Values.serviceAccount }}
+    namespace: {{ $root.Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: strimzi-cluster-operator-watched
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}
+{{- end }}
@@ -0,0 +1,21 @@
+{{- if and .Values.rbac.create .Values.createGlobalResources -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: strimzi-kafka-broker
+  labels:
+    app: {{ template "strimzi.name" . }}
+    chart: {{ template "strimzi.chart" . }}
+    component: broker-role
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+    # The Kafka Brokers require "get" permissions to view the node they are on
+    # This information is used to generate a Rack ID that is used for High Availability configurations
+  - nodes
+  verbs:
+  - get
+{{- end -}}
@@ -0,0 +1,23 @@
+{{- if and .Values.rbac.create .Values.createGlobalResources -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: strimzi-cluster-operator-kafka-broker-delegation
+  labels:
+    app: {{ template "strimzi.name" . }}
+    chart: {{ template "strimzi.chart" . }}
+    component: broker-role-binding
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+# The Kafka broker cluster role must be bound to the cluster operator service account so that it can delegate the cluster role to the Kafka brokers.
+# This must be done to avoid escalating privileges which would be blocked by Kubernetes.
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.serviceAccount }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: strimzi-kafka-broker
+  apiGroup: rbac.authorization.k8s.io
+
+{{- end -}}
@@ -0,0 +1,62 @@
+{{- if and .Values.rbac.create .Values.createGlobalResources -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: strimzi-entity-operator
+  labels:
+    app: {{ template "strimzi.name" . }}
+    chart: {{ template "strimzi.chart" . }}
+    component: entity-operator-role
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+rules:
+- apiGroups:
+  - "kafka.strimzi.io"
+  resources:
+    # The Entity Operator contains the Topic Operator which needs to access and manage KafkaTopic resources
+  - kafkatopics
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - patch
+  - update
+  - delete
+- apiGroups:
+  - "kafka.strimzi.io"
+  resources:
+    # The Entity Operator contains the User Operator which needs to access and manage KafkaUser resources
+  - kafkausers
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - patch
+  - update
+- apiGroups:
+  - "kafka.strimzi.io"
+  resources:
+    # The Entity Operator contains the Topic Operator which needs to access and manage KafkaTopic resources
+  - kafkatopics/status
+    # The Entity Operator contains the User Operator which needs to access and manage KafkaUser resources
+  - kafkausers/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - ""
+  resources:
+    # The entity operator user-operator needs to access and manage secrets to store generated credentials
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - delete
+  - patch
+  - update
+{{- end -}}
@@ -0,0 +1,37 @@
+{{- if .Values.rbac.create -}}
+{{- $root := . -}}
+{{- $watchNamespaces := .Values.watchNamespaces -}}
+{{- if $root.Values.watchAnyNamespace }}
+  {{- $watchNamespaces = list -}}  
+{{- end }}
+{{- range append $watchNamespaces .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if $root.Values.watchAnyNamespace }}
+kind: ClusterRoleBinding
+{{- else }}
+kind: RoleBinding
+{{- end }}
+metadata:
+  name: strimzi-cluster-operator-entity-operator-delegation
+  {{- if not $root.Values.watchAnyNamespace }}
+  namespace: {{ . }}
+  {{- end }}
+  labels:
+    app: {{ template "strimzi.name" $root }}
+    chart: {{ template "strimzi.chart" $root }}
+    component: entity-operator-role-binding
+    release: {{ $root.Release.Name }}
+    heritage: {{ $root.Release.Service }}
+# The Entity Operator cluster role must be bound to the cluster operator service account so that it can delegate the cluster role to the Entity Operator.
+# This must be done to avoid escalating privileges which would be blocked by Kubernetes.
+subjects:
+  - kind: ServiceAccount
+    name: {{ $root.Values.serviceAccount }}
+    namespace: {{ $root.Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: strimzi-entity-operator
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}
+{{- end }}
@@ -0,0 +1,22 @@
+{{- if and .Values.rbac.create .Values.createGlobalResources -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: strimzi-kafka-client
+  labels:
+    app: {{ template "strimzi.name" . }}
+    chart: {{ template "strimzi.chart" . }}
+    component: client-role
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+    # The Kafka clients (Connect, Mirror Maker, etc.) require "get" permissions to view the node they are on
+    # This information is used to generate a Rack ID (client.rack option) that is used for consuming from the closest
+    # replicas when enabled
+  - nodes
+  verbs:
+  - get
+{{- end -}}
@@ -0,0 +1,24 @@
+{{- if and .Values.rbac.create .Values.createGlobalResources -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: strimzi-cluster-operator-kafka-client-delegation
+  labels:
+    app: {{ template "strimzi.name" . }}
+    chart: {{ template "strimzi.chart" . }}
+    component: client-role-binding
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+# The Kafka clients cluster role must be bound to the cluster operator service account so that it can delegate the
+# cluster role to the Kafka clients using it for consuming from closest replica.
+# This must be done to avoid escalating privileges which would be blocked by Kubernetes.
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.serviceAccount }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: strimzi-kafka-client
+  apiGroup: rbac.authorization.k8s.io
+
+{{- end -}}
@@ -0,0 +1,36 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: {{ .Values.logConfigMap }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "strimzi.name" . }}
+    chart: {{ template "strimzi.chart" . }}
+    component: logging-config-map
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+data:
+  log4j2.properties: |
+    {{- if .Values.logConfiguration }}
+    {{- tpl .Values.logConfiguration . | nindent 4 }}
+    {{- else }}
+    name = COConfig
+    monitorInterval = 30
+
+    appender.console.type = Console
+    appender.console.name = STDOUT
+    appender.console.layout.type = PatternLayout
+    appender.console.layout.pattern = %d{yyyy-MM-dd HH:mm:ss} %-5p %c{1}:%L - %m%n
+
+    rootLogger.level = {{ default .Values.logLevel .Values.logLevelOverride }}
+    rootLogger.appenderRefs = stdout
+    rootLogger.appenderRef.console.ref = STDOUT
+
+    # Kafka AdminClient logging is a bit noisy at INFO level
+    logger.kafka.name = org.apache.kafka
+    logger.kafka.level = WARN
+
+    # Keeps separate level for Netty logging -> to not be changed by the root logger
+    logger.netty.name = io.netty
+    logger.netty.level = INFO
+    {{- end }}
@@ -0,0 +1,19 @@
+{{- if .Values.podDisruptionBudget.enabled -}}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: strimzi-cluster-operator-pdb
+spec:
+  selector:
+    matchLabels:
+      name: strimzi-cluster-operator
+  {{- if .Values.podDisruptionBudget.minAvailable }}
+  minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
+  {{- end  }}
+  {{- if .Values.podDisruptionBudget.maxUnavailable }}
+  maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
+  {{- end }}
+  {{- if (semverCompare ">= 1.27-0" .Capabilities.KubeVersion.Version) }}
+  unhealthyPodEvictionPolicy: {{ .Values.podDisruptionBudget.unhealthyPodEvictionPolicy }}
+  {{- end }}
+{{- end }}
@@ -0,0 +1,198 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: strimzi-cluster-operator
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "strimzi.name" . }}
+    chart: {{ template "strimzi.chart" . }}
+    component: deployment
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+  {{- with .Values.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  replicas: {{ .Values.replicas }}
+  {{- if .Values.revisionHistoryLimit }}
+  revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
+  {{- end }}
+  selector:
+    matchLabels:
+      name: strimzi-cluster-operator
+      strimzi.io/kind: cluster-operator
+  template:
+    metadata:
+      labels:
+        name: strimzi-cluster-operator
+        strimzi.io/kind: cluster-operator
+        {{- with .Values.labels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- with .Values.annotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    spec:
+      serviceAccountName: {{ .Values.serviceAccount }}
+      {{- /* imagePullSecrets is allowed to be for backwards compatibility */ -}}
+      {{- if kindIs "string" .Values.image.imagePullSecrets }}
+      imagePullSecrets:
+        - name: {{ .Values.image.imagePullSecrets }}
+      {{- else if kindIs "slice" .Values.image.imagePullSecrets }}
+      imagePullSecrets:
+        {{- with .Values.image.imagePullSecrets }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- end }}
+      {{- with .Values.podSecurityContext }}
+      securityContext: {{ toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if .Values.priorityClassName }}
+      priorityClassName: {{ .Values.priorityClassName }}
+      {{- end }}
+      volumes:
+        - name: strimzi-tmp
+          emptyDir:
+            medium: Memory
+            sizeLimit: {{ .Values.tmpDirSizeLimit }}
+        - name: {{ .Values.logVolume }}
+          configMap:
+            name: {{ .Values.logConfigMap }}
+      containers:
+        - name: strimzi-cluster-operator
+          image: {{ template "strimzi.image" (set . "key" "") }}
+          ports:
+            - containerPort: 8080
+              name: http
+          {{- if .Values.image.imagePullPolicy }}
+          imagePullPolicy: {{ .Values.image.imagePullPolicy | quote }}
+          {{- end }}
+          args:
+            - /opt/strimzi/bin/cluster_operator_run.sh
+          volumeMounts:
+            - name: strimzi-tmp
+              mountPath: /tmp
+            - name: {{ .Values.logVolume }}
+              mountPath: /opt/strimzi/custom-config/
+          env:
+            - name: STRIMZI_NAMESPACE
+              {{- if .Values.watchAnyNamespace }}
+              value: "*"
+              {{- else }}
+              {{- if .Values.watchNamespaces -}}
+              {{- $ns := .Values.watchNamespaces -}}
+              {{- $ns := append $ns .Release.Namespace }}
+              value: "{{ join "," $ns }}"
+              {{- else }}
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+              {{- end }}
+              {{- end }}
+            - name: STRIMZI_FULL_RECONCILIATION_INTERVAL_MS
+              value: {{ .Values.fullReconciliationIntervalMs | quote }}
+            - name: STRIMZI_OPERATION_TIMEOUT_MS
+              value: {{ .Values.operationTimeoutMs | quote }}
+            {{- template "strimzi.kafka.image.map" . }}
+            - name: STRIMZI_DEFAULT_TOPIC_OPERATOR_IMAGE
+              value: {{ template "strimzi.image" (set . "key" "topicOperator") }}
+            - name: STRIMZI_DEFAULT_USER_OPERATOR_IMAGE
+              value: {{ template "strimzi.image" (set . "key" "userOperator") }}
+            - name: STRIMZI_DEFAULT_KAFKA_INIT_IMAGE
+              value: {{ template "strimzi.image" (set . "key" "kafkaInit") }}
+            - name: STRIMZI_DEFAULT_KAFKA_BRIDGE_IMAGE
+              value: {{ template "strimzi.image" (set . "key" "kafkaBridge") }}
+            - name: STRIMZI_DEFAULT_KANIKO_EXECUTOR_IMAGE
+              value: {{ template "strimzi.image" (set . "key" "kanikoExecutor") }}
+            - name: STRIMZI_DEFAULT_MAVEN_BUILDER
+              value: {{ template "strimzi.image" (set . "key" "mavenBuilder") }}
+            - name: STRIMZI_OPERATOR_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            {{- /* imagePullSecrets is allowed to be for backwards compatibility */ -}}
+            {{- if kindIs "string" .Values.image.imagePullSecrets }}
+            - name: STRIMZI_IMAGE_PULL_SECRETS
+              value: {{ .Values.image.imagePullSecrets }}
+            {{- else if kindIs "slice" .Values.image.imagePullSecrets }}
+            - name: STRIMZI_IMAGE_PULL_SECRETS
+              value: {{ template "strimzi.listPluck" (dict "list" .Values.image.imagePullSecrets "key" "name") }}
+            {{- end }}
+            {{- if .Values.image.operatorNamespaceLabels }}
+            - name: STRIMZI_OPERATOR_NAMESPACE_LABELS
+              value: {{ .Values.image.operatorNamespaceLabels }}
+            {{- end }}
+            {{- if .Values.image.imagePullPolicy }}
+            - name: STRIMZI_IMAGE_PULL_POLICY
+              value: {{ .Values.image.imagePullPolicy }}
+            {{- end }}
+            {{ if ne .Values.kubernetesServiceDnsDomain "cluster.local" }}- name: KUBERNETES_SERVICE_DNS_DOMAIN
+              value: {{ .Values.kubernetesServiceDnsDomain | quote }}{{ end }}
+            - name: STRIMZI_FEATURE_GATES
+              value: {{ .Values.featureGates | quote }}
+            {{- if .Values.labelsExclusionPattern }}
+            - name: STRIMZI_LABELS_EXCLUSION_PATTERN
+              value: {{ .Values.labelsExclusionPattern | quote }}
+            {{- end }}
+            {{- if ne .Values.generateNetworkPolicy true}}
+            - name: STRIMZI_NETWORK_POLICY_GENERATION
+              value: {{ .Values.generateNetworkPolicy | quote }}
+            {{- end }}
+            {{- if ne (int .Values.connectBuildTimeoutMs) 300000 }}
+            - name: STRIMZI_CONNECT_BUILD_TIMEOUT_MS
+              value: {{ .Values.connectBuildTimeoutMs | quote }}
+            {{- end }}
+            {{- if ne .Values.generatePodDisruptionBudget true}}
+            - name: STRIMZI_POD_DISRUPTION_BUDGET_GENERATION
+              value: {{ .Values.generatePodDisruptionBudget | quote }}
+            {{- end }}
+            {{- if .Values.extraEnvs }}
+{{ toYaml .Values.extraEnvs | indent 12 }}
+            {{- end }}
+            - name: STRIMZI_LEADER_ELECTION_ENABLED
+              {{- if .Values.leaderElection.enable }}
+              value: "true"
+              {{- else }}
+              value: "false"
+              {{- end }}
+            - name: STRIMZI_LEADER_ELECTION_LEASE_NAME
+              value: "strimzi-cluster-operator"
+            - name: STRIMZI_LEADER_ELECTION_LEASE_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: STRIMZI_LEADER_ELECTION_IDENTITY
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+          livenessProbe:
+            httpGet:
+              path: /healthy
+              port: http
+            initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: http
+            initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+          {{- with .Values.securityContext }}
+          securityContext: {{ toYaml .| nindent 12 }}
+          {{- end }}
+          resources:
+{{ toYaml .Values.resources | indent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
@@ -0,0 +1,53 @@
+{{- if and .Values.rbac.create .Values.createAggregateRoles -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: strimzi-admin
+  labels:
+    app: {{ template "strimzi.name" . }}
+    chart: {{ template "strimzi.chart" . }}
+    component: entity-operator-role
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+    # Add these permissions to the "admin" and "edit" default roles.
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+rules:
+  - apiGroups:
+      - "kafka.strimzi.io"
+    resources:
+      - kafkas
+      - kafkanodepools
+      - kafkanodepools/scale
+      - kafkaconnects
+      - kafkaconnects/scale
+      - kafkausers
+      - kafkatopics
+      - kafkabridges
+      - kafkabridges/scale
+      - kafkaconnectors
+      - kafkaconnectors/scale
+      - kafkamirrormaker2s
+      - kafkamirrormaker2s/scale
+      - kafkarebalances
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - delete
+      - patch
+      - update
+  - apiGroups:
+      - "core.strimzi.io"
+    resources:
+      - strimzipodsets
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - delete
+      - patch
+      - update
+{{- end -}}
@@ -0,0 +1,39 @@
+{{- if and .Values.rbac.create .Values.createAggregateRoles -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: strimzi-view
+  labels:
+    app: {{ template "strimzi.name" . }}
+    chart: {{ template "strimzi.chart" . }}
+    component: entity-operator-role
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+    # Add these permissions to the "view" default role.
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+rules:
+  - apiGroups:
+      - "kafka.strimzi.io"
+    resources:
+      - kafkas
+      - kafkanodepools
+      - kafkaconnects
+      - kafkausers
+      - kafkatopics
+      - kafkabridges
+      - kafkaconnectors
+      - kafkamirrormaker2s
+      - kafkarebalances
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - "core.strimzi.io"
+    resources:
+      - strimzipodsets
+    verbs:
+      - get
+      - list
+      - watch
+{{- end -}}
@@ -0,0 +1,26 @@
+{{- if .Values.dashboards.enabled }}
+{{- $files := .Files.Glob "files/grafana-dashboards/*.json" }}
+{{- range $path, $fileContents := $files }}
+{{- $dashboardName := regexReplaceAll "(^.*/)(.*)\\.json$" $path "${2}" }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ $dashboardName | trunc 63 | trimSuffix "-" }}
+  namespace: {{ $.Values.dashboards.namespace | default $.Release.Namespace }}
+  labels:
+    component: grafana-dashboards
+    {{- if $.Values.dashboards.label }}
+    {{ $.Values.dashboards.label }}: {{ ternary $.Values.dashboards.labelValue "1" (not (empty $.Values.dashboards.labelValue)) | quote }}
+    {{- end }}
+  {{- with $.Values.dashboards.extraLabels }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with $.Values.dashboards.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+data:
+  {{ $dashboardName }}.json: {{ $.Files.Get $path | toJson }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,5 @@
+Thank you for installing {{ .Chart.Name }}-{{ .Chart.Version }}
+
+To create a Kafka cluster refer to the following documentation.
+
+https://strimzi.io/docs/operators/latest/deploying.html#deploying-cluster-operator-helm-chart-str
@@ -0,0 +1,63 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "strimzi.name" -}}
+{{- default "strimzi" .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "strimzi.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "strimzi.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Creates the image name from the registry, repository, image, tag, and digest
+- Priority is given to digests over tags
+- Registry, repository, and image will be joined with '/' if values are not blank
+- tagSuffix is added to tagPrefix or default tag.  To ignore the suffix, use tag.
+- tagSuffix can be ignored by using tag instead of tagPrefix
+To use, add the following key/value pairs to the scope:
+- "key" [optional]: the key to lookup under .Values for the image map
+- "tagSuffix" [optional]: the suffix to add to tagPrefix or the default tag
+- Example: `template "strimzi.image" (merge . (dict "key" "cruiseControl" "tagSuffix" "-kafka-3.1.0"))`
+*/}}
+{{- define "strimzi.image" -}}
+{{- $vals := ternary .Values.image (index .Values .key).image (empty .key) -}}
+{{- $ref := join "/" (compact (list (default .Values.defaultImageRegistry $vals.registry) (default .Values.defaultImageRepository $vals.repository) (default .Values.defaultImageName $vals.name))) -}}
+{{- $tag := join "" (compact (list (coalesce $vals.tag $vals.tagPrefix .Values.defaultImageTag) (ternary .tagSuffix "" (empty $vals.tag)))) -}}
+{{- join "" (compact (list $ref (ternary ":" "@" (empty $vals.digest)) (default $tag $vals.digest))) -}}
+{{- $_ := unset . "key" -}}
+{{- $_ := unset . "tagSuffix" -}}
+{{- end -}}
+
+{{/*
+ Create a list of comma-separated values corresponding to a given key in a map array.
+*/}}
+{{- define "strimzi.listPluck" -}}
+{{- $pluckedList := list -}}
+{{- range .list -}}
+{{- $pluckedList = append $pluckedList (get . $.key) -}}
+{{- end -}}
+{{- join "," $pluckedList -}}
+{{- end -}}
@@ -0,0 +1,27 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/* This file is generated in helm-charts/Makefile */}}
+{{/* DO NOT EDIT BY HAND                            */}}
+
+{{/* Generate the kafka image map */}}
+{{- define "strimzi.kafka.image.map" }}
+            - name: STRIMZI_DEFAULT_KAFKA_EXPORTER_IMAGE
+              value: {{ template "strimzi.image" (merge . (dict "key" "kafkaExporter" "tagSuffix" "-kafka-4.0.0")) }}
+            - name: STRIMZI_DEFAULT_CRUISE_CONTROL_IMAGE
+              value: {{ template "strimzi.image" (merge . (dict "key" "cruiseControl" "tagSuffix" "-kafka-4.0.0")) }}
+            - name: STRIMZI_KAFKA_IMAGES
+              value: |                 
+                3.9.0={{ template "strimzi.image" (merge . (dict "key" "kafka" "tagSuffix" "-kafka-3.9.0")) }}
+                3.9.1={{ template "strimzi.image" (merge . (dict "key" "kafka" "tagSuffix" "-kafka-3.9.1")) }}
+                4.0.0={{ template "strimzi.image" (merge . (dict "key" "kafka" "tagSuffix" "-kafka-4.0.0")) }}
+            - name: STRIMZI_KAFKA_CONNECT_IMAGES
+              value: |                 
+                3.9.0={{ template "strimzi.image" (merge . (dict "key" "kafkaConnect" "tagSuffix" "-kafka-3.9.0")) }}
+                3.9.1={{ template "strimzi.image" (merge . (dict "key" "kafkaConnect" "tagSuffix" "-kafka-3.9.1")) }}
+                4.0.0={{ template "strimzi.image" (merge . (dict "key" "kafkaConnect" "tagSuffix" "-kafka-4.0.0")) }}
+            - name: STRIMZI_KAFKA_MIRROR_MAKER_2_IMAGES
+              value: |                 
+                3.9.0={{ template "strimzi.image" (merge . (dict "key" "kafkaMirrorMaker2" "tagSuffix" "-kafka-3.9.0")) }}
+                3.9.1={{ template "strimzi.image" (merge . (dict "key" "kafkaMirrorMaker2" "tagSuffix" "-kafka-3.9.1")) }}
+                4.0.0={{ template "strimzi.image" (merge . (dict "key" "kafkaMirrorMaker2" "tagSuffix" "-kafka-4.0.0")) }}
+{{- end -}}