[bmscomp]

Rebased onto main after #438, #440 and #439 (c64e0c0). The diff against main is this PR's one commit. Merge it before #442, which is stacked on it.

Problem

The Kates API reads the Kafka cluster it acts on from four settings. Nothing sets them, so they stay at the backend's defaults:

Setting	Default	Read by
kates.chaos.kafka.namespace	kafka	DisruptionSafetyGuard, DisruptionOrchestrator, DisruptionOrphanReconciler, DisruptionConcurrencyGuard, PrometheusMetricsCapture
kates.chaos.kafka.cluster	krafter	DisruptionOrchestrator, DisruptionConcurrencyGuard (the lease key), PrometheusMetricsCapture
kates.topology.kafka-namespace	kafka	ClusterTopologyService, ClusterAlertsService, ConformityCheck, CdcIntegrationService (fallback)
kates.topology.kafka-cluster	krafter	ClusterTopologyService, ConformityCheck

The charts/kates configmap renders none of them. kates deploy sets only kafka.bootstrapServers, kafka.topicNamespace and networkPolicy.kafka.namespace. So with Kafka anywhere but kafka/krafter, the API still looks there:

• kates deploy --kafka-ns X or --kafka-name Y
• kates-platform in any namespace but kafka (fix(chart): kates-platform points Kates at the Kafka it installs, in any namespace #440 fixed the bootstrap address and egress, not these)

In those setups, chaos refuses every plan with No broker pods found, topology comes back empty, alerts read the wrong PrometheusRules, and every conformity check returns 409. plans/conformity-enhancements.md already noted the 409 for --kafka-name.

Fix

• kates 0.12.1 (main is at 0.12.0, from feat(chart,conformity): rbac.scope=namespace runs tests and conformity checks without cluster admin #439), configmap:
  • KATES_CHAOS_KAFKA_NAMESPACE and KATES_TOPOLOGY_KAFKA_NAMESPACE come from networkPolicy.kafka.namespace, through tpl. That value already means "the namespace Kafka runs in" (the brokers and Trogdor), and both kates deploy and kates-platform set it. It applies whether the policy is on or off.
  • KATES_CHAOS_KAFKA_CLUSTER and KATES_TOPOLOGY_KAFKA_CLUSTER come from a new kafka.clusterName, default krafter. It is in the schema. No existing value names the cluster.
  • The defaults are the backend's own, so a default install sets the same values as before. An extraEnv entry still wins, since env overrides envFrom. The lab values in docs/stretched-kafka rely on that.
  • feat(chart,conformity): rbac.scope=namespace runs tests and conformity checks without cluster admin #439 set KATES_TOPOLOGY_KAFKA_NAMESPACE from the same value, but only for rbac.scope=namespace. That block is gone: the line here renders the same value for every scope, and keeping both would be a duplicate key. feat(chart,conformity): rbac.scope=namespace runs tests and conformity checks without cluster admin #439's CI asserts (kafka-ns, and team through tpl) pass, and each key renders once under both scopes.
• kates deploy adds --set kafka.clusterName=<--kafka-name>. It already set the namespace.
• kates-platform 0.8.2:
  • The kates floor moves to >=0.12.1.
  • kates.kafka.clusterName: krafter sits next to the bootstrap address, so a rename of kafka-cluster.clusterName has both lines to change. The README and the change note say so.
  • CI's "Check kates-platform wires Kates to its own Kafka" step also asserts both namespace variables are platform.
• MCP caveats:
  • dry-run-other-namespace (mcp_tools_chaos.go) and topology-unread-looks-empty (mcp_tools_cluster.go) now say which chart value sets each setting, with anchored refs to the configmap lines.
  • The comment in mcp_chaos_preview.go says the chart sets both namespaces from one value.
  • Four refs into charts/kates/values.yaml and configmap.yaml are re-pointed past the added lines, mapped through the diff from main's files.

Upgrading: a release that set networkPolicy.kafka.namespace to anything but where Kafka runs now points chaos and topology there too. With the policy on, its egress already went there (since 0.11.1), so it had already lost Kafka.

Proof

helm template … --show-only templates/configmap.yaml:

default:
  KATES_CHAOS_KAFKA_NAMESPACE: "kafka"
  KATES_TOPOLOGY_KAFKA_NAMESPACE: "kafka"
  KATES_CHAOS_KAFKA_CLUSTER: "krafter"
  KATES_TOPOLOGY_KAFKA_CLUSTER: "krafter"
--set networkPolicy.kafka.namespace=kafka-sys --set kafka.clusterName=orders --set networkPolicy.enabled=false:
  KATES_CHAOS_KAFKA_NAMESPACE: "kafka-sys"
  KATES_TOPOLOGY_KAFKA_NAMESPACE: "kafka-sys"
  KATES_CHAOS_KAFKA_CLUSTER: "orders"
  KATES_TOPOLOGY_KAFKA_CLUSTER: "orders"
kates-platform -n platform:
  KATES_CHAOS_KAFKA_NAMESPACE: "platform"
  KATES_TOPOLOGY_KAFKA_NAMESPACE: "platform"
  KATES_CHAOS_KAFKA_CLUSTER: "krafter"
  KATES_TOPOLOGY_KAFKA_CLUSTER: "krafter"

The extended CI step fails with --set kates.networkPolicy.kafka.namespace=kafka ("KATES_CHAOS_KAFKA_NAMESPACE names another namespace"). TestDeployCommand_KafkaUIFollowsKafkaName now also checks that the kates release gets --set kafka.clusterName=orders under --kafka-name orders.

Local checks

• Helm 4.3.0 locally (CI runs 3.17.0), after make platform-chart-deps and the helm-deps charts. Every run: step of the helm-lint and kyverno-policy-test jobs passes, except kubeconform, which isn't installed here.
• gen-chart-table.sh --check, gen-version-matrix.sh --check, check-versions.sh, check-book-style.sh.
• actionlint, yamllint -c .yamllint.yaml .github config charts. The YAML Validation job needs PyYAML, which this Mac lacks; the changed YAML parses with yq.
• In cli/: go vet ./..., go test ./... (including TestMCPCaveatRefAnchors), golangci-lint run --new-from-rev=origin/main (0 issues), govulncheck (none), check-cli-style.sh, check-cli-compat.sh.
• In kates/: ./mvnw test -Dquarkus.grpc.codegen.skip=true -Dquarkus.http.test-port=0 passes: 1,490 tests in 141 classes, 0 failures, 1 skipped. There is no backend change; CI runs it because cli/** changed. ITs, Docker and native builds run in CI only.

Not in this PR

• A plan step that leaves targetNamespace out gets kafka, a literal in FaultSpec.Builder (FaultSpec.java:83), not kates.chaos.kafka.namespace. With Kafka elsewhere, the guard refuses such a step. That needs a backend fix.
• kates/k8s/configmap.yaml, the raw manifests, still leaves these settings at the backend defaults. Those manifests put Kafka in kafka.
• docs/stretched-kafka sets KATES_CHAOS_KAFKA_CLUSTER through extraEnv. That still works; kafka.clusterName would now cover topology too.