fix(chart): the Kates API's chaos, topology and conformity follow the Kafka namespace and cluster name

.github/workflows/ci.yml

@@ -437,8 +437,12 @@ jobs:
         run: |
           fail() { echo "::error::kates-platform in namespace platform: $1"; exit 1; }
           show() { helm template p charts/kates-platform -n platform --show-only "charts/$1"; }
-          grep -q 'KATES_KAFKA_BOOTSTRAP_SERVERS: "krafter-kafka-bootstrap.platform.svc:9092"' \
-            <<<"$(show kates/templates/configmap.yaml)" || fail "Kates bootstraps from another namespace"
+          cm=$(show kates/templates/configmap.yaml)
+          grep -q 'KATES_KAFKA_BOOTSTRAP_SERVERS: "krafter-kafka-bootstrap.platform.svc:9092"' <<<"${cm}" \
+            || fail "Kates bootstraps from another namespace"
+          for v in CHAOS_KAFKA_NAMESPACE TOPOLOGY_KAFKA_NAMESPACE; do
+            grep -q "KATES_${v}: \"platform\"" <<<"${cm}" || fail "KATES_${v} names another namespace"
+          done
           np=$(show kates/templates/networkpolicy.yaml)
           grep -q 'kubernetes.io/metadata.name: "platform"' <<<"${np}" || fail "no Kates egress to the release namespace"
           if grep -q 'kubernetes.io/metadata.name: "kafka"' <<<"${np}"; then fail "Kates egress still names kafka"; fi

README.md

@@ -212,8 +212,8 @@ When you install charts with Helm directly:
 | [`kafka-common`](charts/kafka-common/) | 0.1.0 |  | Library chart — the templates the Strimzi charts share (names and labels, rails, Kafka client authentication, the Connect worker spec, KafkaUser, secret sync, NetworkPolicy and monitoring fragments, the Grafana grid, the preflight probe) |
 | [`kafka-ui`](charts/kafka-ui/) | 0.3.0 | v1.5.0 | A Helm chart for deploying Kafka UI (Kafbat) with Strimzi SCRAM-SHA-512 authentication |
 | [`kates-chaos`](charts/kates-chaos/) | 2.2.1 | 3.28.0 | Kates Chaos Engineering — wraps the LitmusChaos execution plane (operator, exporter, CRDs) with Kafka-specific RBAC, experiment/engine templating, and monitoring |
-| [`kates-platform`](charts/kates-platform/) | 0.8.1 | 1.0.0 | Umbrella chart for the full Kates platform — Kafka, Kates, and supporting infrastructure |
-| [`kates`](charts/kates/) | 0.12.0 | 1.27.0 | Kates — Kafka Advanced Testing & Engineering Suite |
+| [`kates-platform`](charts/kates-platform/) | 0.8.2 | 1.0.0 | Umbrella chart for the full Kates platform — Kafka, Kates, and supporting infrastructure |
+| [`kates`](charts/kates/) | 0.12.1 | 1.27.0 | Kates — Kafka Advanced Testing & Engineering Suite |
 | [`legacy-kafka`](charts/legacy-kafka/) | 0.2.0 | 3.9.1 | A deliberately old Kafka (2.x on ZooKeeper, or 3.x on KRaft) to migrate FROM — the replication source that the pinned Strimzi release cannot deploy |
 | [`mirror-maker2`](charts/mirror-maker2/) | 0.11.6 | 4.3.1 | Strimzi KafkaMirrorMaker2 — cross-cluster replication, DR, and cross-version migration (2.x/3.x → 4.x) |
 | [`monitoring`](charts/monitoring/) | 1.6.0 | 82.4.3 | Kates Monitoring — wraps kube-prometheus-stack with Kates-specific dashboards and configuration |

charts/kates-platform/Chart.yaml

@@ -2,10 +2,10 @@ apiVersion: v2
 name: kates-platform
 description: Umbrella chart for the full Kates platform — Kafka, Kates, and supporting infrastructure
 type: application
-# Patch: Kates reaches the Kafka this release installs, in the release
-# namespace (kates 0.11.7 renders those values with tpl), and the Helm test pod
-# carries the label the brokers admit test pods by.
-version: 0.8.1
+# Patch: the kates floor moves to 0.12.1, whose configmap points the Kates
+# API's chaos, topology and conformity at networkPolicy.kafka.namespace, which
+# this umbrella sets to the release namespace.
+version: 0.8.2
 appVersion: "1.0.0"
 keywords:
   - kafka
@@ -20,7 +20,7 @@ dependencies:
     repository: "file://../kafka-cluster"
     condition: kafka-cluster.enabled
   - name: kates
-    version: ">=0.11.7 <1.0.0"
+    version: ">=0.12.1 <1.0.0"
     repository: "file://../kates"
     condition: kates.enabled
   - name: apicurio-registry
@@ -42,6 +42,8 @@ dependencies:
     condition: connect-cluster.enabled
 annotations:
   artifacthub.io/changes: |
+    - kind: fixed
+      description: "In any namespace but kafka, the platform's Kates API reached the brokers but its chaos, cluster topology, cluster alerts and conformity checks still looked for Kafka in namespace kafka: chaos refused every plan with No broker pods found, and every conformity check returned 409. The kates floor moves to 0.12.1, which sets those settings from kates.networkPolicy.kafka.namespace, already the release namespace here, and their cluster name from kates.kafka.clusterName (krafter). kafka-cluster.clusterName other than krafter needs kates.kafka.clusterName and kates.kafka.bootstrapServers set to match. Run `make platform-chart-deps` before upgrading"
     - kind: fixed
       description: "Kates could not reach the Kafka the platform installs. The umbrella installs kafka-cluster in its release namespace, but the kates subchart kept its own defaults: bootstrap servers and the Trogdor coordinator in namespace kafka, and NetworkPolicy egress to namespace kafka only; and the platform profile admitted Kates to the brokers only from namespace kates. Installed in kates, as this README does, Kates looked up krafter-kafka-bootstrap.kafka.svc; installed in kafka, the brokers refused it. The umbrella now sets kates.kafka.bootstrapServers, kates.kafka.topicNamespace, kates.trogdor.coordinatorUrl and kates.networkPolicy.kafka.namespace from the release namespace (kates 0.11.7 renders them with tpl), and admits Kates to the brokers from the release namespace, so the platform works in any namespace. A release that set these keys keeps its own values. kafka-cluster.clusterName other than krafter needs kates.kafka.bootstrapServers set to match"
     - kind: fixed

charts/kates-platform/README.md

@@ -27,9 +27,10 @@ Any namespace works: Kafka and Kates both run in the release namespace, and the
 | `kates.enabled` | `true` | Deploy the Kates application subchart |
 | `kates.*` | subchart defaults | Full pass-through — see `charts/kates/values.yaml` |
 | `kates.kafka.bootstrapServers` | `krafter-kafka-bootstrap.{{ .Release.Namespace }}.svc:9092` | The kafka-cluster subchart's bootstrap Service; rename `krafter` with `kafka-cluster.clusterName` |
+| `kates.kafka.clusterName` | `krafter` | The Kafka cluster the Kates API's chaos, topology, cluster alerts and conformity act on; rename it with `kafka-cluster.clusterName` |
 | `kates.kafka.topicNamespace` | `{{ .Release.Namespace }}` | Where INTEGRATION_CDC manages its KafkaTopic CRs |
 | `kates.trogdor.coordinatorUrl` | `http://trogdor-coordinator.{{ .Release.Namespace }}.svc:8889` | A Trogdor coordinator next to Kafka, if you run one |
-| `kates.networkPolicy.kafka.namespace` | `{{ .Release.Namespace }}` | Namespace the Kates NetworkPolicy allows egress to for the brokers and Trogdor |
+| `kates.networkPolicy.kafka.namespace` | `{{ .Release.Namespace }}` | Namespace the Kates NetworkPolicy allows egress to for the brokers and Trogdor, and the one the Kates API's chaos, topology, cluster alerts and conformity act in |
 | `kafka-cluster.networkPolicy.clients` | `kates` from the release namespace | Overrides the platform profile's `kates` grant (namespace `kates`); a list set here replaces it |
 | `kates.rbac.cdcSecretNamespaces` | `[]` | Namespaces where the Kates API may read the `postgresql` Secret; INTEGRATION_CDC needs its database's namespace here, since the kates ClusterRole grants nothing on Secrets |
 | `apicurio-registry.enabled` | `false` | Deploy Apicurio Registry (KafkaSQL storage against the `kafka-cluster` subchart) |
@@ -40,6 +41,6 @@ Subchart values are validated by each subchart's own `values.schema.json`.
 
 ## Version pinning
 
-`Chart.yaml` pins the subcharts with ranges (`>=1.0.10 <2.0.0` for kafka-cluster, `>=0.11.6 <1.0.0` for mirror-maker2, `>=2.1.8 <3.0.0` for connect-cluster, `>=0.11.7 <1.0.0` for kates, `>=0.4.0 <1.0.0` for apicurio-registry); each floor is the version the umbrella was last rendered with. The `file://` repository always resolves to the local working tree, and `Chart.lock` records the exact version at build time.
+`Chart.yaml` pins the subcharts with ranges (`>=1.0.10 <2.0.0` for kafka-cluster, `>=0.11.6 <1.0.0` for mirror-maker2, `>=2.1.8 <3.0.0` for connect-cluster, `>=0.12.1 <1.0.0` for kates, `>=0.4.0 <1.0.0` for apicurio-registry); each floor is the version the umbrella was last rendered with. The `file://` repository always resolves to the local working tree, and `Chart.lock` records the exact version at build time.
 
 Helm installs whatever sits in `charts/` without checking it against those ranges, so the umbrella checks itself: rendering fails, naming the subchart, while `charts/` holds an enabled subchart outside its range. A `charts/` left from an older build would otherwise install its old subcharts, such as kates 0.9.1, whose ClusterRole read every Secret in the cluster. Run `make platform-chart-deps` to refresh it.

charts/kates-platform/values.yaml

@@ -17,6 +17,7 @@ kates:
   enabled: true
   kafka:
     bootstrapServers: "krafter-kafka-bootstrap.{{ .Release.Namespace }}.svc:9092"
+    clusterName: krafter
     topicNamespace: "{{ .Release.Namespace }}"
   trogdor:
     coordinatorUrl: "http://trogdor-coordinator.{{ .Release.Namespace }}.svc:8889"

charts/kates/Chart.yaml

@@ -2,9 +2,10 @@ apiVersion: v2
 name: kates
 description: Kates — Kafka Advanced Testing & Engineering Suite
 type: application
-# Minor: rbac.scope=namespace installs with nothing cluster-scoped. The
-# default, rbac.scope=cluster, renders what 0.11.7 rendered.
-version: 0.12.0
+# Patch: the backend's chaos, topology and conformity settings follow
+# networkPolicy.kafka.namespace and the new kafka.clusterName, whose defaults
+# are the backend's own (kafka, krafter).
+version: 0.12.1
 # The non-blocking health endpoints this chart's probes now point at come from
 # a BUILD-TIME property (quarkus.messaging.health.enabled=false), so they only
 # exist in the image built from this branch. Keep appVersion and
@@ -28,6 +29,8 @@ annotations:
   artifacthub.io/category: integration-delivery
   artifacthub.io/license: Apache-2.0
   artifacthub.io/changes: |
+    - kind: fixed
+      description: "With Kafka outside namespace kafka, or named other than krafter, chaos, the cluster topology, cluster alerts and conformity checks looked for Kafka in kafka/krafter: the configmap never set kates.chaos.kafka.namespace, kates.chaos.kafka.cluster or kates.topology.kafka-cluster, and set kates.topology.kafka-namespace only with rbac.scope=namespace. Chaos refused every plan with No broker pods found, and every conformity check returned 409. The configmap now sets KATES_CHAOS_KAFKA_NAMESPACE and KATES_TOPOLOGY_KAFKA_NAMESPACE from networkPolicy.kafka.namespace (through tpl, with the policy on or off), whatever rbac.scope says, and KATES_CHAOS_KAFKA_CLUSTER and KATES_TOPOLOGY_KAFKA_CLUSTER from kafka.clusterName (new, default krafter). The defaults are the backend's own, so a release that keeps them renders the same settings; an extraEnv entry for these variables still wins. Upgrading: a release that set networkPolicy.kafka.namespace to anything but the namespace Kafka runs in now points chaos and topology there too"
     - kind: added
       description: "rbac.scope (default cluster, unchanged) and rbac.kafkaNamespaceRole (default true). rbac.scope=namespace creates no ClusterRole or ClusterRoleBinding; with rbac.kafkaNamespaceRole=false as well, an account with only edit in the release namespace can install the chart. Performance and INTEGRITY runs make no Kubernetes call. It renders one read-only Role and RoleBinding in networkPolicy.kafka.namespace for conformity checks (get kafkas; list kafkanodepools, pods, persistentvolumeclaims, podmonitors and endpointslices), points the check at that namespace (KATES_TOPOLOGY_KAFKA_NAMESPACE), and sets KATES_CHAOS_PROVIDER=noop unless chaos.provider is set. With rbac.kafkaNamespaceRole=false that Role is left out, for an account that may grant those reads to apply from helm template --show-only templates/rbac.yaml. Without node access a conformity check takes the zones for zones, skew and kafka.rackAwareness with source cr from the EndpointSlices of Strimzi's headless Service, so only another zoneLabel leaves them UNKNOWN. A release that sets neither value, as after helm upgrade --reuse-values, keeps scope cluster"
     - kind: changed

charts/kates/README.md

@@ -38,6 +38,7 @@ All configuration is in [values.yaml](values.yaml). Key sections:
 | `replicaCount` | `1` | Number of Kates API pods. Must be 1; see [One replica](#one-replica) |
 | `kafka.bootstrapServers` | `krafter-kafka-bootstrap.kafka.svc:9092` | Kafka bootstrap address. This, `kafka.topicNamespace`, `trogdor.coordinatorUrl` and `networkPolicy.kafka.namespace` go through `tpl`, so a value may name `{{ .Release.Namespace }}`, as kates-platform does |
 | `kafka.topicNamespace` | `""` | Namespace for CDC test `KafkaTopic` CRs (`""` = auto-detect) |
+| `kafka.clusterName` | `krafter` | Strimzi Kafka cluster, in `networkPolicy.kafka.namespace`, that chaos, topology, cluster alerts and conformity act on; `kates deploy` sets it |
 | `engine.defaultBackend` | `native` | Benchmark engine (`native` or `trogdor`) |
 | `engine.maxDurationMs` | `7200000` | Maximum planned duration accepted for one run |
 | `engine.reaperGraceMs` | `300000` | Grace after a `RUNNING` or `STOPPING` run's planned duration before the reaper fails it |
@@ -58,7 +59,7 @@ All configuration is in [values.yaml](values.yaml). Key sections:
 | `ingress.certManager.issuerName` | `""` | cert-manager issuer name |
 | `ingress.certManager.issuerKind` | `ClusterIssuer` | Issuer kind |
 | `networkPolicy.enabled` | `true` | Enable NetworkPolicy |
-| `networkPolicy.kafka.namespace` | `kafka` | Namespace the brokers (`networkPolicy.kafka.port`) and the Trogdor coordinator (8889) run in; `kates deploy` sets it |
+| `networkPolicy.kafka.namespace` | `kafka` | Namespace the brokers (`networkPolicy.kafka.port`) and the Trogdor coordinator (8889) run in; `kates deploy` sets it. The backend's chaos, topology, cluster alerts and conformity act in it too, with the policy on or off |
 | `networkPolicy.kafka.port` | `9092` | Kafka egress target port |
 | `networkPolicy.prometheus.namespace` | `monitoring` | Prometheus egress target namespace: the one `prometheus.url` points into |
 | `networkPolicy.prometheus.port` | `9090` | Prometheus egress target port |

charts/kates/templates/configmap.yaml

@@ -7,6 +7,12 @@ metadata:
 data:
   KATES_KAFKA_BOOTSTRAP_SERVERS: {{ tpl .Values.kafka.bootstrapServers . | quote }}
   KATES_CDC_TOPIC_NAMESPACE: {{ tpl .Values.kafka.topicNamespace . | quote }}
+  {{- /* Also the namespace rbac.scope=namespace grants the conformity check's Role in. */}}
+  {{- $kafkaNamespace := tpl (.Values.networkPolicy.kafka.namespace | default "kafka") . }}
+  KATES_CHAOS_KAFKA_NAMESPACE: {{ $kafkaNamespace | quote }}
+  KATES_TOPOLOGY_KAFKA_NAMESPACE: {{ $kafkaNamespace | quote }}
+  KATES_CHAOS_KAFKA_CLUSTER: {{ .Values.kafka.clusterName | default "krafter" | quote }}
+  KATES_TOPOLOGY_KAFKA_CLUSTER: {{ .Values.kafka.clusterName | default "krafter" | quote }}
   KATES_KAFKA_SECURITY_PROTOCOL: {{ .Values.kafka.security.protocol | quote }}
   {{- if .Values.kafka.sasl.enabled }}
   KATES_KAFKA_SASL_MECHANISM: {{ .Values.kafka.sasl.mechanism | quote }}
@@ -180,10 +186,6 @@ data:
   {{- with .Values.chaos.provider | default (ternary "noop" "" $namespaced) }}
   KATES_CHAOS_PROVIDER: {{ . | quote }}
   {{- end }}
-  {{- if $namespaced }}
-  {{- /* The namespace the conformity check reads is the one its Role is granted in. */}}
-  KATES_TOPOLOGY_KAFKA_NAMESPACE: {{ tpl (.Values.networkPolicy.kafka.namespace | default "kafka") . | quote }}
-  {{- end }}
 
   {{- with .Values.faultTolerance }}
   COM_BMSCOMP_KATES_SERVICE_TOPICSERVICE_CREATETOPIC_TIMEOUT_VALUE: {{ .topicService.timeoutMs | default "35000" | quote }}

charts/kates/values.schema.json

@@ -341,6 +341,7 @@
                     "minLength": 0
                 },
                 "topicNamespace": { "type": "string" },
+                "clusterName": { "type": "string" },
                 "clientRack": { "type": "string" },
                 "security": {
                     "type": "object",

charts/kates/values.yaml

@@ -355,6 +355,9 @@ kafka:
   # trogdor.coordinatorUrl and networkPolicy.kafka.namespace go through tpl,
   # so a value may name {{ .Release.Namespace }}, as kates-platform does.
   bootstrapServers: "krafter-kafka-bootstrap.kafka.svc:9092"
+  # -- Name of the Strimzi Kafka cluster in networkPolicy.kafka.namespace that
+  # chaos, topology, cluster alerts and conformity act on (kates deploy sets it)
+  clusterName: krafter
   # -- Namespace where CDC integration test KafkaTopic CRs are managed (empty = auto-detect)
   topicNamespace: ""
   # -- Client rack ID for rack-aware consumption
@@ -460,7 +463,10 @@ networkPolicy:
       ports:
         - port: 8080
           protocol: TCP
-  # -- Kafka egress: the brokers on port and Trogdor on 8889 (kates deploy sets namespace)
+  # -- The namespace Kafka runs in: egress to the brokers on port and Trogdor
+  # on 8889, and the namespace the backend's chaos, topology, cluster alerts
+  # and conformity act in, whether or not the policy is enabled (kates deploy
+  # sets namespace)
   kafka:
     namespace: kafka
     port: 9092

cli/cmd/deploy_components.go

@@ -1700,7 +1700,9 @@ data:
 		katesArgs = append(katesArgs,
 			"--set", "kafka.bootstrapServers="+katesBootstrap,
 			"--set", "kafka.topicNamespace="+kafkaNS,
+			// Also the namespace and cluster the API's chaos, topology and conformity act on.
 			"--set", "networkPolicy.kafka.namespace="+kafkaNS,
+			"--set", "kafka.clusterName="+dc.primary.Name,
 			"--set", fmt.Sprintf("monitoring.enabled=%t", deployWithMonitoring))
 		katesArgs = append(katesArgs, dc.scrapeArgs("charts/kates")...)
 		katesArgs = append(katesArgs, dc.prometheusArgs()...)

cli/cmd/deploy_kafkaui_test.go

@@ -7,11 +7,12 @@ import (
 	"testing"
 )
 
-// TestDeployCommand_KafkaUIFollowsKafkaName checks that Kafka UI is pointed
-// at the primary that --kafka-name names. It read kates detect's
-// --cluster-name instead, whose default is krafter, so a primary under any
-// other name got a Kafka UI whose KafkaUser and bootstrap address named a
-// cluster that does not exist.
+// TestDeployCommand_KafkaUIFollowsKafkaName checks that Kafka UI and the
+// Kates API are pointed at the primary that --kafka-name names. Kafka UI read
+// kates detect's --cluster-name instead, whose default is krafter, so a
+// primary under any other name got a Kafka UI whose KafkaUser and bootstrap
+// address named a cluster that does not exist; the Kates API's chaos,
+// topology and conformity stayed on krafter.
 func TestDeployCommand_KafkaUIFollowsKafkaName(t *testing.T) {
 	defer func() {
 		deployTopology = "isolated"
@@ -58,11 +59,17 @@ func TestDeployCommand_KafkaUIFollowsKafkaName(t *testing.T) {
 		t.Fatalf("runDeploy failed: %v", err)
 	}
 
-	var ui string
+	var ui, kates string
 	for _, c := range helmCommands {
 		if strings.Contains(c, "helm upgrade --install kafka-ui charts/kafka-ui") {
 			ui = c
 		}
+		if strings.Contains(c, "helm upgrade --install kates charts/kates") {
+			kates = c
+		}
+	}
+	if !strings.Contains(kates, "--set kafka.clusterName=orders ") {
+		t.Errorf("the Kates API is not pointed at the primary, orders:\n%s", kates)
 	}
 	if ui == "" {
 		t.Fatalf("Kafka UI was not installed; helm calls:\n%s", strings.Join(helmCommands, "\n"))

cli/cmd/mcp_caveats.go

@@ -201,10 +201,10 @@ var mcpCaveatsCore = []mcpCaveat{
 			mcpAnchoredRef("kates/src/main/resources/application.properties:329-334",
 				"# Prometheus server (for disruption metrics capture)",
 				"kates.prometheus.url=http://monitoring-kube-prometheus-prometheus.monitoring.svc:9090"),
-			mcpAnchoredRef("charts/kates/values.yaml:408-418",
+			mcpAnchoredRef("charts/kates/values.yaml:411-421",
 				"# -- Prometheus the backend queries for a disruption's Kafka metrics",
 				`url: "http://monitoring-kube-prometheus-prometheus.monitoring.svc:9090"`),
-			mcpAnchoredRef("charts/kates/templates/configmap.yaml:37-39",
+			mcpAnchoredRef("charts/kates/templates/configmap.yaml:43-45",
 				"{{- with .Values.prometheus.url }}", "KATES_PROMETHEUS_URL: {{ . | quote }}"),
 			mcpAnchoredRef("kates/k8s/configmap.yaml:29-33",
 				"# Prometheus, for a disruption's Kafka metrics",