Cluster
Cluster is the Schema for the Clusters API.
TypeMR
Providerprovider-aws-kafka
Groupkafka.aws.upbound.io
Scopecluster
Version

1apiVersion: kafka.aws.upbound.io/v1beta2

2kind: Cluster

apiVersion
string
kind
string
metadata
object
spec
object

ClusterSpec defines the desired state of Cluster

deletionPolicy
string
forProvider
required
object

(No description available)

brokerNodeGroupInfo
array

Configuration block for the broker nodes of the Kafka cluster.

azDistribution
string
clientSubnets
array

A list of subnets to connect to in client VPC (documentation).

clientSubnetsRefs
array

References to Subnet in ec2 to populate clientSubnets.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
clientSubnetsSelector
object

Selector for a list of Subnet in ec2 to populate clientSubnets.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
connectivityInfo
array

Information about the cluster access configuration. See below. For security reasons, you can't turn on public access while creating an MSK cluster. However, you can update an existing cluster to make it publicly accessible. You can also create a new cluster and then update it to make it publicly accessible (documentation).

publicAccess
array

Access control settings for brokers. See below.

type
string
vpcConnectivity
array

VPC connectivity access control for brokers. See below.

clientAuthentication
array

Configuration block for specifying a client authentication. See below.

sasl
array

SASL authentication type details for VPC connectivity. See below.

iam
boolean
scram
boolean
tls
boolean
instanceType
string
securityGroups
array

A list of the security groups to associate with the elastic network interfaces to control who can communicate with the cluster.

securityGroupsRefs
array

References to SecurityGroup in ec2 to populate securityGroups.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
securityGroupsSelector
object

Selector for a list of SecurityGroup in ec2 to populate securityGroups.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
storageInfo
array

A block that contains information about storage volumes attached to MSK broker nodes. See below.

ebsStorageInfo
array

A block that contains EBS volume information. See below.

provisionedThroughput
array

A block that contains EBS volume provisioned throughput information. To provision storage throughput, you must choose broker type kafka.m5.4xlarge or larger. See below.

enabled
boolean
volumeThroughput
number
volumeSize
number
clientAuthentication
array

Configuration block for specifying a client authentication. See below.

sasl
array

SASL authentication type details for VPC connectivity. See below.

iam
boolean
scram
boolean
tls
array

Enables TLS authentication for VPC connectivity.

certificateAuthorityArns
array

List of ACM Certificate Authority Amazon Resource Names (ARNs).

unauthenticated
boolean
clusterName
string
configurationInfo
array

Configuration block for specifying a MSK Configuration to attach to Kafka brokers. See below.

arn
string
arnRef
object

Reference to a Configuration in kafka to populate arn.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
arnSelector
object

Selector for a Configuration in kafka to populate arn.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
revision
number
encryptionInfo
array

Configuration block for specifying encryption. See below.

encryptionAtRestKmsKeyArn
string
encryptionAtRestKmsKeyArnRef
object

Reference to a Key in kms to populate encryptionAtRestKmsKeyArn.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
encryptionAtRestKmsKeyArnSelector
object

Selector for a Key in kms to populate encryptionAtRestKmsKeyArn.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
encryptionInTransit
array

Configuration block to specify encryption in transit. See below.

clientBroker
string
inCluster
boolean
enhancedMonitoring
string
kafkaVersion
string
loggingInfo
array

Configuration block for streaming broker logs to Cloudwatch/S3/Kinesis Firehose. See below.

brokerLogs
array

Configuration block for Broker Logs settings for logging info. See below.

cloudwatchLogs
array

(No description available)

enabled
boolean
logGroup
string
logGroupRef
object

Reference to a Group in cloudwatchlogs to populate logGroup.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
logGroupSelector
object

Selector for a Group in cloudwatchlogs to populate logGroup.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
firehose
array

(No description available)

deliveryStream
string
deliveryStreamRef
object

Reference to a DeliveryStream in firehose to populate deliveryStream.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
deliveryStreamSelector
object

Selector for a DeliveryStream in firehose to populate deliveryStream.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
enabled
boolean
s3
array

(No description available)

bucket
string
bucketRef
object

Reference to a Bucket in s3 to populate bucket.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
bucketSelector
object

Selector for a Bucket in s3 to populate bucket.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
enabled
boolean
prefix
string
numberOfBrokerNodes
number
openMonitoring
array

Configuration block for JMX and Node monitoring for the MSK cluster. See below.

prometheus
array

Configuration block for Prometheus settings for open monitoring. See below.

jmxExporter
array

Configuration block for JMX Exporter. See below.

enabledInBroker
boolean
nodeExporter
array

Configuration block for Node Exporter. See below.

enabledInBroker
boolean
region
required
string
storageMode
string
tags
object
initProvider
object

THIS IS A BETA FIELD. It will be honored unless the Management Policies feature flag is disabled. InitProvider holds the same fields as ForProvider, with the exception of Identifier and other resource reference fields. The fields that are in InitProvider are merged into ForProvider when the resource is created. The same fields are also added to the terraform ignore_changes hook, to avoid updating them after creation. This is useful for fields that are required on creation, but we do not desire to update them after creation, for example because of an external controller is managing them, like an autoscaler.

brokerNodeGroupInfo
array

Configuration block for the broker nodes of the Kafka cluster.

azDistribution
string
clientSubnets
array

A list of subnets to connect to in client VPC (documentation).

clientSubnetsRefs
array

References to Subnet in ec2 to populate clientSubnets.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
clientSubnetsSelector
object

Selector for a list of Subnet in ec2 to populate clientSubnets.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
connectivityInfo
array

Information about the cluster access configuration. See below. For security reasons, you can't turn on public access while creating an MSK cluster. However, you can update an existing cluster to make it publicly accessible. You can also create a new cluster and then update it to make it publicly accessible (documentation).

publicAccess
array

Access control settings for brokers. See below.

type
string
vpcConnectivity
array

VPC connectivity access control for brokers. See below.

clientAuthentication
array

Configuration block for specifying a client authentication. See below.

sasl
array

SASL authentication type details for VPC connectivity. See below.

iam
boolean
scram
boolean
tls
boolean
instanceType
string
securityGroups
array

A list of the security groups to associate with the elastic network interfaces to control who can communicate with the cluster.

securityGroupsRefs
array

References to SecurityGroup in ec2 to populate securityGroups.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
securityGroupsSelector
object

Selector for a list of SecurityGroup in ec2 to populate securityGroups.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
storageInfo
array

A block that contains information about storage volumes attached to MSK broker nodes. See below.

ebsStorageInfo
array

A block that contains EBS volume information. See below.

provisionedThroughput
array

A block that contains EBS volume provisioned throughput information. To provision storage throughput, you must choose broker type kafka.m5.4xlarge or larger. See below.

enabled
boolean
volumeThroughput
number
volumeSize
number
clientAuthentication
array

Configuration block for specifying a client authentication. See below.

sasl
array

SASL authentication type details for VPC connectivity. See below.

iam
boolean
scram
boolean
tls
array

Enables TLS authentication for VPC connectivity.

certificateAuthorityArns
array

List of ACM Certificate Authority Amazon Resource Names (ARNs).

unauthenticated
boolean
clusterName
string
configurationInfo
array

Configuration block for specifying a MSK Configuration to attach to Kafka brokers. See below.

arn
string
arnRef
object

Reference to a Configuration in kafka to populate arn.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
arnSelector
object

Selector for a Configuration in kafka to populate arn.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
revision
number
encryptionInfo
array

Configuration block for specifying encryption. See below.

encryptionAtRestKmsKeyArn
string
encryptionAtRestKmsKeyArnRef
object

Reference to a Key in kms to populate encryptionAtRestKmsKeyArn.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
encryptionAtRestKmsKeyArnSelector
object

Selector for a Key in kms to populate encryptionAtRestKmsKeyArn.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
encryptionInTransit
array

Configuration block to specify encryption in transit. See below.

clientBroker
string
inCluster
boolean
enhancedMonitoring
string
kafkaVersion
string
loggingInfo
array

Configuration block for streaming broker logs to Cloudwatch/S3/Kinesis Firehose. See below.

brokerLogs
array

Configuration block for Broker Logs settings for logging info. See below.

cloudwatchLogs
array

(No description available)

enabled
boolean
logGroup
string
logGroupRef
object

Reference to a Group in cloudwatchlogs to populate logGroup.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
logGroupSelector
object

Selector for a Group in cloudwatchlogs to populate logGroup.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
firehose
array

(No description available)

deliveryStream
string
deliveryStreamRef
object

Reference to a DeliveryStream in firehose to populate deliveryStream.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
deliveryStreamSelector
object

Selector for a DeliveryStream in firehose to populate deliveryStream.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
enabled
boolean
s3
array

(No description available)

bucket
string
bucketRef
object

Reference to a Bucket in s3 to populate bucket.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
bucketSelector
object

Selector for a Bucket in s3 to populate bucket.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
enabled
boolean
prefix
string
numberOfBrokerNodes
number
openMonitoring
array

Configuration block for JMX and Node monitoring for the MSK cluster. See below.

prometheus
array

Configuration block for Prometheus settings for open monitoring. See below.

jmxExporter
array

Configuration block for JMX Exporter. See below.

enabledInBroker
boolean
nodeExporter
array

Configuration block for Node Exporter. See below.

enabledInBroker
boolean
storageMode
string
tags
object
managementPolicies
array

THIS IS A BETA FIELD. It is on by default but can be opted out through a Crossplane feature flag. ManagementPolicies specify the array of actions Crossplane is allowed to take on the managed and external resources. This field is planned to replace the DeletionPolicy field in a future release. Currently, both could be set independently and non-default values would be honored if the feature flag is enabled. If both are custom, the DeletionPolicy field will be ignored. See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223 and this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md

providerConfigRef
object

ProviderConfigReference specifies how the provider that will be used to create, observe, update, and delete this managed resource should be configured.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
publishConnectionDetailsTo
object

PublishConnectionDetailsTo specifies the connection secret config which contains a name, metadata and a reference to secret store config to which any connection details for this managed resource should be written. Connection details frequently include the endpoint, username, and password required to connect to the managed resource.

configRef
object

SecretStoreConfigRef specifies which secret store config should be used for this ConnectionSecret.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
metadata
object

Metadata is the metadata for connection secret.

annotations
object
labels
object
type
string
name
required
string
writeConnectionSecretToRef
object

WriteConnectionSecretToReference specifies the namespace and name of a Secret to which any connection details for this managed resource should be written. Connection details frequently include the endpoint, username, and password required to connect to the managed resource. This field is planned to be replaced in a future release in favor of PublishConnectionDetailsTo. Currently, both could be set independently and connection details would be published to both without affecting each other.

name
required
string
namespace
required
string
status
object

ClusterStatus defines the observed state of Cluster.

atProvider
object

(No description available)

arn
string
bootstrapBrokers
string
bootstrapBrokersPublicSaslIam
string
bootstrapBrokersPublicSaslScram
string
bootstrapBrokersPublicTls
string
bootstrapBrokersSaslIam
string
bootstrapBrokersSaslScram
string
bootstrapBrokersTls
string
bootstrapBrokersVpcConnectivitySaslIam
string
bootstrapBrokersVpcConnectivitySaslScram
string
bootstrapBrokersVpcConnectivityTls
string
brokerNodeGroupInfo
array

Configuration block for the broker nodes of the Kafka cluster.

azDistribution
string
clientSubnets
array

A list of subnets to connect to in client VPC (documentation).

connectivityInfo
array

Information about the cluster access configuration. See below. For security reasons, you can't turn on public access while creating an MSK cluster. However, you can update an existing cluster to make it publicly accessible. You can also create a new cluster and then update it to make it publicly accessible (documentation).

publicAccess
array

Access control settings for brokers. See below.

type
string
vpcConnectivity
array

VPC connectivity access control for brokers. See below.

clientAuthentication
array

Configuration block for specifying a client authentication. See below.

sasl
array

SASL authentication type details for VPC connectivity. See below.

iam
boolean
scram
boolean
tls
boolean
instanceType
string
securityGroups
array

A list of the security groups to associate with the elastic network interfaces to control who can communicate with the cluster.

storageInfo
array

A block that contains information about storage volumes attached to MSK broker nodes. See below.

ebsStorageInfo
array

A block that contains EBS volume information. See below.

provisionedThroughput
array

A block that contains EBS volume provisioned throughput information. To provision storage throughput, you must choose broker type kafka.m5.4xlarge or larger. See below.

enabled
boolean
volumeThroughput
number
volumeSize
number
clientAuthentication
array

Configuration block for specifying a client authentication. See below.

sasl
array

SASL authentication type details for VPC connectivity. See below.

iam
boolean
scram
boolean
tls
array

Enables TLS authentication for VPC connectivity.

certificateAuthorityArns
array

List of ACM Certificate Authority Amazon Resource Names (ARNs).

unauthenticated
boolean
clusterName
string
clusterUuid
string
configurationInfo
array

Configuration block for specifying a MSK Configuration to attach to Kafka brokers. See below.

arn
string
revision
number
currentVersion
string
encryptionInfo
array

Configuration block for specifying encryption. See below.

encryptionAtRestKmsKeyArn
string
encryptionInTransit
array

Configuration block to specify encryption in transit. See below.

clientBroker
string
inCluster
boolean
enhancedMonitoring
string
id
string
kafkaVersion
string
loggingInfo
array

Configuration block for streaming broker logs to Cloudwatch/S3/Kinesis Firehose. See below.

brokerLogs
array

Configuration block for Broker Logs settings for logging info. See below.

cloudwatchLogs
array

(No description available)

enabled
boolean
logGroup
string
firehose
array

(No description available)

deliveryStream
string
enabled
boolean
s3
array

(No description available)

bucket
string
enabled
boolean
prefix
string
numberOfBrokerNodes
number
openMonitoring
array

Configuration block for JMX and Node monitoring for the MSK cluster. See below.

prometheus
array

Configuration block for Prometheus settings for open monitoring. See below.

jmxExporter
array

Configuration block for JMX Exporter. See below.

enabledInBroker
boolean
nodeExporter
array

Configuration block for Node Exporter. See below.

enabledInBroker
boolean
storageMode
string
tags
object
tagsAll
object
zookeeperConnectString
string
zookeeperConnectStringTls
string
conditions
array

Conditions of the resource.

lastTransitionTime
required
string
message
string
observedGeneration
integer
reason
required
string
status
required
string
type
required
string
observedGeneration
integer
Discover the building blocks for your internal cloud platform.
© 2026 Upbound, Inc.
Solutions
Learn
Company
Community
More