Installing Strimzi Drain Cleaner with Helm

Learn how to install Strimzi Drain Cleaner in Cloudera Streams Messaging Operator for Kubernetes with Helm. Strimzi Drain Cleaner coordinates safe rolling restarts of Strimzi-managed Kafka Pods when Kubernetes nodes are drained.

Strimzi Drain Cleaner is installed in your Kubernetes cluster with the Strimzi Drain Cleaner Helm chart using the helm install command. When you install the chart, Helm deploys the validating admission webhook and supporting resources.

Strimzi Drain Cleaner is installed with a separate Helm chart but requires an existing Strimzi deployment. Strimzi Drain Cleaner is most useful after you deploy at least one Kafka cluster. Cloudera recommends doing so before or soon after installation.

Install Strimzi Drain Cleaner in the same Kubernetes cluster where Strimzi and your Kafka clusters run. Only a single installation is supported per Kubernetes cluster. This is because the chart registers a cluster-scoped ValidatingWebhookConfiguration.

With default chart values, cert-manager must be installed and operational in your Kubernetes cluster. The chart creates cert-manager Certificate and Issuer resources automatically during installation.

Installing Strimzi Drain Cleaner does not require a Cloudera license.

Strimzi Drain Cleaner is deployed to the strimzi-drain-cleaner namespace. The installation steps create that namespace before you run helm install so you can complete required preparation before the chart deploys Strimzi Drain Cleaner.

Installation instructions are provided for the following scenarios.

Installing in an internet environment – Follow these steps to install Strimzi Drain Cleaner in a Kubernetes cluster with internet access.
Installing in an air-gapped environment – Follow these steps to install Strimzi Drain Cleaner in a Kubernetes cluster without internet access or if you want to install from a self-hosted registry.

Installing Strimzi Drain Cleaner in an internet environment

Complete these steps to install Strimzi Drain Cleaner if your Kubernetes cluster has internet access.

Your Kubernetes environment meets requirements listed in System requirements.
Your Kubernetes cluster requires internet connectivity to complete these steps. It must be able to reach the Cloudera Docker registry.
You have access to your Cloudera credentials (username and password). Credentials are required to access the Cloudera Archive and Cloudera Docker registry where installation artifacts are hosted.
Ensure that the Strimzi Cluster Operator is installed and running. See Installation.
cert-manager is installed and operational in your Kubernetes cluster. With default chart values, the Strimzi Drain Cleaner Helm chart creates cert-manager Certificate and Issuer resources during installation.
Review the Strimzi Drain Cleaner Helm chart reference before installation.
The Helm chart accepts various configuration properties that you can set during installation. Using these properties you can customize your installation.

Create the strimzi-drain-cleaner namespace in your Kubernetes cluster.
```
kubectl create namespace strimzi-drain-cleaner
```
Log in to the Cloudera Docker registry with helm.
```
helm registry login container.repository.cloudera.com
```
Enter your Cloudera credentials when prompted.

Create a Kubernetes Secret containing your Cloudera credentials in the strimzi-drain-cleaner namespace.

kubectl create secret docker-registry [***REGISTRY CREDENTIALS SECRET***] \
  --namespace strimzi-drain-cleaner \
  --docker-server container.repository.cloudera.com \
  --docker-username [***USERNAME***] \
  --docker-password "$(echo -n 'Enter your Cloudera password: ' >&2; read -s password; echo >&2; echo $password)"

Take note of the name you specify as [***REGISTRY CREDENTIALS SECRET***]. You specify the name in a later step.
Replace [***USERNAME***] with your Cloudera username.
Enter your Cloudera password when prompted.

Install Strimzi Drain Cleaner with helm install.
```
helm install strimzi-drain-cleaner \
  --namespace strimzi-drain-cleaner \
  --set namespace.create=false \
  --set 'image.imagePullSecrets[0].name=[***REGISTRY CREDENTIALS SECRET***]' \
  oci://container.repository.cloudera.com/cloudera-helm/csm-operator/strimzi-drain-cleaner \
  --version 1.7.0-b248
```
- The string strimzi-drain-cleaner is the Helm release name. You can choose a different name, but Cloudera recommends using strimzi-drain-cleaner so the Helm release name matches the Kubernetes resources the chart creates.
- namespace.create=false prevents the chart from creating the namespace because you created strimzi-drain-cleaner in Step 1.
- image.imagePullSecrets specifies what secret is used to pull images from the Cloudera registry. Setting this property is mandatory. Without it, Helm cannot pull the Strimzi Drain Cleaner image from the Cloudera Docker registry. Ensure that you replace [***REGISTRY CREDENTIALS SECRET***] with the name of the secret you created in Step 3.

Verify your installation.

If installation is successful, you should see a strimzi-drain-cleaner Helm release, Deployment, and Pods in the strimzi-drain-cleaner namespace. In addition a ValidatingWebhookConfiguration should exist as well.

Verify the Helm release with

hel
                            list

helm list --namespace strimzi-drain-cleaner

NAME                    NAMESPACE                REVISION  UPDATED                                  STATUS    CHART                                                                                           APP VERSION
strimzi-drain-cleaner   strimzi-drain-cleaner    1         2026-07-07 16:48:28.661181 +0200 CEST   deployed  strimzi-drain-cleaner-1.7.0-b248   1.6.0-csmop-1.7.0-b248

Verify Deployment with

kubectl get
                                deployments

kubectl get deployments --namespace strimzi-drain-cleaner

NAME                    READY   UP-TO-DATE   AVAILABLE   AGE
strimzi-drain-cleaner   2/2     2            2           95s

Verify Pods with

kubectl get
                            pods

kubectl get pods --namespace strimzi-drain-cleaner

NAME                                     READY   STATUS    RESTARTS   AGE
strimzi-drain-cleaner-776cc6d7b-ff2d4   1/1     Running   0          102s
strimzi-drain-cleaner-776cc6d7b-qj9fv   1/1     Running   0          102s

Verify that the cluster-scoped ValidatingWebhookConfiguration resource exists:

kubectl get validatingwebhookconfiguration strimzi-drain-cleaner

NAME                    WEBHOOKS   AGE
strimzi-drain-cleaner   1          4m23s

After installation, Strimzi Drain Cleaner runs continuously in the background. It requires no day-to-day operator action and responds automatically when Strimzi-managed Kafka Pods are evicted.

Installing Strimzi Drain Cleaner in an air-gapped environment

Complete these steps to install Strimzi Drain Cleaner if your Kubernetes cluster does not have internet access or if you want to install from a self-hosted registry.

Your Kubernetes environment meets requirements listed in System requirements.
A self-hosted Docker registry is required. Your registry must be accessible by your Kubernetes cluster.
A machine with Internet connectivity is required. While the Kubernetes cluster does not need internet access, you will need a machine to pull the images from the Cloudera Docker registry.
Access to docker or equivalent utility that you can use to pull and push images is required. The following steps use docker. Replace commands where necessary.
You have access to your Cloudera credentials (username and password). Credentials are required to access the Cloudera Archive and Cloudera Docker registry where installation artifacts are hosted.
Ensure that the Strimzi Cluster Operator is installed and running. See Installation.
cert-manager is installed and operational in your Kubernetes cluster. With default chart values, the Strimzi Drain Cleaner Helm chart creates cert-manager Certificate and Issuer resources during installation.
Review the Strimzi Drain Cleaner Helm chart reference before installation.
The Helm chart accepts various configuration properties that you can set during installation. Using these properties you can customize your installation.

Copy the following installation artifacts to your self-hosted registry.

Table 1. Strimzi Drain Cleaner artifacts on the Cloudera Docker registry
Artifact	Location	Description
Strimzi Drain Cleaner Docker image	`container.repository.cloudera.com/cloudera/drain-cleaner:1.6.0-csmop-1.7.0-b248`	Docker image for the Strimzi Drain Cleaner validating webhook.
Strimzi Drain Cleaner Helm chart	`oci://container.repository.cloudera.com/cloudera-helm/csm-operator/strimzi-drain-cleaner:1.7.0-b248`	Helm chart used to install Strimzi Drain Cleaner with `helm install`.

This step involves pulling the artifacts from the Cloudera Docker registry, retagging them, and then pushing them to your self-hosted registry. The exact steps you need to carry out depend on your environment and how your registry is set up. The following substeps demonstrate the basic workflow using docker and helm.

Log in to the Cloudera Docker registry with both docker and helm.
Provide your Cloudera credentials when prompted.
```
docker login container.repository.cloudera.com
```
```
helm registry login container.repository.cloudera.com
```
Log in to your self-hosted registry with both docker and helm.
Provide credentials when prompted.
```
docker login [***YOUR REGISTRY***]
```
```
helm registry login [***YOUR REGISTRY***]
```

Pull the Strimzi Drain Cleaner Docker image from the Cloudera Docker registry.

docker pull \
  --platform [***PLATFORM/ARCHITECTURE***] \
  container.repository.cloudera.com/cloudera/drain-cleaner:1.6.0-csmop-1.7.0-b248

Pull the Strimzi Drain Cleaner Helm chart.

helm pull \
  oci://container.repository.cloudera.com/cloudera-helm/csm-operator/strimzi-drain-cleaner \
  --version 1.7.0-b248

Retag the Strimzi Drain Cleaner Docker image you pulled so that it contains the address of your registry.

docker tag \
  container.repository.cloudera.com/cloudera/drain-cleaner:1.6.0-csmop-1.7.0-b248 \
  [***YOUR REGISTRY***]/cloudera/drain-cleaner:1.6.0-csmop-1.7.0-b248

Push the Strimzi Drain Cleaner image and chart to your self-hosted registry.

docker push \
  [***YOUR REGISTRY***]/cloudera/drain-cleaner:1.6.0-csmop-1.7.0-b248

helm push \
  strimzi-drain-cleaner-1.7.0-b248.tgz \
  oci://[***YOUR REGISTRY***]/cloudera-helm/csm-operator/

Create the strimzi-drain-cleaner namespace in your Kubernetes cluster.
```
kubectl create namespace strimzi-drain-cleaner
```
Create a Kubernetes Secret containing credentials for your self-hosted registry in the strimzi-drain-cleaner namespace.
```
kubectl create secret docker-registry [***REGISTRY CREDENTIALS SECRET***] \
  --namespace strimzi-drain-cleaner \
  --docker-server [***YOUR REGISTRY***] \
  --docker-username [***USERNAME***] \
  --docker-password "$(echo -n 'Enter your password: ' >&2; read -s password; echo >&2; echo $password)"
```
- Take note of the name you specify as [***REGISTRY CREDENTIALS SECRET***]. You specify the name in a later step.
- Replace [***YOUR REGISTRY***] and [***USERNAME***] with values valid for your self-hosted registry.
- Enter the password for the user when prompted.
Install Strimzi Drain Cleaner with helm install.
```
helm install strimzi-drain-cleaner \
  --namespace strimzi-drain-cleaner \
  --set namespace.create=false \
  --set 'image.imagePullSecrets[0].name=[***REGISTRY CREDENTIALS SECRET***]' \
  --set image.registry=[***YOUR REGISTRY***] \
  oci://[***YOUR REGISTRY***]/cloudera-helm/csm-operator/strimzi-drain-cleaner \
  --version 1.7.0-b248
```
- The string strimzi-drain-cleaner is the Helm release name. You can choose a different name, but Cloudera recommends using strimzi-drain-cleaner so the Helm release name matches the Kubernetes resources the chart creates.
- namespace.create=false prevents the chart from creating the namespace because you created strimzi-drain-cleaner in the previous step.
- image.imagePullSecrets specifies what secret is used to pull images from your self-hosted registry. Ensure that you replace [***REGISTRY CREDENTIALS SECRET***] with the name of the secret you created in Step 3.
- image.registry must point to your self-hosted registry so that the chart pulls the retagged Strimzi Drain Cleaner image.