Deploying and configuring the Strimzi Entity Operator

Learn how to deploy and configure the Strimzi Entity Operator in your cluster by configuring your Kafka resource. Deploying the Entity Operator is required if you want to use custom resources to manage Kafka topics and users in your cluster.

The Entity Operator is responsible for managing Kafka users (clients) and Kafka topics in your Kafka cluster. The Entity Operator comprises the following two operators.

Strimzi Topic Operator – An operator application that creates and manages Kafka topics in your Kafka cluster with KafkaTopic resources.
Strimzi User Operator – An operator application that creates and manages Kafka users in your Kafka cluster with KafkaUser resources.

To deploy and configure the Entity Operator you configure your Kafka resource to include the entityOperator property. The entityOperator property can include topicOperator and userOperator properties.

These properties specify which of the two operators are deployed with the Entity Operator. You can choose to deploy either the Topic or User Operator, or deploy both at once.

The following example deploys both the Topic and User Operator with default configurations.

#...
kind: Kafka
spec:
  entityOperator:
    topicOperator: {}
    userOperator: {}

You can further configure all three operators by including additional supported properties in the configuration. The entityOperator property can include the template property that specifies configuration related to pod and deployment templates. The topicOperator and userOperator support various sub-properties that allow you to configure watched namespaces, reconciliation intervals, and others.

The Entity, Topic, and User Operator are deployed by the Strimzi Cluster Operator. On successful deployment, the Cluster Operator creates an Entity Operator deployment and pod. The Topic and User Operator run within the pod in their own containers.

Deploying the Topic or User Operator as standalone components is not supported in Cloudera Streams Messaging Operator for Kubernetes.

Deploying and configuring the Strimzi Topic Operator

You deploy and configure the Strimzi Topic Operator by configuring the entityOperator property in your Kafka resource to include topicOperator properties. Deploying the Topic Operator is required if you want to manage Kafka topics with KafkaTopic resources instead of the KafkaAdmin API.

The Topic Operator enables you to manage Kafka topics using KafkaTopic resources. In Cloudera Streams Messaging Operator for Kubernetes, you deploy the Topic Operator through the Strimzi Entity Operator. The Entity and Topic Operator are both deployed by the Strimzi Cluster Operator.

To deploy the Topic Operator, you configure the entityOperator property in your Kafka resource to include topicOperator properties. You configure the Topic Operator by specifying additional sub-properties in the topicOperator property.

By default, the Topic Operator watches KafkaTopic resources in the namespace of the Kafka cluster deployed by the Cluster Operator.

A single Topic Operator can watch a single namespace. One namespace should be watched by only one Topic Operator. If you are deploying multiple Kafka clusters into the same namespace, enable the Topic Operator for only one Kafka cluster.

To configure the Topic Operator to watch a namespace different from the Kafka cluster namespace, see Configuring Entity Operator to watch a different namespace.

Strimzi must be installed in your cluster. The Strimzi Cluster Operator must be running. See Installation.
For a full list of supported properties, see the EntityTopicOperatorSpec schema reference in the Strimzi API Reference.

Edit the entityOperator property in your Kafka resource to include topicOperator properties.
The following example configures the reconciliation interval as well as various resource properties.
```
#...
kind: Kafka
spec:
  entityOperator:
    topicOperator:
      reconciliationIntervalMs: 60000
      resources:
        requests:
          cpu: "1"
          memory: 500Mi
        limits:
          cpu: "1"
          memory: 500Mi
```
If you want to deploy the Topic Operator with default configuration, add an empty object ({}).
```
#...
kind: Kafka
spec:
  entityOperator:
    topicOperator: {}
```

Create or update your Kafka resource.

kubectl apply --filename [***YAML CONFIG***] --namespace [***NAMESPACE***]

Verify the status of the deployment.
```
kubectl get pods --namespace [***NAMESPACE***]
```
If deployment is successful, you should see an Entity Operator pod in the output.
```
NAME                                          READY   STATUS    RESTARTS
#...
my-cluster-entity-operator-67947ff779-k5sbv   2/2     Running      0
```
The READY column shows the number of replicas that are ready/expected. Deployment is successful when the STATUS displays as Running.

note
The Topic Operator is running in a container within the Entity Operator pod.

Create and manage Kafka topics with KafkaTopic resources. See Managing topics.

Deploying and configuring the Strimzi User Operator

You deploy and configure the Strimzi User Operator by configuring the entityOperator property in your Kafka resource to include userOperator properties. Deploying the User Operator is required if you want to manage Kafka users with KafkaUser resources instead of the KafkaAdmin API.

The User Operator enables you to manage Kafka users (clients) with KafkaUser resources. In Cloudera Streams Messaging Operator for Kubernetes you deploy the User Operator through the Strimzi Entity Operator. The Entity and User Operator are both deployed by the Strimzi Cluster Operator.

To deploy the User Operator, you configure the entityOperator property in your Kafka resource to include userOperator properties. You configure the User Operator by specifying additional sub-properties in the userOperator property.

By default, the User Operator watches KafkaUser resources in the namespace of the Kafka cluster deployed by the Cluster Operator. A single User Operator can watch a single namespace. One namespace should be watched by only one User Operator.

To configure the User Operator to watch a namespace different from the Kafka cluster namespace, see Configuring Entity Operator to watch a different namespace.

Strimzi must be installed in your cluster. The Strimzi Cluster Operator must be running. See Installation.
For a full list of supported properties, see the EntityUserOperatorSpec schema reference in the Strimzi API Reference.

Edit the entityOperator property in your Kafka resource to include userOperator properties.
The following example configures the reconciliation interval as well as various resource properties.
```
#...
kind: Kafka
spec:
  entityOperator:
    userOperator:
      reconciliationIntervalMs: 60000
      resources:
        requests:
          cpu: "1"
          memory: 500Mi
        limits:
          cpu: "1"
          memory: 500Mi
```
If you want to deploy the User Operator with default configuration, add an empty object ({}).
```
#...
kind: Kafka
spec:
  entityOperator:
    userOperator: {}
```

Create or update your Kafka resource.

kubectl apply --filename [***YAML CONFIG***] --namespace [***NAMESPACE***]

Verify the status of the deployment.
```
kubectl get pods --namespace [***NAMESPACE***]
```
If deployment is successful, you should see an Entity Operator pod in the output.
```
NAME                                          READY   STATUS    RESTARTS
#...
my-cluster-entity-operator-67947ff779-k5sbv   2/2     Running      0
```
The READY column shows the number of replicas that are ready/expected. Deployment is successful when the STATUS displays as Running.

note
The User Operator is running in a container within the Entity Operator pod.

Create and manage Kafka users with KafkaUser resources. See User management.

Configuring Entity Operator to watch a different namespace

Configure the Topic Operator or User Operator to watch Kafka resources in a namespace different from the Kafka cluster namespace using the watchedNamespace property.

By default, the Topic Operator watches KafkaTopic resources and the User Operator watches KafkaUser resources in the same namespace where the Kafka cluster is deployed. You can configure them to watch a different namespace, which is useful when you want to manage Kafka resources separately from the Kafka cluster deployment.

Each Topic Operator or User Operator instance can watch only one namespace. When configuring cross-namespace watching, the Entity Operator deployment and all related resources (ConfigMap, Secret, Role, RoleBinding) are created in the Kafka cluster namespace, but the operators watch the specified different namespace.

If you configure watchedNamespace to a different namespace without setting STRIMZI_ENTITY_OPERATOR_WATCHED_NAMESPACE_ENABLED=true in the Cluster Operator deployment, the Entity Operator deployment will be deleted during reconciliation, and your topics and users will no longer be managed.

important

Cross-namespace watching is disabled by default because it extends the Entity Operator's access beyond the Kafka cluster namespace. When you enable it, the Cluster Operator creates a Role in the watched namespace that grants the Entity Operator full create, read, update, and delete access to Secret resources.

Anyone who can create or edit Kafka resources could set watchedNamespace to a namespace you did not intend. Enable cross-namespace watching only if:

You must manage topics or users in a namespace separate from the Kafka cluster
You trust the users and processes that can configure Kafka resources
You accept that the Entity Operator will have Secret access in the watched namespace

The Cluster Operator is deployed and running.
A Kafka cluster is deployed.
The Entity Operator (Topic Operator and/or User Operator) is deployed in the Kafka cluster.

Enable cross-namespace watching in the Cluster Operator.

Create the Helm values file.
Create a file named entity-operator-values.yaml with the following content.
```
extraEnvs:
  - name: STRIMZI_ENTITY_OPERATOR_WATCHED_NAMESPACE_ENABLED
    value: "true"
```

Run helm upgrade with the values file.

helm upgrade strimzi-cluster-operator \
  --namespace [***STRIMZI CLUSTER OPERATOR NAMESPACE***] \
  --atomic \
  --reset-then-reuse-values \
  --values entity-operator-values.yaml \
  oci://container.repository.cloudera.com/cloudera-helm/csm-operator/strimzi-kafka-operator \
  --version 1.7.0-b248

Configure the Topic Operator and User Operator to watch different namespaces.
Add watchedNamespace to the Topic Operator and/or User Operator specifications in your Kafka resource. You can configure different watched namespaces for the Topic Operator and User Operator, or both can watch the same namespace. You can also configure only one of them to watch a different namespace.
```
#...
kind: Kafka
spec:
  entityOperator:
    topicOperator:
      watchedNamespace: [***MY TOPICS NAMESPACE***]
    userOperator:
      watchedNamespace: [***MY USERS NAMESPACE***]
```
Verify the operators are running.
Verify that the Entity Operator pod is running.
```
kubectl get pods --namespace [***KAFKA NAMESPACE***] | grep entity-operator
```

Verify the operators can access the watched namespace.

Check the logs to verify that the Topic and User Operator can access the watched namespace.

kubectl logs --namespace [***KAFKA NAMESPACE***] [***ENTITY OPERATOR POD NAME***] --container topic-operator
kubectl logs --namespace [***KAFKA NAMESPACE***] [***ENTITY OPERATOR POD NAME***] --container user-operator

Create resources in the watched namespace.
Create a KafkaTopic or KafkaUser resource in the watched namespace.
```
kubectl apply --filename [***MY-TOPIC.YAML***] --namespace [***MY TOPICS NAMESPACE***]
```
Verify that the operators manage the resources.
```
kubectl get kafkatopic --namespace [***MY TOPICS NAMESPACE***]
```