User management

Users are created and managed with the Strimzi Entity Operator and KafkaUser resources.

The Strimzi Entity Operator can set up external Kafka users with KafkaUser resources. In the KafkaUser resource, authentication can be configured with spec.authentication property and authorization can be configured using the spec.authorization.type property.

The following is an example of a KafkaUser resource that has tls authentication and simple authorization configured

#...
kind: KafkaUser
spec:
  authentication:
    type: tls
  authorization:
    type: simple
    acls:
      - resource:
          type: topic
          name: my-topic
          patternType: literal
        operations:
          - All

Renewing KafkaUser certificates

Force-renew a KafkaUser certificate before its scheduled expiry by adding the strimzi.io/force-renew annotation to the user Secret.

The Strimzi User Operator renews KafkaUser certificates automatically before they expire. Use the strimzi.io/force-renew annotation on the user Secret to trigger an immediate renewal outside the normal schedule. This is useful when a certificate must be rotated for security or operational reasons.

The user Secret is created by the User Operator and has the same name as the KafkaUser resource.

Add the strimzi.io/force-renew: "true" annotation to the user Secret.
```
kubectl annotate secret [***KAFKAUSER NAME***] \
  --namespace [***NAMESPACE***] \
  strimzi.io/force-renew="true"
```
The Secret name matches the name of the KafkaUser resource.
Verify that the User Operator has renewed the certificate.
At the next reconciliation, the Strimzi User Operator generates a new certificate and updates the Secret. The annotation is removed automatically once the renewal is complete. Check that the annotation is no longer present on the Secret.
```
kubectl get secret [***KAFKAUSER NAME***] \
  --namespace [***NAMESPACE***] \
  -o jsonpath='{.metadata.annotations}'
```