Strimzi Kafka Resource Generator

A Strimzi KafkaTopic and KafkaUser. The cluster label is what makes the operator act on them at all.

Cluster

The operator finds these resources by a label naming the cluster. Without it they are ignored silently, which is the most common Strimzi surprise.

KafkaTopic
KafkaUser

kafka-resources.yaml

updates as you type

    Common mistakes

    These are the ones that fail silently. The config is accepted, nothing raises an error, and the consequence arrives later.

    1. Omitting the cluster label on a KafkaTopic or KafkaUser

      Without strimzi.io/cluster the operator does not associate the resource with a cluster and simply ignores it. Nothing happens and nothing is logged as an error.

      Instead:Set the label on every KafkaTopic and KafkaUser.

    2. Setting broker config the operator manages

      Listeners, storage, rack and several others are owned by the operator. Values set in config are rejected or overwritten.

      Instead:Use the CR's own sections for those.

    3. Editing topics with kafka-topics instead of the CR

      The topic operator reconciles from the KafkaTopic resource, so a manual change is reverted on the next reconcile.

      Instead:Change the CR. It is the source of truth once the operator is running.

    Two things Strimzi does that have no error message

    A missing label and a principal nobody wrote an ACL for.

    The strimzi.io/cluster label is the whole mechanism

    The operator watches for resources carrying a label naming its cluster. Without it, or with a typo, kubectl reports the object created and the operator never looks at it. There is no event, no status condition and no error: the topic simply does not exist in Kafka while the KafkaTopic exists in Kubernetes.

    A Kafka topic name is not a Kubernetes object name

    Kubernetes object names are DNS labels: lowercase, no dots, no underscores. Kafka topic names allow all three. That is why spec.topicName exists separately from metadata.name, and it means kubectl get kafkatopic can show a name that is not the topic name.

    With TLS the principal is the distinguished name

    A KafkaUser with TLS authentication gets a certificate, and the principal derived from it is CN=<name> rather than the plain name. Every ACL has to match that, and ssl.principal.mapping.rules on the broker decides whether it is shortened. An mTLS client that authenticates perfectly and is authorised for nothing is almost always this.

    min.insync.replicas equal to replicas breaks operator upgrades

    Strimzi performs rolling updates routinely, for its own version upgrades as well as yours. A topic with min.insync.replicas equal to its replica count stops accepting acks=all writes the moment one broker is taken down, so the configuration that looks safest in review is the one that makes every operator action an outage.

    The operator can revert changes made outside it

    Strimzi's topic operator reconciles, so a change made directly with kafka-configs.sh can be undone, or can leave the resource and the topic disagreeing. Pick one place to make changes and treat the other as read-only.

    More kafka tools

    Kafka Confluent Wire Format Decoder The five junk bytes in front of your payload Kafka Key to Partition Mapper Which partition does this key land on? Kafka Topic Name Validator Legal, risky, or 249 characters too long? Kafka Replication Safety Checker How many brokers can you lose Kafka Producer Config Linter Will it start, and will it lose a record? Kafka Message Payload Decoder The first five bytes are usually not data Kafka Connect Source Connector Generator tasks.max is a ceiling, not a count Kafka Connect Sink Connector Generator A dead letter queue with no context headers is a pile of records Kafka Connect SMT Chain Builder The order is the transforms list Kafka MirrorMaker 2 Config Generator It renames every topic by default Kafka Partition Reassignment Generator The throttle is not optional Kafka mTLS Config Generator The certificate is the identity Kafka Schema Registry Config Generator The compatibility direction is your deployment order Kafka Exactly-Once Config Generator Half of it is worse than none Kafka Broker and KRaft Config Generator The internal topics that break a one-broker cluster Kafka Quota Generator Byte rates are per broker, not per cluster Kafka Streams Config Generator application.id is four things at once Kafka Connect Worker Config Generator Security three times, or the tasks fail Kafka Retention and Unit Converter log.retention.hours does not take milliseconds Kafka Timestamp Converter Two sentinels and two meanings Kafka .properties to YAML Converter Dotted keys stay flat Kafka Streams Internal Topic Predictor Create them before Streams does Kafka ACL Generator The grant you forgot is on another resource type Kafka Topic Config Generator min.insync.replicas is the one that matters Kafka client.properties Generator The file every CLI tool asks for Kafka Producer Config Generator No password field, on purpose Kafka Consumer Config Generator The commit mode decides the semantics Kafka Disk and Retention Calculator retention.bytes is per partition Kafka Partition Count Calculator The number you can never reduce Kafka Cluster Sizing Calculator The traffic no client metric shows Kafka Consumer Lag Catch-Up Calculator Whether it ever clears, not just when Kafka Producer Batching Calculator linger.ms=0 still batches Kafka Segment and Index Sizing Why retention.ms is a lower bound Kafka Rebalance Duration Estimator What a rolling restart really costs Kafka Cost Estimator Your rates, so nothing goes stale Kafka Config Explorer by Version The answer depends on the release Kafka Default Config Reference What moved under a config you never edited Kafka OAuth Bearer Token Decoder Will Kafka accept it, and can it refresh Kafka Record Header Viewer Headers are a list, not a map Kafka Topic Regex Subscription Tester Kafka matches the whole name Kafka ACL Permission Matrix Viewer DENY beats every ALLOW Kafka Connect Config Validator The mistakes that raise no error Kafka Consumer Group Id Validator Which broker coordinates the group Kafka Partition Assignment Visualizer Leadership is the load, not replicas Kafka Consumer Assignment Visualizer The three assignors disagree Kafka ZooKeeper to KRaft Config Converter The authorizer class nobody changes Kafka Config to Strimzi Half of it belongs elsewhere Kafka Docker Compose Generator (KRaft) Reachable from inside and outside Kafka JAAS Config Decoder The line that stops SASL working Kafka CRC32C Calculator Which CRC, over which bytes Kafka Config Upgrade Checker What breaks when you upgrade Kafka Kafka Config Diff Which change actually changed something Kafka Consumer Config Linter Why the group rebalances, and where the records went Kafka Avro Schema Validator The defaults Avro accepts and rejects Kafka Schema Compatibility Checker What the registry will say, before you ask it Kafka Avro Schema Diff Which direction each change breaks Kafka Compression Comparison Measured on your bytes Kafka Delivery Semantics Exactly-once has a consumer half Kafka ksqlDB Query Builder It looks like SQL and the rules are not Kafka Connect SMT Predicate Tester negate reads backwards Kafka Streams Topology Viewer Count the repartitions Kafka Connect Pipeline Visualizer The order things really run in Kafka Protobuf Binary Decoder Works without the .proto Kafka Protobuf JSON Converter Why your JSON does not round-trip Kafka Protobuf to Avro Schema What does not survive the conversion Kafka Avro Binary Decoder Wrong schema, no error Kafka Avro JSON Converter Why the console producer rejects your line Kafka Avro Sample Data Generator Records that actually serialize Kafka JSON to Avro Schema What JSON cannot tell you Kafka JSON Schema to Avro What does not survive the conversion Kafka SASL JAAS Generator One login module, four syntaxes Kafka CLI Command Builder kcat is librdkafka, not Kafka

    Elsewhere on the site

    Terraform Validator & Formatter Kubernetes YAML Generator Kubernetes YAML Validator AWS IAM Policy Validator & Analyzer