// Module included in the following assemblies:
//
// deploying/assembly_deploy-standalone-operators.adoc

[id='deploying-the-topic-operator-standalone-{context}']
= Deploying the standalone Topic Operator

[role="_abstract"]
This procedure shows how to deploy the Topic Operator as a standalone component for topic management.
You can use a standalone Topic Operator with a Kafka cluster that is not managed by the Cluster Operator.

A standalone deployment can operate with any Kafka cluster.

Standalone deployment files are provided with Strimzi.
Use the `05-Deployment-strimzi-topic-operator.yaml` deployment file to deploy the Topic Operator.
Add or set the environment variables needed to make a connection to a Kafka cluster.

.Prerequisites

* You are running a Kafka cluster for the Topic Operator to connect to.
+
As long as the standalone Topic Operator is correctly configured for connection,
the Kafka cluster can be running on a bare-metal environment, a virtual machine, or as a managed cloud application service.

.Procedure

. Edit the `env` properties in the `install/topic-operator/05-Deployment-strimzi-topic-operator.yaml` standalone deployment file.
+
.Example standalone Topic Operator deployment configuration
[source,shell,subs=+quotes]
----
apiVersion: apps/v1
kind: Deployment
metadata:
  name: strimzi-topic-operator
  labels:
    app: strimzi
spec:
  # ...
  template:
    # ...
    spec:
      # ...
      containers:
        - name: strimzi-topic-operator
          # ...
          env:
            - name: STRIMZI_NAMESPACE <1>
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: STRIMZI_KAFKA_BOOTSTRAP_SERVERS <2>
              value: my-kafka-bootstrap-address:9092
            - name: STRIMZI_RESOURCE_LABELS <3>
              value: "strimzi.io/cluster=my-cluster"
            - name: STRIMZI_ZOOKEEPER_CONNECT <4>
              value: my-cluster-zookeeper-client:2181
            - name: STRIMZI_ZOOKEEPER_SESSION_TIMEOUT_MS <5>
              value: "18000"
            - name: STRIMZI_FULL_RECONCILIATION_INTERVAL_MS <6>
              value: "120000"
            - name: STRIMZI_TOPIC_METADATA_MAX_ATTEMPTS <7>
              value: "6"
            - name: STRIMZI_LOG_LEVEL <8>
              value: INFO
            - name: STRIMZI_TLS_ENABLED <9>
              value: "false"
            - name: STRIMZI_JAVA_OPTS <10>
              value: "-Xmx=512M -Xms=256M"
            - name: STRIMZI_JAVA_SYSTEM_PROPERTIES <11>
              value: "-Djavax.net.debug=verbose -DpropertyName=value"
            - name: STRIMZI_PUBLIC_CA <12>
              value: "false"
            - name: STRIMZI_TLS_AUTH_ENABLED <13>
              value: "false"
            - name: STRIMZI_SASL_ENABLED <14>
              value: "false"
            - name: STRIMZI_SASL_USERNAME <15>
              value: "admin"
            - name: STRIMZI_SASL_PASSWORD <16>
              value: "password"
            - name: STRIMZI_SASL_MECHANISM <17>
              value: "scram-sha-512"
            - name: STRIMZI_SECURITY_PROTOCOL <18>
              value: "SSL"
----
<1> The Kubernetes namespace for the Topic Operator to watch for `KafkaTopic` resources. Specify the namespace of the Kafka cluster.
<2> The host and port pair of the bootstrap broker address to discover and connect to all brokers in the Kafka cluster.
Use a comma-separated list to specify two or three broker addresses in case a server is down.
<3> The label selector to identify the `KafkaTopic` resources managed by the Topic Operator.
<4> The host and port pair of the address to connect to the ZooKeeper cluster.
This must be the same ZooKeeper cluster that your Kafka cluster is using.
<5> The ZooKeeper session timeout, in milliseconds.
The default is `18000` (18 seconds).
<6> The interval between periodic reconciliations, in milliseconds.
The default is `120000` (2 minutes).
<7> The number of attempts at getting topic metadata from Kafka.
The time between each attempt is defined as an exponential backoff.
Consider increasing this value when topic creation takes more time due to the number of partitions or replicas.
The default is `6` attempts.
<8> The level for printing logging messages.
You can set the level to `ERROR`, `WARNING`, `INFO`, `DEBUG`, or `TRACE`.
<9> Enables TLS support for encrypted communication with the Kafka brokers.
<10> (Optional) The Java options used by the JVM running the Topic Operator.
<11> (Optional) The debugging (`-D`) options set for the Topic Operator.
<12> (Optional) Skips the generation of trust store certificates if TLS is enabled through `STRIMZI_TLS_ENABLED`. If this environment variable is enabled, the brokers must use a public trusted certificate authority for their TLS certificates.
The default is `false`.
<13> (Optional) Generates key store certificates for mutual TLS authentication. Setting this to `false` disables client authentication with TLS to the Kafka brokers.
The default is `true`.
<14> (Optional) Enables SASL support for client authentication when connecting to Kafka brokers.
The default is `false`.
<15> (Optional) The SASL username for client authentication.
Mandatory only if SASL is enabled through `STRIMZI_SASL_ENABLED`.
<16> (Optional) The SASL password for client authentication.
Mandatory only if SASL is enabled through `STRIMZI_SASL_ENABLED`.
<17> (Optional) The SASL mechanism for client authentication.
Mandatory only if SASL is enabled through `STRIMZI_SASL_ENABLED`.
You can set the value to `plain`, `scram-sha-256`, or `scram-sha-512`.
<18> (Optional) The security protocol used for communication with Kafka brokers.
The default value is "PLAINTEXT".
You can set the value to `PLAINTEXT`, `SSL`, `SASL_PLAINTEXT`, or `SASL_SSL`.

. If you want to connect to Kafka brokers that are using certificates from a public certificate authority, set `STRIMZI_PUBLIC_CA` to `true`. Set this property to `true`, for example, if you are using Amazon AWS MSK service.
. If you enabled TLS with the `STRIMZI_TLS_ENABLED` environment variable, specify the keystore and truststore used to authenticate connection to the Kafka cluster.
+
.Example TLS configuration
[source,shell,subs=+quotes]
----
# ....
env:
  - name: STRIMZI_TRUSTSTORE_LOCATION <1>
    value: "/path/to/truststore.p12"
  - name: STRIMZI_TRUSTSTORE_PASSWORD <2>
    value: "__TRUSTSTORE-PASSWORD__"
  - name: STRIMZI_KEYSTORE_LOCATION <3>
    value: "/path/to/keystore.p12"
  - name: STRIMZI_KEYSTORE_PASSWORD <4>
    value: "__KEYSTORE-PASSWORD__"
# ...
----
<1> The truststore contains the public keys of the Certificate Authorities used to sign the Kafka and ZooKeeper server certificates.
<2> The password for accessing the truststore.
<3> The keystore contains the private key for TLS client authentication.
<4> The password for accessing the keystore.

. Deploy the Topic Operator.
+
[source,shell,subs=+quotes]
kubectl create -f install/topic-operator

. Verify that the Topic Operator has been deployed successfully.
+
[source,shell,subs=+quotes]
kubectl describe deployment strimzi-topic-operator
+
The Topic Operator is deployed when the `Replicas` entry shows `1 available`.
+
NOTE: You may experience a delay with the deployment if you have a slow connection to the Kubernetes cluster and the Topic Operator images have not been downloaded before.
