// Module included in the following assemblies:
//
// deploying/assembly_deploy-standalone-operators.adoc

[id='deploying-the-user-operator-standalone-{context}']
= Deploying the standalone User Operator

[role="_abstract"]
This procedure shows how to deploy the User Operator as a standalone component for user management.
You can use a standalone User Operator with a Kafka cluster that is not managed by the Cluster Operator.

A standalone deployment can operate with any Kafka cluster.

Standalone deployment files are provided with Strimzi.
Use the `05-Deployment-strimzi-user-operator.yaml` deployment file to deploy the User Operator.
Add or set the environment variables needed to make a connection to a Kafka cluster.  

.Prerequisites

* You are running a Kafka cluster for the User Operator to connect to.
+
As long as the standalone User Operator is correctly configured for connection,
the Kafka cluster can be running on a bare-metal environment, a virtual machine, or as a managed cloud application service.

.Procedure

. Edit the following `env` properties in the `install/user-operator/05-Deployment-strimzi-user-operator.yaml` standalone deployment file.
+
.Example standalone User Operator deployment configuration
[source,shell,subs=+quotes]
----
apiVersion: apps/v1
kind: Deployment
metadata:
  name: strimzi-user-operator
  labels:
    app: strimzi
spec:
  # ...
  template:
    # ...
    spec:
      # ...
      containers:
        - name: strimzi-user-operator
          # ...
          env:
            - name: STRIMZI_NAMESPACE <1>
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: STRIMZI_KAFKA_BOOTSTRAP_SERVERS <2>
              value: my-kafka-bootstrap-address:9092
            - name: STRIMZI_CA_CERT_NAME <3>
              value: my-cluster-clients-ca-cert
            - name: STRIMZI_CA_KEY_NAME <4>
              value: my-cluster-clients-ca
            - name: STRIMZI_LABELS <5>
              value: "strimzi.io/cluster=my-cluster"
            - name: STRIMZI_FULL_RECONCILIATION_INTERVAL_MS <6>
              value: "120000"
            - name: STRIMZI_LOG_LEVEL <7>
              value: INFO
            - name: STRIMZI_GC_LOG_ENABLED <8>
              value: "true"
            - name: STRIMZI_CA_VALIDITY <9>
              value: "365"
            - name: STRIMZI_CA_RENEWAL <10>
              value: "30"
            - name: STRIMZI_JAVA_OPTS <11>
              value: "-Xmx=512M -Xms=256M"
            - name: STRIMZI_JAVA_SYSTEM_PROPERTIES <12>
              value: "-Djavax.net.debug=verbose -DpropertyName=value"
            - name: STRIMZI_SECRET_PREFIX <13>
              value: "kafka-"
            - name: STRIMZI_ACLS_ADMIN_API_SUPPORTED <14>
              value: "true"
----
<1> The Kubernetes namespace for the User Operator to watch for `KafkaUser` resources. Only one namespace can be specified.
<2>  The host and port pair of the bootstrap broker address to discover and connect to all brokers in the Kafka cluster.
Use a comma-separated list to specify two or three broker addresses in case a server is down.
<3> The Kubernetes `Secret` that contains the public key (`ca.crt`) value of the Certificate Authority that signs new user certificates for TLS client authentication.
<4> The Kubernetes `Secret` that contains the private key (`ca.key`) value of the Certificate Authority that signs new user certificates for TLS client authentication.
<5> The label selector used to identify the `KafkaUser` resources managed by the User Operator.
<6> The interval between periodic reconciliations, in milliseconds.
The default is `120000` (2 minutes).
<7> The level for printing logging messages.
You can set the level to `ERROR`, `WARNING`, `INFO`, `DEBUG`, or `TRACE`.
<8> Enables garbage collection (GC) logging.
The default is `true`.
<9> The validity period for the Certificate Authority.
The default is `365` days.
<10> The renewal period for the Certificate Authority. The renewal period is measured backwards from the expiry date of the current certificate.
The default is `30` days to initiate certificate renewal before the old certificates expire.
<11> (Optional) The Java options used by the JVM running the User Operator
<12> (Optional) The debugging (`-D`) options set for the User Operator
<13> (Optional) Prefix for the names of Kubernetes secrets created by the User Operator.
<14> (Optional) Indicates whether the Kafka cluster supports management of authorization ACL rules using the Kafka Admin API.
When set to `false`, the User Operator will reject all resources with `simple` authorization ACL rules.
This helps to avoid unnecessary exceptions in the Kafka cluster logs.
The default is `true`.


. If you are using TLS to connect to the Kafka cluster, specify the secrets used to authenticate connection.
Otherwise, go to the next step.
+
.Example TLS configuration
[source,shell,subs=+quotes]
----
# ....
env:
  - name: STRIMZI_CLUSTER_CA_CERT_SECRET_NAME <1>
    value: my-cluster-cluster-ca-cert
  - name: STRIMZI_EO_KEY_SECRET_NAME <2>
    value: my-cluster-entity-operator-certs
# ..."
----
<1> The Kubernetes `Secret` that contains the public key (`ca.crt`) value of the Certificate Authority that signs Kafka broker certificates for TLS client authentication.
<2> The Kubernetes `Secret` that contains the keystore (`entity-operator.p12`) with the private key and certificate for TLS authentication against the Kafka cluster.
The `Secret` must also contain the password (`entity-operator.password`) for accessing the keystore.

. Deploy the User Operator.
+
[source,shell,subs=+quotes]
kubectl create -f install/user-operator

. Verify that the User Operator has been deployed successfully.
+
[source,shell,subs=+quotes]
kubectl describe deployment strimzi-user-operator
+
The User Operator is deployed when the `Replicas` entry shows `1 available`.
+
NOTE: You might experience a delay with the deployment if you have a slow connection to the Kubernetes cluster and the User Operator images have not been downloaded before.
