Strimzi Operator Quiz

This quiz tests your understanding of Strimzi Operator fundamentals, installation methods, core CRDs, KRaft node roles, and EKS deployment considerations.

Multiple Choice Questions

1. What kind of CNCF project is Strimzi?
   • A) A service mesh
   • B) An Operator for running Apache Kafka on Kubernetes
   • C) A container runtime
   • D) A CI/CD pipeline tool

Show Answer

Answer: B) An Operator for running Apache Kafka on Kubernetes

Explanation: Strimzi is a CNCF Incubating project that uses the Kubernetes Operator pattern to manage the deployment and full lifecycle of Apache Kafka clusters, including installation, upgrades, scaling, and certificate management. Instead of hand-writing Kafka brokers as a StatefulSet, you declare the desired state through CRDs and the Operator reconciles the actual cluster state to match it.

2. Which of the following is LEAST accurate as a challenge of running Kafka directly as a StatefulSet without Strimzi?
   • A) Handling sequential rolling upgrades
   • B) Issuing and rotating TLS certificates
   • C) Building container images becomes impossible
   • D) Managing data movement during partition rebalancing

Show Answer

Answer: C) Building container images becomes impossible

Explanation: Running Kafka directly as a StatefulSet is not impossible in itself. The real problem is operational complexity and fragility: sequential upgrades, certificate rotation, and data movement during rebalancing are hard to manage by hand and error-prone. Strimzi automates all of this through CRDs and Operator logic.

3. What command adds the Strimzi Helm repository before installing the Cluster Operator?
   • A) helm repo add strimzi https://strimzi.io/charts/
   • B) helm repo add kafka https://kafka.apache.org/charts/
   • C) helm repo add strimzi https://github.com/strimzi/charts/
   • D) helm install strimzi https://strimzi.io/

Show Answer

Answer: A) helm repo add strimzi https://strimzi.io/charts/

Explanation: Strimzi's official Helm repository is https://strimzi.io/charts/. After adding it, the Cluster Operator is installed with helm install strimzi-kafka-operator strimzi/strimzi-kafka-operator --namespace kafka --create-namespace.

4. What namespace scope does the Strimzi Cluster Operator watch by default?
   • A) Every namespace in the cluster
   • B) All kube-system namespaces
   • C) Only the namespace it is deployed into
   • D) Only the default namespace

Show Answer

Answer: C) Only the namespace it is deployed into

Explanation: By default, the Cluster Operator only watches resources in its own namespace. To watch multiple namespaces, set the STRIMZI_NAMESPACE environment variable on the Operator Deployment to a comma-separated list of namespaces, or * to expand the watch scope to the entire cluster.

5. Which field became unnecessary once Strimzi 0.45+ made KRaft mode the default?
   • A) Kafka.spec.kafka.listeners
   • B) Kafka.spec.zookeeper
   • C) Kafka.spec.entityOperator
   • D) KafkaNodePool.spec.storage

Show Answer

Answer: B) Kafka.spec.zookeeper

Explanation: With KRaft mode as the default, the controller quorum manages metadata directly without ZooKeeper, so the previously required Kafka.spec.zookeeper block is no longer needed. Broker and controller roles are instead defined through separate KafkaNodePool resources.

6. Which value is NOT a valid entry for KafkaNodePool.spec.roles?
   • A) controller
   • B) broker
   • C) A dual-role combining controller and broker
   • D) zookeeper

Show Answer

Answer: D) zookeeper

Explanation: The roles field on a KRaft-based KafkaNodePool only supports controller, broker, or a dual-role combination ([controller, broker]). zookeeper is not a valid role — ZooKeeper does not exist at all in KRaft mode.

7. What is the main reason for running the controller node pool with 3 nodes?
   • A) It must always match the broker count
   • B) The controller quorum requires a majority vote, so an odd number is safer
   • C) Kafka client libraries require at least 3 controllers
   • D) EBS volume limits require it

Show Answer

Answer: B) The controller quorum requires a majority vote, so an odd number is safer

Explanation: The KRaft controller quorum operates using a Raft-like consensus protocol that requires a majority vote for leader election and metadata commits. An even number of controllers can lead to split-vote scenarios that hurt availability, so odd counts like 3 or 5 are typical. This is decided independently of the broker count.

8. What is the name of the CSI provisioner used when defining an EBS StorageClass for Kafka brokers on Amazon EKS?
   • A) kubernetes.io/aws-ebs
   • B) ebs.csi.aws.com
   • C) efs.csi.aws.com
   • D) aws.amazon.com/ebs

Show Answer

Answer: B) ebs.csi.aws.com

Explanation: The Amazon EBS CSI driver uses the provisioner name ebs.csi.aws.com. kubernetes.io/aws-ebs is the deprecated in-tree provisioner. persistent-claim volumes under KafkaNodePool.spec.storage reference a StorageClass backed by this provisioner to dynamically provision EBS gp3 volumes.

9. What field is added to KafkaNodePool.spec.template.pod to spread broker Pods evenly across AZs?
   • A) nodeSelector
   • B) topologySpreadConstraints
   • C) tolerations
   • D) priorityClassName

Show Answer

Answer: B) topologySpreadConstraints

Explanation:topologySpreadConstraints is a scheduling constraint that spreads Pods evenly based on a topologyKey (for example, topology.kubernetes.io/zone). Spreading Kafka brokers across AZs means a single AZ outage doesn't take down the whole cluster's availability. Setting whenUnsatisfiable: DoNotSchedule enforces the constraint strictly by blocking scheduling that would violate it.

10. What listener types can be added to Kafka.spec.kafka.listeners when external clients need to reach the Kafka brokers from outside the cluster?
    • A) internal and clusterip
    • B) loadbalancer or nodeport
    • C) Only ingress
    • D) External exposure is not supported

Show Answer

Answer: B) loadbalancer or nodeport

Explanation: Strimzi listeners support internal, route, ingress, loadbalancer, and nodeport types. On EKS, external access is typically provided through loadbalancer (auto-provisions an AWS NLB per bootstrap/broker) or nodeport (worker node ports plus an external load balancer). The loadbalancer type can be tuned via annotations that control the AWS Load Balancer Controller's NLB settings, such as internal vs. internet-facing scheme.

Short Answer Questions

11. Name the two internal Strimzi components responsible for synchronizing KafkaTopic and KafkaUser custom resources with actual Kafka resources.

Show Answer

Answer: Topic Operator, User Operator

Explanation: The Topic Operator unidirectionally synchronizes KafkaTopic custom resources onto actual Kafka topics (the CR is the source of truth), while the User Operator manages SCRAM-SHA-512 or TLS authentication credentials and ACLs based on KafkaUser custom resources. Both are bundled into a single Pod per Kafka cluster as part of the Entity Operator.

12. What environment variable configures the Cluster Operator to watch multiple namespaces?

Show Answer

Answer: STRIMZI_NAMESPACE

Explanation: Setting STRIMZI_NAMESPACE on the Cluster Operator Deployment controls the namespace scope it watches. You can specify a comma-separated list of namespaces, or * to expand the watch scope to the entire cluster.

13. What storage type in KafkaNodePool.spec.storage lets you attach multiple EBS volumes per broker to spread out I/O?

Show Answer

Answer: JBOD (type: jbod)

Explanation: JBOD (Just a Bunch Of Disks) storage lets a single broker use multiple persistent-claim volumes, each identified by a distinct id. This distributes I/O across several volumes rather than being limited by a single EBS volume's throughput ceiling.

14. What status condition on the Kafka resource indicates that brokers/controllers have formed a healthy quorum and listeners are active?

Show Answer

Answer: Ready: True

Explanation: When you check the Kafka resource's status with kubectl get kafka -n kafka, a Ready condition set to True means all cluster components (brokers, controllers, listeners, Entity Operator) are functioning correctly.

15. What is the name of the Strimzi CRD that defines a separate worker cluster for running source/sink connectors, such as Debezium?

Show Answer

Answer: KafkaConnect

Explanation:KafkaConnect is the CRD that defines a Kafka Connect worker cluster. Individual connector instances are managed declaratively through KafkaConnector custom resources, which are deployed onto a KafkaConnect cluster.

Hands-on Questions

16. Write the full command sequence to install the Strimzi Cluster Operator via Helm into the kafka namespace.

Show Answer

Answer:

# Add the Strimzi Helm repository
helm repo add strimzi https://strimzi.io/charts/
helm repo update

# Install the Cluster Operator into the kafka namespace
helm install strimzi-kafka-operator strimzi/strimzi-kafka-operator \
  --namespace kafka \
  --create-namespace \
  --version 0.45.0

# Verify the installation
kubectl get pods -n kafka
kubectl get crd | grep strimzi

Explanation:helm repo add registers the Strimzi repository, and helm repo update fetches the latest chart metadata. Adding --create-namespace to helm install automatically creates the kafka namespace if it doesn't already exist. After installing, use kubectl get pods -n kafka to confirm the Cluster Operator Pod is Running, and kubectl get crd | grep strimzi to confirm CRDs like Kafka and KafkaNodePool are registered.

17. Write a KafkaNodePool consisting of 3 broker-only nodes, each using a 100Gi gp3-based persistent-claim volume.

Show Answer

Answer:

apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaNodePool
metadata:
  name: broker
  labels:
    strimzi.io/cluster: my-cluster
spec:
  replicas: 3
  roles:
    - broker
  storage:
    type: jbod
    volumes:
      - id: 0
        type: persistent-claim
        size: 100Gi
        class: gp3-kafka
        deleteClaim: false
  resources:
    requests:
      cpu: "2"
      memory: 4Gi
    limits:
      cpu: "4"
      memory: 4Gi

Explanation: The strimzi.io/cluster label must match the name of the Kafka resource this node pool belongs to. roles: [broker] designates broker-only nodes, and the persistent-claim volume under storage.type: jbod provisions a 100Gi EBS-backed persistent volume. class references a StorageClass backed by the ebs.csi.aws.com provisioner.

18. Create a KafkaTopic named orders with 12 partitions and 3 replicas, then write the commands to test it with the console producer and consumer.

Show Answer

Answer:

apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaTopic
metadata:
  name: orders
  namespace: kafka
  labels:
    strimzi.io/cluster: my-cluster
spec:
  partitions: 12
  replicas: 3
  config:
    min.insync.replicas: 2

# Apply the topic
kubectl apply -f orders-topic.yaml -n kafka
kubectl get kafkatopic -n kafka

# Producer test
kubectl run kafka-producer -n kafka -ti \
  --image=quay.io/strimzi/kafka:0.45.0-kafka-3.9.0 --rm=true --restart=Never -- \
  bin/kafka-console-producer.sh --bootstrap-server my-cluster-kafka-bootstrap:9092 --topic orders

# Consumer test
kubectl run kafka-consumer -n kafka -ti \
  --image=quay.io/strimzi/kafka:0.45.0-kafka-3.9.0 --rm=true --restart=Never -- \
  bin/kafka-console-consumer.sh --bootstrap-server my-cluster-kafka-bootstrap:9092 --topic orders --from-beginning

Explanation: The strimzi.io/cluster label tells the Topic Operator which Kafka cluster this KafkaTopic belongs to. After applying, kubectl get kafkatopic -n kafka confirms the topic was actually created. The producer/consumer test runs Strimzi's Kafka image as a throwaway Pod that connects to the bootstrap Service (my-cluster-kafka-bootstrap:9092).

19. Write a KafkaUser with SCRAM-SHA-512 authentication that is only authorized to Read, Write, and Describe the orders topic.

Show Answer

Answer:

apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaUser
metadata:
  name: order-service
  namespace: kafka
  labels:
    strimzi.io/cluster: my-cluster
spec:
  authentication:
    type: scram-sha-512
  authorization:
    type: simple
    acls:
      - resource:
          type: topic
          name: orders
        operations: [Read, Write, Describe]

Explanation:authentication.type: scram-sha-512 instructs the User Operator to generate SCRAM credentials and store them in a Secret. authorization.type: simple uses Kafka's built-in ACL-based authorization, and the acls list restricts this user to only Read, Write, and Describe operations on the orders topic — implementing least privilege declaratively at the CR level.

20. Add a topologySpreadConstraints to a KafkaNodePool's spec.template.pod to spread broker Pods evenly across AZs.

Show Answer

Answer:

apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaNodePool
metadata:
  name: broker
  labels:
    strimzi.io/cluster: my-cluster
spec:
  replicas: 3
  roles: [broker]
  template:
    pod:
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels:
              strimzi.io/cluster: my-cluster
              strimzi.io/name: my-cluster-broker
  storage:
    type: jbod
    volumes:
      - id: 0
        type: persistent-claim
        size: 100Gi
        class: gp3-kafka

Explanation:topologyKey: topology.kubernetes.io/zone spreads Pods based on the AZ label on EKS worker nodes. maxSkew: 1 allows at most a 1-Pod difference in count between AZs, and whenUnsatisfiable: DoNotSchedule blocks scheduling outright when the constraint can't be satisfied, guaranteeing even distribution. labelSelector determines which set of Pods (the same broker node pool) the skew is calculated against.

---

Return to Learning Materials | Next Quiz: Kafka Operations