Skills deploying-kafka-k8s

📦

deploying-kafka-k8s

Name: deploying-kafka-k8s
Author: Asmayaseen

Content revision r2 High Risk ⚙️ External commands🌐 Network access

Deploy Kafka on Kubernetes with Strimzi

Operating Kafka on Kubernetes requires coordinated operator, cluster, topic, and client configuration. This skill provides Strimzi commands, KRaft manifests, tests, monitoring, and troubleshooting steps.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "deploying-kafka-k8s" from https://skillstore.io/skills/asmayaseen-deploying-kafka-k8s.md and its manifest at https://skillstore.io/api/skills/asmayaseen-deploying-kafka-k8s/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/asmayaseen-deploying-kafka-k8s.md Signed manifest GET /api/skills/asmayaseen-deploying-kafka-k8s/manifest Signed lockfile GET /api/skills/asmayaseen-deploying-kafka-k8s/lockfile

Test it

Using "deploying-kafka-k8s". Prepare a development Kafka cluster in namespace events with one broker.

Expected outcome:

A staged plan creates the namespace, pins Strimzi, applies a single-broker resource, waits for readiness, and verifies a test topic.

Using "deploying-kafka-k8s". Review the provided production listener configuration for security.

Expected outcome:

The review flags plaintext external NodePort access and recommends TLS, client authentication, network restrictions, and certificate management before deployment.

Using "deploying-kafka-k8s". Troubleshoot a Kafka pod that remains unready.

Expected outcome:

The diagnostic sequence checks the Kafka resource condition, broker events, pod details, operator logs, storage claims, resource limits, and recent cluster changes.

Security Audit

High Risk

v9 • 7/23/2026 Open versioned report

Most external-command findings are Markdown fences, YAML examples, identifiers, or read-only diagnostics and are false positives. Confirmed findings cover cluster-changing kubectl commands, destructive cleanup, and unpinned remote Strimzi manifests. The production example also exposes an unauthenticated plaintext NodePort listener, which requires remediation.

Files scanned

349

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

SKILL.md:109-112

Unauthenticated Plaintext Production Listener

The production example exposes an external NodePort listener with TLS disabled and defines no authentication. Unauthorized network clients could access Kafka traffic and data.

The configuration explicitly combines an external NodePort with TLS disabled, and no authentication block appears in the Kafka listener configuration.

Capability review items (12)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:16-31

Ruby/shell backtick execution

```bash

This Bash block creates a namespace, installs an operator, and applies a Kafka resource. These commands make material cluster changes and fetch remote manifests.

Medium

SKILL.md:37-41

Ruby/shell backtick execution

```bash

This Bash block creates a namespace and installs the Strimzi operator into the cluster. It performs privileged Kubernetes changes.

Medium

SKILL.md:45-50

Ruby/shell backtick execution

```bash

This Bash block downloads an unpinned operator manifest and applies it with kubectl. It combines network retrieval with cluster mutation.

Medium

SKILL.md:161-172

Ruby/shell backtick execution

```bash

This Bash block uses kubectl run to create temporary pods and execute Kafka tooling from a container image. It modifies cluster state and runs external binaries.

Medium

SKILL.md:178-184

Ruby/shell backtick execution

```bash

This Bash block creates a temporary pod and launches a Kafka console producer. It executes an external image within the Kubernetes cluster.

Medium

SKILL.md:188-194

Ruby/shell backtick execution

```bash

This Bash block creates a temporary pod and launches a Kafka console consumer. It executes an external image within the Kubernetes cluster.

Medium

SKILL.md:269-281

Ruby/shell backtick execution

```bash

This cleanup block deletes Kafka resources, persistent volumes, the operator, and the namespace. Running it can irreversibly remove cluster data and workloads.

Medium

SKILL.md:21

Hardcoded URL

kubectl create -f 'https://strimzi.io/install/latest?namespace=kafka' -n kafka

kubectl retrieves and applies the unversioned latest Strimzi installation manifest. Upstream changes can gain cluster privileges without local review.

Medium

SKILL.md:27

Hardcoded URL

kubectl apply -f https://strimzi.io/examples/latest/kafka/kraft/kafka-single-node.yaml -n kafka

kubectl directly applies an unversioned latest Kafka example from the network. This creates supply-chain and configuration-drift risk.

Medium

SKILL.md:39

Hardcoded URL

kubectl create -f 'https://strimzi.io/install/latest?namespace=kafka' -n kafka

The command installs an unpinned latest operator manifest directly from Strimzi. The downloaded resources can change between executions.

Medium

SKILL.md:47

Hardcoded URL

curl -L https://strimzi.io/install/latest?namespace=kafka > strimzi-install.yaml

curl downloads an unpinned latest operator manifest that the next command applies. The file can change upstream and is not integrity-verified.

Medium

SKILL.md:277

Hardcoded URL

kubectl -n kafka delete -f 'https://strimzi.io/install/latest?namespace=kafka'

The cleanup command fetches the current latest remote manifest to decide which operator resources to delete. Version drift can delete an unexpected resource set.

Risk Factors

⚙️ External commands (41)

🌐 Network access (5)

SKILL.md:21 SKILL.md:27 SKILL.md:39 SKILL.md:47 SKILL.md:277

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/asmayaseen-deploying-kafka-k8s/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/asmayaseen-deploying-kafka-k8s/security.svg)](https://skillstore.io/skills/asmayaseen-deploying-kafka-k8s?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/asmayaseen-deploying-kafka-k8s?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/asmayaseen-deploying-kafka-k8s/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/asmayaseen-deploying-kafka-k8s.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Asmayaseen. (2026). deploying-kafka-k8s security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/asmayaseen-deploying-kafka-k8s/audits/9

BibTeX citation

@techreport{asmayaseen-asmayaseen-deploying-kafka-k8s-2026,
  author = {Asmayaseen},
  title = {deploying-kafka-k8s security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/asmayaseen-deploying-kafka-k8s/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "deploying-kafka-k8s security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "Asmayaseen"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/asmayaseen-deploying-kafka-k8s/audits/9"
identifiers:
  - type: other
    value: "skillstore:asmayaseen-deploying-kafka-k8s:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create a Development Cluster

Deploy a single-broker Kafka environment for integration testing and local application workflows.

Prepare a Kubernetes Deployment

Plan a resilient Strimzi deployment with persistent storage, replication, resources, topics, and secure listeners.

Diagnose Kafka Operations

Inspect operator status, broker pods, events, logs, bootstrap services, and common storage or connection failures.

Try These Prompts

Deploy a Development Cluster

Deploy a single-node Strimzi Kafka cluster in namespace [namespace]. Pin compatible versions, explain each change, and wait for readiness before testing.

Create and Test a Topic

Create topic [topic] with [partitions] partitions and [replicas] replicas. Then outline safe producer and consumer tests inside the cluster.

Design a Production Cluster

Design a three-broker Strimzi Kafka cluster for [workload]. Include persistent storage, replication, resource sizing, TLS, authentication, network policy, and monitoring.

Audit and Troubleshoot a Deployment

Audit the Kafka resources in namespace [namespace]. Identify availability, security, storage, and connectivity risks, then provide ordered diagnostics and reversible remediation steps.

Best Practices

Pin Strimzi, Kafka, and container image versions before applying resources.
Use TLS, client authentication, network policies, and least-privilege Kubernetes access for non-development environments.
Validate storage, replication, capacity, backups, and recovery procedures before production rollout.

Avoid

Do not apply unreviewed latest manifests directly to production clusters.
Do not expose plaintext unauthenticated Kafka listeners outside trusted namespaces.
Do not run cleanup commands before confirming context, namespace, labels, backups, and data-retention requirements.

Frequently Asked Questions

Does this skill support managed Kafka services?

No. It focuses on Strimzi-managed Kafka in Kubernetes, not Confluent Cloud, Amazon MSK, or similar services.

Does it create a Kubernetes cluster?

No. You need an existing cluster, kubectl connectivity, permissions, and an appropriate storage class.

Which software versions appear in the examples?

The examples reference Strimzi 0.49.1 and Kafka 3.9.0. Confirm current compatibility and pin tested versions before deployment.

Is the production example ready to apply unchanged?

No. Add TLS, authentication, network controls, storage settings, capacity planning, monitoring, and environment-specific policies.

Can the skill verify producer and consumer connectivity?

Yes. It provides temporary in-cluster producer, consumer, and topic administration workflows using Strimzi container images.

Can the cleanup steps remove Kafka data?

Yes. They include persistent volume and namespace deletion, so verify context and backups before running them.

Developer Details

Author

Asmayaseen

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/Asmayaseen/hackathon-2/tree/main/.claude/skills/deploying-kafka-k8s

Ref

89edfdc710d0846129dcee6a929477b04f08052c

Maintenance freshness

7/24/2026

Usage

6 downloads · 161 views

File structure

📁 scripts/

📄 verify.py

📄 SKILL.md