:_mod-docs-content-type: ASSEMBLY

// This assembly is included in the following assemblies:
//
// main deploying file

[id='assembly-drain-cleaner-{context}']
= Evicting pods with the Strimzi Drain Cleaner

[role="_abstract"]
Kafka pods might be evicted during Kubernetes upgrades, maintenance, or pod rescheduling.
If your Kafka pods were deployed by Strimzi, you can use the Strimzi Drain Cleaner tool to handle the pod evictions.
The Strimzi Drain Cleaner handles the eviction instead of Kubernetes.

By deploying the Strimzi Drain Cleaner, you can use the Cluster Operator to move Kafka pods instead of Kubernetes.
The Cluster Operator ensures that the number of in sync replicas for topics are at or above the configured `min.insync.replicas` and Kafka can remain operational during the eviction process.
The Cluster Operator waits for topics to synchronize, as the Kubernetes worker nodes drain consecutively.

An admission webhook notifies the Strimzi Drain Cleaner of pod eviction requests to the Kubernetes API.
The Strimzi Drain Cleaner then adds a rolling update annotation to the pods to be drained.
This informs the Cluster Operator to perform a rolling update of an evicted pod.

NOTE: If you are not using the Strimzi Drain Cleaner, you can xref:proc-manual-rolling-update-pods-str[add pod annotations to perform rolling updates manually].

== Default webhook configuration

The Strimzi Drain Cleaner deployment includes a `ValidatingWebhookConfiguration` resource that registers the webhook with the Kubernetes API:

[source,yaml,subs="attributes+"]
----
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
# ...
webhooks:
  - name: strimzi-drain-cleaner.strimzi.io
    rules:
      - apiGroups:   [""]
        apiVersions: ["v1"]
        operations:  ["CREATE"]
        resources:   ["pods/eviction"]
        scope:       "Namespaced"
    clientConfig:
      service:
        namespace: "strimzi-drain-cleaner"
        name: "strimzi-drain-cleaner"
        path: /drainer
        port: 443
        caBundle: Cg==
    # ...
----

Unless you are using your own TLS certificates, no manual configuration is required.

The webhook intercepts pod eviction requests based on the `rules` defined in the configuration. 
Only `CREATE` operations targeting the `pods/eviction` sub-resource are evaluated. 
When these conditions are met, the API forwards the request to the webhook.

The `clientConfig` section specifies the target service and endpoint for the webhook. 
The webhook listens on the `/drainer` path and requires a secure TLS connection. 

The `caBundle` property provides the Base64-encoded certificate chain used to validate HTTPS communication.
By default, the TLS certificates are generated and injected into the configuration automatically.
If you supply your own TLS certificates, you must manually update the `caBundle` value.

//steps for deploying drain cleaner
include::../../modules/drain-cleaner/proc-drain-cleaner-deploying.adoc[leveloffset=+1]
ifdef::Section[]
//deploy using Helm
include::../../modules/drain-cleaner/proc-drain-cleaner-deploying-helm-chart.adoc[leveloffset=+1]
endif::Section[]
//steps for using drain cleaner
include::../../modules/drain-cleaner/proc-drain-cleaner-using.adoc[leveloffset=+1]
ifdef::Section[]
//generate tls certificates when deploying on Kubernetes
include::../../modules/drain-cleaner/proc-drain-cleaner-certs.adoc[leveloffset=+1]
endif::Section[]
//watching TLS certs renewals
include::../../modules/drain-cleaner/proc-drain-cleaner-certs-renewals.adoc[leveloffset=+1]
