The Kafka Incident That Was Just a Certificate (And the Operator That Saved MirrorMaker)

A Kafka cluster on EKS briefly triggered an under-replicated partitions alert while Strimzi automatically renewed CA certificates and rolled pods one by one.

The alert was part of routine maintenance, not an outage, showing how operator-driven rotations can look like incidents in monitoring.

MirrorMaker2 kept replication working by using Reflector to copy the primary cluster’s CA secret into its namespace for cross-namespace TLS trust.

The setup highlights both the monitoring noise from certificate renewals and the need for secret mirroring in Kubernetes Kafka deployments.