Why a ClusterRole is required to expose Kafka via NodePort Listener

[alita1991]

Hi,

I'm currently running strimzi operator in namespace mode and found out that I cannot expose Kafka via NodePort, because a ClusterRole with the following level of access is required:

• clusterrolebinding - get, create (a clusterrolebinding for the init container is created with get access on nodes endpoint, only if does not exists)
• node - list, get (get is required by the init container to gather the list of addresses from the current node and write to a config file, but unable to find where list nodes is used and why)

In addition to this, I'm trying to understand why a simple creation of a service of type NodePort is not enough to expose Kafka via NodePort.

Thank you

[scholzj]

This was discussed many times in various threads. So only shortly ... for more details, please search for the previous threads here and on Slack ...

• node - list, get (get is required by the init container to gather the list of addresses from the current node and write to a config file, but unable to find where list nodes is used and why)

Access to nodes is required to get the node address (for node port listenrs) which is needed to configure the listener. It is also needed to get the zone in which the node is when using rack awareness

• clusterrolebinding - get, create (a clusterrolebinding for the init container is created with get access on nodes endpoint, only if does not exists)

This is needed to allow the Kafka nodes query the node. As the node resource is cluster-wide, to grant a right to it you need to be able to create cluster role binding.