Role and RoleBindings are'nt namespace scoped.

[digrouz]

Hi,

Could you share the choice/logic behind the fact the Role and RoleBindings created via the operator helmchart are not namespace scoped ?

i've seen https://github.com/orgs/strimzi/discussions/8602, I think i understand properly the limitations of hosting multiple concurent versions inside the same cluster, but what are the concerns to scope Role and Rolebindings into the kafka instance namespace ?

Kind Regards

[scholzj]

Role and RoleBindings are namespace scoped resources by design. They cannot be not namespace scoped. So you should probably explain what exactly do you mean.

[digrouz]

it's deploying a ClusterRole, but i would have expected it to be just a Role to allow to install multiple operator into a single cluster.

[scholzj]

Operators are inherently cluster-wide because the CRDs are cluster-wide. While there are ways to install different versions of an operator for different namespaces or even in the same namespace, it will be always hacky with some amount of risk. And it will be possibly only with some operator versions.

Strimzi supports many different ways how to run - as a cluster-wide, namespace-wide, or across multiple namespaces. So we need different RBAC setups in different situations. Also, for some features, we just need cluster-level permissions such as reading nodes or storage classes.

So, in many cases we need the ClusterROles and ClusterRoleBindigns and that is why we use them.