Can UserOperator create KafkaUsers in namespaces where kafka cluster is not running ,

[hari819]

Hello @scholzj ,

i have my application running in one namespace and kafka in one namespace , i have enabled mTLS ,I can see the secret for the user getting created in the same namespace where Kafka is running , to make it dynamic i would like to create this secret in other namespace where my application is using so that i can just mount the secret and use to to connect to the broker with mTLS,

Is this possible ? , I see the below configuration in the doc , will it fit my scenario ,
https://strimzi.io/docs/operators/latest/full/using.html#user-operator-str

**User Operator configuration properties
User Operator deployment can be configured using additional options inside the userOperator object. The following properties are supported:

watchedNamespace
The Kubernetes namespace in which the user operator watches for KafkaUsers. Default is the namespace where the Kafka cluster is deployed.**

[hari819]

I tried like this where kafka is running in "kafka-mtls" namespace and my application is running in "app" namespace

entityOperator: userOperator: watchedNamespace: app topicOperator: { }

but when creating the cluster i can see the below error in clusterOperator log ,
2021-12-09 11:27:03 WARN AbstractOperator:508 - Reconciliation #13(timer) Kafka(kafka-mtls/kafka): Failed to reconcile io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: GET at: https://10.222.0.1/apis/rbac.authorization.k8s.io/v1/namespaces/app/roles/kafka-entity-operator. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. roles.rbac.authorization.k8s.io "kafka-entity-operator" is forbidden: User "system:serviceaccount:kafka-mtls:strimzi-cluster-operator" cannot get resource "roles" in API group "rbac.authorization.k8s.io" in the namespace "app". at io.fabric8.kubernetes.client.dsl.base.OperationSupport.requestFailure(OperationSupport.java:570) ~[io.fabric8.kubernetes-client-5.0.2.jar:?] at io.fabric8.kubernetes.client.dsl.base.OperationSupport.assertResponseCode(OperationSupport.java:507) ~[io.fabric8.kubernetes-client-5.0.2.jar:?] at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:474) ~[io.fabric8.kubernetes-client-5.0.2.jar:?] at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleResponse(OperationSupport.java:435) ~[io.fabric8.kubernetes-client-5.0.2.jar:?] at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleGet(OperationSupport.java:402) ~[io.fabric8.kubernetes-client-5.0.2.jar:?] at io.fabric8.kubernetes.client.dsl.base.OperationSupport.handleGet(OperationSupport.java:384) ~[io.fabric8.kubernetes-client-5.0.2.jar:?] at io.fabric8.kubernetes.client.dsl.base.BaseOperation.handleGet(BaseOperation.java:925) ~[io.fabric8.kubernetes-client-5.0.2.jar:?] at io.fabric8.kubernetes.client.dsl.base.BaseOperation.getMandatory(BaseOperation.java:220) ~[io.fabric8.kubernetes-client-5.0.2.jar:?] at io.fabric8.kubernetes.client.dsl.base.BaseOperation.get(BaseOperation.java:186) ~[io.fabric8.kubernetes-client-5.0.2.jar:?] at io.fabric8.kubernetes.client.dsl.base.BaseOperation.get(BaseOperation.java:85) ~[io.fabric8.kubernetes-client-5.0.2.jar:?] at io.strimzi.operator.common.operator.resource.AbstractResourceOperator.lambda$reconcile$0(AbstractResourceOperator.java:100) ~[io.strimzi.operator-common-0.22.1.jar:0.22.1] at io.vertx.core.impl.ContextImpl.lambda$executeBlocking$2(ContextImpl.java:313) ~[io.vertx.vertx-core-3.9.1.jar:3.9.1] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) ~[?:?] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) ~[?:?] at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [io.netty.netty-common-4.1.60.Final.jar:4.1.60.Final] at java.lang.Thread.run(Thread.java:834) [?:?]

[hari819]

@scholzj , sure thankyou i will add the required RBAC ,because i need the secret to be created in "app" namespace ,
Yes it is single namespace , would have been very good for our scenario when we have application running in PROD,PREPROD,UAT,SIT like this multiple namespaces using the single kafka cluster ,

[scholzj]

Yeah, having multi-namespace support would be lovely ... but it is not completely trivial

[hari819]

@scholzj , do you mean if i add RBAC and set watchAnyNamespace to true , can the UserOperator watch all the namespaces in the whole cluster ?

[scholzj]

No, the user operator will always watch only one namespace today. Only the cluster operator can watch multiple namespaces or whole cluster.

[hari819]

@scholzj , ok got it , thanks