delegations and SA

[282ori]

Hi,
I'm investigating the Strimzi operator in order to fully understand how it works, I would be happy if you can explain for me these 2 questions:

1. How do the delegations actually work? There is nothing special in the ClusterRoleBindings, no label or something else that points to the delegation except the name of the yaml.
2. When a new Kafka broker is created, the Kafka and the Zookeeper create a ServiceAccount that you can see in the statefulset, but there is no RoleBinding nor ClusterRoleBinding that binds any role to these ServiceAccounts. What is their purpose?

[scholzj]

This depends on your configuration in the Kafka CR. We always create the SAs to make sure they do not inherit any undesired rights from the default service account. But in some configurations, they do not get any RBAC rights. In case of ZooKeeper I think there is never any binding. In case of Kafka, the bindings are created when node port listener is used or when rack-awareness is used (these are ClusterRoleBindings). Similarly, for KafkaConnect it is created when rack-awareness is used.