--- # Source: strimzi-kafka-operator/templates/010-ServiceAccount-strimzi-cluster-operator.yaml apiVersion: v1 kind: ServiceAccount metadata: name: strimzi-cluster-operator namespace: default labels: app: strimzi chart: strimzi-kafka-operator-1.0.0 component: service-account release: strimzi-kafka-operator heritage: Helm --- # Source: strimzi-kafka-operator/templates/050-ConfigMap-strimzi-cluster-operator.yaml kind: ConfigMap apiVersion: v1 metadata: name: strimzi-cluster-operator namespace: default labels: app: strimzi chart: strimzi-kafka-operator-1.0.0 component: logging-config-map release: strimzi-kafka-operator heritage: Helm data: log4j2.properties: | name = COConfig monitorInterval = 30 appender.console.type = Console appender.console.name = STDOUT appender.console.layout.type = PatternLayout appender.console.layout.pattern = %d{yyyy-MM-dd HH:mm:ss} %-5p %c{1}:%L - %m%n rootLogger.level = ${env:STRIMZI_LOG_LEVEL:-INFO} rootLogger.appenderRefs = stdout rootLogger.appenderRef.console.ref = STDOUT # Kafka AdminClient logging is a bit noisy at INFO level logger.kafka.name = org.apache.kafka logger.kafka.level = WARN # Keeps separate level for Netty logging -> to not be changed by the root logger logger.netty.name = io.netty logger.netty.level = INFO --- # Source: strimzi-kafka-operator/templates/020-ClusterRole-strimzi-cluster-operator-role.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: strimzi-cluster-operator-namespaced labels: app: strimzi chart: strimzi-kafka-operator-1.0.0 component: role release: strimzi-kafka-operator heritage: Helm rules: # Resources in this role are used by the operator based on an operand being deployed in some namespace. When needed, you # can deploy the operator as a cluster-wide operator. But grant the rights listed in this role only on the namespaces # where the operands will be deployed. That way, you can limit the access the operator has to other namespaces where it # does not manage any clusters. - apiGroups: - "rbac.authorization.k8s.io" resources: # The cluster operator needs to access and manage rolebindings to grant Strimzi components cluster permissions - rolebindings verbs: - get - list - watch - create - delete - patch - update - apiGroups: - "rbac.authorization.k8s.io" resources: # The cluster operator needs to access and manage roles to grant the entity operator permissions - roles verbs: - get - list - watch - create - delete - patch - update - apiGroups: - "" resources: # The cluster operator needs to access and delete pods, this is to allow it to monitor pod health and coordinate rolling updates - pods # The cluster operator needs to access and manage service accounts to grant Strimzi components cluster permissions - serviceaccounts # The cluster operator needs to access and manage config maps for Strimzi components configuration - configmaps # The cluster operator needs to access and manage services and endpoints to expose Strimzi components to network traffic - services - endpoints # The cluster operator needs to access and manage secrets to handle credentials - secrets # The cluster operator needs to access and manage persistent volume claims to bind them to Strimzi components for persistent data - persistentvolumeclaims verbs: - get - list - watch - create - delete - patch - update - apiGroups: - "" resources: # For inplace resizing, we need access to pods/resize subresource - pods/resize verbs: - patch - update - apiGroups: - "apps" resources: # The cluster operator needs to access and manage deployments to run deployment based Strimzi components - deployments # The cluster operator needs to access replica-sets to manage Strimzi components and to determine error states - replicasets verbs: - get - list - watch - create - delete - patch - update - apiGroups: - "apps" resources: # The Cluster Operator needs to scale Deployments while migrating Connect and Mirror Maker 2 clusters from Deployments to StrimziPodSets - deployments/scale verbs: - get - patch - update - apiGroups: - "events.k8s.io" # new events api, used by cluster operator resources: # The cluster operator needs to be able to create events - events verbs: - create - apiGroups: # Kafka Connect Build on OpenShift requirement - build.openshift.io resources: - buildconfigs - buildconfigs/instantiate - builds verbs: - get - list - watch - create - delete - patch - update - apiGroups: - networking.k8s.io resources: # The cluster operator needs to access and manage network policies to lock down communication between Strimzi components - networkpolicies # The cluster operator needs to access and manage ingresses which allow external access to the services in a cluster - ingresses verbs: - get - list - watch - create - delete - patch - update - apiGroups: - route.openshift.io resources: # The cluster operator needs to access and manage routes to expose Strimzi components for external access - routes - routes/custom-host verbs: - get - list - watch - create - delete - patch - update - apiGroups: - image.openshift.io resources: # The cluster operator needs to verify the image stream when used for Kafka Connect image build - imagestreams verbs: - get - apiGroups: - policy resources: # The cluster operator needs to access and manage pod disruption budgets this limits the number of concurrent disruptions # that a Strimzi component experiences, allowing for higher availability - poddisruptionbudgets verbs: - get - list - watch - create - delete - patch - update --- # Source: strimzi-kafka-operator/templates/021-ClusterRole-strimzi-cluster-operator-role.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: strimzi-cluster-operator-global labels: app: strimzi chart: strimzi-kafka-operator-1.0.0 component: role release: strimzi-kafka-operator heritage: Helm rules: - apiGroups: - "rbac.authorization.k8s.io" resources: # The cluster operator needs to create and manage cluster role bindings in the case of an install where a user # has specified they want their cluster role bindings generated - clusterrolebindings verbs: - get - list - watch - create - delete - patch - update - apiGroups: - storage.k8s.io resources: # The cluster operator requires "get" permissions to view storage class details # This is because only a persistent volume of a supported storage class type can be resized - storageclasses verbs: - get - apiGroups: - "" resources: # The cluster operator requires "list" permissions to view all nodes in a cluster # The listing is used to determine the node addresses when NodePort access is configured # These addresses are then exposed in the custom resource states - nodes verbs: - list --- # Source: strimzi-kafka-operator/templates/022-ClusterRole-strimzi-cluster-operator-role.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: strimzi-cluster-operator-leader-election labels: app: strimzi chart: strimzi-kafka-operator-1.0.0 component: role release: strimzi-kafka-operator heritage: Helm rules: - apiGroups: - coordination.k8s.io resources: # The cluster operator needs to access and manage leases for leader election # The "create" verb cannot be used with "resourceNames" - leases verbs: - create - apiGroups: - coordination.k8s.io resources: # The cluster operator needs to access and manage leases for leader election - leases resourceNames: # The default RBAC files give the operator only access to the Lease resource names strimzi-cluster-operator # If you want to use another resource name or resource namespace, you have to configure the RBAC resources accordingly - strimzi-cluster-operator verbs: - get - list - watch - delete - patch - update --- # Source: strimzi-kafka-operator/templates/023-ClusterRole-strimzi-cluster-operator-role.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: strimzi-cluster-operator-watched labels: app: strimzi chart: strimzi-kafka-operator-1.0.0 component: role release: strimzi-kafka-operator heritage: Helm rules: # Resources in this role are being watched by the operator. When operator is deployed as cluster-wide, these permissions # need to be granted to the operator on a cluster wide level as well, even if the operands will be deployed only in # few of the namespaces in given cluster. This is required to set up the Kubernetes watches and informers. # Note: The rights included in this role might change in the future - apiGroups: - "" resources: # The cluster operator needs to access and delete pods, this is to allow it to monitor pod health and coordinate rolling updates - pods verbs: - watch - list - apiGroups: - "kafka.strimzi.io" resources: # The Cluster Operator operates the Strimzi custom resources - kafkas - kafkanodepools - kafkaconnects - kafkaconnectors - kafkabridges - kafkamirrormaker2s - kafkarebalances verbs: - get - list - watch - create - patch - update - apiGroups: - "kafka.strimzi.io" resources: # The Cluster Operator needs to manage the status of the Strimzi custom resources - kafkas/status - kafkanodepools/status - kafkaconnects/status - kafkaconnectors/status - kafkabridges/status - kafkamirrormaker2s/status - kafkarebalances/status verbs: - get - patch - update - apiGroups: - "kafka.strimzi.io" resources: # Needed for environments with enabled OwnerReferencesPermissionEnforcement admission controller (e.g. OpenShift) - kafkas/finalizers - kafkanodepools/finalizers - kafkaconnects/finalizers - kafkaconnectors/finalizers - kafkabridges/finalizers - kafkamirrormaker2s/finalizers - kafkarebalances/finalizers verbs: - update - apiGroups: - "core.strimzi.io" resources: # The cluster operator uses StrimziPodSets to manage the Kafka, Kafka Connect, and Kafka MirrorMaker 2 pods - strimzipodsets verbs: - get - list - watch - create - delete - patch - update - apiGroups: - "core.strimzi.io" resources: # The Cluster Operator needs to manage the status of the StrimziPodSet custom resource - strimzipodsets/status verbs: - get - patch - update - apiGroups: - "core.strimzi.io" resources: # Needed for environments with enabled OwnerReferencesPermissionEnforcement admission controller (e.g. OpenShift) - strimzipodsets/finalizers verbs: - update - apiGroups: - "kafka.strimzi.io" resources: # The Cluster Operator needs deletion for KafkaRebalance only (during auto-rebalancing) - kafkarebalances verbs: - delete --- # Source: strimzi-kafka-operator/templates/030-ClusterRole-strimzi-kafka-broker.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: strimzi-kafka-broker labels: app: strimzi chart: strimzi-kafka-operator-1.0.0 component: broker-role release: strimzi-kafka-operator heritage: Helm rules: - apiGroups: - "" resources: # The Kafka Brokers require "get" permissions to view the node they are on # This information is used to generate a Rack ID that is used for High Availability configurations - nodes verbs: - get --- # Source: strimzi-kafka-operator/templates/031-ClusterRole-strimzi-entity-operator.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: strimzi-entity-operator labels: app: strimzi chart: strimzi-kafka-operator-1.0.0 component: entity-operator-role release: strimzi-kafka-operator heritage: Helm rules: - apiGroups: - "kafka.strimzi.io" resources: # The Entity Operator contains the Topic Operator which needs to access and manage KafkaTopic resources - kafkatopics verbs: - get - list - watch - create - patch - update - delete - apiGroups: - "kafka.strimzi.io" resources: # The Entity Operator contains the User Operator which needs to access and manage KafkaUser resources - kafkausers verbs: - get - list - watch - create - patch - update - apiGroups: - "kafka.strimzi.io" resources: # The Entity Operator contains the Topic Operator which needs to access and manage KafkaTopic resources - kafkatopics/status # The Entity Operator contains the User Operator which needs to access and manage KafkaUser resources - kafkausers/status verbs: - get - patch - update - apiGroups: - "kafka.strimzi.io" resources: # Needed for environments with enabled OwnerReferencesPermissionEnforcement admission controller (e.g. OpenShift) - kafkatopics/finalizers - kafkausers/finalizers verbs: - update - apiGroups: - "" resources: # The entity operator user-operator needs to access and manage secrets to store generated credentials - secrets verbs: - get - list - watch - create - delete - patch - update --- # Source: strimzi-kafka-operator/templates/033-ClusterRole-strimzi-kafka-client.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: strimzi-kafka-client labels: app: strimzi chart: strimzi-kafka-operator-1.0.0 component: client-role release: strimzi-kafka-operator heritage: Helm rules: - apiGroups: - "" resources: # The Kafka clients (Connect, Mirror Maker, etc.) require "get" permissions to view the node they are on # This information is used to generate a Rack ID (client.rack option) that is used for consuming from the closest # replicas when enabled - nodes verbs: - get --- # Source: strimzi-kafka-operator/templates/021-ClusterRoleBinding-strimzi-cluster-operator.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: strimzi-cluster-operator labels: app: strimzi chart: strimzi-kafka-operator-1.0.0 component: role-binding release: strimzi-kafka-operator heritage: Helm subjects: - kind: ServiceAccount name: strimzi-cluster-operator namespace: default roleRef: kind: ClusterRole name: strimzi-cluster-operator-global apiGroup: rbac.authorization.k8s.io --- # Source: strimzi-kafka-operator/templates/030-ClusterRoleBinding-strimzi-cluster-operator-kafka-broker-delegation.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: strimzi-cluster-operator-kafka-broker-delegation labels: app: strimzi chart: strimzi-kafka-operator-1.0.0 component: broker-role-binding release: strimzi-kafka-operator heritage: Helm # The Kafka broker cluster role must be bound to the cluster operator service account so that it can delegate the cluster role to the Kafka brokers. # This must be done to avoid escalating privileges which would be blocked by Kubernetes. subjects: - kind: ServiceAccount name: strimzi-cluster-operator namespace: default roleRef: kind: ClusterRole name: strimzi-kafka-broker apiGroup: rbac.authorization.k8s.io --- # Source: strimzi-kafka-operator/templates/033-ClusterRoleBinding-strimzi-cluster-operator-kafka-client-delegation.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: strimzi-cluster-operator-kafka-client-delegation labels: app: strimzi chart: strimzi-kafka-operator-1.0.0 component: client-role-binding release: strimzi-kafka-operator heritage: Helm # The Kafka clients cluster role must be bound to the cluster operator service account so that it can delegate the # cluster role to the Kafka clients using it for consuming from closest replica. # This must be done to avoid escalating privileges which would be blocked by Kubernetes. subjects: - kind: ServiceAccount name: strimzi-cluster-operator namespace: default roleRef: kind: ClusterRole name: strimzi-kafka-client apiGroup: rbac.authorization.k8s.io --- # Source: strimzi-kafka-operator/templates/020-RoleBinding-strimzi-cluster-operator.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: strimzi-cluster-operator namespace: default labels: app: strimzi chart: strimzi-kafka-operator-1.0.0 component: role-binding release: strimzi-kafka-operator heritage: Helm subjects: - kind: ServiceAccount name: strimzi-cluster-operator namespace: default roleRef: kind: ClusterRole name: strimzi-cluster-operator-namespaced apiGroup: rbac.authorization.k8s.io --- # Source: strimzi-kafka-operator/templates/022-RoleBinding-strimzi-cluster-operator.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: strimzi-cluster-operator-leader-election namespace: default labels: app: strimzi chart: strimzi-kafka-operator-1.0.0 component: role-binding release: strimzi-kafka-operator heritage: Helm subjects: - kind: ServiceAccount name: strimzi-cluster-operator namespace: default roleRef: kind: ClusterRole name: strimzi-cluster-operator-leader-election apiGroup: rbac.authorization.k8s.io --- # Source: strimzi-kafka-operator/templates/023-RoleBinding-strimzi-cluster-operator.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: strimzi-cluster-operator-watched namespace: default labels: app: strimzi chart: strimzi-kafka-operator-1.0.0 component: role-binding release: strimzi-kafka-operator heritage: Helm subjects: - kind: ServiceAccount name: strimzi-cluster-operator namespace: default roleRef: kind: ClusterRole name: strimzi-cluster-operator-watched apiGroup: rbac.authorization.k8s.io --- # Source: strimzi-kafka-operator/templates/031-RoleBinding-strimzi-cluster-operator-entity-operator-delegation.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: strimzi-cluster-operator-entity-operator-delegation namespace: default labels: app: strimzi chart: strimzi-kafka-operator-1.0.0 component: entity-operator-role-binding release: strimzi-kafka-operator heritage: Helm # The Entity Operator cluster role must be bound to the cluster operator service account so that it can delegate the cluster role to the Entity Operator. # This must be done to avoid escalating privileges which would be blocked by Kubernetes. subjects: - kind: ServiceAccount name: strimzi-cluster-operator namespace: default roleRef: kind: ClusterRole name: strimzi-entity-operator apiGroup: rbac.authorization.k8s.io --- # Source: strimzi-kafka-operator/templates/060-Deployment-strimzi-cluster-operator.yaml apiVersion: apps/v1 kind: Deployment metadata: name: strimzi-cluster-operator namespace: default labels: app: strimzi chart: strimzi-kafka-operator-1.0.0 component: deployment release: strimzi-kafka-operator heritage: Helm spec: replicas: 1 selector: matchLabels: name: strimzi-cluster-operator strimzi.io/kind: cluster-operator template: metadata: labels: name: strimzi-cluster-operator strimzi.io/kind: cluster-operator spec: serviceAccountName: strimzi-cluster-operator volumes: - name: strimzi-tmp emptyDir: medium: Memory sizeLimit: 1Mi - name: co-config-volume configMap: name: strimzi-cluster-operator containers: - name: strimzi-cluster-operator image: quay.io/strimzi/operator:1.0.0 ports: - containerPort: 8080 name: http args: - /opt/strimzi/bin/cluster_operator_run.sh volumeMounts: - name: strimzi-tmp mountPath: /tmp - name: co-config-volume mountPath: /opt/strimzi/custom-config/ env: - name: STRIMZI_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: STRIMZI_FULL_RECONCILIATION_INTERVAL_MS value: "120000" - name: STRIMZI_OPERATION_TIMEOUT_MS value: "300000" - name: STRIMZI_DEFAULT_KAFKA_EXPORTER_IMAGE value: quay.io/strimzi/kafka:1.0.0-kafka-4.2.0 - name: STRIMZI_DEFAULT_CRUISE_CONTROL_IMAGE value: quay.io/strimzi/kafka:1.0.0-kafka-4.2.0 - name: STRIMZI_KAFKA_IMAGES value: | 4.1.0=quay.io/strimzi/kafka:1.0.0-kafka-4.1.0 4.1.1=quay.io/strimzi/kafka:1.0.0-kafka-4.1.1 4.1.2=quay.io/strimzi/kafka:1.0.0-kafka-4.1.2 4.2.0=quay.io/strimzi/kafka:1.0.0-kafka-4.2.0 - name: STRIMZI_KAFKA_CONNECT_IMAGES value: | 4.1.0=quay.io/strimzi/kafka:1.0.0-kafka-4.1.0 4.1.1=quay.io/strimzi/kafka:1.0.0-kafka-4.1.1 4.1.2=quay.io/strimzi/kafka:1.0.0-kafka-4.1.2 4.2.0=quay.io/strimzi/kafka:1.0.0-kafka-4.2.0 - name: STRIMZI_KAFKA_MIRROR_MAKER_2_IMAGES value: | 4.1.0=quay.io/strimzi/kafka:1.0.0-kafka-4.1.0 4.1.1=quay.io/strimzi/kafka:1.0.0-kafka-4.1.1 4.1.2=quay.io/strimzi/kafka:1.0.0-kafka-4.1.2 4.2.0=quay.io/strimzi/kafka:1.0.0-kafka-4.2.0 - name: STRIMZI_DEFAULT_TOPIC_OPERATOR_IMAGE value: quay.io/strimzi/operator:1.0.0 - name: STRIMZI_DEFAULT_USER_OPERATOR_IMAGE value: quay.io/strimzi/operator:1.0.0 - name: STRIMZI_DEFAULT_KAFKA_INIT_IMAGE value: quay.io/strimzi/operator:1.0.0 - name: STRIMZI_DEFAULT_KAFKA_BRIDGE_IMAGE value: quay.io/strimzi/kafka-bridge:1.0.0 - name: STRIMZI_DEFAULT_KANIKO_EXECUTOR_IMAGE value: quay.io/strimzi/kaniko-executor:1.0.0 - name: STRIMZI_DEFAULT_BUILDAH_IMAGE value: quay.io/strimzi/buildah:1.0.0 - name: STRIMZI_DEFAULT_MAVEN_BUILDER value: quay.io/strimzi/maven-builder:1.0.0 - name: STRIMZI_OPERATOR_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: STRIMZI_FEATURE_GATES value: "" - name: STRIMZI_LEADER_ELECTION_ENABLED value: "true" - name: STRIMZI_LEADER_ELECTION_LEASE_NAME value: "strimzi-cluster-operator" - name: STRIMZI_LEADER_ELECTION_LEASE_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: STRIMZI_LEADER_ELECTION_IDENTITY valueFrom: fieldRef: fieldPath: metadata.name livenessProbe: httpGet: path: /healthy port: http initialDelaySeconds: 10 periodSeconds: 30 readinessProbe: httpGet: path: /ready port: http initialDelaySeconds: 10 periodSeconds: 30 resources: limits: cpu: 1000m memory: 384Mi requests: cpu: 200m memory: 384Mi