// Module included in the following assemblies:
//
// assembly-deploy-intro-operators.adoc

[id='ref-operator-cluster-rbac-resources-{context}']
= Managing RBAC resources 

[role="_abstract"]
The Cluster Operator creates and manages role-based access control (RBAC) resources for Strimzi components that need access to Kubernetes resources.

For the Cluster Operator to function, it needs permission within the Kubernetes cluster to interact with Kafka resources, such as `Kafka` and `KafkaConnect`, as well as managed resources like `ConfigMap`, `Pod`, `Deployment`, and `Service`.

Permission is specified through the following Kubernetes RBAC resources:

* `ServiceAccount`
* `Role` and `ClusterRole`
* `RoleBinding` and `ClusterRoleBinding`

[id='delegated-privileges-{context}']
== Delegating privileges to Strimzi components

The Cluster Operator runs under a service account called `strimzi-cluster-operator`, which is assigned cluster roles that give it permission to create the necessary RBAC resources for Strimzi components.
Role bindings associate the cluster roles with the service account.

Kubernetes enforces link:https://kubernetes.io/docs/reference/access-authn-authz/rbac/#privilege-escalation-prevention-and-bootstrapping[privilege escalation prevention], meaning the Cluster Operator cannot grant privileges it does not possess, nor can it grant such privileges in a namespace it cannot access. 
Consequently, the Cluster Operator must have the necessary privileges for all the components it orchestrates.

The Cluster Operator must be able to do the following:

* Enable the Topic Operator to manage `KafkaTopic` resources by creating `Role` and `RoleBinding` resources in the relevant namespace.
* Enable the User Operator to manage `KafkaUser` resources by creating `Role` and `RoleBinding` resources in the relevant namespace.
* Allow Strimzi to discover the failure domain of a `Node` by creating a `ClusterRoleBinding`.

When using rack-aware partition assignment, broker pods need to access information about the `Node` they are running on, such as the Availability Zone in Amazon AWS. 
Similarly, when using `NodePort` type listeners, broker pods need to advertise the address of the `Node` they are running on.
Since a `Node` is a cluster-scoped resource, this access must be granted through a `ClusterRoleBinding`, not a namespace-scoped `RoleBinding`.

The following sections describe the RBAC resources required by the Cluster Operator.

== `ClusterRole` resources

The Cluster Operator uses `ClusterRole` resources to provide the necessary access to resources.
Depending on the Kubernetes cluster setup, a cluster administrator might be needed to create the cluster roles.

NOTE: Cluster administrator rights are only needed for the creation of `ClusterRole` resources.
The Cluster Operator will not run under a cluster admin account.

The RBAC resources follow the _principle of least privilege_ and contain only those privileges needed by the Cluster Operator to operate the cluster of the Kafka component.

All cluster roles are required by the Cluster Operator in order to delegate privileges.

.`ClusterRole` resources
[cols="1m,1",options="header"]
|===

| Name
| Description

|strimzi-cluster-operator-namespaced
|Access rights for namespace-scoped resources used by the Cluster Operator to deploy and manage the operands.

|strimzi-cluster-operator-global
|Access rights for cluster-scoped resources used by the Cluster Operator to deploy and manage the operands.

|strimzi-cluster-operator-leader-election
|Access rights used by the Cluster Operator for leader election.

|strimzi-cluster-operator-watched
|Access rights used by the Cluster Operator to watch and manage the Strimzi custom resources.

|strimzi-kafka-broker
|Access rights to allow Kafka brokers to get the topology labels from Kubernetes worker nodes when rack-awareness is used.

|strimzi-entity-operator
|Access rights used by the Topic and User Operators to manage Kafka users and topics.

|strimzi-kafka-client
|Access rights to allow Kafka Connect, MirrorMaker (1 and 2), and Kafka Bridge to get the topology labels from Kubernetes worker nodes when rack-awareness is used.

|===

== `ClusterRoleBinding` resources

The Cluster Operator uses `ClusterRoleBinding` and `RoleBinding` resources to associate its `ClusterRole` with its `ServiceAccount`.
Cluster role bindings are required by cluster roles containing cluster-scoped resources.

.`ClusterRoleBinding` resources
[cols="1m,1",options="header"]
|===

| Name
| Description

|strimzi-cluster-operator
|Grants the Cluster Operator the rights from the `strimzi-cluster-operator-global` cluster role.

|strimzi-cluster-operator-kafka-broker-delegation
|Grants the Cluster Operator the rights from the `strimzi-entity-operator` cluster role.

|strimzi-cluster-operator-kafka-client-delegation
|Grants the Cluster Operator the rights from the `strimzi-kafka-client` cluster role.

|===

.`RoleBinding` resources
[cols="1m,1",options="header"]
|===

| Name
| Description

|strimzi-cluster-operator
|Grants the Cluster Operator the rights from the `strimzi-cluster-operator-namespaced` cluster role.

|strimzi-cluster-operator-leader-election
|Grants the Cluster Operator the rights from the `strimzi-cluster-operator-leader-election` cluster role.

|strimzi-cluster-operator-watched
|Grants the Cluster Operator the rights from the `strimzi-cluster-operator-watched` cluster role.

|strimzi-cluster-operator-entity-operator-delegation
|Grants the Cluster Operator the rights from the `strimzi-cluster-operator-entity-operator-delegation` cluster role.

|===

== `ServiceAccount` resources

The Cluster Operator runs using the `strimzi-cluster-operator` `ServiceAccount`.
This service account grants it the privileges it requires to manage the operands.
The Cluster Operator creates additional `ClusterRoleBinding` and `RoleBinding` resources to delegate some of these RBAC rights to the operands.

Each of the operands uses its own service account created by the Cluster Operator.
This allows the Cluster Operator to follow the principle of least privilege and give the operands only the access rights that are really need.

.`ServiceAccount` resources
[cols="1m,1",options="header"]
|===
| Name
| Used by

|<cluster_name>-zookeeper
|ZooKeeper pods

|<cluster_name>-kafka
|Kafka broker pods

|<cluster_name>-entity-operator
|Entity Operator

|<cluster_name>-cruise-control
|Cruise Control pods

|<cluster_name>-kafka-exporter
|Kafka Exporter pods

|<cluster_name>-connect
|Kafka Connect pods

|<cluster_name>-mirror-maker
|MirrorMaker pods

|<cluster_name>-mirrormaker2
|MirrorMaker 2 pods

|<cluster_name>-bridge
|Kafka Bridge pods

|===