// Module included in the following assemblies:
//
// assembly-deploy-intro-operators.adoc

[id='ref-operator-cluster-rbac-resources-{context}']
= Managing RBAC resources 

[role="_abstract"]
The Cluster Operator creates and manages role-based access control (RBAC) resources for Strimzi components that need access to Kubernetes resources.

For the Cluster Operator to function, it needs permission within the Kubernetes cluster to interact with Kafka resources, such as `Kafka` and `KafkaConnect`, as well as managed resources like `ConfigMap`, `Pod`, `Deployment`, and `Service`.

Permission is specified through the following Kubernetes RBAC resources:

* `ServiceAccount`
* `Role` and `ClusterRole`
* `RoleBinding` and `ClusterRoleBinding`

[id='delegated-privileges-{context}']
== Delegating privileges to Strimzi components

The Cluster Operator runs under a service account called `strimzi-cluster-operator`.
It is assigned cluster roles that give it permission to create the RBAC resources for Strimzi components.
Role bindings associate the cluster roles with the service account.

Kubernetes prevents components operating under one `ServiceAccount` from granting another `ServiceAccount` privileges that the granting `ServiceAccount` does not have.
Because the Cluster Operator creates the `RoleBinding` and `ClusterRoleBinding` RBAC resources needed by the resources it manages, it requires a role that gives it the same privileges.

The following sections describe the RBAC resources required by the Cluster Operator.

== `ClusterRole` resources

The Cluster Operator uses `ClusterRole` resources to provide the necessary access to resources.
Depending on the Kubernetes cluster setup, a cluster administrator might be needed to create the cluster roles.

NOTE: Cluster administrator rights are only needed for the creation of `ClusterRole` resources.
The Cluster Operator will not run under a cluster admin account.

The RBAC resources follow the _principle of least privilege_ and contain only those privileges needed by the Cluster Operator to operate the cluster of the Kafka component.

All cluster roles are required by the Cluster Operator in order to delegate privileges.

.`ClusterRole` resources
[cols="1m,1",options="header"]
|===

| Name
| Description

|strimzi-cluster-operator-namespaced
|Access rights for namespace-scoped resources used by the Cluster Operator to deploy and manage the operands.

|strimzi-cluster-operator-global
|Access rights for cluster-scoped resources used by the Cluster Operator to deploy and manage the operands.

|strimzi-cluster-operator-leader-election
|Access rights used by the Cluster Operator for leader election.

|strimzi-cluster-operator-watched
|Access rights used by the Cluster Operator to watch and manage the Strimzi custom resources.

|strimzi-kafka-broker
|Access rights to allow Kafka brokers to get the topology labels from Kubernetes worker nodes when rack-awareness is used.

|strimzi-entity-operator
|Access rights used by the Topic and User Operators to manage Kafka users and topics.

|strimzi-kafka-client
|Access rights to allow Kafka Connect, MirrorMaker (1 and 2), and Kafka Bridge to get the topology labels from Kubernetes worker nodes when rack-awareness is used.

|===

== `ClusterRoleBinding` resources

The Cluster Operator uses `ClusterRoleBinding` and `RoleBinding` resources to associate its `ClusterRole` with its `ServiceAccount`.
Cluster role bindings are required by cluster roles containing cluster-scoped resources.

.`ClusterRoleBinding` resources
[cols="1m,1",options="header"]
|===

| Name
| Description

|strimzi-cluster-operator
|Grants the Cluster Operator the rights from the `strimzi-cluster-operator-global` cluster role.

|strimzi-cluster-operator-kafka-broker-delegation
|Grants the Cluster Operator the rights from the `strimzi-entity-operator` cluster role.

|strimzi-cluster-operator-kafka-client-delegation
|Grants the Cluster Operator the rights from the `strimzi-kafka-client` cluster role.

|===

.`RoleBinding` resources
[cols="1m,1",options="header"]
|===

| Name
| Description

|strimzi-cluster-operator
|Grants the Cluster Operator the rights from the `strimzi-cluster-operator-namespaced` cluster role.

|strimzi-cluster-operator-leader-election
|Grants the Cluster Operator the rights from the `strimzi-cluster-operator-leader-election` cluster role.

|strimzi-cluster-operator-watched
|Grants the Cluster Operator the rights from the `strimzi-cluster-operator-watched` cluster role.

|strimzi-cluster-operator-entity-operator-delegation
|Grants the Cluster Operator the rights from the `strimzi-cluster-operator-entity-operator-delegation` cluster role.

|===

== `ServiceAccount` resources

The Cluster Operator runs using the `strimzi-cluster-operator` `ServiceAccount`.
This service account grants it the privileges it requires to manage the operands.
The Cluster Operator creates additional `ClusterRoleBinding` and `RoleBinding` resources to delegate some of these RBAC rights to the operands.

Each of the operands uses its own service account created by the Cluster Operator.
This allows the Cluster Operator to follow the principle of least privilege and give the operands only the access rights that are really need.

.`ServiceAccount` resources
[cols="1m,1",options="header"]
|===
| Name
| Used by

|<cluster_name>-zookeeper
|ZooKeeper pods

|<cluster_name>-kafka
|Kafka broker pods

|<cluster_name>-entity-operator
|Entity Operator

|<cluster_name>-cruise-control
|Cruise Control pods

|<cluster_name>-kafka-exporter
|Kafka Exporter pods

|<cluster_name>-connect
|Kafka Connect pods

|<cluster_name>-mirror-maker
|MirrorMaker pods

|<cluster_name>-mirrormaker2
|MirrorMaker 2 pods

|<cluster_name>-bridge
|Kafka Bridge pods

|===