Cluster operator creates ClusterRoleBinding although rack feature isn't used

[kaihil]

I found the following section in the docs.

https://strimzi.io/docs/operators/in-development/using.html#delegated-privileges-str:

• The Kafka broker pods use a ServiceAccount called cluster-name-kafka
  • When the rack feature is used, the strimzi-cluster-name-kafka-init ClusterRoleBinding is used to grant this ServiceAccount access to the nodes within the cluster via a ClusterRole called strimzi-kafka-broker
  • When the rack feature is not used no binding is created

I don't use the rack feature explicitly (no rack: in my Kafka cluster definition). Nevertheless, the ClusterRoleBinding strimzi-cluster-name-strimzi-kafka-init is created.

Do I understand something wrong here? Or do I need to turn off the rack feature explicitly somehow?

Thanks!

[kaihil]

Actually I found the problem in the strimzi code:

strimzi-kafka-operator/cluster-operator/src/main/java/io/strimzi/operator/cluster/model/KafkaCluster.java

Line 1655 in 62d06f1

if (rack != null || isExposedWithNodePort()) {

I think the last sentence in the documentation should be changed from

When the rack feature is not used no binding is created
to
When the rack feature and nodeports are not used no binding is created

[scholzj]

Yes, you are right. This is a mistake in the docs ... it is exactly as you say.