[Bug]: Duplicate ClusterRoleBindings will be attempted to be created when we set watchAnyNamespace to true and add some namespaces to watchNamespaces

[Eric84626]

Bug Description

Duplicate ClusterRoleBindings will be attempted to be created when we set watchAnyNamespace to true and add some namespaces to watchNamespaces.

Steps to reproduce

watchNamespaces:

• namespaceA
• namesapceB
  watchAnyNamespace: true

Duplicate ClusterRoleBindings will be attempted to be created(strimzi-cluster-operator-namespaced & strimzi-cluster-operator-watched & strimzi-cluster-operator-entity-operator-delegation).

Expected behavior

If I set watchAnyNamespace to true, we should ignore the values of watchNamespaces list

Strimzi version

0.42.0

Kubernetes version

1.28

Installation method

Helm chart

Infrastructure

AWS EKS/Azure AKS

Configuration files and logs

No response

Additional context

No response

[Eric84626]

I will fix it, and create a PR.

[scholzj]

@Eric84626 Sure, feel free to open the PR

[forsberg]

Related is that I got the same error when my watchNamespaces setting included the namespace in which the operator is installed. This is inline with documentation, but still confused me after a Helm version upgrade.

[Eric84626]

Related is that I got the same error when my watchNamespaces setting included the namespace in which the operator is installed. This is inline with documentation, but still confused me after a Helm version upgrade.

Hello @forsberg ,
I think we should not add strimzi operator namespace to watchNamespaces list.
Please refer below comment in strimzi operator helm chart.
https://github.com/strimzi/strimzi-kafka-operator/blob/main/packaging/helm-charts/helm3/strimzi-kafka-operator/values.yaml#L6-L7

[scholzj]

Triaged on the Community call on 8.8.2024: This should be fixed.

If it is possible, I think we prefer if it throws an error when both options are configured in parallel. If that is not possible (we do not have much Helm knowledge to be honest),the suggested solution to ignore the watchNamespaces option when it is configured to watch all namespaces sounds good as well.

[Eric84626]

hello @scholzj,
Thanks for your confirm, my PR is in progress.